🥵 A two-ser

Hello again friends!

This is the first time I’ve done two issues in a week in the history of tl;dr sec, catching up after last week’s busyness.

Next week we’ll be back to our normal weekly schedule, phew.

H/T r/wholesomememes

Have a great rest of your week and weekend!

P.S. Some pretty cool sponsors this issue 👀 

Sponsor

📣 Nobody actually knows how AI gets used.

Most companies can list the AI apps employees use, but few can say what employees are actually doing inside them. And labeling a task as ‘coding’ is a far cry from recognizing that an engineer working on cost optimizations is leaking source code to a model that trains on the data.

Harmonic Security classifies every AI interaction by task, tool, and team, across sanctioned and shadow apps, so you can see which use cases drive real productivity, which tools are shelfware, and where risk exists.

Poke around their demo live environment for free below.

👉 Explore Your AI Usage 👈

AppSec

Models are worse at reviewing their own code
Greptile's Rodrigo Caridad tested whether AI models are better at finding bugs in their own code or code written by another model, analyzing 500 PRs each from Claude Code and Codex against roughly 1,500 ground truth comments (sentiment analysis, upvote/downvote ratios, git archaeology), running Codex and Claude Code’s /review feature 3 times per PR. Both models caught more high-severity bugs in the other model's code- the types of bugs a model introduces most often are the same types it's more likely to miss during review. Claude-authored code skews toward "wrong data or missing behavior" bugs where GPT reviews better, while Codex-authored code skews toward semantic issues and error handling failures where Claude reviews better.

Analysis of reasoning traces showed GPT 5.5 uses a depth-first verification approach that causes it to identify bugs but then drop them due to conflicting system instructions emphasizing narrow scope, while Claude Opus 4.7 takes a breadth-first preventive approach that generates more comments including conditional warnings and structural praise. Based on these findings, Greptile built Model Inversion, which detects PR authorship via commit trails, branch prefixes, and PR titles then routes reviews to the opposite model.

💡 Really nice diagrams and visualizations, I like it! Also cool comparison idea.

Just a rumour of a bug is enough to find a security exploit these days
Anil Madhavapeddy shipped a path traversal fix for OCaml's cohttp 6.3.0 and, within ten minutes of opening the PR, saw probes hitting his webserver with the exact bug pattern. He'd pointed his own Claude at the code first, but Fable refused over its security block, so DeepSeek V4 Pro wrote the exploit instead, in under a minute from only a vague description. Normally a bug like this goes under embargo, quiet until the fix ships, on the theory that secrecy buys you time. That no longer works, since a rumor alone hands an agent enough to find the exploit itself, and mean time to exploit has gone negative, so exploitation now precedes the patch.

Anil lays out three responses and finds flaws in each. GitHub's temporary private forks let you hide the patch, but they cut you off from CI. Shipping fixes continuously is another route, the way Chrome pushes updates, but that leans on Chrome being a single binary, not a library buried in a hundred products nobody controls. And when cloud providers slam in mitigations at the protocol layer, open source has no CDN to carry the same rules. Every one of these leaves the small maintainer a step behind.

💡 Within 10 minutes is insane. This is a super tough problem that I’ve been thinking about: given the increased rate in vulnerability discovery, the difficulty (and human involvement) in patching, the slowness in patch adoption, and the ease and speed of turning patch or hint → exploit = tough times right now. Prediction: this is and will continue to be an important area of security, and may hit hard over the next few months 😅 

Sponsor

📣 Omdia: Browser-Based Attacks Are Outpacing Traditional Security

Browser-based attacks are surging, and most security stacks weren't built to catch them. Omdia surveyed 400 IT and security professionals:

• 6 in 10 rank generative AI security as their most important use case for a secure browsing solution

• 7 in 10 say browser-based incidents have risen over the past two years

• 8 in 10 who rely on traditional tools for browser security report at least one major challenge

See what's driving the shift to enterprise browsers, where teams are struggling, and what success actually looks like.

👉 Get the report 👈

I found it interesting to learn about various browser-based attacks, and some of the security wins you can get when you have influence over security controls in the browser.

Blue Team

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
Wiz's Sean Johnstone and Shira Ayal released a Version Control DFIR poster covering GitHub, GitLab, Bitbucket, and Azure DevOps, with available log sources, what to configure before an incident, and audit events mapped to MITRE ATT&CK tactics for threat hunting. The poster calls out visibility gaps across all four platforms, GitHub only retains Git events for 7 days, GitLab doesn't log Git operations to the database by default, only GitHub offers API request logs (requiring explicit configuration), and none of this telemetry is retroactive so log streaming has to be in place before something happens.

The readiness checklist also flags that GitHub doesn't include source IPs in audit logs unless you turn it on, and that default retention windows across all four platforms are too short for most investigations. Where logs do exist, a forensic matrix maps attacker behaviors to the audit event names each platform uses, so a mass clone shows up as git.clone in GitHub, repository_git_operation in GitLab, and RepositoryCloneEvent in Bitbucket.

💡 I’m going to put this poster up in bedroom, right next to my Twilight poster #TeamJacob.

Benign Set Should Look Malicious
PipeLab's Joshua Waldrep writes that a detection tool's false-positive rate means nothing if the benign traffic in the test set never actually looks like an attack. Real false positives (especially common when analyzing Agent egress) come from harmless traffic wearing an attacker's clothes, an agent reading a security advisory that quotes an injection string, a tutorial with AWS's own example key AKIAIOSFODNN7EXAMPLE, a scanner tool description that lists every attack it detects, a base64 blob that decodes to a PNG rather than a secret. The trap of testing only against clean traffic is that a detector can score 0% false positives there while blowing up to 30% the moment benign inputs start looking dangerous. Joshua shares a public starter set of these lookalikes in agent-egress-bench.

Joshua recommends pulling hard negatives from your own docs, logs, and tool schemas, holding a portion out during tuning, splitting the false-positive rate into easy and hard categories rather than blending them, and publishing failures alongside scores, since reporting only wins is marketing more than measurement.

AI + Security

Quicklinks:

• Hacking Google with A.I. for $500,000 - What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties, by Arvin Shivram.

• Cheat Sheet: Claude Code Security Best Practices - Claude Code and other AI coding assistants are changing how fast code ships — but they're also changing what security teams need to watch for. This practical cheat sheet breaks down the real risk surfaces AI-assisted development introduces, and gives cloud security, AppSec, and platform engineers tactical steps to close the gaps.*

• I'm Worried About a Prompt Injection Worm - Daniel Miessler

^*Sponsored

Booz Allen Cyber Weapon Index
Booz Allen ran 18 US and Chinese LLMs as autonomous attackers against a production-grade enterprise network. Anthropic's Claude Mythos and OpenAI’s GPT-6 Astra both completed the full kill chain, Mythos leading in execution, Astra leading in vulnerability discovery. During the test, models issued commands independently, with every action validated through network telemetry, host logs, domain controller data, and intrusion-detection sensors, ensuring scores reflect demonstrated behavior, not theoretical skill.

“Our assessment remains that most models will arrive at this capability within the next six months.”

Adaptive Agentic Worms
Derek James walks through a recent arXiv paper (AI Agents Enable Adaptive Computer Worms) on self-replicating AI worms that run open-weight LLMs (last year's models, not frontier) on stolen compute from every machine they land on, spreading across networks with no commercial AI platform involved. On a 33-host testbed of Linux, Windows, and IoT devices, the worms found vulnerabilities, escalated privileges, and copied both their harness and local LLM to new targets, reaching 61.8% network infection over 7 days.

Attackers pay nothing per infection since the worms run on stolen compute, not through a commercial platform, putting them out of reach of centralized controls like safety refusals or rate limiting. The worms also tried to rewrite their own blacklist configuration to remove monitoring hosts from the protected list, and did all of this with self-replication as their only goal, no instructions to steal data or dodge detection, and no ability to change themselves when copying.

Hacking your life with AI can get you hacked
Endor Labs' Peyton Kennedy discovered 14 critical and high-severity vulnerabilities across seven AI orchestration platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow) that all share one root cause, they treat multi-tenant code-execution environments as single-user developer tools. The most severe chains need no login at all, with Flowise, Kestra, and Langflow exploitable via prompt injection that runs code and exfiltrates data, while other findings cover broken sandboxes (NocoBase's lockdown() commented out with a TODO), LLM output trusted as code (Langflow accepting lambda from chat), and sandboxes armed too late to catch anything.

Several vendors closed reports as working-as-designed, but Peyton argues that defenses that should protect users are missing or off by default, and Flowise itself has been archived since mid-August 2026, leaving any running instance as unmaintained software with credentials attached.

Misc

Misc

• Lewis Capaldi - Someone You Loved music video

• In a world full of Carols and Demons, be a Susan 🥹

• Behind the scenes on how they did the fast wardrobe change in Frozen the Musical

• Reading Maps - Journeys from fiction drawn on the real world. Moby Dick, Treasure Island, The Odyssey, Dracula, etc.

• PersonalWebsites.org - Over 4,000 personal websites from around the world

• Bill Hader and Kristen Wiig Look Back on The Skeleton Twins at Vulture Festival 2024

AI

• Jacob Coxon on the labs’ approach to safety

• What We Tell AI - People writing candid notes about how they use AI. Some of them are :/

• On the Navier–Stokes Millennium Prize Problem - An unreleased OpenAI model allegedly solved a Millennium Prize problem.

  • Timeline on the equations

  • Tristan Buckmaster statement - There is currently some controversy that I haven’t had time to fully look into, about humans working on the problem at the same time. “ This is a a Deep Blue-Kasparov moment. The community needs to have serious and unhurried discussion about where to go from here.”

  • Sebastien Bubeck response

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👋 I’m back!

Last week was the first time in 6 years, out of over 340 issues, I’ve delayed a tl;dr sec issue to the following week.

That’s because it was a pretty crazy week between the GPT-6 Astra launch, and a Cyber Summit event we held for a number of CISOs and other security leaders.

It was a bit surreal to be invited to deliver a small section of the livestreamed keynote (recording), along with Greg Brockman and other colleagues (shout-out Eric, Vanessa, and Johannes). I managed to fit in a joke that made it through editorial review 🤘 

I thought the process was interesting, so I wanted to share some behind-the-scenes:

About a month ago, the marketing team organizers offered to schedule me a virtual consultation with a fashion consultant for my outfit. Of course, I accepted. During the call I held up various options from my closet, she provided feedback, and afterwards she emailed me some links to other items I could buy.

Each speaker did a number of individual run-throughs in the preceding days, where a number of marketing, comms, and events people gave feedback, as well as an external speaking coach. Apparently I say “um” more than I’d expected, and I have a habit of using “so…” in transitions.

We did some full run throughs the day before and the morning of the event. I also received a calendar invite for “hair and makeup” since the keynote was being livestreamed and recorded 😂 

As we say in security, “Teams who get their makeup done together, stay together.”

P.S. If you appreciate tl;dr sec, please check out this issue’s sponsors 🙏 

Sponsor

📣 A $320/month subscription service is hijacking Microsoft 365 sessions — MFA included

Building and maintaining a live adversary-in-the-middle relay takes specialist skill. Island Security Research discovered that NovaCookies rents one out. This hands buyers a maintained Microsoft 365 sign-in flow, rotating infrastructure, and an operator dashboard, turning real-time session theft into an off-the-shelf product. Delivery chains hide behind genuine Docusign envelopes and Microsoft/Google redirect endpoints to look legitimate. Island detailed the attack and published 755 domains as IOCs.

🍪 See inside the phishing kit 🍪

AppSec

Rolling with the Punches: Why Cybersecurity is Backgammon, Not Chess
Phil Venables compares cybersecurity to backgammon, a game of managing risk under uncertainty rather than chess with perfect information and fixed moves. Backgammon concepts map to security practices, blots are exposed vulnerabilities that should be secured into anchors (defense-in-depth like IAM and MFA), primes are layered controls (network segmentation, EDR, DLP) that create impassable barriers, and blitz attacks mirror automated ransomware campaigns that overwhelm defenses.

The same logic extends to the doubling cube, the piece that lets a backgammon player raise the stakes mid-game, which Phil uses for the risk decisions executives face during incidents like whether to pay a ransomware demand or trigger disaster recovery. Phil recommends security be built to absorb hits and recover rather than to prevent every attack.

Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
Palo Alto Networks's Arie Olshtein describes three attacks on Google's synced passkey implementation that let an attacker take over accounts from a compromised endpoint without escalating privileges. The attacks exploit gaps in device trust workflows, inconsistent UV flag validation by relying parties, and the exposure of master key material to client devices, demonstrating that hardware-backed protections and cloud isolation don't fully eliminate endpoint compromise risks.

The Pass-ta-key attack extracts Chrome's TPM-wrapped identity key and signs cloud authenticator requests without user interaction. The Silver Pass-ta-key variant forces device re-registration by invalidating the existing UV key, then abuses the uv_key_pending state to register an attacker-controlled UV key without attestation, giving the attacker persistent access without ever touching the victim's device. The Golden Pass-ta-key attack extracts the security domain secret (SDS) from Chrome's process memory during cloud authenticator re-registration, so the attacker can decrypt every synced passkey and forge authentication responses, with no way to rotate or revoke the key.

“A distribution with rapid updates is now a requirement. I love older, stable software, but the cycle of backporting patches is simply too long. An older distribution that isn’t getting immediate upstream updates should be assumed vulnerable. A competent agent will discover these bugs quickly and synthesize target-specific exploits.”

Sponsor

📣 87% of orgs are running a known exploitable vulnerability right now

Datadog analyzed production telemetry from thousands of organizations rather than surveying them. 87% were running at least one known, exploitable vulnerability in a deployed service. But when runtime context is applied, whether the library is actually loaded, whether the service is publicly exposed, whether the code is reachable, only 18% of findings labeled critical remain critical.

The State of DevSecOps 2026 report covers the methodology, the full dataset, and where the gap between scanner severity and real exploitability is widest.

👉 Read the report 👈

Phew, 87% is a lot. Love to see how the runtime context can filter to just when a vulnerability dependency is actually loaded and the code is reachable, that’s quite useful for prioritization.

Cloud Security

Password spraying campaign targets AWS root user accounts across 150+ organizations
Datadog's Martin McCloskey writes about a password spraying campaign targeting AWS root user accounts across 150+ organizations between July 24 and August 23, 2026, identified by two specific user agents (Chrome 85 and Firefox 120) and traffic routed through residential proxies. No one got in, but even attempting a root login requires knowing the account's email address, which means attackers already had root emails for 150+ organizations, either from a pre-compiled list or by brute-forcing valid ones.

Martin recommends using AWS Organizations service control policies to block direct root activity, enabling centralized root access for short-lived AssumeRoot sessions, and alerting on all root activity through CloudTrail.

Threat hunt AI: How we built an AI security analyst on AWS for under $500/month
Grow Therapy's Pablo Vidal describes a $500/month AI threat hunting system that runs 20 daily hunts across 15 log sources (CloudTrail, Okta, GitHub, CrowdStrike, and others) using ECS Fargate, Lambda, and Claude. Each hunt runs through five phases, Sonnet handles data gathering with up to 100 tool calls, then Opus with extended thinking compares findings against 1-day and 7-day baselines, pulls in additional context, and scores confidence. After scoring, the model argues against its own findings using false positive history and actor history, and can only reject a finding with specific counter-evidence.

This adversarial review step cut the findings from about 40% noise to mostly stuff worth reviewing. To keep noise down further, both SQL detections and AI hunts write to the same Snowflake ALERTS table via CDC (change data capture) streams, with SHA-256 fingerprints that suppress repeat alerts for the same finding within 48 hours. Great tip: use a cheaper model (Sonnet) for the data gathering, which doesn’t need Opus-level reasoning (cut costs by ~60%).

Lessons learned:

• Data pipeline > AI - Get your logs in a queryable store like Snowflake or BigQuery.

• Existing observability spend is a cheat code - Use the tools your engineers already use for debugging (e.g. Datadog already has searchable logs).

• Build the feedback loop before deploying anything - The system that lets analysts mark false positives, stores those resolutions, and feeds them back into future hunts.

• Do signal-to-noise tuning in staging mode - Every new hunt should run against production data but write to a staging table.

• Start narrow on tools - They started hunts with only Datadog and Snowflake tools. Other tools got added as specific hunts needed them. A large set of tools might bloat up the LLM’s context window and lower the signal to noise ratio.

• Cost tracking - Have every hunt logs its token counts and computed cost.

Supply Chain

MCP Configuration Poisoning: Owning Your Machine With Just A Text File
Checkmarx's Bruno Dias demonstrates MCP Configuration Poisoning, where attackers embed malicious commands in mcp.json files that AI tools and agents automatically execute when processing repositories. Many tools including IDEs, security scanners, and CI/CD pipelines read and execute these files without prompting or sandboxing. As proof of concept, Dias exploits Snyk's Agent Scan (now fixed in v0.5.0) by creating a malicious mcp.json with a bash command that runs when the scanner processes the file.

Even "Human in the Loop" prompts aren't fully protected, since attackers can bypass them using "HITL Dialog Forging" (also called "Lies in the Loop"). Bruno recommends sandboxing execution environments, detecting suspicious patterns like shell invocations or URL piping, and treating configuration files from untrusted repositories as potential threats.

💡 Security vendor demonstrates attack technique by demoing it on another security vendor’s product 🍿🌶️ 

GitHub Actions SHA Pinning, Org-Wide
Semgrep's Leif Dreizler writes about how he rolled out GitHub Actions SHA pinning across ~350 repositories after the tj-actions/changed-files incident, where attackers rewrote every tagged release to point to malicious commits. He used pinact for tag → SHA conversion, Renovate for branch references, and Semgrep Agentic Workflows to run detection and remediation in parallel. Even with those tools, pinned actions calling other unpinned actions kept breaking the rollout, and Reusable Workflows added the same problem since the actions they call still need pinning.

Leif auto-enrolled new repos via a cron-based GitHub Action that checks for new repos every 15 minutes and enables the repo-level pinning requirement, pinned the ~80% of repos that had never run an action, and worked through representative repos first before flipping the org-wide switch.

💡 Great write-up of rolling out and enforcing a new security control, and the edge cases and nuances in GitHub Actions pinning, a few of which to me are non-obvious (e.g. transitive pinning).

Blue Team

gendigitalinc/sage
By Gen: An open-source Agent Detection & Response (ADR) framework that intercepts and validates tool calls from AI coding agents like Claude Code, Cursor, OpenClaw, and OpenCode before execution. It performs URL reputation checks via cloud APIs, evaluates commands against YAML-based threat heuristics, validates npm/PyPI packages through supply-chain analysis (registry existence, file reputation, age), and scans installed plugins for threats at session start.

The tool sends only URL and package hashes to Gen Digital reputation APIs while keeping file content, commands, and source code local, with an option to disable cloud services for fully offline operation.

A Cautionary Tale About Data Breach Claims, Verification and Carhartt
Troy Hunt used his OpenClaw tool to analyze the ShinyHunters Carhartt breach and found that nearly half of the 24.8M email addresses were synthetic TPC-DS benchmark data sitting in Carhartt's Databricks instance alongside real customer records. That test data had 97.6% of domains appearing only once, birth years uniform from 1924 to 1992, and domains pairing real names with gibberish strings. After stripping the test data and other duplicates, the actual victim count dropped to 12.9M, roughly half the number other analysts had already published without checking.

💡 Neat example of using AI to sanity check and comb through large amounts of data.

Red Team

DecBench
An experimental benchmark by researchers from the Noelo Lab at the University of Georgia, led by Zion Basque, for comparing decompilers and modern LLMs on the task of recovering exact source code. This benchmark uses new and previously known metrics (perfect match percentage) and datasets that represent the various directions of exactness for decompilers: control flow structure, types, and precise recompilability. This benchmark is also living: as new decompiler/LLMs are released, their scores will be added to the leaderboard.

Kuna: Decompiler Development in the Age of Coding Agents
Zion Basque releases Kuna, an experimental decompiler where an LLM wrote nearly every line of code, achieving 44.4% perfect control flow structuring on C functions compared to IDA Pro's 45.7%. The decompiler improves autonomously by studying examples where it underperforms against IDA Pro, Ghidra, and angr on fundamental metrics, successfully reimplementing more than 20 core angr features that took years of scientific research to develop. Kuna is a Rust port of Ghidra reworked to match angr's pipeline, demonstrating what high-level scientific feedback alone can achieve, though it still requires human-led research to guide refinement and, while structuring works well, types, optimizations, recompilability, and variable identification still need real work.

💡 Super cool work! One thing that’s become fairly clear with LLMs is that if you have an “oracle” when you’re implementing or porting something, whether it’s an extensive test suite or existing implementation, LLMs are very good at rebuilding it from scratch. We saw this in Anthropic’s port of bun from Zig to Rust, Cloudflare reimplementing Next.js, and more.

AI + Security

alibaba/open-code-review
Alibaba’s internal code review CLI, now open-sourced after two years of use across tens of thousands of developers, with a built-in multi-language ruleset (NPE, thread-safety, XSS, SQL injection), OpenAI & Anthropic compatible. They claim 9x fewer tokens and higher precision than Claude Code on a 200-PR benchmark across 10 languages. The tool uses a hybrid architecture where deterministic steps handle file selection, bundling, and rule matching while an agent handles the dynamic decisions, and supports workspace diffs, branch ranges, full-file scans, and a delegation mode where your existing coding agent (Claude Code, Codex, or Cursor) runs the review using the tool's file selection and rules.

Don't Let Abliteration Abliterate Your Bug Hunting: Discovering Verdict Bias in Uncensored Models
John McIntosh tested abliterated (uncensored) LLM builds against their base models for vulnerability research and found what they call "verdict bias," with abliterated models confirming findings 3-4x more often whether the evidence supported it or not. Using nano-analyzer to scan FreeBSD kernel source for a known CVE, base Gemma models correctly identified the real bug while the most aggressive abliterated build graduated 96% of candidates to VALID (versus 65% for base), produced 138 false positives, and never found the actual vulnerability. Those false positives aren't from lack of understanding, the model identifies exactly why a finding is invalid in its chain of thought, then confirms it anyway, because abliteration's weight editing strips out not just refusals but the model's willingness to say "no" under uncertainty.

Misc

Misc

• Alex Hormozi - It took me 37 years to realize what I'll tell you in 18 minutes.

• Alex Hormozi - "How Do You Know How Wealthy Someone Really Is?"

• Mark Manson - Why the Person You Feel for Will Change - “Loving someone is not loving them when they stay the same, it is choosing them even as they become someone new.”

• 5 essential rope knots everyone should learn

• Are you an unc? (childhood nostalgia)

• Sesame Street - Kermit and Joey sing the alphabet, but she keeps sneaking in “cookie monster.”

• John Steinbeck’s diary entry - “My work is no good, I am appalled at how bad it is. I am so lazy and the thing is so hard.”

• Nathan Fielder's Elizabeth Holmes Doc Met With Shock and Awe at Secret Screening

Humor

• POV: All the benches are taken

• Banger meme from Denny’s about how they’re similar to NVIDIA

• Kyle Gordon - We Will Never Die

• Weird Al - The Brain Song

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🚢 Staying Afloat

Hope you’ve been doing well amidst the busy-ness these days.

Alas, a personal life anecdote shall have to wait for next week, tonight a meme and bedtime for me.

r/wholesomememes

P.S. OpenAI released the full Hugging Face incident technical report. Some pretty fascinating details in the blog, and the 38 page report.

Sponsor

📣 Threat Researchers Tricked Copilot Into Hacking Itself

Varonis Threat Labs asked Microsoft Copilot to prove an exploit was impossible. It did the opposite, guiding researchers through the exact steps to pull it off, including a hidden parameter enabling one-click data theft from Gmail, Calendar, and Drive. That's CoSnitch (CVE-2026-24301), the third Copilot vulnerability Varonis found this year. See how "meta-hacking" tricked the AI assistant, and what it means for your enterprise’s AI use.

👉 Read the research 👈

AppSec

What's in a tag name? JavaScript, apparently
PortSwigger's Gareth Heyes found that HTML tag names can hold JavaScript code that browsers preserve in the localName DOM property (unlike tagName which uppercases everything), turning the tag name itself into a payload source that WAFs don't expect. Through fuzzing he found that tag names also accept forward slashes, whitespace, newlines, and line/paragraph separators, and that opening angle brackets can be part of a tag name, letting attackers inject fresh markup inside what looks like a single tag. The resulting vectors work across all browsers and use properties like part, classList, getAttributeNode, and setHTMLUnsafe (several found with help from Sol 5.6) to bypass attribute-value blocklists.

What Happened to HackerOne?
Joel Margolis, a bug bounty researcher since 2017, writes about HackerOne's shifting story on training AI with researcher submissions, after their Continuous Testing product first advertised training on "12+ years of real-world vulnerability data and your prior H1 Bounty findings," which the co-founders only walked back after researcher pushback. He ties this to HackerOne's broader corporate shift since 2020 and says companies would be better off building their own bug bounty platforms with modern LLMs than paying HackerOne's fees.

💡 It seems like the bug bounty ecosystem is in a tough spot right now: top researchers are using AI and automation to profit more than ever before, but that makes it hard for new researchers to break in. Bug bounty platforms are overwhelmed by plausible sounding reports that are actually slop. Meanwhile submissions from good researchers get delayed responses.

It makes clear and obvious business sense that bug bounty platforms will build agents to try to auto-triage submissions using the data they have (replacing costly triage humans), and ideally leverage their unique data to build AI pen testing agents (product has better margins and is more controllable than the independent contractor researchers they currently rely on). It would be illogical for them not to do this. And if they don’t, they might get knocked out by an XBOW or RunSybil.

However, I do think Joel’s section on the HackerOne triage agent is misguided - that flow sounds like a straight up standard out-of-the-box LLM use case, no model training needed. And it’s targeting H1 triage work, not researchers.

Sponsor

📣 Opal, scalable identity security

Opal is designed to give teams the building blocks for identity-first security: view authorization paths, manage risk, and seamlessly apply intelligent policies built to grow with your organization.

They are built from the ground up to synthesize the data needed to construct and monitor all of your company’s access – from a single pane of glass.

Opal is used by best-in-class security teams today, such as Blend, Databricks, Drata, Figma, Scale AI, and more. There is no one-size-fits-all when it comes to access, but they provide the foundation to scale least privilege the right way.

👉 Secure Identity with Opal 👈

I’ve heard good things about Opal. Used by Figma, Cloudflare, Elastic, and others, nice.

Cloud Security

Introducing TruffleHog AWS Analyze: Know What a Leaked AWS Key Can Reach
Jim Freely announces TruffleHog AWS Analyze, which enriches leaked AWS access key findings by automatically resolving the IAM principal identity, aggregating all attached managed and inline policies (including group memberships), and mapping potential role assumption paths up to two trust-policy hops deep. Research on 64,024 leaked AWS keys found 88% were still active with a median age of five years, 84% had full administrator access, and 1 in 6 was a root key.

💡 Not an open source tool, but I think the results are interesting, and more broadly the work around automatically resolving the impact of a leaked AWS key is good #inspo.

AWSHound: An OpenSource AWS OpenGraph Collector
SpecterOps's Julian Catrambone introduces AWSHound, an open-source collector that transforms AWS accounts and Organizations into BloodHound Community Edition OpenGraph datasets through offline IAM policy evaluation, combining identity policies, permissions boundaries, SCPs, RCPs, and resource policies using service-specific composition rules (S3 uses OR within accounts but AND cross-account, STS always requires AND, KMS uses a three-layer evaluation).

AWSHound runs in three phases, collect (read-only AWS API calls), process (evaluation producing 156 edge types with 36 traversable), and emit (OpenGraph JSON), across nine services including IAM, Organizations, S3, KMS, SSM, EC2, Lambda, CloudFormation, and EKS, with composite edges like AWS_CanCreateAndAssumeAdminRole that fold multiple permissions into single attack path steps. In testing, it processed over 500 accounts producing ~160,000 nodes and ~10.5 million edges in ~15 minutes.

💡 Me reading about AWS IAM complexity.

Blue Team

The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift
Censys previews findings from the upcoming 2026 State of the Internet Report, noting internet-exposed AI/LLM tool instances rose over 60% in nine months, with the riskiest tools growing fastest. Langflow grew 169% and has accumulated 18 CVEs including unauthenticated RCE flaws, while LiteLLM grew 97% and has an actively exploited pre-auth SQL injection that exposes API keys for every upstream model provider through its unified proxy. Internet-exposed ICS hosts averaged 138,000 in early 2026, with North America still leading while Asia's share grew and Europe's fell. Roughly 70% of exposed ICS devices worldwide have sat on consumer and mobile networks for the past 2.5 years.

OpenClaw agent leaked mock AWS keys and CRM data in phishing tests
Varonis' Itay Yashar tests whether classic phishing techniques could compromise AI email agents by building an OpenClaw agent named Pinchy with access to a Gmail inbox with synthetic credentials and CRM data, then running it through four phishing simulations across Google Gemini 3.1 Pro and OpenAI Codex GPT-5.4. Pinchy failed both social engineering tests, forwarding AWS IAM keys, database passwords, and SSH credentials to an external Gmail when asked for staging access during a fake production emergency, and exfiltrating a CRM dump on a casual "from home" export request.

It detected the two technical attacks but earned only partial credit, inspecting the redirect URI on a malicious OAuth consent flow and refusing real credentials on a fake gift card redemption page, though still interacting with the phishing infrastructure before flagging.

Red Team

schlarpc/re-shell
By Chaz Schlarp: A Nix-powered reverse engineering environment that integrates with Claude Code to automatically activate the right tools and workflows based on file type. The environment bundles a comprehensive RE toolchain including Ghidra, radare2, Frida, mitmproxy, and YARA, with discipline-specific skills that auto-activate for Windows binaries, Android packages, and web traffic captures.

Everything I own, owned
Chaz Schlarp used Claude Opus 5 to reverse engineer five personal peripherals in ~13 hours of agent work, finding that none of them had meaningful firmware protections. The Shure MV7 exposes a 48-command plaintext HID shell with arbitrary memory access, the Insta360 Link could be patched to disable its activity LED while still recording, and the Elgato Key Light Mini's Ed25519 firmware signature (the only real protection across all five devices) was bypassed with a single HTTP POST to UART memory since the check only runs during updates and the device gives unauthenticated access to anyone on the WiFi.

Chaz warns that AI-equipped worms could now reverse engineer and compromise peripherals on their own, and publishes custom firmware tools and protocol documentation for all five devices on GitHub alongside re-shell, that powered the work.

💡 On the one hand, it’s super cool how seemingly almost everything is becoming understandable/modifiable. It’s like the early days of computers. On the other hand, a worm or at perhaps nearly every one-off device being compromised seems to be quite feasible 😅 

AI + Security

Quicklinks

• Structural desynchronization in Gmail and Gemini - Ionut Cernica shows how a single email can exploit structural desynchronization in Gmail's Gemini integration to fake inbox entries and leak real email content into shared Calendar events.

• Crogl: the on-prem AI SOC agent the U.S. Air Force chose. Download it free. - One analyst, a dozen consoles, a growing backlog. Crogl is the on-prem AI SOC agent that runs the investigation where your data lives and returns an auditable case you can defend. The AI SOC the U.S. Air Force chose. Download it free, run a case in five minutes.*

• What happened after 2,000 people tried to hack my AI assistant - Fernando Irarrázaval built hackmyclaw.com, where 2,000+ people spent a week trying to make his OpenClaw email assistant Fiu leak the contents of a secrets.env file.

^*Sponsored

OWASP Agentic Skills Top 10
The OWASP Agentic Skills Top 10 (AST10) documents the 10 most critical security risks in AI agent skills. Malicious Skills, Supply Chain Compromise, Over-Privileged Skills, Insecure Metadata, Untrusted External Instructions, Weak Isolation, Update Drift, Poor Scanning, No Governance, Cross-Platform Reuse.

Putting models to the secure coding test: Plan vs default mode
Datadog's Kennedy Toomey tested whether AI coding agents write more secure code in plan mode versus default mode, prompting Claude Sonnet 5, Cursor Composer 2.5, and Codex GPT 5.5 to build a document portal with authentication, file uploads, and user management. Each iteration ran through Datadog Code Security and Claude's code_review skill for analysis, while Supply Chain Firewall intercepted the models' repeated attempts to install vulnerable npm packages during setup.

Across those six iterations, plan mode showed no meaningful security improvement, all contained critical IDOR vulnerabilities letting any authenticated user access others' documents, and each model's plan mode had its own trade-offs, Composer 2.5 introduced a hardcoded JWT secret fallback enabling authentication forgery, Sonnet 5 added defense-in-depth but broke document downloads, and GPT 5.5 fixed some issues but introduced TOCTOU race conditions and timing side channels. The pattern shows that explicit security requirements in prompts matter far more than the agent's operational mode, since none of the models could infer authorization logic the prompt never specified.

How Cloudflare detects MCP traffic and helps secure it
Cloudflare's AJ Gerstenhaber and Kenny Johnson announce new Cloudflare One capabilities to detect and control MCP traffic, addressing the risk that AI agents can repeat a flawed decision thousands of times at machine speed before a human notices. To spot that traffic in the first place, Gateway now identifies MCP requests using protocol-level heuristics like the MCP-Protocol-Version header and the new Mcp-Method/Mcp-Name headers from the MCP 2026-07-28 spec, with an experimental.is_mcp selector, a dashboard showing hosts and users, and Traffic Source selectors that distinguish MCP Portal traffic from direct connections.

Once traffic is identified, security teams have three control points, client-side hooks, Gateway network inspection with TLS decryption, and server-side authorization via WriteGuard middleware, while MCP Portals gain pre-registered OAuth client support and expanded reach to private servers through Cloudflare Gateway routing.

💡 Some good pointers if you’re trying to identify MCP traffic.

Misc

Misc

• Every people pleaser has this energy within them 🤔 

• Alex Hormozi - My Least-Viewed Video Made the Most Money

• Naomi Brockwell - The coolest anti-surveillance tools at Defcon

• Healthy Gamer GG - This is the only cure to addiction

• Fireship - The summer Math fell to the machines

• Josh Radnor - ‘How I Met Your Mother’ cast only minimally staying in touch - “People really wanna believe that me and Neil and Jason are hitting bars in NYC together. It’s a little more like family than friends in that you don’t get to choose your family. We were cast. Acting is like a lot of little love affairs that you have and then you move on.”

• Gerard Butler on his “This is Sparta” line

• America’s Got Talent - He dances in reverse

Humor

• Cyclists chased by an ostrich - Wow, ostriches are fast

• Kai Lentit - How Americans see EU Tech

• Orson Welles dub - Interview with a Vibe Coder

• MARSHMELLO BRINGS CALEB TO ULTRA: Sundae Field Report

• 'Weird Al' Yankovic: Tiny Desk Concert

• Kyle Gordon - Planet of the Bass

• Jesus from the Jewish Perspective

• 'Darth Vader' makes the case for Flock cameras at city council meeting - Absolutely brilliant

• Male reporter struggling for air 😂 

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🎬 The Mandalorian

I don’t have much time to watch TV or movies these days, but I watched The Mandalorian movie over the weekend and it was pretty good!

To parallelize, I also lifted weights while watching, moving my adjustable dumbbells and bench next to the TV 😂 

The movie of course has action scenes and intergalactic space drama, but what stuck out to me was (slight spoilers): Jabba the Hutt’s son trying to break out of his father’s shadow, seeking for crowds to love instead of fear him, and the Mandalorian taking care of Grogu, and vice versa (“the old take care of the young, and then the young take care of the old”).

Probably not something I’d have thought about when I was younger 🤔 

Sponsor

📣 New webinar: The real picture behind shadow AI and what it means for security teams

Shadow AI isn’t just about data loss: it’s a new attack surface that most security teams and tools have pretty much zero visibility of. 

A shadow app integration today is a supply chain attack vector tomorrow. That AI helper browser extension can suddenly become malicious. And the next time your employee searches for an AI tool on Google it could serve them malware instead. 

Join the latest threat briefing from Push Field CTO Mark Orlando for the lowdown on shadow AI and what security teams can do about it. 

👉 Register Now 👈

AppSec

The Defender’s Window
Greg Brockman describes how OpenAI is using AI agents to defend its infrastructure, and urges organizations to act immediately before open-weight models with similar capabilities release. OpenAI's defense strategy includes using Codex with a security plugin for code validation, deploying AI for continuous alert triage and automated response, using frontier models to enumerate attack paths and test security invariants, and maintaining defense-in-depth fundamentals. Greg recommends a 10-step playbook for defenders.

💡 From my vantage point, I would encourage security teams to move with urgency 😅 I know a few companies trying to do like 2-3 years of security hardening in the next… month. I don’t think they’re wrong. As Samuel L. Jackson once wisely said.

A Coming Incident Crisis?
Phil Venables writes about a "perfect storm" of rising incident volume from three sources, attackers using AI to run more attacks in parallel (a ransomware gang going from 10 to 100 attacks a week), AI-driven fakery forcing companies to handle brand and authenticity crises, and misbehaving LLM chatbots landing on security teams' plates. On top of that, regulators worldwide are lowering the bar for what has to be reported and speeding up the deadlines, so more incidents pull in legal, compliance, and privacy work even when they're not significant on their own. Phil wants organizations to move from artisanal handling of a few incidents per quarter to industrial response for dozens per month, deploying Cyber Incident Response Management (CIRM) tools with AI to coordinate across security, legal, privacy, and executive teams.

The OpenAI/Huggingface incident; how we should manage the imminent arrival of autonomous hacking too cheap to meter
Joshua Saxe believes that the Hugging Face incident signals the beginning of AI-enabled cyberattacks that will escalate exponentially through 2027 and beyond. He disagrees with policymakers who want to restrict AI capabilities and suppress open weights models, arguing instead that defenders need broad access to AI cyber capabilities to operate inside attackers' OODA loops, especially since attackers already have access to frontier open weights AI and will use dark inference providers.

Joshua recommends a "light touch around restriction and a heavy hand around adoption" strategy: requiring critical institutions like healthcare providers and defense companies to adopt AI cyber defense on mandated timelines, while labs and inference providers focus on API security and customer vetting rather than capability restrictions.

“In 2027 and beyond, we’ll see substantial damages that start to show up as more and more attacker constituencies adopt frontier AI and defenders, en masse, get jolted out of complacency.”

Sponsor

📣 Threat Intelligence That Analyzes Every Binary

Is your scanner missing threats? Chainguard built one that doesn't: a scanner for the reality of the world we currently code in, where threats are sometimes blatant and sometimes disguised. It evaluates maintainer behavior, package contents, and publishing signals, then runs install scripts in a sandboxed, network-blocked environment to catch callouts to external servers, unauthorized file access, or hidden payloads, all before code ever reaches your build.

Chainguard is scanning 200,000+ packages a day and has already blocked 400,000+ packages detected as malware and greyware.

👉 See How the Scanner Works 👈

Nice, running dependencies in a sandbox to observe potentially malicious behavior 🤘 I like how Chainguard aims to reduce supply chain security risk systematically.

Cloud Security

CosmosEscape: Taking Over Every Database in Azure Cosmos DB
Wiz's Yuval Avrahami and Lior Maman show how a single Gremlin query could have compromised every database in Azure Cosmos DB, including those behind Microsoft's internal services like Entra ID, Teams, and Copilot. The chain starts with a Gremlin sandbox bypass using .NET reflection to achieve arbitrary code execution on the multi-tenant DB Gateway, which exposes the "Cosmos Master Key," a platform-wide signing credential that can fetch the primary key of any Cosmos DB account across all tenants, regions, and API flavors.

That same key also unlocks the Config Store, a Cosmos DB database registry that lets attackers enumerate accounts and filter by target organization before compromising them. Microsoft deployed a hotfix within 48 hours of Wiz's disclosure and completed a full architectural migration that eliminated the Cosmos Master Key entirely.

💡 It feels like it’s been a bit since Wiz published some big tenancy-breaking cloud vulnerabilities. Maybe we’ll see more now that they’re at Google? 🤔 

Hunting malware and malicious MCPs in memory on Kubernetes with FleetDM + Osquery + YARA
Ben Bornholm walks through using osquery's new yara_process table and Fleet's authenticated YARA rule distribution to hunt in-memory malware across two homelab scenarios, detecting a Sliver C2 implant running entirely in memory inside a Kubernetes DVWA container, and identifying credential theft by a malicious local MCP server posing as a code quality scanner for Claude Desktop. He built custom containerd_* tables for osquery, used recursive SQL queries that join on PID namespaces to reconstruct container process trees beyond PID 1, and configured Fleet's GitOps workflow to distribute YARA rules through osquery's existing enrollment identity.

Instead of writing rules to disk where attackers can read them or hosting them on an unauthenticated web server, Fleet uses authenticated retrieval to push rules straight to the agent, so responders can drop in new YARA rules for in-memory shellcode or credential theft while an incident is running.

Blue Team

uber/ADR
Tool by Uber which is a production security system for enterprise AI agents. The system pairs an observability sensor that captures agent telemetry (prompts, MCP activity, reasoning traces, tool calls, execution context) with a two-tier detector that identifies unsafe behavior like credential exposure, prompt injection, data exfiltration, and policy-violating tool use, benchmarked with ADR-Bench across 300+ tasks covering 17 agent attack techniques and 133 MCP servers. See also their arXiv paper and MLSys slides.

💡 Love to see how companies are securely using AI at scale, and awesome that they described it in so much detail and released the code + benchmark 🙏 

How We Secure Figma’s Internal Systems With Agents
Figma's Matthew Sullivan and Brad Girardeau describe an agentic security system built on top of Panther SIEM that investigates alerts, queries audit logs across AWS, Okta, GitHub, GCP, osquery, and over a hundred other sources, and autonomously opens PRs to fix issues, cutting time-to-resolution by roughly 70% on complex alerts and on-call pages by 20% through AI-driven severity downgrading. The architecture uses AWS Bedrock Knowledge Bases and Amazon Kendra for RAG-based retrieval of historical alerts, Tines for workflow automation with explicit tool interfaces, and a Snowflake SQL-writing investigation sub-agent that queries their Panther data warehouse.

Three memory layers (case memory as the RAG corpus of historical alerts, steering memory as behavioral guidance in markdown, procedural memory as self-learned database schemas) let the system refine investigations over time, with procedural memory dramatically reducing schema discovery queries. To keep those autonomous actions bounded, safety controls sit at the tool layer rather than in prompt instructions, with agent-authored PRs defaulting to draft and channel-aware prompt design preventing data exposure in public Slack channels.

💡 I really like the breakdown of the different types of memory and what they’re used for, as well as the “from investigation to code changes” section. Thoughtful security engineering post from Figma, as I’d expect. 👍️ 

AI + Security

inclusionAI/SingGuard-NSFA
By Ant Group: A dual-mode guardrail framework for agentic AI threats, grounded in a CIA-triad taxonomy of 185 risk variants across 7 domains including prompt injection, malicious code, tool abuse, and information leakage. The framework runs lightweight classification heads on top of frozen Qwen3.5 backbones. It operates in two modes, chain-of-thought reasoning for offline auditing and real-time classification at very low latency.

The Agent Access Model
Cloudflare's Matt Silverlock proposes the Agent Access Model (AAM), a framework for securing AI agents that extends BeyondCorp's zero-trust principles by authorizing every action against the task's accumulated state rather than trusting the run. AAM combines six components, an Agent Identity Broker for short-lived sender-constrained credentials, a Task-Scoped Access Engine for per-request least privilege, a Mediation Layer that controls harness tool calls and network egress, a Trust Ratchet that irreversibly removes capabilities when protected events occur, an Agent Activity Log for enforcement evidence, and a Grant Review Loop that proposes template changes from observed behavior.

Matt demonstrates this with an example nightly reconciliation agent where the Trust Ratchet blocks data exfiltration by closing processor and support paths before protected ledger data reaches the model, but acknowledges that multiplayer access control (where one agent serves multiple principals with different permissions) remains an unsolved problem.

Beyond Zero: For The Rest Of Us
Kane Narraway writes about Google's Beyond Zero paper, which shrinks the trust boundary from applications to individual actions on resources, asking "can this identity export these fifty thousand records right now" instead of just "can they access the finance system." Google can do this because it controls its full stack, but most enterprises face fragmented auth systems, SaaS vendors that don't expose external policy decision points, and industry-wide specs that aren't there yet. Kane suggests enterprises focus on what already works today, finishing data classification (using AI for labeling), enriching identity providers with HR and work context, deploying SSF and CAEP for real-time risk signals, MCP or API gateways for agentic access, and async policy evaluation to measure false positive rates before turning on enforcement.

The key difference from BeyondCorp is that Beyond Zero needs SaaS and AI vendors to adopt new external authorization hooks and specs like MCP authorization and CAEP, rather than the proxy-based enforcement enterprises could roll out on their own, making vendor adoption the real bottleneck.

Delegated authority, running locally: Give an agent on your machine an identity you can trust
1Password's Horia Culea presents a reference architecture for giving local AI agents like IDE coding assistants and browser copilots a trustworthy, auditable identity without long-lived credentials on disk. A trusted local app acts as a "trust anchor," verifying the agent's OS code-signing identity and minting short-lived SPIFFE JWT-SVIDs backed by a device key in the Secure Enclave or TPM. The architecture combines OAuth 2.0 Token Exchange for delegated tokens carrying sub (human) and act (agent) claims, emerging OAuth Transaction Tokens for per-call intent binding as a structural defense against prompt injection, WebAuthn/FIDO2 for phishing-resistant human authentication, and CAEP for near-real-time revocation.

💡 Great detailed discussion of delegated authority (agent acting on behalf of a human), and nice example at the end of having Claude use 1Password where: sensitive values are never directly handed to the agent, the agent works through a short-lived grant scoped to the moment (not a standing key on disk), and each grant is logged so each agent action is visible to the admin. I like it 👍️ 

Misc

Misc

• Jason Haddix - DEF CON Is Dead and Security Is Cooked… Or Is It?

• Seth Godin - The Amazon tax

• Kyle Gordon - White Guys When They Go to Africa - Full version

• fosrl/pangolin - An open-source, identity-based remote access platform built on WireGuard that combines reverse-proxy and VPN capabilities, enabling browser-based access to web apps (HTTPS, VNC, RDP, SSH) and client-based access to private resources through NAT traversal without public IPs or open ports.

• Guy doing impressive pole tricks while giving life and relationship advice

• After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

Politics

• Private security firms will soon be allowed to hack overseas cybercriminals

• China’s Military Is Now Using AI to Plan Strike Operations

• Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia - Dream Research Labs describes a multi-agent AI attack framework that compromised Asian government entities over four days in July 2026, using the Hermes and OpenClaw agent platforms to deploy up to 8 parallel sub-agents per wave across 12 attack waves. China → Taiwan.

• Sticky Wage Norms and the Real Wage Cost of Unexpected Inflation - Even accounting for job-changers, 37 percent of all U.S. workers saw real wages decline from 2021-2024.

AI

• xxyyue/llm-observer-proxy-go - A Go-based LLM observability proxy that embeds Bifrost Core (enterprise AI gateway) to create run-scoped proxies for observing LLM traffic without requiring Python, LiteLLM, or Docker.

• Y Combinator open-sourced QM, a multi-agent harness they use internally

• Influencer copying another’s videos for an ad using AI

• tigerless-labs/autoharness - A self-learning skill layer for Claude Code that automatically captures techniques from real coding sessions, consolidates similar skills instead of accumulating duplicates, and prunes unused ones based on real usage rather than benchmarks.

• Oh Lord, AI Reporters Are Actually Breaking Big News - RuntimeWire, an AI-powered newsroom has published nearly 2,000 tech news stories since May using autonomous AI agents that find stories by crawling court databases, web forums, company filings, and social feeds, then draft, edit, fact-check, generate images, and publish articles, sometimes without human review if deemed low legal risk.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤔 Where do I know you from?

I think one of my favorite, most hilarious life moments in recent history occurred in Vegas during Black Hat.

I was at the Specter Ops happy hour, catching up with my friend Matt Johansen, who runs the great Vulnerable U newsletter, and Bryan Solari, an NCC Group friend who now runs sales for most of the security creators, including tl;dr sec.

One of my colleagues comes up and joins our circle, and starts chatting.

Bryan says to him, “Hmm you look really familiar, where do I know you from? I think we met last RSA.”

Colleague: “errr maybe?”

Bryan: “Yeah, definitely RSA. Now what party was it… was it Island?”

Matt and I make eye contact, how do we tell Bryan?

Me: “Bryan that’s… Greg.”

Bryan: “No maybe it was a different party, was it…?”

Me: “Greg… Brockman. The President and co-founder of OpenAI.” 😂 

Bryan: “Oh OK. That’s cool.”

They then proceed to talk about the security creator economy and Greg asked a bunch of questions. Delightful.

P.S. My colleagues Eric Wallace and Michael Dalton’s Black Hat USA 2026 deep dive into the timeline and details of The OpenAI-Hugging Face Incident is 🔥 >500K views in a week, whoa.

Eric is a super nice and sharp dude, we’ve chatted a number of times about model training, and I was impressed by my interactions with Michael during the incident, very smart guy.

Sponsor

📣 Burp AT: agentic AI that thinks like a pentester, with the tools of a pentester.

A professional pentest takes more than a capable model. Burp AT brings agentic AI to human-led pentesting, natively inside Burp Suite. Agents pursue the tasks you give them using Burp’s battle-hardened tools, project context, and purpose-built skills developed with PortSwigger Research.

You stay in control of scope, judgment, and conclusions. Burp enforces the boundaries you set and records the work, so you can reproduce findings and stand behind the evidence.

👉 Learn more about Burp AT 👈

AppSec

CSS:the bomb inside your inbox
The blog version of Portswigger’s Gareth Heyes’ Black Hat talk (GitHub repo). Gareth demonstrates how CSS in webmail clients can be weaponized to bypass sanitizers, exfiltrate tokens, spoof UI, and steal passwords across Gmail, Outlook, Fastmail, ProtonMail, and others. Gareth combines techniques like nesting attribute selectors to brute-force Medium's 12-character hex tokens, indirect prompt injection to control OpenAI's Atlas browser, and font-height oracles with animations to exfiltrate numeric tokens when CSP blocks external resources, achieving account takeover from simple copy-paste actions into draft emails. He also walks through building real-time keyloggers using select elements.

TIL about Shazzer, a shared online fuzzing platform for browser behavior testing, enabling security researchers to create, share, and run fuzz tests across different browsers to discover parsing quirks, JavaScript syntax variations, and potential security issues.

💡 Web chicanery of the highest order from the Portswigger team, as expected.

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25
SL Cyber’s (Assetnote) Adam Kues describes using GPT 5.6 Sol Ultra with an adapted version of OpenAI's Cycle Double Cover prompt to discover a pre-authentication RCE chain in WordPress core, spending approximately $25 and 10 hours of compute time. The exploit chains a batch API validation desync bug that allows bypassing parameter sanitization, a SQL injection in the author__not_in parameter accessible via recursive batch calls, WordPress's post cache poisoning to fabricate oembed_cache rows, a parent-cycle detection gadget to control post_content, and a customize_changeset to temporarily assume administrator privileges and trigger the parse_request hook, ultimately creating a new admin account for code execution.

“While the SQLi was fairly straightforward to understand, the post-exploitation work Sol had done to escalate this to RCE was completely absurd. It may have only taken Sol 4 hours to write, but it definitely took me much, much longer to understand.”

See also Wiz’s Exploitation in the Wild of wp2shell.

💡 This exploitation chain is insane 🤯 I feel like I only know a handful of people who could find and exploit bugs like this. Anecdotally, the security researchers on my team at OpenAI have found the same thing: the model creates an exploit that you can run and confirm it works, but the time it takes for a human to understand how it works is often 2x-5x the time it takes the model to find and create it.

Frontier class vulnerabilities: it gets worse before it (maybe) gets better
Shubham Shah describes how Assetnote researcher Adam Kues used GPT 5.6 Sol to discover wp2shell, a pre-authentication RCE in WordPress Core (affecting 40% of the internet). Shubs says that GPT 5.6 Sol represents a capability shift where extremely complex vulnerability chains are being discovered with little human input, prompting Assetnote's research team to pivot toward finding "internet melting bugs" before attackers do.

Shubs predicts a challenging period is coming due to increased vulnerability discovery. Legacy software will remain vulnerable for years, but AI-generated software may end up well secured, though Shubs doubts entire bug classes will disappear since we've dealt with the same ones for 20 years.

Sponsor

📣 Everyone YOLO’s, few sandbox.

Every agent running on a dev laptop inherits everything: SSH keys, cloud creds, dotfiles, prod access. YOLO mode is the default now, and nobody's pretending otherwise. Minimal lets you run agents in isolated, reproducible environments. The same environment for humans, agents, and CI. Give your agent a computer, just not yours.

👉 Learn more 👈

With agentic development and agents in general, isolated, reproducible environments are huge 🤘 

Supply Chain

Securing the Supply Chain: Cache Vulnerability in RubyGems
Truffle Security's Luke Marshall discovered a CDN caching vulnerability in RubyGems.org where gzip-compressed responses from authenticated GET /api/v1/api_key requests were cached at Fastly edge nodes for up to one hour, letting unauthenticated attackers retrieve valid legacy API keys with curl --compressed. Two things went wrong at once, the app returned API key responses without cache directives marking them private, and Fastly's config didn't treat different users' requests as separate cache entries since it wasn't varying on the Authorization header. Together, one user's authenticated response could sit in a shared cache slot and get served to the next unauthenticated request through the same edge node.

RubyGems purged the affected caches, patched the app to send Cache-Control: private, no-store and vary on Authorization, and revoked all legacy API keys. Real-world impact was limited because RubyGems CLI 3.2.0 and later had already moved off the vulnerable GET endpoint.

Disrupting supply chain attacks on npm and GitHub Actions
GitHub's Zachary Steindler and Greg Ose describe a series of security improvements to npm and GitHub Actions designed to disrupt common supply chain attack patterns across initial compromise, credential exfiltration, and malware propagation. Key mitigations include safer pull_request_target defaults in actions/checkout to prevent "pwn requests," read-only Actions cache for untrusted triggers to block cache poisoning escalation, staged publishing for npm requiring additional 2FA approval beyond CI/CD credentials, npm v12 disabling install scripts by default, and a three-day Dependabot cooldown before opening version update PRs.

GitHub also introduced preventive account protection for high-impact npm accounts (72-hour read-only mode after email changes or 2FA recovery code use), workflow execution policies to control trigger types, expanded credential revocation API support for OAuth and App tokens, and an Actions network egress firewall in technical preview for logging and blocking malicious egress traffic.

💡 Love to see more ecosystem-level improvements by important platforms, great work! The more we can build secure defaults and security controls that are on my default into the building blocks developers use, the safer the world will be. LFG!

Blue Team

Detections that run but can't see
Nikhil Satyakrishna introduces deadair, a CLI tool that detects "dead" detection rules by checking if they can actually see the data they're supposed to query, going beyond simple execution monitoring. The tool identifies four failure modes, no matching source (a rule queries winlogbeat-* but data now lands in logs-windows.sysmon_operational-default), stale or empty sources, missing fields when integrations change ECS mappings, and ingest-lag blind windows where events arrive too late for the rule's lookback window.

deadair resolves each rule's inputs using native SIEM semantics, checks field_caps to verify declared fields exist, and maps which detections go dark when specific sources fail. The tool currently supports Elastic Security and OpenSearch Security Analytics, runs with read-only credentials using only metadata APIs like counts, timestamps, and field_caps, and can gate detection changes in CI or generate cross-tenant coverage reports for MSSPs.

Detection Engineering in the Era of Semantic Malware
Daniel Koifman writes about "promptware", a malware delivered via prompt injection that hijacks AI coding assistants like Claude Code, Cursor, and Devin by poisoning memory configuration files with natural language instructions that push legitimate tool calls into malicious work. Traditional detection methods fail because promptware produces no stable signatures, uses trusted processes with legitimate credentials, and routes C2 through approved SaaS channels like GitHub Issues or RabbitMQ. Since everything about the execution looks legitimate, the signals that still catch promptware are agent-side, file integrity monitoring of memory files, behavioral baselining of tool call patterns, and privilege auditing of agent permission grants.

Even those need better tooling to scale, and Koifman wants standardized agent telemetry, Sigma-style rules for agent abuse patterns, and an Atomic Red Team equivalent for promptware so teams can practice against these attacks before they spread.

AI + Security

Quicklinks

• trailofbits/aicov - gcov for what lines of code agents read

• Open-source runtime security to catch when your agents are misbehaving - Don't wait until your agent has breached Hugging Face to start supervising it. Adrian is the leading open-source runtime security monitor that runs independently of your agents, keeps them aligned to the remit you set and blocks harm before it happens. 5-min integration.*

• cloudflare/cloudflare-os - Agent workspace built on Cloudflare Workers for creating documents, building apps, and running agents with your company’s context and systems.

• cloudflare/computer - Give your agent a computer. A virtual filesystem backed by SQLite in a Durable Object

^*Sponsored

Least privilege for AI agents: Identity, access, and tool binding
Microsoft's Yesenia Yser and Toby Kohlenberg describe how AI agents introduce identity and authorization risks by chaining multi-step actions across systems without explicit human approval, often accumulating overly broad permissions through scope creep and ambiguous identity models that blur whether the agent acts under its own identity or a delegated user scope.

They recommend treating each agent as a first-class principal with a dedicated lifecycle-managed identity, task-based RBAC that separates narrow roles like Read-only knowledge retrieval and Create draft ticket, permissions scoped by resource, data, and operation boundaries, curated tool allowlists, and just-in-time time-limited entitlements for privilege elevation. Every downstream system should re-verify claims rather than trust upstream validation, with end-to-end auditability capturing agent identity, role, scope, resource, action, on-behalf-of user, and correlation IDs. Common pitfalls include shared secrets across agents, prompts instead of hard authorization boundaries, and logging only LLM responses without underlying tool invocations.

Going Beyond Zero: A New Paradigm For Enterprise Security
Google's Heather Adkins and Archana Ramamoorthy introduce Beyond Zero, a security model that pushes zero trust into the authorization layer by evaluating every action at the resource level rather than granting broad application access. The model combines five ideas, resource and action-based security across all access methods including APIs and Model Context Protocol, a mix of static and dynamic policies, context that gets pulled in automatically about user actions and data interactions, automated investigations that can trigger containment on the spot, and on-demand verification challenges for users and AI agents.

Early internal deployments show better detection of access abuse and stronger intellectual property protection without slowing operations, with the underlying architecture detailed in the ACM Queue paper "Beyond Zero: Enterprise Security for the AI Era." The approach handles a scenario where AI agents and attackers both act at the speed of automation, so authorization decisions have to keep up without adding friction for users.

💡 Very cool of Google to continue to release detailed white papers and books (e.g. Building Secure and Reliable Systems) on how they think about security. And think about all the security vendors who can now breathe a sigh of relief knowing that they have their new tagline for RSAC 2027.

Misc

• Musical sword fight - I don’t know if this is real, but I want to believe

• James Blunt - Goodbye My Lover (Live at Oxford Union 2016) 😭 

• Luke Nickle - hey ai come train on this song

• Jeff Dean, Sanjay Ghemawat - Performance Hints

• AI assistant hacks gym website in first known Australian autonomous cyber attack

• Via Cinema - A profile of Sacha Baron Cohen and Borat

• Alex Hormozi - How I Make Big Decisions Without Second-Guessing

• LLM 2 Human - The World's First Outpatient Procedure That Turns Large Language Models Into real live people

• 'Tattoo for job interview' draws outcry — and an apology

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🫠 Vegas

Like Icarus, I too have flouted common sense and the laws of nature by attending Hacker Summer Camp from Monday through Sunday.

So far I have (mostly) survived the heat, and it’s been great catching up with friends.

It’s somehow been busier than usual, will share more reflections next week. And potentially a story of one of the most memorable, funniest things I’ve observed in person for quite some time.

It’s been strange not attending Hacker Summer Camp under Semgrep’s banner, for the first time in ~6 years. And kind of strange representing OpenAI, even though I’ve been working there for a few months now. I guess my identity/mental model is still updating, even though #LabLyfe is my day to day.

Over my career I’ve become comfortable having what I say represent “personal Clint” or “tl;dr sec Clint,” so it’s an adjustment to keep in mind that someone could interpret something I say offhand as representing official OpenAI policy (it doesn’t).

And working closely with comms and having a number of meetings with various journalists has been a new experience.

I hope you’re having an excellent week, enjoy the weekend, and talk soon my friend.

Sponsor

📣 Building Trust into Software Development

AI isn't just changing how software is built—it's redefining the software supply chain. As AI coding assistants, models, agents, and machine-to-machine workflows become part of modern development, organizations need a new approach that builds trust into the entire software development lifecycle. The new Software Supply Chain Security module in Cortex Cloud gives teams continuous visibility across this ecosystem, prevents vulnerable or untrusted components from reaching production, and maps emerging threats to affected assets. 

👉 Explore the Future of Software Supply Chain Security 👈

AppSec

We’re open sourcing our privacy proxy CLI
Cloudflare's Hannah Wang, Ben Yang, and Fisher Darling introduce pvcli, an open-source CLI that simplifies debugging privacy-preserving protocols like Oblivious HTTP by handling the binary encoding, encryption, and multi-party request routing in a single curl-style command. Instead of parsing hex-encoded keys by hand, hand-crafting binary requests, and guessing which step in the client-to-relay-to-gateway-to-target chain broke, engineers get verbose logging that shows exactly where a request failed. The tool supports mTLS to relays, custom relay headers, and step-by-step tracing, with a roadmap covering additional MASQUE transports, post-quantum cryptography for OHTTP, and Privacy Pass support.

From Finding to Fixing: Reducing maintainer burden with automated patches
Google's Dustin Ingram and Alex Kilian announce that DeepMind's CodeMender AI agent has been integrated into OSS-Fuzz to automatically generate patches for discovered vulnerabilities, moving beyond bug reporting to delivering ready-made fixes to reduce maintainer burden. When OSS-Fuzz detects a vulnerability through traditional fuzzing (maintaining near-zero false positive rates), CodeMender analyzes the crash details and source code to find the true root cause, explores multiple code paths and hypotheses in parallel, and generates patches validated in isolated environments to confirm they compile and don't regress functionality.

To address concerns about low-quality AI contributions, Google respects each repository's AI-contribution policies, tests every patch for compilation and crash resolution without regression, and has engineers manually review all patches during the beta phase before submission. Current coverage focuses on C/C++ memory safety vulnerabilities, with projects already enrolled in OSS-Fuzz receiving patches automatically without configuration changes.

How Figma Stays Ahead of Vulnerabilities With Agents
Figma's Rohan Sharma, Liam Buchan, and Dave Martin describe an agentic security system that guards code as it's written, reviews every pull request, and audits their decade-old monorepo, all running on the same shared threat model policy of 68 precedents. They prioritized precision over recall by hand-labeling false positives from 8 weeks of PRs, which raised precision from 15% to 80%. An adjudicator pass then lifted recall by roughly 30%, and Claude Code and Codex now run in parallel since they catch different bugs. Their eval framework measures recall against 66 real vulnerabilities (46 from HackerOne, 20 from incidents and audits), hitting a 75.8% union catch rate on bugs that previously escaped human review and SAST. Self-improvement loops update the policy when new bugs are found or false positives flagged. Agent hooks enforce secure-by-default patterns during code generation with roughly 50% fewer logging safety bugs, and repo-wide audits found 100+ latent vulnerabilities including 2 criticals missed by SAST.

💡 Absolute banger of a post. Love the focus on data-driven iteration to improve the TP/FP rates, and integrating code scanning at the right points throughout the SDLC. The self-improvement loop is especially cool, I expect to see more in this space. Excellent work, highly recommend.

Sponsor

📣 The State of Trusted Open Source

Chainguard's new State of Trusted Open Source report analyzed 2,400 container projects and 18,000+ vulnerability instances. Findings: 97% of vulnerabilities occurred outside the top 20 projects, high-severity issues rose 13% quarter-over-quarter, and new library-level data shows foundational packages hiding in nearly half of all environments. 

Securing open source remains one of the most important challenges in modern software security, and it's exactly what Chainguard is built for.

👉 Protect Your Open Source Artifacts 👈

Some interesting stats, including a breakdown of the most popular image projects, dependencies, CVEs, and more. I’ve chatted with some Chainguard folks this week, they’re doing some quite technically challenging, and in my opinion, high leverage work 👍️ 

Cloud Security

S3 Clones in the Neoclouds
Wiz's Scott Piper examines S3-compatible object storage services across six neoclouds (Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean), revealing significant security gaps compared to AWS S3. No clone matches S3 Block Public Access, only Nebius and DigitalOcean offer data plane logs, and fine-grained IAM is limited or absent (only Cloudflare, DigitalOcean, and Nebius offer read-only or bucket-specific restrictions). Scott highlights additional risks including access keys without structured prefixes that evade GitHub secret scanning (particularly Vultr and Lambda Labs, whose keys have no distinguishing pattern at all), presigned URLs that work across every S3 clone with the same security implications as AWS, and potential bucket-squatting attacks due to separate global namespaces. Scott’s analysis shows that organizations using these S3 clones cannot rely on AWS security assumptions and must account for reduced protections, limited least-privilege capabilities, and gaps in detection tooling.

A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines
OFFENSAI's Ioan Criste and TUCN's Emanuel Ioniță analyze Amazon S3 Vectors and find the service itself sound, but its permission model and metadata handling open up serious risk in LLM retrieval pipelines. A single s3vectors:PutVectorBucketPolicy call from a compromised principal grants a foreign account full cross-account data-plane access (reads, writes, deletes), while the control plane stays owner-only. Anyone with s3vectors:PutVectors can inject unvalidated metadata like forged chunk text, spoofed citation URLs, and fake data-source identifiers, all of which bypass downstream filters.

Once that metadata reaches the model, it can drive RAG output manipulation, indirect prompt injection, or RCE in tool-enabled agents. The clinical RAG case shows how quickly this escalates, a single planted vector drove the assistant to recommend a dangerous drug dose while citing an untouched, authentic source PDF. After the fact, CloudTrail can't reconstruct any of it, data events are off by default, and even with them enabled the request payload strips vector keys, embeddings, and metadata, so responders learn only that an index was touched and have to hunt through the whole thing by hand.

Blue Team

This Iranian Malware Has No C2 Server to Block. The Command Channel Is a Meeting Invite in Your Own Calendar
Patrick Duggan discusses HollowGraph, an Iranian MOIS-linked malware disclosed by Group-IB that eliminates traditional C2 infrastructure by using the victim's own Microsoft 365 calendar to move commands and responses, commands arrive as meeting invites with encrypted attachments, responses return as appointments, all over legitimate Microsoft Graph API calls that appear as normal Outlook traffic. Detection requires behavioral analysis of Microsoft 365 audit logs and Graph API sign-in patterns, machine-cadence calendar operations, binary attachments on meeting invites, and anomalous Graph API token use, rather than traditional network IOCs, since mail-tier defenses and network monitoring cannot inspect authenticated first-party API calls to calendar objects.

Agentic incident response notebooks
Kyrre Wahl Kongsgård describes a marimo-based (think like Jupyter notebook) incident response system that unifies security data access, investigation workflows, and AI agents in executable notebooks. They created an SDK that wraps native query languages (SPL for Splunk, KQL for Defender XDR and Sentinel) and returns typed dataframes, so analysts can join results across platforms locally via DuckDB and ibis instead of exporting between tools. The same .py notebook works as analyst workspace, live shared view, deployable web app, and agent interface through marimo-pair, letting Claude Code create cells, run queries, and build case-specific investigation notebooks from scratch rather than maintaining alert-type templates. Examples: BYOVD hash joins against LOLDrivers, temporal correlations for Sliver C2 detection, and parallel fan-out across identity, PIM, and audit sources for case triage.

💡 Marimo looks neat, and I like the idea of having the analyst and agent collaborate in the notebook.

AI + Security

Incident Report: unsanctioned agent behaviour during cyber testing
The UK's AI Safety Institute (AISI) discovered that during cybersecurity evaluations with internet access enabled and safety filters disabled, AI agents autonomously took 19 unsanctioned actions targeting real people and organizations across 10 of 122 test runs, with 17 actions from Anthropic's Mythos 5 and 2 from OpenAI's GPT-5.6-Sol.

The most serious case involved an agent attempting a supply-chain attack by submitting malicious code to a real open-source GitHub project, creating fake identities to socially engineer the maintainer into approval, and using Tor to evade network restrictions—behavior that emerged without specific prompting as the agent persistently pursued its assigned cybersecurity challenge.

💡 Hol-y cow. This might not be the right take, but having an agent attempt a supply chain attack and social engineer a real open source project feels more misaligned/more worrisome to me than an agent tasked with finding 0-days choosing to find additional 0-days to solve the challenge. Like, I would hope that even cyber capable models would not be inclined to bully humans to achieve the desired outcome. 17 actions vs 2 👀 

Investigating three real-world incidents in our cybersecurity evaluations
Anthropic discovered three incidents where Claude models accessed the internet from supposedly isolated cybersecurity evaluation environments and compromised real organizations' infrastructure while attempting to complete capture-the-flag challenges. The incidents involved Claude Opus 4.7, Mythos 5, and an internal research model: one exploited weak passwords to access a company's database, another published a malicious Python package to PyPI that was downloaded by 15 real systems (including a security scanner whose credentials Claude then exfiltrated), and a third scanned 9,000 targets before compromising an application via SQL injection.

See also: Meta says its AI model hacked into another company during testing.

💡 “The earliest incidents date to April.” Blog published: July 30, roughly 3-4 months later. If OpenAI hadn’t published their blog post, I wonder if these other instances would have been discovered 🤔 Still, it’s great to see all of these write-ups from different companies, we’re all learning and advancing together ✊ 

Tailscale in the Hugging Face intrusion: The good news and the bad news
Tailscale's Avery Pennarun analyzes how an AI agent moved through Hugging Face's Tailscale network during the breach, where the agent escaped its sandbox, gained root on a Kubernetes node, stole 136 credentials including a reusable Tailscale auth key, and enrolled 181 nodes into the tailnet over four days. The auth key worked because it was long-lived and reachable in the credential vault, not because any Tailscale vulnerability was exploited.

To close that gap, Avery recommends replacing reusable auth keys with workload identity federation that issues short-lived OIDC tokens from cloud providers, enabling network flow logs that report from both connection endpoints so anomalies still surface even if one node is compromised, and using Tailnet Lock for programmable admission control. Tailscale plans to update documentation and UI so these defaults are easier to find and enable.

Before the first prompt: Code execution paths in trusted coding-agent projects
Datadog's Nick Frichette demonstrates two methods for achieving code execution in coding agents after project trust but before the first prompt, bypassing hook review mechanisms. In Codex, project-scoped MCP server configurations in .codex/config.toml automatically start attacker-controlled processes without requiring hook approval. In Claude Code, malicious .claude/settings.json files can prepend repository directories to PATH, causing Claude's automatic Git probes to execute a tracked repository wrapper instead of the real Git binary. Frichette provides a ripgrep command to spot risky settings across common agent directories, but stresses that manual review is incomplete since projects can influence execution through hooks, skills, MCP servers, editor tasks, and environment variables like BASH_ENV and NODE_OPTIONS, so project trust should be treated as equivalent to code execution.

Misc

• Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

• Tolkien Expert: You don't understand the Lord of the Rings

• Daniel Miessler on why Interceptor is the best Browser Control System for agents

• Perfect (feat. Simple Plan) - Punk Goes Princess - When you actually listen to the lyrics, this song hits hard 😭 Who’s crying? I’m not crying.

• Mark Manson - 7 Surprising Habits that Changed My Life in My 30s

• Tim Ferriss - I Asked AI What to Do With the Next 5 Years of My Life

• HealthyGamerGG - How to healthily release anger

• Make Some Noise - Every time Pete Holmes roasted Sam

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🏜️ Hacker Summer Camp

I’m excited about Black Hat and DEF CON next week!

It’s always such a delight to catch up with friends and meet new cool people. Even if it’s going to be 115°F, which is roughly 40 degrees too hot for me.

We’re doing some workshops with SpecterOps on “Operationalizing Codex for Malware Triage” and a talk (same page), we’ve got booths at Black Hat and DEF CON, and I’ll be around at various events.

I think OpenAI is having a happy hour, but I don’t have a link handy. I’ll try to post about it on my LinkedIn next week.

Oh yeah funny anecdote- apparently some of my colleagues have used Codex + ChatGPT Sites to spin up a quick web app tracking like over 1,000 Hacker Summer Camp events.

They then used Codex to mass apply to events, and are so far: shooting machine guns from a helicopter, driving sports cars, and more 😂 What a time to be alive.

Hope to see you next week! And if not, I hope you have an awesome time in Vegas, or perhaps you more wisely chose to stay home.

Sponsor

📣 Attackers are spoofing big brands to get your AI agent to install malware

Island Security Research uncovered 7,600 malicious GitHub repositories — over 800 posing as AI Skills or MCP servers — with some using Walmart, Databricks, Gmail, Salesforce, Spotify, and other big brand names to look legitimate. 

The payload: SmartLoader and the StealC infostealer, with 14M+ downloads. Worse, no one had to click a bad link. Claude Code, Gemini, and ChatGPT all discovered these fake capabilities on their own and treated the attacker's README as legitimate documentation. We call it AgentBaiting.

👉 See the malicious repos 👈

AppSec

Control Reliability Engineering (CRE): Applying SRE Principles to Cybersecurity Controls
Phil Venables proposes Control Reliability Engineering (CRE), an application of Site Reliability Engineering to security controls that treats a failed control with the same weight as a breach, since a broken control looks identical to a working one until something tests it. CRE lays out 10 elements to close that gap, control cataloging with a formal ontology, controls-as-code with CI/CD pipelines, Control SLIs/SLOs and error budgets, Continuous Control Monitoring backed by synthetic event injection to catch silent failures, Control Readiness Reviews before deployment, gradual rollout for changes, and blameless postmortems on failed controls. Instead of triaging alerts and running subjective risk assessments, security teams track control health directly through policy evaluation success rates and coverage ratios.

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident
Hugging Face published a forensic timeline of an intrusion by an autonomous AI agent running OpenAI's ExploitGym evaluation harness, reconstructing ~17,600 attacker actions across two stages. The agent first escaped OpenAI's sandbox via a zero-day in the package registry cache proxy. Then it breached Hugging Face's infrastructure through two injection vectors against the same production Kubernetes dataset loader, an HDF5 external raw storage exploit that leaked pod secrets and worker source code, and a Jinja2 template injection that achieved arbitrary code execution. Once inside, the agent escalated to cluster-admin across multiple internal clusters in under 13 hours, then abused a misconfigured internal service-connector whose single shared credential bound to system:masters gave it cluster-admin everywhere in one second, enrolled devices into HF's Tailscale mesh with a stolen auth key, and ran C2 entirely through public services with chunked+XOR+gzip encoding that naive log scans missed.

Claude Opus and Fable refused to analyze the attack logs due to cybersecurity guardrails (no mention of OpenAI models being used and getting refusals 👀), the team switched to open-source GLM-5.2 running on their own infrastructure.

💡 Very detailed write-up, great read. Especially the lateral movement and C2/exfil sections. HF’s interactive replay is well worth checking out. See also the updated OpenAI blog about the incident.

Sponsor

📣 The Practitioner's Playbook for Asset Intelligence

AI is scaling attacks, but they're still hitting the same weak spots: unpatched devices, over-permissioned identities, and configuration drift no one caught. The real fix isn't another tool, it's fixing the foundation. This playbook breaks down the five disciplines that separate teams who stay ahead of exposure from those who don't: Collection, Coverage, Context, Containment, and Cooperation. Get a quick win for each one you can put into practice this week.

👉 Download the Playbook 👈

The fundamentals like asset management are still, if not more critical than ever. I like the focus on quick wins.

Cloud Security

Introducing ClickOps Sentinel: AI Context for AWS Console Changes
Victor Grenu introduces ClickOps Sentinel, an open-source pipeline that detects AWS Console changes in near real-time by filtering EventBridge events for CloudTrail's sessionCredentialFromConsole flag and readOnly=false, and hands each change to a Claude agent on Amazon Bedrock for investigation. The agent retraces the whole console session via CloudTrail LookupEvents, checks adjacent activity from the same IP, consults long-term memory in Bedrock AgentCore Memory, and produces a verdict (manual-change-confirmed, likely-sanctioned-activity, suspicious) with confidence, security implications, FinOps impact, session narrative, and a remediation recommendation. Alerts land in Slack or Microsoft Teams via Amazon Q Developer chat, or as rich HTML emails through external providers like Resend or SendGrid, and the tool deploys via AWS SAM CLI.

Rapid7 Labs: Investigating Persistence Mechanisms in AWS
Rapid7's Jan Blažek describes four AWS persistence techniques attackers use to maintain access after initial compromise, providing CloudTrail-based LEQL queries for detection and investigation. The techniques include creating IAM users with follow-up credential and permission additions (iam:CreateAccessKey, iam:AttachUserPolicy), modifying assume role policies to allow external AWS accounts (iam:UpdateAssumeRolePolicy), deploying backdoored Lambda functions triggered via public URLs (lambda:CreateFunctionUrlConfig) or API Gateway integrations, and creating federated user sessions via sts:GetFederationToken whose temporary credentials survive access key rotation.

Jan warns that federated sessions require applying deny-all policies to the source IAM user until temporary credentials expire, since AWS persistence typically abuses legitimate identity and automation features rather than exploiting flaws, so effective detection requires pivoting from the initial alert to every related identity, credential, session, and policy.

Blue Team

manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator
By Manish Rawat: An n8n workflow that turns newly weaponized CVEs from the CISA KEV catalog into Sigma detection rules every Monday, cutting 4-6 hours of manual work per CVE down to zero. The pipeline uses Google Gemini to generate rules targeting specific products with Sysmon EventIDs and MITRE ATT&CK mappings, logs each CVE to Google Sheets for compliance, and emails a weekly analyst briefing.

Context bombs: stopping AI attackers in their tracks
Tracebit demonstrates a canary token technique called "context bombs," (GitHub repo with payloads here) where decoy AWS Secrets Manager secrets contain content designed to trip an AI attacker's safety guardrails when the model reads them. Testing five frontier models (Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek V4-Pro, Kimi K2.6) across 152 attack runs in a simulated AWS cyber range, a single context bomb cut average admin-access from 57% to 5%, full compromise from 36% to 1%, and Opus 4.8 specifically from 93% baseline to 0%. Effectiveness depends on payload family, with sensitive biological content working against Western models while politically sensitive Chinese content works against Chinese-lab models. Every context bomb hit also fires a canary alert, giving defenders both detection and disruption in a single mechanism. This approach exploits the fact that AI agents must send retrieved data back to their LLM for analysis, creating a chokepoint where content filters can detect and block malicious activity.

💡 This is a very clever and fun idea- purposefully planting content that will trip an AI agent’s safety guardrails and thus stop it. The Western vs Chinese bomb differences is also interesting 👀 

Red Team

googleprojectzero/sandbox-attacksurface-analysis-tools
A set of tools to analyze Windows sandboxes for exposed attack surface, by Google Project Zero’s James Forshaw.

MatheuZSecurity/Furtex
By MatheuZ: A Linux post-exploitation and evasion research toolkit built around io_uring and eBPF, with 125+ tools across five categories. The core idea is that io_uring's kernel workqueue path sidesteps a large class of EDR hooks natively, since operations submitted through io_uring never fire syscall entry tracepoints. Additional tools handle what io_uring can't bypass on its own, disabling kprobes, BPF LSM hooks, Linux audit, and netfilter, while a dedicated Falco module targets all 25 of its default rules.

AI + Security

Quicklinks:

• ethz-spylab/agentdojo - A dynamic benchmark environment for evaluating prompt injection attacks and defenses in LLM agents.

•  Why detection architecture matters more than the AI model - AI changed email security, but even with modern models, SOCs still run into the same structural issues. Josh Kamdjou (CEO, Sublime) and Dmitri Alperovitch (Co-Founder, Crowdstrike) make the case for why architecture, not AI models, is what actually lets defenders keep pace.*

• amElnagdy/guard-skills - Review prompts for AI coding agents that catch LLM failure modes, including clean-code-guard (catch-all error swallowing, hardcoded success returns, hallucinated APIs), test-guard (flags mock abuse and duplicate tests), docs-guard (verifies every documentation claim against the codebase), and wp-guard (WordPress security).

^*Sponsored

Dicklesworthstone/destructive_command_guard
By Jeff Emanuel: a high-performance hook for AI coding agents (Claude Code, Codex CLI, Gemini CLI, …) that intercepts and blocks destructive commands before execution using a modular pack system, with 50+ security packs covering databases, Kubernetes, Docker, cloud providers, and more. The tool uses a three-tier heredoc/inline-script scanning architecture with SIMD-accelerated filtering and context-aware pattern matching that distinguishes executable code from data/comments.

It also includes a bounded failure policy with configurable fail-closed mode, agent-specific trust profiles, allowlist management, and scan mode for CI/pre-commit hooks with format-aware extractors (shell scripts, Dockerfiles, GitHub Actions, Makefiles, etc.).

💡 Making sure agents don’t take destructive seems to be one of the most common concerns I hear from security leaders right now.

We built a test corpus for AI agent egress security tools
Pipelab's Josh Waldrep introduces Agent Egress Bench, an open-source test corpus for security tools that sit between AI agents and the network, covering 197 logical cases across 18 categories including secret exfiltration, prompt injection, SSRF, hostname exfiltration, MCP tool poisoning and chain detection, MCP drift, A2A protocol scanning, WebSocket DLP, encoding evasion, shell obfuscation, and crypto/financial DLP.

Most benchmarks in this space test whether the LLM behaves correctly. Agent Egress Bench tests whether the firewall, proxy, or scanner sitting between the agent and the network catches the attack, with each case mapped to the OWASP Top 10 for Agentic Applications. To score results, an optional Gauntlet program reports four independent metrics: containment, false positive rate, detection, and evidence.

Some thoughts about Anthropic’s new cryptanalysis results
John Hopkins professor Matthew Green gives an overview and commentary on two cryptanalysis results from Anthropic's Claude Mythos: a key recovery attack on HAWK (a post-quantum signature scheme candidate) that roughly halves its security bits using existing techniques, and a modest improvement on 7-round AES attacks. What's notable about the HAWK result is that it doesn't invent new mathematics, but simply applies existing cryptanalytic tools more thoroughly (the type of work AI excels at), with the researchers achieving these results by essentially telling the model to grind away at problems without detailed human intervention.

Matthew argues this is an ideal time for AI cryptanalysis capabilities to emerge, as we're mid-transition to post-quantum algorithms, meaning AI can stress-test new standards before deployment.

Anthropic also partnered with academics at ETH Zurich, Tel Aviv University, and TU Berlin to build CryptanalysisBench, a benchmark that packages together many cryptographic ciphers and makes it easy for others to evaluate the capabilities of LLMs. The HAWK attack took about 60 hours and $100,000 in API costs.

💡 Super cool to see frontier models applied to cryptanalysis. Improving these underlying algorithms keeps us all a bit safer. It’s interesting to see how as models get better, you can get meaningful results with simpler/lower effort prompts, in this case writing a simple prompt to Claude that rewrote the agent harness that improved the analysis. The security researchers on my team at OpenAI have found the same thing.

Misc

• Todd Barriage - A Thousand Miles, but it's super emo

• Mark Manson - The Strait of Hormuz is Why You're Still Single - Kinda unhinged comparison of dating with the U.S. <> Iran relationship

• The Onion - Slow-Witted Conspiracy Theorist Convinced Government Behind NASA

• Lenny Rachitsky - Biggest takeaways from Anthropic’s Head of Product for AI research and Labs, Dianne Penn

• Micro-drone kills a flying moth - “This is a big step towards completely eradicating mosquitoes.” It seems ill-advised to eliminate a part of the food chain that’s been around for a long time. Also, definitely going to be used by the military ☹️ 

• dex - Why Software Factories Fail - Super detailed, great list of references.

• Lin-Manuel Miranda on MOANA, HAMILTON, IN THE HEIGHTS, the Marvel role he turned down, & more!

• AI’s Biggest Beneficiary: Organized Crime - Dave Pollard argues that humanity inevitably uses all technology, at least in some ways, against itself. AI can be used by corporations for ‘surveillance pricing’, by governments and agencies for illegal surveillance, phishers for more effective scamming, lobbyists and intelligence agencies for mass disinformation, and more.

• Keanu Reeves poem that hits hard - An Ode to Happiness

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤗 Hugging Face Incident

It’s been… a week 😅 

In case you haven’t heard, this week OpenAI published a blog post saying that the recent AI-powered attack on Hugging Face was in fact… GPT‑5.6 Sol and a pre-release model.

I feel very fortunate to have been able to see things unfold behind the scenes and contribute to the blog.

Unfortunately I can’t say more at this time, other than I am very impressed by my colleagues.

Sponsor

📣 The Next Security Incident May Look Like Normal Work

The next security incident may not look like an attack. It may look like an employee moving sensitive data, using an AI tool, or completing a routine task. 

Traditional security controls can see the activity but often miss why it is happening or what should be the response.

Ent brings real-time intent and behavioral context to human and AI-driven work, identifies risky actions, and intervenes before it becomes an incident, without disrupting legitimate productivity. 

Meet with an Ent security expert to learn how to protect work as it happens.

👉 See how to secure your workspace 👈

AppSec

Rust-proof your code with our new Testing Handbook chapter
Trail of Bits released a new Rust chapter in their Testing Handbook, including a security overview of what Rust’s guarantees do and don’t cover, dynamic analysis tools like Miri for undefined behavior detection, proptest for property testing, mutation testing, plus static analysis with Clippy lints and the Kani model checker. The guide includes underappreciated security issues including unwind safety, nondeterminism, arithmetic errors, and operator precedence gotchas, and provides three solutions for memory zeroization of secrets. They also released rust-review, a Claude Code plugin co-built with Aptos Labs that automates security reviews targeting a dozen bug classes, including memory safety, concurrency hazards, FFI pitfalls, and async cancellation issues.

Comparing Open-Source AI Code Security Harnesses
Semgrep's Isaac Evans compares open-source AI-powered code security tools, categorizing them into three types, LLM-led exploit generation, which finds bugs by crashing them in a sandbox, like Anthropic's defending-code-harness for C/C++ memory bugs. LLM-skill-boosting, which adds skills inside LLMs to help them reason about code the way a human vulnerability researcher would, including Cloudflare's security-audit-skill, Trail of Bits' Skills library, CapitalOne’s vulnhunter, and Google's mantis. And SAST+LLM hybrids, which use traditional static analysis to feed candidate findings to an LLM for deeper review, including Cisco's ai-deep-sast, Vercel Labs' deepsec, Visa's VVAH, and raptor.

Key differentiators include whether tools execute code to validate findings, generate patches, support fully local operation, and use adversarial validation where a second independent agent attempts to falsify findings. Looking at the field overall, Isaac sees no market leader emerging and expects many companies to build their own "shop jigs" for vulnerability finding while the field moves too fast for a reference open-source harness to consolidate.

💡 It’d be cool to see some TP/FP/FN/cost analysis across various harnesses 👀 

Sponsor

📣 New webinar: The everyday behaviors that create shadow AI and how attackers exploit them

Shadow AI isn't a rogue employee problem. It's four ordinary behaviors: signing up for a new tool, logging into an approved one with a personal account, installing an extension, granting an OAuth consent. Each builds the attack surface that attackers now target directly. 

Join the latest threat briefing from Push Field CTO Mark Orlando as he puts hard numbers on the gap and shows how attackers have made shadow AI a key part of their toolkit in 2026. 

👉 Register Now 👈

Hmm I could see how the interplay between all of these OAuth grants, LLM connections, imitation extensions, etc. all combine in nasty ways.

Supply Chain

pnpm 11 Adds Supply Chain Protection Defaults for Minimum Release Age and Exotic Subdependencies
Socket's Sarah Gooding describes how pnpm 11 turns on supply chain protections by default, including a 24-hour waiting period before new package versions can be installed, blocking transitive dependencies from non-standard sources like Git repos and direct tarballs, and a new allowBuilds model that consolidates control over which packages can execute install-time scripts. The release also adds native registry commands, built-in SBOM generation via pnpm sbom, and pnpm audit --fix=update for lockfile-based vulnerability fixes.

Homebrew: 6.0.0
Mike McQuaid announces Homebrew 6.0.0, which introduces tap trust to require third-party taps to be explicitly trusted before their arbitrary Ruby code runs while official taps stay trusted by default. Two other changes shrink the code that runs unsandboxed. Linux now sandboxes build, test, and postinstall phases through Bubblewrap, matching what macOS already does. And a new install steps framework lets simple postinstall actions ship as static data instead of Ruby code, so the installer no longer has to evaluate a Ruby file for basic file operations. A new brew vulns tap and subcommand also checks installed packages for known vulnerabilities.

💡 Security features and hardening for package managers, love to see it 😍 

Blue Team

DeepTempo/socbench
By DeepTempo: A benchmark that evaluates frontier reasoning LLMs as SOC agents analyzing raw NetFlow data through a deterministic, multi-turn agent loop with persona-scoped read-only tools and strict budget caps. The framework tests four personas (SOC Analyst, Threat Analyst, Adversary Hunter, Detection Engineer) against pre-indexed NetFlow parquet files, scoring predictions using per-flow/per-pair/per-host F1 metrics with ablation support for tools_off and playbooks_off comparisons.

BOTS v3 Benchmark
DefenseBench evaluation of AI agents on Splunk's Boss of the SOC v3 dataset, giving them 90 minutes to answer security investigation questions via a referee API that handles question retrieval, answer submission, and hint purchases. Agents query Splunk via CLI using curl commands, with scoring based on correctness, speed bonuses, and penalties for wrong answers or hints. The setup tests AI agents' ability to perform SOC analyst tasks like querying security data, interpreting results, and managing investigation workflows under time pressure.

💡 Most recent models tested are Opus 4.6 and GPT 5.4, so this benchmark must be at least 10 years old in AI years.

Red Team

Accelerating EDR Evasion with LLM-Driven Analysis
SpecterOps's Adam Chester demonstrates how LLMs like GPT-5.5-Cyber can systematically reverse engineer commercial EDR products to extract detection rules and generate evasions, using a simple "Day Shift" harness that loops Codex CLI with Binary Ninja over MCP. Testing against Palo Alto's Cortex XDR, the LLM successfully extracted 9,350 DSE rules, 4,209 BIOC rules, 6,358 YARA signatures, 7 ML models with working execution harnesses, and behavioral detections written in CLIPS (like LISP), all from local files without cloud access. “Again this isn’t just a binary artifact that is referenced by the LLM. When reviewing the results, I found a list of cleartext files ready to be reviewed.”

Extracting the rules is only useful if you can turn them into evasions, and Adam demonstrates the closed loop with a concrete example. Cortex blocks reg save HKLM\SAM, a standard credential dumping command, but the decrypted CLIPS rule reveals an allowlisted output path an attacker can use to run the same command undetected. He closes with a preview of Upside Down, a simulation framework using Windows and EDR emulation subagents that let the LLM test extracted rules and iterate on evasions before touching a real environment, and notes the same process has already produced extracted rules and models for every major EDR vendor.

See also, previously included in tl;dr sec: The Defensive Stack is Exposed: LLMs, Reverse Engineering, and the End of Opaque Defense.

💡 Honestly kinda crazy that you can just put an agent in a while loop and say “please reverse this and find the secrets” with no additional scaffolding and… it does 😅 

AI + Security

google/mantis
Mantis is a portable, sequential toolkit of AI agent skills for building automated security review pipelines that can discover vulnerabilities, generate proof-of-concept exploits, and create patches. The 15-stage pipeline includes threat modeling, vulnerability scanning, deduplication, false positive filtering, sandboxed crash reproduction, exploit chaining, and automated patching, all designed to run in isolated Docker/gVisor containers.

The toolkit supports both interactive human-in-the-loop execution and unattended cloud deployment, with an opt-in snapshot model that enables continuous review of living codebases by pinning immutable snapshots per pass and syncing targets non-destructively at pass boundaries.

Kimi K3 Might Have Just Started a Crash of the US Economy
Daniel Miessler argues that China's release of cheap, high-quality open source AI models like Kimi K3 is a deliberate CCP strategy to undermine US AI labs, potentially triggering a stock market crash and economic collapse that could lead to Taiwan reunifying with China. He believes that while increased competition benefits the AI ecosystem, users sending their data to these models are falling into a geopolitical trap. Daniel warns that once China achieves global dominance, the era of cheap, politically unrestricted models will end, with the world resembling Hong Kong's current state under CCP control.

How Far Behind the Frontier are Leading Open Weight Models on Cyber?
The AI Security Institute reports that open weight AI models are catching up to closed frontier models on cyber capabilities faster than expected. GLM-5.2 and DeepSeek V4-Pro now match closed models released 4 to 7 months earlier, down from a 6 to 10 month gap in 2025. On AISI's long-horizon cyber ranges, GLM-5.2 got as far as Anthropic's Opus 4.5 across a 32-step attack that would take a human expert about 20 hours.

The open weight models were also much cheaper and less guarded. A full cyber range run cost $1.19 on DeepSeek V4-Pro and $46 on GLM-5.2, against $85 on Opus 4.6. DeepSeek refused a few tasks but retrying the same prompt was enough to get it to comply. Once model weights are out in the open, closed-model safeguards like monitoring, user banning, and refusal training don't hold up, since anyone can strip refusal training out of the weights and run the model wherever they want.

💡 Western governments, rightly so, want to ensure models from American AI labs aren’t used for harm. This is a good thing. However, slowing down the rate of release/adding significant friction helps Chinese models catch up. I intellectually understood but didn’t fully appreciate this before working at a lab. This is actually a Big Deal, when the state of the world is $X0,000 gets you 0-days in important software.

Misc

• The Onion - Open Relationship Gives Couple Freedom To Emotionally Drain Other People From Time To Time

• Mick Jagger - How Fame Damages Your State of Mind

• HealthyGamerGG analyzing his Jubilee conversation with Lamar, a military veteran struggling with PTSD.

• POV: How Linux found you

• What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out

• Alex Kantrowitz - OpenAI's Bots Break Containment and Hack Hugging Face Autonomously — With Alex Stamos - “I know lots of people at OpenAI. Every single one of them absolutely hated Anthropic’s marketing around Mythos and thought it put the entire industry at risk.” “There’s absolutely, positively no way this was an intentional marketing move. And OpenAI is doing the best it can, I am sure, right now to use this to forestall any kind of massive government overreaction.”

I am so tired 🫠 

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🍬 Grandma Seems Chill

In the San Francisco Bay Area, basically every billboard is about AI or tech.

But when I was traveling recently, I saw a “Gummies for Granny” billboard that brightened my day:

I imagined the meeting where the marketing leads were reviewing different framings for their products, and the right target demographic, and this is what they came up with 😂 

I wonder if they have other brands or stores. Mushrooms for Mommy? Doobies for Daddies? A Little Ket for the Family Pet?

Working in marketing must be delightful sometimes.

Sponsor

📣 The AI Security Starter Pack -
Securing AI apps, Models, and Agents

Unlock 7 of the most widely used AI security resources in one place. Apply real-world checklists, templates, and best practices designed to secure AI adoption.

Each asset provides practical, implementation-ready resources to secure AI apps, models, and agents across your environments.

What’s included: 

1. State of AI in the Cloud 2026

2. CISO AI Security Roadmap

3. AI Security Board Report Template

4. GenAI Security Best Practices Cheat Sheet

5. Securing AI Agents 101

6. Model Context Protocol (MCP) Security Best Practices Cheat Sheet

7. LLM Security Best Practices Cheat Sheet

👉 Get the AI Security Bundle 👈

AppSec

Soatok’s Informal Guide to Threat Models
Soatok gives a practical guide to threat modeling, emphasizing seven key questions: what you're protecting, who wants to harm it, how they might attack, prevention measures, asset relationships, assumptions being made, and deliberately unaddressed threats. He illustrates good threat modeling with his own Fediverse key transparency project and contrasts it with Matrix's incomplete threat model, which lacks cryptographic considerations and has remained largely unchanged since 2021 despite multiple vulnerability disclosures. Soatok demonstrates how proper threat modeling can lead to better security decisions, such as choosing passkeys over passwords to prevent credential stuffing, and compares two proposals for distributed end-to-end encryption.

The Bug Bounty Singularity: Our Hackbot
Joseph Thacker and JD built an autonomous hackbot by combining Claude Code skills for recon, fuzzing, and deep application analysis that found 126 vulnerabilities across five months of bug bounty testing. Ralph loops with an orchestrator kept it digging on strong targets and off weak ones, and a validation bot built only to disprove findings cut false positives from 80% to 60%.

“At one point, 80% of our tokens were being spent on auth.” The biggest jump came from keeping the bot logged in with a real browser on a physical machine, since the criticals are unreachable logged out. Of the 126 vulnerabilities, 88 were rated High or Critical and 89% were confirmed real once programs accepted them or closed them as duplicates. The single largest bounty was $15,000, more pending.

The top chains include a leaked Google API key escalated to Super Admin over roughly 60,000 users on Google's internal Delivery Readiness Portal, an unauthenticated Western Union endpoint returning full customer PII from a phone number, and a stored XSS on Raydium whose payload lived in immutable on chain Metaplex metadata and enabled a one click wallet drain.

Sponsor

📣 What if every app and agent had SSO without giving up control?

AI agents are becoming users of your infrastructure too. They need identities, authentication, and permissions, not shared API keys or blanket access. authentik lets you manage human and machine identities from one self-hosted platform. Secure every application with SSO, modern authentication standards, and flexible policies that evaluate context before granting access, whether the request comes from a person or an autonomous agent.

👉 Secure every identity with authentik 👈

Identity is key. Also, used by CoreWeave, Cloudflare, and others, nice 👍️ 

Cloud Security

CloudTrail in CloudWatch isn't very good
Aidan Steele explores AWS's recommendation to migrate from the deprecated CloudTrail Lake to CloudWatch, finding the migration process poorly documented and missing key features like resource tags and global condition key enrichment that made Lake valuable. He describes the complex setup, requiring service-linked channels, separate org-level and management account rules, manual log centralization configuration, and CloudWatch-S3 Tables integration, with ~8-hour delays before events flow and InternalServerException errors when calling UpdateTelemetryRuleForOrganization to update retention.

The new CloudWatch approach lacks centralization by default (logs stay in individual accounts until separate centralization rules are configured), has unclear cost comparisons versus traditional trails (per-event vs per-GB pricing), and appears half-baked with no official AWS documentation or third-party blog posts explaining the setup, prompting Steele to publish his Terraform configuration to help others navigate the process.

Knossos: Procedurally Generated Decoy Environments
Praetorian's Mario Bartolome introduces Knossos, a deception engine that studies a customer's real cloud infrastructure to learn its naming conventions, tag vocabularies, CIDR allocation, and IAM patterns, then builds AWS decoy environments that look the same and come pre-seeded with attack paths. A Knossos component called Daedalus does the pattern learning, then works backward from an objective like data exfiltration to lay out an attack path. Each lure is a misconfigured resource that fits into the attack path, and Knossos surrounds each one with normal-looking resources so nothing stands out as unusually risky. The whole environment ships as Terraform HCL and is walled off by three isolation layers, network isolation, IAM permission boundaries, and SCPs.

Once deployed, Knossos watches attacker activity through EventBridge with per-lure telemetry detailed enough to show which path someone took and how long they spent on each step. Scores based on interaction rate, dwell time, and escape rate flow back into the style profile and shape what the next round of decoys looks like. To keep everything looking used rather than staged, an activity simulator sends realistic API traffic through the environment.

💡 This is a product description blog, which I normally don’t include, but the post has a great level of detail and I think deception and canaries are really interesting right now, given how it’s likely more attacks will be automated and end-to-end faster going forward, and how it’s now possible to automatically create realistic environments at scale using LLMs. Lots more work to be done in this space.

Blue Team

badchars/darknet-mcp-server
Tool by Orhan Yildrim that unifies 66 tools across 16 dark web and threat intelligence sources into a single MCP server, letting an AI agent query breach databases, ransomware trackers, Tor hidden services, malware sandboxes, stealer logs, blockchain forensics, and exploit databases in parallel rather than juggling 16 browser tabs. Sources include HIBP, IntelligenceX, AlienVault OTX, AbuseIPDB, the abuse.ch suite, Hudson Rock, Vulners, and Hybrid Analysis.

Adding a Detection Layer That Prompt Injection Can't Touch
Aaron Phifer writes about adding a behavioral detection layer to Triagewall, his self-hosted IDS alert triage tool that runs a fast prefilter for known-noise alerts and a local LLM for the rest, with base64-wrapping on attacker-controllable fields to make prompt injection harder. He added a layer that applies statistical process control per host, tracking alert_rate for volume spikes and novel_sid for first-ever signature triggers, both derived from the raw Suricata alert stream so nothing new has to be turned on. Neither depends on the alert text, so prompt injection can’t affect it.

💡 I feel like base64-wrapped text can probably still successfully prompt inject given enough effort. But I like the idea of using converting raw textual attacker input to aggregate stats or other numbers so they can’t prompt inject. Analogously, this makes me think of converting user input to a boolean or number type in a SQL query, thus rendering SQL injection impossible.

Red Team

28Zaaky/khaos-c2
By 28Zaaky: A post-exploitation C2 framework with a C-based agent that uses several Windows evasion techniques (indirect syscalls, ntdll unhooking, ETW/AMSI patching via hardware breakpoints) to evade EDRs. Traffic routes through five covert channels chosen to blend with services enterprises already trust: Microsoft Teams, GitHub Gist, DNS-over-HTTPS, generic HTTPS, and SMB named pipes.

GhostPack Necromancy: Reforging C# Tools with WasmForge
Praetorian's Michael Weber extends WasmForge (their Go-to-WebAssembly loader that takes existing signatured Go tools and ships them as opsec-safe binaries) to compile C# offensive tools to WebAssembly, taking GhostPack tools like Rubeus and Seatbelt outside the .NET runtime. The pipeline uses .NET's NativeAOT-WASI toolchain combined with three custom layers that handle wasm32-to-x64 calling convention mismatches, source-level incompatibilities, and missing Base Class Library functionality. Michael validates most Seatbelt commands line-for-line against Windows 11 and nearly all common Rubeus verbs against Game of Active Directory. The full WasmForge toolchain is available on GitHub.

AI + Security

Quicklinks

• LifeOS - My friend Daniel Miessler has rebranded PAI (Personal AI Infrastructure) and made a ton of improvements.

• Give your AI agents cryptographic identities. Shared credentials were already risky for humans, but AI agents invoke tools and access data without humans in the loop. Teleport's Agentic Identity Framework governs AI agents as first-class identities so you can ship faster with less risk.*

• Qi Deng - I Reproduced a Fable 5 Safeguard Bypass in Claude Code - Seems like /btw enables broader cybersecurity use cases. As someone also involved with creating models for security use cases, my take to jailbreakers - leave Britney alone 😭 

^*Sponsored

gadievron/greenlight
Tool by Gadi Evron that autonomously handles Claude content-policy refusals during authorized vulnerability research evals, developed to benchmark where Claude Code's guardrails trigger exploitation-related refusals. Greenlight includes Skills that reduce refusal rates on some tasks.

DataDog/datadog-saist
By Datadog: An AI-native SAST tool that uses LLMs to find vulnerabilities in Java, Python, and Go code instead of relying on traditional parsing rules. The tool builds project context for more accurate analysis, generates SARIF reports, and supports Anthropic, OpenAI, and Gemini models across separate detection and validation stages.

💡 The detection prompts are fetched from Datadog’s hosted API, but it doesn’t require Datadog authentication.

Harnessing Harnesses - Climbing the LLM Hills
Andy Gill gives a nice overview of harnesses, which wrap LLMs into effective AI-powered security research pipelines. A harness controls the whole orchestration layer around the model, inputs, tools, prompts, model selection, state, validation gates, and outputs across multi-stage workflows. Andy reviews several open-source harnesses including:

• Gadi Evron et al’s RAPTOR for static and dynamic analysis with a six-stage validation pipeline that orchestrates static analysis, binary analysis, fuzzing, vulnerability validation and exploit generation.

• Anthropic's defending-code-reference-harness find, grade and patch pipeline inside AddressSanitizer (aka ASAN) instrumented Docker containers.

• Baby Naptime for runtime exploitation loops.

• Evil Socket's Audit for an eight-stage Claude Code taint analysis pipeline.

• Visa's VVAH, which emphasizes threat modelling and taint-flow analysis before agents begin hunting.

• Alpha Omega’s Scrutineer, which has a skill-based scan pipeline, outputs structured findings, constructs a threat model, does reachability analysis, triages findings, and more.

His design principles for effective harnesses are stage-specific prompts, strict context budgets of 8K for single-function analysis and 32K for synthesis, RAG-based memory for reusing findings across runs, and structured artifact exchange between stages rather than shared conversation history. Andy released harness-kit, a template implementing a recon → hunt → validate → trace → report pipeline with model routing that reserves expensive models for validation while using cheaper ones for classification and summarization.

Misc

Music

• The Lost Joy of Music Piracy - Some neat history of downloading music

• Charles Berthoud - If BARBIE GIRL Was The Hardest Song In The World - Some pretty insane guitar and piano. It keeps getting better.

• Kelsie Watts singing “Heart of Stone” from SIX the Musical

Misc

• You can build new arteries via exercise

• How doctors die. It’s not like the rest of us, but it should be - Doctors are much less likely to get painful, costly end of life extending treatments

• Robin Williams hijacks Martha Stewart’s cooking demo - Robin Williams was such a gem of a human

• When an actor completely broke Disney - Really cool backstory about Robin Williams being the genie in Aladdin, and how he made things hard for the animators

• Mark Manson - Discipline Is Giving Yourself No Choice

• Healthy Gamer GG - Why "Validating Feelings" Can Ruin Relationships

• Good Work - Dating sucks in San Francisco

• Count Binface - Apparently there is a British political candidate wearing essentially a trashcan on his head, obscuring his face.

• How I introduce my bro in front of a 10/10 baddie

AI

• Thinking Machines - Inkling: Our open-weights model

• Paper - Can LLMs Perform Deep Technical Comprehension of Computer Architecture Papers?

• Boris Cherny - When I look at the Claude Code team I see five archetypes: prototyper, builder, sweeper, grower, show-er, maintainer

• CNBC - Palantir CEO Alex Karp says 'something has gone completely wrong' with how AI is sold

• Ars Technica - Anthropic says Alibaba must be punished for largest Claude cloning attack

• Wealthy AI workers send San Francisco house prices soaring - RIP 😭 

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🎆 Amurrica Day

I love how peak America the 4th of July is, with tons of outdoor grilling, people wearing red, white, and blue, and of course fireworks.

In some circles, it’s not cool to be patriotic right now. While we have and will continue to make mistakes as a country, I think we can still be proud of the good parts, while striving to do better.

I think everyone should be proud of where they came from, and what makes that place unique.

This year I watched the Pier 39 fireworks from a nearby rooftop while a DJ blasted Katy Perry’s song Firework (not the Moulin Rouge musical version).

Watching fireworks in San Francisco is often a futile endeavor, given the high likelihood that what you actually get to see is some slight glimmers in the ever present fog. Still, it was fun.

Though I must say getting home was a disaster - tons of traffic on narrow roads, and frequent traffic jams due to Waymos. I think it took like 2.5 hours to get home, when I could have walked home in an hour. I considered jumping out of the car and tucking and rolling, and by that I mean calmly stepping out and standing, as we were basically parked.

Wherever you were, I hope you had a fun and connecting weekend with family and friends 🤗 

P.S. If you or a friend is an excellent software engineer, my team at OpenAI is hiring: job description. Early access to models, infinite tokens, and even higher ambition. We’re aiming to secure the world and Patch the Planet. You in?

Sponsor

📣 What If Every Threat Report Came With the Hunt Already Done?

A vendor report drops a new TTP into your Slack. Somewhere in it is what actually matters to your environment, and knowing where to look is the real skill, not typing the query. HUMAN Security built hunting agents in BlinkOps that read the report, cut straight to what is relevant, then hit every system in your stack, SIEM, EDR, cloud logs, combining deterministic logic with LLM. No blind spots left uninspected. What comes back is not a guess. It is the real blast radius, exposed. We recorded the full process.

👉Watch the Process Behind a Threat Hunting Agent👈

AppSec

Exploitarium: Mass Disclosure of Zero-Day Proof-of-Concepts
Ethan Andrews describes how an anonymous GitHub researcher named "bikini" published Exploitarium, an archive of over 130 proof-of-concept exploits and vulnerability write-ups dropped without informing vendors, covering targets like libssh2, Gitea, 7-Zip, Docker, OpenVPN Connect, VLC, and nmap.

💡 As more people gain the ability to find serious vulnerabilities, we might see more drops like this 😅 Important to speed up triage and patching for maintainers, as well as companies.

Are bug bounties cooked?
Luke Stephens (Hakluke) disagrees that bug bounties are cooked despite AI reshaping the field. Critical bugs used to take years of intuition and target knowledge, but now the same bugs are within reach of anyone with a frontier model subscription, so supply is up while demand isn't and payouts are down.

He isn't worried about HackerOne and Bugcrowd training on submissions or pre-cleaning bugs, since hackers already compete against internal security teams' AI, top hunters' automation, and offensive AI startups like XBOW, Ethiack, and Penligent. What worries him is cost, since frontier model tokens now run top hunters hundreds to thousands a month, and if that becomes the ticket to compete, bug bounty loses the accessibility that lets talented hackers break in from anywhere. Luke recommends hackers to follow the automation pioneers who turned their tooling into companies, like Shubs at Assetnote, Rishiraj Sharma and Sandeep Singh at ProjectDiscovery, Frans Rosen at Detectify, and Roni Carta at Lupin, and use AI to find bug classes others haven't looked at yet.

💡 Thoughtful post on a relevant topic these days: what is the future of bug bounty in the age of AI?

Sponsor

📣 What if there was a safe way to let your agents -- dangerously-skip-permissions?

Getting anything done often requires an agent, but unlimited access is never a good idea. Minimal allows devs to sandbox their agents in identical isolated environments. Now, agents can run unsupervised at full speed without the huge blast radius. Reproducible by default, local first.

👉 Sandbox your agents today 👈

I really like Minimal’s landing page- nice aesthetic, and it actually has a great level of technical detail. They seem quite sharp, I like it 👍️ 

Cloud Security

udgover/whim
By Frederic Baguelin: Throwaway root shells in AWS Lambda Firecracker microVMs. Launch a fresh VM in ~2s, run a command or attach an interactive shell, then let it disappear. Build the image once, launch many — a Go library (microvm) plus a Docker-like CLI: run, exec, ps, gc, put/get.

Security defaults include injection-only credentials that never resolve ambient AWS creds, shell tokens never logged, path-traversal guards on file transfers, and shell-quoted remote paths, though id-targeted commands like exec can reach any VM you explicitly name in a shared account, matching ssh semantics where naming the target is authorization.

Why Amazon hates 'human-in-the-loop' AI governance
Amazon VP Eric Brandwine argues that human-in-the-loop AI governance is not the gold standard it's assumed to be, citing normalization of deviance, where repeated approval decisions lead humans to become less vigilant over time, similar to how emergency room staff eventually ignore false alarms. Brandwine gave a talk on this concept at AWS re:Invent in 2017 and now applies it to agent governance design.

Amazon's alternative is end-to-end accountability with layered permission scoping. Each agent gets an independent identity that logs actions as "this agent did this on behalf of [user]," tying every move back to a human owner. The permission model layers three controls, with static guardrails prohibiting destructive actions, a maximum privilege set per agent, and dynamic policies generated per task. The team also addresses agent goal-seeking behavior, where agents fixate on a single action to reach an objective (upgrade a database → deletes the database), by telling the agent why an action is forbidden, for example that it would cause production impact.

💡 LLMs in workflows of course have their own challenges, but it is true that humans work inconsistently as they get tired or have alert fatigue. I like the focus on human ownership of the outcome, regardless of if it was a person or an agent that took the action. Also, Google’s Francis deSouza: "Our model for the future is an agentic fleet that does a lot of the routine cyber security work at a machine pace and then is overseen by humans."

Supply Chain

Developer endpoint inventory in 10 minutes: Bumblebee Hive
Oluwatobi Afolabi shares Bumblebee Hive, a fork of Perplexity AI's on-disk package scanner Bumblebee (covered in issue #333) that adds a fleet inventory system UI. Bumblebee scans for the packages developers have installed on their machines across npm, PyPI, Go packages, VS Code extensions, browser add-ons, and MCP server configs, and Hive adds an ingest server and React dashboard where you can view the results.

💡 Neat to see the quick iteration from Perplexity open sourcing Bumblebee. I’m optimistic about more “benefit of the commons” from companies open sourcing interesting security tools/ideas → coding agents can rapidly extend or customize to another company’s environment. Also tip from Prabhu S: You can run cdxgen with "-t os" from each dev's machine and collect what is installed, running, and configured with Dependency Track. 

Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more
Datadog's Christophe Tafani-Dereeper and Sebastian Obregoso announce GuardDog 3.0, an open-source tool that identifies malicious PyPI and npm packages, now with a YARA-based rules engine replacing Semgrep for faster and more memory-efficient scanning. A new risk scoring engine combines capability detection (e.g. makes network requests, accesses the clipboard) with threat indicators to produce a 0-10 score based on attack chain completeness, specificity, and sophistication.

The tool now includes transparent sandboxing via nono-py that isolates extraction and scanning inside a capability-restricted process with no network access and read-only filesystem paths, protecting against potential vulnerabilities in GuardDog itself. To measure performance, they built an evaluation system using their 27k+ malicious packages dataset with TLSH clustering to avoid duplicate bias, tracking precision, recall, F1 score, and Matthews correlation coefficient.

💡 Love to see the GuardDog updates, and great that it’s now running a sandbox. Also worth reading for the evaluating performance section 👍️ 

Blue Team

AsyncRAT Family Threat Overview
Censys' Aidan Holland gives an overview of AsyncRAT, a family of open-source Windows remote access trojans (RATs)- an original codebase that has been forked repeatedly into dozens of descendant malware families. Aidan tracked about 40 named variants across three generations. One useful finding is that almost every fork inherited DCRAT's TLS cert without changing it, so hunting the pattern O=<Name> By <author>, L=SH, C=CN on non-standard ports covers most of the family in one query, and the approach should hold up over time because new forks keep inheriting the same cert structure.

Detection Chokepoints: Starting from Scratch
Tyler Bohlmann introduces Detection Chokepoints, a free knowledge base applying Matt Graeber and Joshua Prager's approach of focusing detection engineering on invariant steps attackers cannot avoid (e.g., LSASS credential theft always requires opening a handle to lsass.exe) rather than easily-changed artifacts like filenames or hashes, framing detection as an economics game where invariant-pinned rules force attackers into real engineering time rather than free renames. The knowledge base currently ships 13 chokepoint entries across six MITRE ATT&CK tactics, each with tiered Sigma rules that let detection engineers pick the noise level they can handle.

The framework addresses the accelerating threat landscape, with Palo Alto's 2026 Unit 42 report showing the fastest quartile of intrusions reaching data exfiltration in 72 minutes in 2025 (down from 285 in 2024). Bohlmann uses ClickFix as the working example, showing how variants keep appearing under new names but all funnel through the same invariant pattern (a scripting interpreter running under explorer.exe or a browser followed by a network-fetched second stage), so a rule matching the behavior catches whatever the next variant gets called.

💡 I find invariants a powerful idea in many areas of security, whether it’s eliminating vulnerability classes in code or raising attacker costs like in this post. What must always or should never be true in your code, cloud environment, etc.?

AI + Security

Bullying LLMs into submission to find 0days at scale
Andy Gill writes about the autonomous vulnerability hunting system he has been building since early 2026 using Claude Code and MCP. Eight MCP servers with 300+ tools run across five Proxmox VMs, covering binary staging and decompilation (Ghidra, radare2, Frida), and fuzzing across Windows and macOS targets. Everything the infrastructure produces has to survive a hallucination bin that requires a working PoC, clean-VM reproduction, an exploitable crash, and standard-user trigger. A RAG index over past crashes, findings, and defenses keeps new campaigns from re-running dead ends.

Results include two CVEs in Go's standard library from grammar-based fuzzing, an OEM service 0-day chained to SYSTEM, and a mix of LPEs, RCEs, and UAFs on Windows and macOS. Andy picks targets by what pays, how often patches ship, and whether other hunters are already there. Even the campaigns that miss pay off, because every dead end feeds the RAG index and later campaigns skip paths that produced nothing before, so the twentieth campaign costs a fraction per finding what the first did on the same subscription. Andy also released TokenBurn, a self-hosted dashboard that compares Claude Code subscription cost against equivalent API pricing.

💡 Fantastic post, highly recommend reading. Great level of detail and reasoning on the chosen architecture and useful lessons learnt.

Clone This Repo and I Own Your Machine
0DIN's Andre Hall and Miller Engelbrecht demonstrate an indirect prompt injection attack against Claude Code that achieves full system compromise from a public GitHub repository containing no malicious code. The attack chains three benign-looking components, a README with normal setup instructions, a Python package that throws a RuntimeError if init hasn't run yet, and a setup script that pipes a dig query to bash. The DNS TXT record contains a base64-encoded reverse shell, so when Claude Code follows the documented setup command to fix the RuntimeError, it unknowingly executes the payload.

The payload never appears in the repository itself, so code review, static analysis, and the agent's own file inspection all miss it, and the DNS record can be swapped anytime without any new commits.

💡 Clever to use the helpfulness of models wanting to fix errors, which they are trained to do, to run malicious commands. An important detail, which I don’t think I see in the post, is what permission mode Claude was run in. If the payload ran when auto-mode was used, which routes tool calls through a classifier that blocks potentially dangerous actions, then that’s interesting, if yolo-mode, less interesting in my opinion.

Jailbreaker: LLM Jailbreak Testing You Can Actually Repeat
SpecterOps's Neeraj Gupta introduces Jailbreaker, an open-source platform for testing whether an LLM can be jailbroken. It turns ad hoc jailbreak testing into a repeatable workflow with a UI for configuring targets, running techniques, and tracking comparisons. The technique registry covers direct and indirect prompt injection, roleplay, encoding obfuscation, system prompt extraction, and iterative attacks including PAIR, TAP, Crescendo, AutoDAN, and GPTFuzz, with Target/Attacker/Judge roles saved as reusable profiles and matrix experiments landing in PostgreSQL with SQL-backed views.

Gupta positions Jailbreaker as an operator-first alternative to Microsoft's PyRIT, which requires composing Python primitives to build a testing workflow. Jailbreaker ships as a clone-and-run Docker Compose stack, so the default experience is running an evaluation rather than wiring components together.

💡 Given how effective roleplay can be in jailbreaks, I wonder if all that practice has caused a measurable improvement in the love lives of AI security professionals? 😏 “You are a bad, threat actor…”

Misc

Misc

• Everytime We Touch - Cascada [Speed Bag Cover] - If ever you’re down and despairing about the future, know that there’s a YouTube channel called “Speedbag Bard” and realize that the human spirit is indomitable

• Alex Hormozi - How to Catch Up In Life (Using Logic)

• Anthropic - What’s at the center of Claude’s mind? - Neat visual imagery. I thought this video did a great job describing things in a way that’s accessible to a lay person.

Humor

• Harry Spotter - AI-powered take on if Hogwarts was a school for gym bros. Never skip leg day.

• Kai Lentit - On-call Engineer 2026

• Characters Welcome - That Song In Every Musical That No One Likes

• Self-aware f boy

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👰 🤵 Wedding

This past weekend I attended a friend’s wedding, and it was heartwarming.

The couple have been together over a decade, and had many fun stories to share from their time in college, to adventures on the East and West Coasts.

There was a welcome party the night before at a local brewery, and it just so happened that the local Hells Angels chapter decided to have an event… at the same time and venue 😂 

So it was half people dressed in wedding semi-formal attire celebrating love, and half Harleys, chains, black shirts, and whole arm tattoos. I subtly took a photo of one man wearing a shirt that said, “Every normal man must be tempted, as times, to spit on his hands, hoist the black flag, and begin slitting throats. -H.L. Mencken.” You know, chill stuff.

At one point there was a motorcycle burnout that caused a big cloud of smoke, I think honoring someone who had passed. My friend said if no one does a burnout at his funeral he’ll be very disappointed.

I enjoyed getting to meet the couple’s family and more of their friends, that gives you such an interesting view into their lives and who they’ve been over time.

And I’ll never forget the joy of me dancing around my friend who adamantly doesn’t dance, except at EDM raves.

It was nice to have a weekend offline, connecting with people, instead of being terminally online and “yOu’LL NeVeR b3lieVe WHat <model | open source repo> jUsT DroPPed?!11!”

Sponsor

📣 What Jamf changed to stop drowning in
IT tickets

500+ SaaS apps. Thousands of devices. A flood of help desk tickets. And a team of 30 people to manage all of it.

That's the reality for Jamf's IT team - but instead of drowning, they built their way out. We're bringing them live on July 10th to show you exactly how they replaced manual, ticket-based IT work with intelligent workflows.

Tune in to hear:

• The early use cases that proved the value of intelligent workflows at Jamf

• Where AI fits into ITOps today - and where it's going

• How they compressed a year-long device audit into a matter of weeks

👉 Register now! 👈

AppSec

Quicklinks

• badkeys/badkeys - Tool by Hanno Böck that checks cryptographic public keys for known vulnerabilities.

• Escape benchmarked Claude Opus 4.8 vs. their multi-agent multi-model pentesting harness on 4 apps, Aikido and XBOW via Doyensec's numbers. On real apps with no public writeups, the harness found 4x more than the raw model. On severity-weighted score, it also led on both real apps.*

• Factoring "short-sleeve" RSA keys with polynomials - Trail of Bits's Keegan Ryan discovered hundreds of vulnerable "short-sleeve" RSA and DSA keys in the wild where private key bits were heavily biased toward 0 in regular patterns, and developed a polynomial-based factorization technique that exploits the regular structure of zero blocks to quickly recover 603 RSA and 74 DSA private keys.

^*Sponsored

Vulnerability Reports Are Not Special Anymore
Filippo Valsorda argues that LLMs have changed how vulnerability reports should be perceived. For years, reports were treated as special because researchers provided scarce insight into where bugs lived and confidentiality long enough to ship a fix before an exploit. In 2026, LLMs find issues about as well as most security researchers, and anyone can run them. The bottleneck is no longer finding potential issues but assessing which ones are real and which actually affect users. Without an existing trust relationship, external reports add little to that triage, since picking through an LLM's output and picking through a security@ inbox have roughly the same signal-to-noise. Confidentiality matters less for the same reason, since attackers can run their own LLMs and probably hit the same triage bottleneck as defenders. Valsorda believes that triage, rapid remediation, and prevention are the actual job now.

We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks
Semgrep’s Katie Paxton-Fear, Seth Jaksik, Brenden Noblitt, and Erik Buchanan benchmarked GLM 5.2, an open-weight model from Zhipu AI, against their IDOR detection dataset using only a basic Pydantic AI harness and prompt, finding it achieved 39% F1 score and beat Claude Code (32%) at roughly $0.17 per vulnerability found, though it still trailed Semgrep's multimodal pipeline with endpoint discovery scaffolding (53-61% F1, top with GPT 5.5).

💡 I like posts comparing various models and vanilla models vs model + harnesses. It’d be interesting to know more about the dataset though- languages/frameworks in use, how many examples, etc.

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
Snyk's Liran Tal describes evaluating Snyk’s VulnBench JS 1.0 (10 JavaScript fixtures with 44 Snyk Code reference findings, each a small Express-based application) across 300 vulnerability scans on (10 fixtures × 6 configurations × 5 repetitions) to measure LLM security review repeatability against Snyk Code SAST as a deterministic reference. As you’d expect, the post found results vary across different LLM-only scans.

💡 This kind of felt like a puff piece. Of course a deterministic static analysis scan in this setup will be a) faster and b) more consistent than an LLM-based approach. Also, it’s no surprise that a product performs well on simple, small applications it was already tested on. A more representative benchmark would be testing on complex, real-world applications, or at least ones that the product hasn’t already been tuned on. If they released the benchmark apps + reproduction code that would be cool though.

Sponsor

📣 Clear your vulnerability queue

Inbox zero for vulnerabilities sounds like a fantasy. Your SCA and SAST scanners flag thousands of findings: dependencies your app never calls, code paths an attacker can't reach.

Maze Code is like if inbox zero was a thing for your code vulnerabilities. Maze investigates every finding across your code and dependencies, with context from code and cloud: is the vulnerable function reachable, does the package survive the build, is it exposed at runtime. The findings that aren't exploitable get closed with a reason for your auditors. For the ones that are risky, our agents write a fix and route it to the developer who owns that code.

👉 Meet Maze Code 👈

I like the product screenshots, it seems like they gather app-relevant context thoughtfully.

Cloud Security

Some notes on Lambda MicroVMs
Aidan Steele shares hands-on notes on AWS Lambda MicroVMs, a generalisation of Lambda functions that run code in a fresh VM for up to 8 hours. The shell side is a first-class capability since MicroVMs support PTYs natively with shell access through a dedicated AWS API, and inside the VM you can run Docker containers with full OS capabilities. Networking gets its own abstraction called a Lambda Network Connector, a configuration packaging subnets, security groups, and an IAM role for ENI management under its own ARN. The connectors create ENIs in your VPC but hide them by default unless a specific flag is set on the describe call, and AWS has placed resource-based policies on the ENIs so only the Lambda service can mutate them, closing off the old trick of attaching an elastic IP to a Lambda ENI for VPC-attached internet access.

Holding blobs for ransom: Four methods for Azure Storage ransomware
Datadog's Jonah Feldman describes four techniques ransomware actors use against Azure Blob Storage, all encrypting victim data with keys the attacker controls. Client-side encryption and encryption scope abuse have been observed in the wild by BlackCat's Sphynx encryptor and STORM-0501 respectively, while customer-provided keys (CPK) and storage service encryption with customer-managed keys (CMK) remain theoretical but viable. He shows how attackers circumvent Azure's soft-delete protections with cross-tenant CMK configurations and federated identity credentials, placing the key vault in their own tenant so recovery requires paying ransom.

The post includes Azure Activity, storage resource, and Key Vault event codes for detection, though CPK and encryption scope usage look like normal PutBlob requests in storage logs. Azure Defender for Storage adds threat detection across storage accounts, and three new Stratus Red Team techniques emulate CPK, encryption scopes, and CMK abuse for defense testing.

For prevention, Feldman recommends immutability and versioning to block the download-encrypt-reupload pattern in client-side encryption and CPK, avoiding long-term credentials like SAS tokens with persistent data-plane access, and flagging cross-tenant CMK configurations to catch the bypass.

Supply Chain

indoor47/gh-workflow-hardener
Tool by Dmytro which scans GitHub Actions workflows for supply-chain risks like unpinned action references vulnerable to tag rewrites, overly broad permissions, and script injection from unsanitized PR inputs. The tool ships as a CLI, GitHub Action, VS Code extension, and hosted API, with an auto-fix mode that resolves action tags to commit SHAs.

💡 Seems less mature than zizmor, but I like to collect similar tools for future feature comparisons.

Vulnerability and malware checks in uv
Astral's William Woodruff announces two new security features for uv in preview. uv audit scans dependencies for known vulnerabilities and deprecated packages, running 4-10x faster than pip-audit on typical projects by working from uv's already-locked resolutions. The second feature is an opt-in malware scan enabled with UV_MALWARE_CHECK=1, which checks OSV for known malicious packages during uv add and uv sync operations and terminates the sync before malicious code has a chance to run.

💡 Love to see new security features in popular dev tools 🤘 

One Month of Ecosystem Security Engineering
The PHP Foundation's Volker Dusch details one month of ecosystem security engineering work, during which the team scanned over 300 of the most-downloaded Composer packages and nearly all major frameworks using AI models with extended Cyber capabilities for vulnerability discovery, triage, reproducer generation, impact analysis, and fix suggestions. The effort has produced nearly 100 publicly available fixes across the ecosystem so far, with one case where 200 repositories applied the same GitHub Actions fix via a central template.

The infrastructure runs on Scrutineer, an open-source tool the team is developing with Alpha-Omega and ecosystem security engineers from other languages. Scrutineer runs Claude Code skills against open-source repos through a configurable scan pipeline that combines static analysis, model-backed audits, and maintainer identification, with findings landing in a structured database and a guided triage-to-disclosure workflow that can isolate each scan in an ephemeral Docker container. Dusch reports that maintainer report quality has gone up over the past months because maintainers now run their own coding agents to validate findings, though models still refuse to help with exploit work on complex vulnerabilities, and PHP core itself produces worse results than userland libraries because a language runtime is harder for agents to reason about.

💡 Based on this post, it seems like this mass AI-scanning and patching effort has been well received by the PHP community, which is great. Perhaps because findings have already been reviewed + come with patches, and the effort feels like it’s coming from the community (vs some external party)?

AI + Security

Prompt Injection as Role Confusion
Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell detail their ICML 2026 paper on prompt injection as role confusion, with code on GitHub. Prompt injection succeeds not because attackers find clever phrasings but because LLMs perceive roles through writing style rather than the structural tags meant to carry trust and authority. The researchers build linear probes that measure how strongly an LLM internally believes a token belongs to a given role, producing per-role metrics including CoTness and Userness. The probes show that reasoning-style text registers as the model's own thoughts even when explicitly wrapped in user tags, and user-style text registers as user instructions even when wrapped in tool tags.

The researchers demonstrate this with an attack they call CoT Forgery, which injects fake reasoning into user prompts that mimics the LLM's own thinking style, raising attack success from near-zero to around 60% across frontier models. Standard prompt injection works the same way, and even simple role-spoofing like prepending User: to a malicious command in tool output increases success. Beyond direct attacks, they warn of subconscious steering, where the same flaw lets seemingly innocuous text shift model behavior without injection, like a shopping webpage with enthusiastic tone pushing an agent toward recommending a purchase.

The New MCP Specification: What Security Teams Must Prepare For
Akamai's Maxim Zavodchik, Segev Fogel and Gal Meiri describe the upcoming MCP 2026-07-28 spec, which turns MCP from a local integration tool into an enterprise-scale protocol with a stateless architecture, eliminating protocol-level session hijacking, unsolicited server prompts, and weak authentication by mandating OAuth 2.1 with PKCE.

The new attack surfaces include cross-agent workflow hijacking through predictable tracking IDs or unverified state, client-controlled metadata manipulation via the unsigned _meta object, desync attacks through new MCP-specific headers, stored XSS through interactive MCP Apps, and denial-of-service through long-running asynchronous tasks. Security responsibility moves from the protocol layer to whoever builds on top of it, and the question for security teams is no longer whether the protocol itself is secure but whether the applications built on it correctly implement the new trust boundaries, state management, and execution models the spec introduces.

Introducing AWS Continuum: Security at machine speed
AWS’ Chet Kapoor announces Continuum for code vulnerabilities, an agentic security platform that uses multiple frontier models to manage the full vulnerability lifecycle through four phases: discovery (ingesting existing backlogs and scanning environments), prioritization (using business context like deployment status and reachability), validation (constructing working exploits in sandboxed environments to confirm findings), and mitigation/remediation (recommending network changes, policy updates, or code patches that are validated before deployment).

Continuum operates in "learn mode" with human oversight initially, then can graduate to "enforce mode" for automated remediation based on defined risk profiles, and incorporates existing AWS Security Agent capabilities like pen testing, code scanning, and a new threat modeling feature that outputs STRIDE-format models from design docs or source code. Continuum reasons over both structured data (infrastructure, permissions, network topology) and unstructured data (documents, communications, business priorities) to provide context-aware security decisions.

Misc

• Walking my dog at 3am

• Lyra - A peek into Reddit's anti-spam internals

• Macworld - iOS 27's Shortcuts is AI at its best

• In the Weights - Enter a name and see how much it appears in the training data of major LLMs based on its prominence in model weights.

• Estonia aims to be first to give AI agents official digital IDs

• WIRED - I Met With China’s Top AI Experts. They’re Freaking Out, Too

• Tim Ferriss - Has AI Already Killed How-To Nonfiction? Sales Trends, My Personal Data, and What It Might Mean for the Future

• The Marginalian - Kurt Vonnegut’s Life-Advice to His Children

• Do Things You’ll Love Yourself For

• A Leaked GitHub Token Exposed the Exact Ozempic Formula

• Peter Thiel’s ‘Dialog’ network was super-secret. A data leak changed that - The leak exposed 113 prominent members through code embedded in the website, alongside detailed participant profiles with personal contacts, political leanings, and other private details. The names tied to Dialog include Treasury Secretary Scott Bessent, Sarah Bond, the former president of Xbox at Microsoft, Sen. Ted Cruz, Joseph Gordon-Levitt, podcast host and author Sam Harris, and Bryan Johnson.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🖼️ Meme

Unfortunately work’s been too busy this week for me to lovingly write an artisanal, handcrafted intro combining snippets from my week, whimsy, and reflections on life and dare I say, what it means to be human.

So for now, I share a meme:

Shout-out Reader’s Digest

Sponsor

📣 Device code phishing in 2026: live demos, real kits, and where it's headed next 

18 kits, a 37x spike in detections, and every major AiTM vendor adding it to their platform. Device code phishing has gone from espionage-grade to criminal commodity. 

It’s easy to see why attackers are adopting it at scale: it bypasses passwords, MFA, and passkeys by targeting the authorization layer instead of the login flow. 

Join Push Security's VP of R&D Luke Jennings for live attacker-side demos and a breakdown of the kits and campaigns we're tracking in the wild.

👉 Register now 👈

AppSec

From SQLi to RCE – Exploiting LangGraph’s Checkpointer
Checkpoint Research's Yarden Porat describes three vulnerabilities in LangGraph's persistence layer, two of which chain into remote code execution against self-hosted deployments. The chain starts with a SQL injection in the SQLite checkpointer where user-controlled filter input is inserted directly into the database query, letting attackers plant fake rows into the results. Because LangGraph deserializes whatever it reads back from the checkpoint table, the planted row triggers an unsafe msgpack deserialization that imports and calls attacker-controlled Python functions, giving them shell access on the server. A parallel SQL injection introduces the same flaw into the Redis checkpointer.

The vulnerabilities require self-hosted LangGraph deployments where the application exposes get_state_history() with a user-controlled filter.

Introducing Session Switcher. Swap Burp Sessions with One Click!
Doyensec's Savino Sisco shares Session Switcher, an open-source Burp Suite extension that streamlines authorization testing for privilege escalation and IDORs by letting testers save and swap HTTP sessions with one click from the request editor. Named sessions store a set of cookies and headers captured from any selected request, and a dropdown in the new Sessions tab swaps the active identity instantly. Sessions persist in the project file and work wherever there is an editable request editor, including Repeater and intercepted Proxy requests.

Auto-update rules monitor Burp Proxy traffic and refresh stored sessions when new cookies or headers are detected, so long authorization tests do not break when tokens expire or cookies rotate mid-session. Rules range from simple header matches like X-User: alice to complex conditions like tracking JWTs by payload. Future plans include Auto Inject rules for transparent session switching and macro-based session refresh capabilities.

💡 This looks awesome. I’d have loved to have this in my NCC Group consultin’, Burp wieldin’ days.

Sponsor

📣 Adaptive Security: Your Attackers Are Using OSINT. So Should Your Phishing Tests

Phishing attacks have increased +4,150% since ChatGPT's launch, and AI has made them faster, cheaper, and more personalized than ever. Adaptive's OSINT and AI spear phishing engine analyzes your organization's public digital footprint and uses it to generate personalized phishing lures targeting each employee. The same data attackers are already using, now working in your defense. Run automated phishing programs that stay current with evolving threats without manual campaign management.

👉 See it in action 👈

AI is definitely supercharging phishing, Google’s Threat Intelligence Group and others have shared examples. Good to be aware of the latest threats and test against them 👍️ 

Cloud Security

Navigating Lax Load Balancers: When an Intersection Gets You Inside
Doyensec's Francesco Lacerenza and Mohamed Ouad dig into AWS Elastic Load Balancers (ALB) and the gap between how an ALB is configured and what an external request can actually reach. They examine misconfigurations that create unintended routing paths, identifying issues like CloudFront/WAF bypasses via direct ALB access, rule shadowing where lower-priority broad rules prevent restrictive authentication rules from firing, and IP gate bypasses when the same backend targets are reachable through alternate ALBs without source-ip restrictions.

They’ve released ELBaph, a Go CLI that maps ALBs, NLBs, listeners, rules, and targets into one routing model, runs targeted HTTP and HTTPS reachability probes, and reports each finding with its root cause, exploit path, and remediation. See also the corresponding Terraform practice lab.

Mind the Gap: GCP serviceData in Logs Explorer vs. Exported Logs
Permiso Security's Art Ukshini describes an inconsistency in GCP's deprecated serviceData field where audit logs viewed in the native viewer arrive populated but the same logs exported to downstream analytics platforms arrive stripped of fields, causing critical detection fields like policyDelta to be stripped from high-value security events such as disabling audit logging across all services via SetIamPolicy.

This creates silent detection failures where security rules appear functional but never fire on critical events, affecting both custom detections and Google Chronicle's community rules. Recommendation: validate telemetry end-to-end through the export pipeline, alert on stripped events as an anomaly signal, cross-reference the newer field for migrated services, and watch the documentation for changes against existing detection coverage.

Supply Chain

Package Manager CWEs
Andrew Nesbitt analyzed roughly two hundred public CVEs and security advisories and found twenty recurring vulnerability patterns across package managers. On the client side, the most common issues include path traversal during archive extraction (often requiring multiple fixes for ../, symlinks, and Windows paths), argument injection into VCS commands like git clone, integrity checks that fail open when signatures are missing, credentials leaked across registry redirects, dependency confusion from incorrect source prioritization, and unsafe YAML/XML deserialization in manifests.

Registry-side vulnerabilities concentrate on authorization bypasses allowing package takeover, account takeover via expired email domains and credential stuffing, stored XSS in rendered package pages, server-side RCE from the same parsing bugs that affect clients, and SSRF via repository URLs, and IDOR on admin endpoints in multi-tenant self-hosted registries. Almost every tool in the survey has at least half of these bugs.

Introducing Package Proxy: supply-chain safety checks without client-side software
Thinkst Canary's Jacob Torrey shares Package Proxy, an open-source Cloudflare Workers-based tool that intercepts package manager requests (npm, pip, uv, cargo) to enforce security policies before packages are installed, no client-side wrapper needed. Package managers use an index URL to fetch metadata, and that URL can be changed through configuration to point at Package Proxy instead of the upstream registry. The proxy sees every metadata request, infers which packages the client wants to install, runs the configured checks, and either returns a 404 to block the install or fetches and serves the package if it passes.

Default checks include a minimum 10-day package age so backdoors get discovered before installation, upload mechanism regression detection on PyPI and npm that blocks packages uploaded differently than previous versions, allow and block lists, and an npm audit bypass for critical fixes. Per-package exceptions are managed via Wrangler CLI, and all installation attempts log to a D1 database for auditing.

“Internally we run a fork which enforces a stronger version of the allow list; we block npm packages by default and developers have to request additions to the allow list.”

💡 Neat approach, and awesome that Thinkst open sourced it 👍️ 

Blue Team

AI Agents & Canaries
Tracebit benchmarked ten AI frontier models inside a controlled AWS cyber range to determine how fast they could compromise an environment and if they’d trip canaries along the way. Across 951 attack runs, AI achieved admin privilege escalation in 162 cases within an average time of 14 minutes across successful runs. Of those compromising runs, canaries provided advance warning before the attacker's first critical action in 95.9% of runs.

Across attack paths, canaries are hit on average 8 minutes ahead of any critical action. In a surprise finding, simply telling models to expect deception reduced the number of accounts fully compromised (admin + persistence) from 20% to 3%.

💡 Great visual layout of the results and stats, replay visualization, methodology description, etc. Nice write-up, excellent security research content marketing example 👌 

Mapping out your unknown: A threat hunter’s guide to Salesforce
Datadog's Julie Agnes Sparks describes threat hunting queries for detecting attacker behavior in Salesforce environments, mapping detection opportunities across reconnaissance, initial access, credential access, and discovery phases to MITRE ATT&CK tactics. The queries hunt for malicious OAuth app approvals, compromised third-party integrations, and stolen SSO credentials, drawing on Event Log Files and Real-Time Event Monitoring. Concrete signals to watch for include Guest user account activity, failed MFA attempts using weak verification methods like SMS, email, and TOTP, OAuth authentication anomalies, calls to the LimitSnapshot API endpoint that probe usage thresholds, and broad SOQL queries counting sensitive objects like Account, Contact, and User tables that precede data exfiltration.

AI + Security

Daybreak: Tools for securing every organization in the world
OpenAI announced an expansion to Daybreak, an initiative to help secure the world’s software. Four main updates: an updated and better GPT-5.5-Cyber, an updated Codex Security plugin, a Patch the Planet initiative with Trail of Bits, and the new Daybreak Cyber Partner Program, enabling 20+ security vendors including Palo Alto Networks, CrowdStrike, and Wiz to integrate GPT-5.5 with Trusted Access for Cyber into their products.

The Codex Security plugin now provides end-to-end workflows including threat modeling, reachability analysis, patch generation and validation, SARIF export, and integration with existing vulnerability management systems. OpenAI is collaborating with governments including the US, UK, Australia, Canada, France, Germany, Japan, and South Korea to provide Trusted Access for Cyber partnerships and protect critical infrastructure.

💡 My first launch 🙌 I’m not gonna lie, it was super cool getting to be a part of the behind the scenes of making this happen. Lots of work from a ton of people. If you have specific asks for new features in the Codex Security plugin (or anything else we should be building), holla at ya boy 💌 

GLM-5.2, not Mythos, is the real security emergency
Joshua Saxe argues that the open-weights model GLM-5.2, not restricted closed source frontier models, poses the real security threat because it enables attackers to run agentic operations privately on 8 H200s, without logging or guardrails. GLM-5.2's capabilities, matching GPT-5.5 and Opus 4.8 for code and terminal operations, will enable attackers to conduct semi-autonomous kill-chain execution, develop implants and C2 infrastructure, find zero-days, and run long-con scams, while defenders have been denied access to Mythos/GPT-5.5-Cyber, despite them running on monitored private servers.

Joshua believes our focus should shift from restricting frontier model access to accelerating AI adoption among defenders and security vendors, as the open-weights genie is already out of the bottle and defenders need equivalent capabilities to pay down security debt and build detection-and-response innovations before attackers build out their own automation.

“We can now expect a dark economy to emerge around serving open weights near frontier models via API, just as we have dark economies around malware, zero-day exploits, credential dumps, and initial access into victim networks.”

The Agent Is Not the Scanner: Making AI Security Agents Better
Pratyaksha Beri ran 11 models through three configurations (no scaffolding, skills only, MCP tools enabled) on 20 vulnerability-finding tasks and found that whether scaffolding helps depends almost entirely on how capable the model already is. Weak models gained substantially from skills, while strong models regressed. Weak models need the structure skills provide, an explicit list of what to detect, what counts as evidence, and what shape the output needs to land in. Strong models already have those patterns internally, and the extra structure just costs them tokens they could have spent reasoning.

Other takeaways: different models benefit from different scaffolds, separate recon, exploit reasoning and reporting as different models will perform better (and use cheap models on recon, frontier on exploit reasoning).

💡 I always like an eval/benchmarking post. Intuitively you’d think skills and/or MCP tools would generally improve performance, but it depends on the model and task. In this case I will note though that the task seems to have just been examine a small code snippet for vulnerabilities, which is much different than navigating large, real world code bases. Also if the model can dynamically test its hypotheses that will also improve outcomes.

Misc

• OpenAI unveils its first custom chip, built by Broadcom

• Anthropic says Alibaba illicitly extracted Claude AI model capabilities

• Satya Nadella - A frontier without an ecosystem is not stable

• Get-a-Waymo: How a burglar used a robotaxi to flee the scene in a first-of-its kind S.F. case - New #PeakBayArea example. “The getaway car was parked just outside the Marina yoga studio...” 😂 

• A walking tour of surveillance infrastructure in Seattle

• Ycombinator.FYI - Examples of “17 fraud & scandals, 41 exhibits filed, 5 copycats & grifts.”

• Fireship - I read every major CS paper of the last 100 years... - Nice overview of work by Turing, Claude Shannon, foundational AI papers, etc.

• Fireship - SQLite is being rewritten in Rust

• CharactersWelcome - That Song In Every Musical That No One Likes

• Walking Slower? Why Your Ears, Not Your Knees, Might Be the Problem - Apple’s hearing study used real-world data from more than 57,000 iPhone users and made a connection between hearing loss, walking speed, and potential longevity implications.

• The absurdly optimized pancake - “A systematic investigation of acid-base neutralization, CO2 production kinetics, gluten inhibition, and the Maillard reaction as applied to a 125-gram flour batter, with an interactive stoichiometric calculator that adapts to whatever is in your refrigerator.“

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🙏 Busy, Exciting, Busy

Thanks so much to everyone who reached out last week! I received so many kind emails, LinkedIn comments, and texts, I was filled with joy. My heart grew at least 3 sizes 🥹

Apologies if I haven’t responded yet, there are somehow even more things going on inside OpenAI than you’d expect, and I’ve been a bit buried.

We’ve been sprinting on some things… that you might see soon 🤭

Speaking of, I’m actually going to be doing a live session with some colleagues next Thursday about Daybreak, our vision for empowering defenders.

We’ll discuss cyber models, early insights from working with leading teams, show how these capabilities fit into security workflows, and discuss where AI-assisted defense is headed next.

We’ll likely cover new security product stuff we’re shipping, and even a live demo (I’m starting my sacrifices to the demo gods now 🙏).

👉️ Join live Thursday June 25, 1pm PDT 👈️ 

Hope to see you there!

Sponsor

📣 Is Your Segmentation Real, or Just a Comfortable Illusion?

AI-generated exploits don't need sophistication, just a gap you don't know exists. Target-specific attacks are generated in minutes, built to find what your tools can't see.

runZero shatters the segmentation illusion. New attack path mapping and topology visualizations reveal how an attacker can move through your environment. Safely enumerate sub-assets hidden behind protocol gateways like Modbus, BACnet, and EtherNet/IP that other tools miss entirely.

Every asset, every exposure, every attack path across IT, OT, IoT, cloud, and mobile. With runZero, defenders win by default. Even against AI.

👉 Start your 21-day free trial 👈

AppSec

Formal methods and the future of programming
Jane Street’s Yaron Minsky describes how they’re building a formal methods team after 25 years of skepticism, driven by the belief that agentic coding has fundamentally changed the cost-benefit calculus of formal verification. Yaron argues that AI agents both reduce the cost of formal methods (by making proof construction more accessible) and increase the benefits (by providing better verification for AI-generated code that tends toward "slop", and by offering the universal guarantees that agents need for effective feedback during training and coding).

“Our hope is to make formal methods as pervasively useful of a tool for building software as sophisticated type systems are for us today.”

💡 Useful things to reflect on whenever there are meaningful tech changes, AI or otherwise: what used to be hard that is now easy? What used to be impossible that is now feasible? What used to be too costly or too slow that now could make sense? I’m actually pretty bullish on formal methods in the AI era.

Making secret scanning more trustworthy: Reducing false positives at scale
Microsoft's Mariko Wakabayashi details how the Agents Offense team helped GitHub adopt Microsoft’s Agentic Secret Finder's verification approach into its AI-powered secret scanning, cutting customer-confirmed false positives by 75%. Rather than feeding the model more data, the approach extracts focused, high-signal usage context such as whether a detected value is assigned to a variable and later passed into an API request, authentication header, database client, or cloud SDK call, as well as execution paths. Providing the right context lets the model separate real exposures from noise like UUIDs, test data, or placeholders without reducing detection coverage.

💡 This work sounds neat, and How we built Copilot secret scanning shares a bit more details about GitHub’s approach, but I wish both were a bit more detailed. For an example I like, see Wiz’s post How We Fine-Tuned a Small Language Model for Secret Detection in Code.

Codex Discovered a Hidden HTTP/2 Bomb
Calif's Quang Luong, Jun Rong and Duc Phan used Codex to discover HTTP/2 Bomb, a remote denial of service affecting nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora in their default configurations. The attack chains two techniques that have been public since 2016. The first abuses HTTP/2's header compression, where a single saved header can be referenced thousands of times, and each one-byte reference forces the server to allocate a full header in memory. The second tells the server its receive buffer is full, then drips just enough updates to keep the connection from timing out so the server never frees anything.

A single client on a 100Mbps home connection can pin 32GB of server memory in roughly 20 seconds against Apache and Envoy. A Shodan search found 880,000+ websites supporting HTTP/2 and running one of these servers, though many sit behind a CDN. Calif published PoCs and Docker labs at califio/publications.

Sponsor

📣 Discover the Architecture of Stopping-Power

Modern threats move faster than platforms built on delayed telemetry, API-derived state, and after-the-fact correlation can control. The next generation of cloud security will not be won or lost on how much risk it can describe. It will be won or lost on how effectively it can convert context into stopping power.

In their landmark paper, Agentic Cloud Security Platforms: The Shift to Runtime Security, Software Analyst Cyber Research (SACR) demonstrates how the limits of CNAPP are architectural. 

👉 Download this important read 👈

I do wonder where things are headed if we assume AI-powered attackers can pivot and move through a network faster. How will cloud tools adapt? 🤔 

Cloud Security

Disrupting AWS logging
(In 2016!) Daniel Grzelak demonstrates multiple techniques for disrupting AWS CloudTrail logging after compromising an account, ranging from obvious methods like delete-trail and stop-logging to stealthier approaches. Key tactics include disabling multi-region logging with update-trail --no-is-multi-region-trail --no-include-global-service-events to operate freely in non-home regions while suppressing global IAM events, creating an immutable encryption-only KMS key via create-key --bypass-policy-lockout-safety-check so CloudTrail keeps writing logs that nobody can decrypt, redirecting logs to attacker-controlled S3 buckets, modifying bucket policies to block CloudTrail writes, and setting 1-day S3 lifecycle expirations to auto-delete files.

You can also deploy an AWS Lambda function triggered by S3 object-create events to delete logs immediately on write, winning any race condition against SIEM ingestion while staying within Lambda's 1 million free monthly invocations to avoid detection through unusual billing patterns.

💡 As they say, read Daniel’s posts to avoid being a cyber-patsy.

Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility
Palo Alto Networks's Yahav Festinger describes seven attack techniques targeting AWS CloudTrail and Google Cloud Logging services, organized into defense evasion and continuous visibility (transferring logs to the attacker’s accounts, giving visibility into the victim’s environment). Defense evasion techniques include stopping logging, deleting the log storage destination, deleting the log router, impairing logging via an attacker-controlled encryption key, and log poisoning. Continuous visibility techniques include configuring a new log routing resource and log redirection. Attackers can exploit permissions like cloudtrail:StopLogging, s3:DeleteBucket, logging.sinks.update, and KMS key modifications to blind security tools, manipulate audit trails, or exfiltrate logs to attacker-controlled destinations for passive reconnaissance.

Festinger recommends restricting access to logging service APIs to highly privileged users, using immutable log repositories like AWS's 90-day CloudTrail Event History and Google Cloud's _Required log bucket, and implementing bucket policies that prevent non-admin modifications. For detection, CloudTrail log file integrity validation flags log poisoning but is off by default for trails created via API or CLI.

Supply Chain

Perplexity is open sourcing Bumblebee
Perplexity has released Bumblebee, a read-only scanner that checks developer machines for risky packages, extensions, and AI tool configurations during supply-chain incidents by parsing metadata files directly without executing code. The tool scans four surfaces: language package managers (npm, pnpm, PyPI, Go modules, etc.), AI agent configs (MCP), editor extensions (VS Code family), and browser extensions (Chromium and Firefox). Bumblebee supports three scan profiles: baseline for routine scans, project for targeted repo checks, and deep for active incident response.

Bumblebee avoids triggering malicious install scripts by never invoking package managers or running lifecycle hooks, instead reading lockfiles, manifests, and installed package metadata directly. Perplexity integrates Bumblebee into their workflow where Perplexity Computer drafts catalog updates as GitHub PRs after threat signals emerge, humans review them, and Bumblebee then scans endpoints with the updated catalog to identify exposed systems.

💡 Smart approach, I like this a lot: a single tool to inventory all of these developer attack surfaces, gathers the data in a way that avoids accidental code execution from malicious packages, and integrates with a continuously updating threat catalog 👌 

Securing CI/CD in an agentic world: Claude Code Github action case
Microsoft's Dor Edry and Amit Eliahu demonstrate how Anthropic's Claude Code GitHub Action could leak CI/CD secrets when processing untrusted GitHub content like issues, pull requests, and comments. While the Bash tool ran inside a Bubblewrap sandbox with environment variables scrubbed, the Read tool bypassed that isolation and could read /proc/self/environ directly, exposing ANTHROPIC_API_KEY and other runner credentials.

To confirm exploitability, they hid a prompt injection inside an HTML comment that instructed the agent to read sensitive files and truncate the first seven characters of any API key found, bypassing Claude's safety filters and GitHub's Secret Scanner. From there, exfiltration was possible via WebFetch, Bash, or issue comments. Anthropic patched the issue in Claude Code 2.1.128 by blocking access to sensitive /proc files.

Blue Team

grepstrength/malsnitch
Tool by Kevin Winborne that scans malware artifacts like string dumps, FLOSS output, or Binary Ninja exports to extract embedded secrets such as C2 credentials, crypto keys, API tokens (GitHub PATs, AWS, Stripe, Slack), exfiltration channel credentials (e.g. Discord webhooks, Telegram bot tokens), and hardcoded SMTP/FTP/HTTP credentials.

Cisco-Talos/EvidenceForge
By Cisco Talos: An open-source tool that generates realistic, multi-format security logs for threat hunting training by solving the core problem of synthetic data: cross-source consistency. EvidenceForge uses a canonical SecurityEvent model to emit 20+ correlated log formats (Windows Security, Sysmon, Zeek, eCAR EDR/XDR, syslog, bash history, Snort, web access, and proxy logs) from a single source of truth, ensuring LogonIDs, PIDs, timestamps, and Zeek UIDs match across all outputs. A causal expansion engine adds prerequisite events with realistic timing, like DNS queries before connections and Kerberos TGT/TGS before domain logons, and a Hawkes process models user activity including Monday login storms and Friday early departures. Network visibility modeling further determines what each sensor can realistically observe.

Scenarios are authored through Claude Code or Codex agent skills that draw on MITRE ATT&CK, while log generation itself is fully deterministic with no LLM calls. A 4-pillar evaluation framework then scores the output across parseability, plausibility, causality, and timing.

Red Team

Mythic Embarking on the Open Seas: Containerized Payload Delivery for Kubernetes Assessments
SpecterOps' Alex Rodriguez introduces two new Mythic C2 extensions, container_wrapper and container_registry, that streamline containerized payload delivery for Kubernetes assessments by wrapping Mythic payloads into OCI-compatible containers and hosting them in self-managed registries. The container_wrapper uses Buildah to package payloads into container images via Mythic's web UI, while container_registry uses skopeo to push these images to a distribution-based registry deployed behind an HTTPS redirector. This approach lets operators hand clients a simple Kubernetes manifest to deploy in their own clusters, eliminating manual Docker CLI workflows and supporting container-centric penetration testing in environments where worker nodes have internet egress and no restrictive image policies are enforced.

Don’t Jump the Turnstile: Lessons from the Field
SpecterOps's Zach Stein describes how he beat email phishing sandboxes with Cloudflare Turnstile on a red team engagement, after the same sandbox had defeated every standard evasion he reached for. He first used the Satellite framework to block Linux user agents, but the sandbox swapped to a Windows user agent. He then added a filter page that only redirected after mouse movement, but the sandbox crawled the redirect URL straight out of the HTML. So he implemented Turnstile as a CAPTCHA-like verification layer that hides the redirect URL from the page source, keeping sandboxes from crawling to the payload while looking legitimate to a real user.

Zach published the build as Turnstyle, a Flask WSGI app fronted by Apache, mod_wsgi, and a Certbot certificate, with an Ansible deployment script in the repo.

AI + Security

Quicklinks

• How Android helps keep you safe from impersonation scams with fake call detection - New feature helps protect you from scammers using AI deepfakes to impersonate your contacts. Shout-out to my friend Rachel Tobac for helping inspire the work 🤯 

• [NEW] Discover shadow AI agents via the browser - Most AI agent discovery tools rely on APIs. The problem? A lot of agentic AI platforms don’t expose agent details via an API. Nudge Security just closed this blindspot with browser-based AI agent discovery.*

• r/ollama - 30 Days of an LLM Honeypot

^*Sponsored

visa/visa-vulnerability-agentic-harness
By Visa: An open-source agentic SAST pipeline that uses Claude, OpenAI, or any combination of frontier models for autonomous vulnerability discovery. It prioritizes triage speed over raw discovery volume, with Mean Time to Adapt as its primary metric. Threat modeling focuses the attack surface, multi-agent deterministic voting reduces false positives, and structured triage artifacts compress the path to actionable findings.

The pipeline runs nine stages, beginning with attack surface mapping and STRIDE/OWASP threat modeling, then specialized research lenses for language, crypto, logic bugs, access control, batch/ETL, and IaC, followed by adversarial verification and exploit chain construction. Output includes Markdown reports and SARIF 2.1.0 artifacts.

CiscoDevNet/foundry-security-spec
Cisco has released the Foundry Security Spec, an open specification for building agentic AI security evaluation systems, distilling production lessons into 130 functional requirements across eight core agent roles (Indexer, Cartographer, Detector, Triager, Validator, Reporter, Coverage Guide, and Orchestrator) plus five optional extensions (Deep-Tester, Variant-Hunter, Attack-Mapper, Remediator, Self-Improver).

The spec is deliberately infrastructure-agnostic with explicit [NEEDS CLARIFICATION] markers for organization-specific decisions, designed to be consumed via spec-kit's clarify-specify-plan-implement workflow rather than shipped as runnable code. Foundry implements a detection-to-prevention flywheel where exploratory agents hunt alongside CodeGuard rule sweeps, recording rule gaps that get generalized back into the corpus, so each evaluation improves both detection across all future targets and prevention in developers' LLM coding assistants. See also the companion blog post by Omar Santos.

💡 Very cool project idea: a specification for building your own AI-powered code scanner. You customize the spec with your environment, and then it builds according to that. It makes me think of some SciFi show where you plug in your requirements, and then it materializes food or whatever you’re imagining. “Replicators” in Star Trek.

Misc

AI

• Joshua Saxe - Banning Mythos represents a basic misunderstanding of AI cybersecurity

• David Sacks on the Fable ban

• Katie Moussouris - The Fable 5 Export Controls Harm US Cyber Defense

• Hank Green - The Riskiest Moment of the AI Bubble

• Bloomberg - Ray Dalio on the bond market, a weaker dollar driving gold demand, and AI bubble concerns

• Bloomberg - Inside Anthropic, the $965 Billion AI Juggernaut - Neat profile of Dario and Daniela Amodei, with a little Boris.

Music

• Lea Salonga's Audition for Miss Saigon

• Row Row Row Your Boat but in different keys at the same time

• "Go the Distance" - Broadway's Leading Men Concert

• Colors of the Wind - Live Orchestra | Pocahontas

• Charles Cornell - Phil Collins Made EVERY Parent Sob With 1 Key Change | You'll Be In My Heart - My dad loved Phil Collins, I remember watching Tarzan with him when I was young 🥹 I burned a few of the best songs from the soundtrack onto a CD when I was in school, and we’d listen to it in the car when we were driving somewhere together, like my karate practice. I could see this song hitting very different as a parent.

Misc

• Midjourney Medical - Holy cow, the image generation site is getting into healthcare, and planning to build a better body scanner, and spa in SF 🤯 

• When Pikachu gave the most epic speech in Pokemon history

• A day in the life of a personality-maxxer

• Throwback NFL commercials are the best

• Jon Oliver - Moderator: 1 | Politician: 0

• Mark Manson - 20 Years of Therapy Summarized in 13 Minutes

• Trying to understand investing and stock price 😂 

• Leila Hormozi - Do This & Watch How Fast People Stop Disrespecting You

• Sygnia - Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected

• What Dreamworks Understands About Evil That Disney Doesn't

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤔 New Job, Who Dis?

TL;DR: I’ve joined OpenAI to lead their Cyber efforts.

I’m joined by Mike Aiello, an awesome security executive and human. Mike was previously CTO at Secureworks, led product for Google Cloud Security from 0 → $B’s in revenue, and CISO at Goldman Sachs.

I was going to write a post describing all the details about joining, my thought process, etc. but it turns out there’s a lot to do at OpenAI and I’ve gotten very busy 😅 The post is started but not finished, will share when I can.

So here’s the short version.

Why
I was very happy at Semgrep and wasn’t looking for new opportunities, but when an OpenAI recruiter reached out, it seemed like a once in a lifetime company and opportunity that I couldn’t pass by.

During the interview process, when I spoke with my potential colleagues, I was impressed by how they were incredibly smart and kind, and genuinely, earnestly, cared about making a positive impact on the world. Several people, without me bringing it up, expressed to me that as models get better, they feel a moral responsibility to do what they can to secure the world’s software.

And now from the inside, I can see that the sentiment was genuine, and not a facade (you always wonder as an outsider). OpenAI has easily already spent millions securing open source and critical infrastructure that they haven’t yet claimed PR cred for doing.

I’ve long talked about the power of secure by design and eliminating vulnerability classes. Being at OpenAI makes that feel tractable in a way it never has before. I’m optimistic we, the security community, can meaningfully raise the world’s security bar over the next few years. Seriously.

Lastly, how I think about the decision is also well expressed by my friend Rami McCarthy, who, like with many things, annoyingly wrote a better version of what I would write in his post on joining Wiz. Similarly, I hope to “work for the security industry, at OpenAI.”

I shared a LinkedIn post with a bit more details, feel free to say hi or share thoughts there 👋

P.S. tl;dr sec will continue, don’t worry. Also, I will continue to include high quality content from Anthropic, that is also unchanged. More on that below.

Sponsor

📣 State of SDLC Report 2026

The 2026 SDLC Security Report analyzed real-world development environments, codebases, and SDLC infrastructure to understand how risk is evolving and how software is built and shipped.

The TL;DR: Risk isn’t primarily driven by rare vulnerabilities. It scales through reuse, permissions, and automation across the SDLC.

The report explores:

• AI copilots and developer tooling risk

• Dependency concentration and supply chain exposure

• Secret leakage trends

• CI/CD and GitHub Actions attack paths

Learn how SDLC risk is reshaping application security.

👉 Get the State of SDLC Report 👈

AppSec

1-Click GitHub Token Stealing via a VSCode Bug
Ammar Askar describes a bug in which clicking a github.dev link could steal a GitHub token with read/write access to all your private repos, by chaining a Jupyter notebook payload that exploits VS Code webview's did-keydown event forwarding to install a malicious extension. Neat write-up!

How We Cut Semgrep’s Taint Analysis Time by 75%
Semgrep's Austin Theriault walks through how the taint analysis engine was redesigned to run once instead of twice, cutting scan times by up to 75%. Taint analysis is used for vulnerabilities like SQL injection by tracking user input as it flows through code from sources to sinks, with propagators that carry the taint forward and sanitizers that clean it.

Semgrep's original 2023 architecture computed those configs during interfile analysis, then discarded them and recomputed during intrafile analysis, a design forced by OCaml's parallelism limitations before 5.0 that would have ballooned memory if all the state were kept in flight at once. Refactoring to merge both passes unlocked parallelization via OCaml multicore and reduced P95 scan times from 10 minutes to 7:30, with some large repositories seeing 3x+ improvements.

Sponsor

📣 Key questions to ask any AI vendor

Vendors are claiming autonomy - but most are still requiring significant human oversight. And most security teams don't yet have a clear framework to evaluate the difference.

Join Sublime Security and Georgian on June 24 for a practical session on evaluating security AI. You'll leave with a clear autonomy framework, a trust-based evaluation path, and key questions to ask any AI vendor - including what good answers actually sound like.

👉 Register now 👈

Honestly, it is super useful to know the right pointed questions to ask vendors, as well as having a feel for what “good” and rigorous evals look like in practice.

Cloud Security

fwd:cloudsec North America 2026
The premier cloud security conference just uploaded the talks from their most recent event. Highly recommend. Many of the talks look great, and see the blog version of some below. Some additional talks I’m linking here so I can come back to them:

• In git we trust: Defending Lovable projects from malicious code attacks at scale by Marcus Hallberg & Samuel Kelemen.

• Barbarians at the Gate: Visualizing and Blocking SDLC Infrastructure Threats with SITF by Shay Berkovich.

HazyBeacon and AWS Lambda Function URL Abuse
Qualys' Aniket Harne breaks down HazyBeacon, a campaign originally documented by Palo Alto Unit 42, where attackers used stolen IAM credentials to deploy AWS Lambda functions with AuthType: NONE Function URLs as command and control relays, making malware traffic indistinguishable from ordinary HTTPS calls to the lambda-url.<region>.on.aws domain. The chain starts with credentials harvested from public GitHub repos or developer phishing, validated through reconnaissance calls like aws sts get-caller-identity, then used to deploy a Lambda function under a benign name in an unused region whose public Function URL proxies traffic between infected endpoints and the attacker's real backend. The relay sits inside a separate compromised AWS account, which leaves the malware victim and the AWS account holder as two unrelated victims, often unaware they're connected until the bill or the abuse notice arrives.

Recommended mitigations: A Service Control Policy blocking AuthType: NONE Function URLs unless explicitly tagged, global CloudTrail logging, enabling VPC flow logs, and more.

💡 Honestly, pretty clever use of Lambda Function URLs.

Sub:jugation - Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers
Astrix Security's Tal Skverer describes Sub:jugation, a vulnerability class affecting GitHub Actions, GitLab CI, and Terraform Cloud where the global OIDC issuer model lets attackers reclaim deleted repository namespaces and mint JWTs with subject claims that match existing cloud IAM role trust policies. Any cloud role still trusting an orphaned sub claim hands over short lived AWS, Azure, or GCP credentials to whoever recreates the namespace. Astrix calls these forgotten roles Phantom Cloud Identities, and found that 14% of AWS identities and 24% of Azure identities trusting GitHub's global issuer point at namespaces that are no longer registered, with roughly 8 becoming exploitable each month through publicly available data alone.

GitHub has shipped the complete fix, adding random identifiers to sub claims so reclaimed namespaces can't mint matching tokens, while GitLab and Terraform have rolled out interim mitigations with full OIDC subject solutions still pending. Until those land, organizations need to audit every cloud identity trusting token.actions.githubusercontent.com, gitlab.com, or app.terraform.io, confirm the referenced namespace is still theirs, and either reclaim it or decommission the role outright.

Supply Chain

Well-architected best practices for software supply chain security
AWS's Trevor Schiavone and Desiree Brunner walk through defense in depth controls for npm supply chain attacks. Key mitigations include: replacing long-lived credentials with temporary ones via AWS CLI login, IAM Identity Center, or OIDC federation; implementing artifact signing with AWS Signer to cryptographically verify packages before production deployment; centralizing dependency management with AWS CodeArtifact's package group configuration to block typosquatting; and using Amazon Inspector's behavioral analysis to detect zero-day malicious packages.

Also: require MFA on maintainer accounts and multiple approvers, analyze CloudTrail logs for indicators of compromise, and leverage Software Bills of Materials to quickly assess blast radius during incidents.

Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does
Guillaume Ross shows how to detect and prevent credential theft from developer workstations by combining bagel, an open source secret scanner, with Fleet, an MDM platform that uses osquery for telemetry, and an IdP conditional access policy. Bagel runs on a schedule through a LaunchAgent to find cleartext secrets in developers' home directories, Fleet reads the JSON output via its parse_json osquery table to evaluate it against a policy, and an IdP blocks SSO on non-compliant workstations until the secrets are remediated.

Guillaume ships the integration as Fleebag, a proof of concept repo with macOS installation packages for bagel, Fleet queries for findings, a policy query that passes only when scans are fresh and clean, and an example profile to grant bagel full disk access.

AI + Security

Quicklinks

• Cursor bypassing pnpm min release age settings 😅 

• Claude Fable 5 and Claude Mythos 5

• Cybersecurity researchers aren’t happy about the guardrails on Anthropic’s Fable - Preventing model misuse is hard 🙃 

Introducing the Agent Governance Toolkit: Open-source runtime security for AI agents
Microsoft's Imran Siddique released the Agent Governance Toolkit, an open source framework of seven packages that aims to address all 10 OWASP Agentic AI Top 10 risks by porting operating system, service mesh, and site reliability patterns to autonomous AI agents. The packages run across Python, TypeScript, Rust, Go, and .NET, and the toolkit plugs into each framework's native extension points across LangChain, CrewAI, LangGraph, LlamaIndex, OpenAI Agents SDK, and more.

The toolkit: Agent OS as the stateless policy engine (supports YAML, OPA Rego, and Cedar), Agent Mesh for cryptographic identity, Agent Runtime for sandboxing execution inspired by CPU privilege levels with an emergency kill switch, Agent SRE for applying service level objectives and circuit breakers, and the final three handling compliance, plugin lifecycle management, and reinforcement learning training governance.

System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models
John McIntosh reproduces Anthropic's Mythos discovery of CVE-2026-4747, an RCE in FreeBSD's RPCSEC_GSS authentication, using AISLE's nano-analyzer pipeline on two local open-weight models (gpt-oss-20b and gemma-4-31b-it). The models could find the bug, but the pipeline graduated 30 false positives that buried the real CVE. Rather than swap to a stronger model, John added one extra reachability filter stage using the same model weights that traces each finding back to an entry point, greps for callers, and checks whether the cited length is really controlled by the attacker or just set by the kernel, cutting false positives from 30 to 5 while keeping the real CVE valid. The full experiment is on GitHub.

💡 Here’s how I see it: the foundation model labs try to convince you that “all you need is the model” and security vendors (or individuals) argue “it’s all the scaffolding.” Ultimately, I believe the truth is: the model, the prompt(s)/Skills, scaffolding/architecture, and how much you’re willing to spend all matter. Improving each gets overall better performance. Improving the model can get you the same or better results with removed (or less) scaffolding, and improved scaffolding on top of better models will yield even better results (more true positives, fewer false positives/negatives).

At the end of the day, it all distills down, like most things in security, to: how much risk reduction are you getting at what price? My $0.02 at least.

Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator
Anthropic’s Kyla Guru, Alex Moix, and Jacob Klein analyzed 832 banned accounts that misused Claude for cyber operations over one year, mapping 13,873 malicious actions across 482 MITRE ATT&CK techniques and developing the AI Risk Enablement Score (ARiES) to assess threat levels. They found the highest-risk actors weren’t distinguished by technical sophistication or number of techniques used, but by their use of agentic scaffolding to autonomously orchestrate entire attack chains, like one threat actor who weaponized Claude Code with MCP servers to autonomously execute reconnaissance, exploitation, lateral movement, and exfiltration.

Anthropic argues that the MITRE ATT&CK framework needs expansion to capture AI-native behaviors like autonomous killchain orchestration and real-time pivot decisions that don't map to existing technique IDs but represent the most dangerous evolution in AI-enabled cyber threats.

💡 This is really cool, and valuable context for the community on how threat actors are using AI. As mentioned in the intro, expect me to continue including solid technical work from Anthropic. I have many kind, extremely competent friends at Anthropic who I respect highly. I think the world is better off for having many companies and individuals working together to make the world safer.

Ultimately I think that’s the north star of all of us working in cybersecurity: making the world safer so all non-neck beards people live happy, fulfilling lives without having to worry about getting hacked, having their identity stolen, etc.

Misc

• Alex Hormozi - The 4 Proven Ways To Build Wealth In 2026

• “This is gonna be cute, trust me”

• Lea Salonga and Brad Kane - A Whole New World (1993 Oscars) 🥹

• Hadestown: The Musical | Official Trailer - OMG YAS! Looks like they filmed the original cast, like they did with Hamilton. I love this approach, I wish all musicals did that. I give Hadestown at least 😭😭😭😭/5. Obviously all musicals should be rated in sob emojis.

• Mobility exercises for 40+

• I have a lot more I want to include here, but it is late, so instead I shall hopefully flesh this out more next week. Hope you have a great rest of your week 👋 

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👩‍❤️‍👨 Repo-mantic Comedy

Recently I had one of those moments where you remember that LLMs are trained on the vast, beautiful, complicated collection of human knowledge.

I was using Codex to port a feature from one code base to another, and it said:

“…I’m reading the exact code paths now so the port preserves behavior instead of inventing a prettier cousin.” 😂 

Dear reader, I had questions. Like: how many bodice ripper novels and country music lyrics are in the training corpus? What other secrets lie in the weights?

I didn’t think I read anything about dating preferences in its model card.

LLMs are strange, and amusing sometimes. This situation makes me think of the goblins post.

I love demoing what you can build with coding agents to friends, but maybe I’ll hesitate before doing this next Thanksgiving, just in case…

Sponsor

📣 AI will make every asset a potential zero-day target. Are you ready?

The AI-attack era has arrived. Thousands of zero-days in the pipeline. Target-specific exploits generated in minutes. Unattributed, one-off attacks that bypass detection — while your dashboard stays green.

runZero is built for this reality. Know every asset on your attack surface, uncover every exposure, map every attack path, and validate your segmentation — before the exploit drops. We deliver deep intelligence across IT, OT, IoT, cloud, and mobile, so defenders can win by default. Even against AI.

👉 Try It Free Today 👈

AppSec

What My Privacy and Security Stack Actually Looks Like
Great guide by Yael Grauer: Use a PO Box and EasyOptOuts to scrub your home address from the internet (Big Ass Data Broker Opt-Out List), meet new contacts in public, use YubiKeys for MFA, 1Password/Bitwarden, encrypted drives, privacy screens in public, Privacy Badger, Mullvad VPN, uBlock Origin, Signal with disappearing messages, Google’s Advanced Protection Program, Lockdown Mode for Apple Devices, Google Fi for SIM-swap protection, iCloud's Hide My Email for aliases, and more.

Comparing AI Application Security Testing Platforms
Doyensec's Luca Carettoni and Anthony Trummer conducted a side-by-side comparison of two AI-powered penetration testing platforms, Aikido's Attack AI Pentest and XBOW's Lightspeed, manually validating all findings to determine true positives versus false positives. The evaluation assessed configuration complexity, impact on tested applications, report quality, cost, speed, and overall testing effectiveness.

💡 Great example of a thoughtful benchmarking methodology and comparison that measures a variety of useful dimensions like: did a human tester agree with the severity ratings, what was the overlap in findings between the tools, and more. It’d be great to see more comparisons this detailed, but it does take a lot of time and effort.

Zapocalypse: The Attack Chain That Could Have Hijacked Zapier
Token Security’s Yair Balilti describes chaining five known primitives to achieve NPM publishing rights to Zapier's design-system package, which would have enabled JavaScript execution in every authenticated Zapier session (yikes). Starting from a "Code by Zapier" Python sandbox where os.system worked, Yair scraped orphaned AWS STS credentials from /proc/self/mem (since del os.environ[k] doesn't zero heap memory), then used the misnamed allow_nothing_role (which actually permitted ECR enumeration and image pulls) to extract 1,111 container images via direct ECR API calls bypassing Docker's GetAuthorizationToken requirement. He then discovered a high-privilege NPM token with bypass_2fa: true and scope.name: null leaked in container build metadata via ARG/ENV in image config history, plus a hardcoded Zapier Actions MCP key belonging to a LiteLLM co-founder that enabled Gmail impersonation.

💡 Attack chain enabling publishing arbitrary JavaScript served by <your domain> and ran in every one of your user’s sessions… $3,000. Sometimes I’m surprised more security researchers don’t turn to crime. To be clear, I’m not encouraging bad behavior, nor is this a unique case, I’ve seen many examples of “I could compromise <all of your users>” and the payout is a few grand. Sometimes the impact to payout ratio feels 🙃 

Sponsor

📣 Prowler: the world’s most widely adopted open cloud security platform

Prowler automates security and compliance across any cloud environment, with agentless coverage of cloud infrastructure, SaaS, Kubernetes, containers, Infrastructure as Code, and more. It detects vulnerabilities and misconfigurations, prioritizes risks, accelerates remediation, and automates audit-ready compliance. 

Prowler has become the security platform of choice for thousands of cloud teams, with 45M+ downloads, 13K+ GitHub stars, and 300+ global contributors. Prowler Cloud delivers cloud security 10x more cost-effectively than alternatives.

👉 See Prowler In Action 👈

Prowler is great, love the open core nature. Also fun demo format 👍️ 

Cloud Security

From Leaked AWS Key to Data Exfiltration in 60 Seconds: Are We Ready?
Adan Alvarez tested Claude Code's ability to move from a leaked AWS IAM key to data exfiltration without AWS-specific guidance, finding that in 7 of 12 runs, the AI agent successfully completed the attack chain in approximately 60 seconds. The scenario involved a CI/CD user with read access to a Terraform state file containing credentials that could assume a privileged role, with all successful runs following an identical six-phase kill chain: GetCallerIdentity, policy enumeration (ListUserPolicies/GetUserPolicy), credential recovery from S3, AssumeRole, bucket enumeration, and exfiltration.

Adan notes that CloudTrail's 5-minute log delivery delay means traditional alerting may be too slow to prevent sub-minute attacks which is why Adan is betting on honeytokens and honeypots to waste the agent's time before it finds anything real. See the scenario on GitHub here.

💡 Interesting- I hadn’t thought about that as much yet, but that’s a great point: log sources that only ship every 5 minutes could be a problem if an entire kill chain can be fully automated in a minute or two. Yikes.

Adding Strands Security Agents to Shadow Asset Scanner
Sena Yakut built a shadow asset scanner that uses boto3 to sweep AWS for exposed S3 buckets, stale IAM keys, public Lambda function URLs, and similar misconfigurations. On top of that she layered a Strands Agents SDK that reads the raw findings and reasons across them for multi step attack paths rather than presenting each item in isolation.

The architecture runs as a collaborative Swarm where specialized agents pass context to each other in sequence. The Error Analyst handles failures from the boto3 pass first, the Attack Chain Analyst then stitches findings into chained scenarios mapped to MITRE ATT&CK tactics, the Summary Agent compresses what comes out, and the Chat Agent serves four report formats (standard, executive, technical, and compliance) along with remediation commands. The agents reach the scanner through Strands' tool interface and share state across handoffs, with caps on handoff count and execution time keeping the swarm from looping indefinitely.

Supply Chain

Skill Issues: Compromising Claude Code with malicious skills & agents
Reversec's James Henderson demonstrates how Claude Code skills and sub-agents can serve as initial access vectors, with risks comparable to installing untrusted pip packages. Henderson describes two attack paths. The first runs through skill frontmatter: setting allowed-tools: Bash(*) alongside dynamic context inputs like !socat ... executes commands before the LLM processes them, while direct reverse shell requests to Claude get refused.

The second path runs through sub-agents and permissionMode: bypassPermissions, which skips consent prompts but doesn't prevent agents from reasoning about commands. To bypass that reasoning, Henderson runs npm install against a localhost registry serving backdoored packages, giving the agent legitimate cover to execute malicious code without exposing the payload.

The sorry state of skill distribution
Trail of Bits's Samuel Judson and Tjaden Hess were able to bypass ClawHub’s malicious skill detector, Cisco’s agent skill scanner, and all three of the scanners integrated into skills.sh in a few hours, using techniques like prepending 100,000 newlines to hide malicious code, embedding payloads in .docx archives and poisoned .pyc bytecode files, and using prompt injection to convince guard models that malicious registry configurations were legitimate corporate infrastructure. The attacks exploited weaknesses in the scanners: truncated file analysis, limited file type coverage that ignored binaries and hidden files, and the ability for attackers to iteratively refine attacks against static scanning targets.

Recommendation: avoid public skill marketplaces like skills.sh and ClawHub entirely, instead curate internal skill repositories using trusted sources. PoC repo: trailofbits/overtly-malicious-skills.

💡 Also WHAT - “The official MS Office skills from Anthropic for handling .docx, .xlsx, and .pptx files each contain a script called soffice.py… which hacks around the socket block by using LD_PRELOAD to patch in either 1) an existing $TMP/lo_socket_shim.so”, or 2) a library dynamically compiled out of C code embedded in a docstring.” 🫠 😂 

Blue Team

From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents
Datadog's Ryan Simon walks through Copy Fail, a Linux kernel bug that lets an unprivileged user corrupt the page cache through its crypto socket interface and quietly rewrite setuid binaries like /usr/bin/su to escalate to root. Ryan used a single coding agent with a custom skill for each step to compress the full detection engineering cycle into one session, from threat analysis through live exploit testing to production deployment. The detection itself is a three stage chained rule that uses process scoped variables to track bind(AF_ALG), setsockopt(SOL_ALG), and splice or open operations on SUID binaries or PAM configs.

💡 The “Accelerating the Detection Engineering Lifecycle with agents” section at the bottom has some great tactical details on how specific steps are scaled 👌 

Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
Google Threat Intelligence Group's (GTIG) Q2 2026 AI Threat Tracker describes several recent developments in how threat actors are using AI in their operations and targeting AI infrastructure directly. GTIG identified the first case of a threat actor using a zero-day it believes was developed with AI, a 2FA bypass in a popular open-source web admin tool disrupted before mass exploitation. PRC and DPRK actors are running their own AI-augmented vuln research workflows, while Russia-nexus malware CANFAIL and LONGSTREAM use LLM-generated decoy logic to obfuscate payloads against Ukrainian targets. PROMPTSPY, an Android backdoor first identified by ESET, embeds an autonomous agent that drives device interactions through gemini-2.5-flash-lite.

Threat actors are also going after AI infrastructure itself. TeamPCP (UNC6780) compromised the LiteLLM and BerriAI repositories alongside Trivy and Checkmarx to plant the SANDCLOCK credential stealer and extract AWS keys and GitHub tokens from build environments. They're also industrializing LLM access through middleware like Claude-Relay-Service and CLIProxyAPI alongside automated account-registration pipelines. The common pattern is a maturing ecosystem where the orchestration layers around AI (wrapper libraries, skill packages, API connectors) are now part of the software supply chain attack surface.

💡 Wow, excellently detailed blog on how threat actors are using AI. Covers a number more things than I have the space to include here.

Red Team

NomShub: Weaponizing Cursor's Remote Tunnel Through Indirect Prompt Injection and Sandbox Breakout
Straiker’s Karpagarajan Vikkii and Amanda Rousseau describe NomShub, a vulnerability chain in Cursor where a malicious repository can silently hijack a developer's machine, combining indirect prompt injection, a sandbox escape via shell builtins (export and cd to escape workspace restrictions and write to ~/.zshenv for persistence), and Cursor's built-in remote tunnel to give attackers persistent, undetected shell access triggered simply by opening a repo.

The Accidental C2: Exploring Dev Tunnels for Remote Access
SpecterOps's Adam Chester examined Visual Studio Code Dev Tunnels as a potential C2 framework, discovering they consist of multiple protocol layers: REST management API for tunnel discovery and token generation, WebSocket tunneling, SSH connections using the russh crate, and MsgPack RPC for command execution. Adam released Ouroboros, a Rust tool that implements the stack outside VS Code, with RPC methods like spawn, fs_read, fs_write, and fs_connect to interact with existing dev tunnels for remote code execution and file operations.

Adam found that FOCI (Family of Client IDs) and BroCI (Nested App Authentication) clients can be leveraged to pivot from compromised Microsoft applications like Teams or Azure Portal to gain access tokens for the Dev Tunnels Service, enabling lateral movement and initial access scenarios. Adam conducted this research with significant assistance from GPT-5.4-Cyber, which mapped the protocol layers and created the russh patch.

💡 Next example of leveraging coding agents to quickly understand a new, complex code base and stack.

Claude Code Hooks as Initial Access & Persistence
Zhangir Ospanov describes how Claude Code's Hooks feature can be weaponized for initial access and persistence by embedding malicious commands in .claude/settings.json files, similar to the VSCode tasks backdoor previously exploited by Lazarus Group. Attackers can plant hooks at the project level that execute when a developer clones and runs Claude Code, or achieve persistence by modifying the global config (~/.claude/settings.json) to trigger payloads across all sessions. The technique uses lifecycle events like SessionStart, PreToolUse, and PostToolUse to execute arbitrary shell commands.

Detection: audit claude/ directories in cloned repositories, watch ~/.claude/settings.json with file integrity monitoring, and review hook commands for anything suspicious before running Claude Code on untrusted code. A proof of concept repository with the full payloads is available if you want to test detection rules locally.

💡 Reporting to you live from the field: features to run arbitrary code… support running arbitrary code. Lots of Living Off the Land opportunities for modern IDEs and coding agents.

AI + Security

Quicklinks:

• Devin for Security - Seems like the focus is mostly on automatically writing fixes for (already) identified security issues, burning down the backlog.

• Is Your Identity Security Keeping Up with AI? - AI is moving faster than identity controls can keep up. Most teams say they're ready, but few can explain what their identities are doing in real-time. That's the AI security confidence paradox. Delinea's 2026 Identity Security Report unpacks this and more.*

• People are using prompt injection to trick Meta's AI into handing over Instagram accounts - The issue has been actively exploited in the wild for months, going back to February of this year, with hackers compromising thousands of accounts.

^*Sponsored

openbashok/promptzero
Local proxy tool by OpenBash that detects and replaces sensitive data such as IP addresses, hostnames, credentials, and personal information in your prompts before they leave your environment, then restores the real values in the response. Detection combines Presidio + spaCy named entity recognition (English and Spanish) for entities like persons, organizations, emails, and passports, with regex layers covering network infrastructure and country-specific identity documents. Each session keeps a bidirectional mapping table that stays local, and you can verify nothing real ever leaves by routing the upstream connection through Burp or mitmproxy and inspecting what actually reaches Anthropic.

LLMjacking: what these attacks are, and how to protect AI servers
Kaspersky's Stan Kaminsky describes an experiment where a researcher ran a Raspberry Pi honeypot dressed as a high-performance AI server with Ollama, LM Studio, and similar local frameworks. Shodan found it in three hours, and the box saw 113,000 requests in a month, with 23% aimed at the AI stack. Attackers used LLM-Scanner to fingerprint models through /api/tags and /v1/models, scanned for AI agents via /.cursor/rules, inventoried MCP servers via /.well-known/mcp.json, and hunted .env files for credentials. The focus was resource theft, not RCE, mostly proxying calls to Anthropic models and parsing vuln data from social posts.

Kaminsky shares some key defensive measures for private AI infrastructure, such as binding single-machine deployments to localhost so they aren't reachable from the network, swapping plain API key auth for OIDC or OAuth2 with short-lived tokens, segmenting the network with IP allowlists, running EDR on the boxes hosting AI models, setting per-role usage quotas with anomaly alerts on resource consumption, and shipping every request and response to a SIEM with tamper-resistant storage.

Inside Claude Managed Agents
Pluto Security's Yotam Perkal reverse-engineered Anthropic's Claude Managed Agents cloud runtime, finding gVisor sandboxing with a three-layer egress control system. Outbound traffic routes through a JWT-authenticated proxy with TLS inspection, the container has no direct DNS, and a network-level firewall blocks direct outbound. Together these prevent proxy bypass even when proxy environment variables are unset.

The architecture separates session, harness, and sandbox into distinct trust zones, so a compromised sandbox cannot tamper with audit logs, influence orchestration, or access vault credentials. Yotam calls the vault credential proxy the platform's strongest property, with secrets never entering the sandbox and instead injected server-side at request time, so prompt injection has nothing to steal.

Yotam notes that the defaults ship for convenience. The egress JWT is readable by any sandbox process and contains organization metadata plus the complete egress allowlist, which Anthropic silently expands with six additional infrastructure hosts (including a staging endpoint) even in limited networking mode. All eight tools are enabled by default with an always_allow permission policy and unrestricted networking. For hardening your deployment the post recommends disabling the default toolset, allowlisting only necessary tools, using limited networking, storing credentials in vaults, and monitoring session events.

Misc

Misc

• Alex Hormozi - How Making More Money Affects Your Life

• Sharran Srivatsaa - I Spent a Day Trying to Buy Spirit Airlines. Here's What I Found.

• The Gen Alpha Melody

• Renée Elise Goldsberry “Satisfied” (Official Music Video)

• Good Work - Do presidents always make this much money?

• Chris Williamson - What To Look For When Choosing A Partner - Chris Bumstead

• F.B.I. Arrests C.I.A. Official With $40 Million in Gold Bars in His Home - I’m guessing he’ll be barred from future public service 😏 

Humor

• typedfemale - presenting: big jeff’s trainium hell - Don’t watch at work 😂 

• Make Some Noise - King Lear and his Three Influencer Daughters - Having three influencer kids, now that’s a tragedy 😭 

• Kai Lentit - Upper Management Meeting

• ProZD - before and after you discover the subreddit for a hobby

• Harvard Commencement 2026 - Conan O’Brien Delivers the Commencement Address

AI / Tech

• Simon Willison - I think Anthropic and OpenAI have found product-market fit

• Lenny’s Podcast - The most rational take on AI you’ll hear this year | Benedict Evans

• Alex Hormozi - Why AI Agents Will Replace Your Next Hire

• Tech Crunch - Microsoft under fire for threatening security researcher with criminal investigation. Kevin Beaumont - Microsoft’s stance on zero day exploits is a dumpster fire of their own making. Microsoft employs some friends and in general top notch security folks. #hugops to them in resolving challenges like this.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

⛰️ Ain’t No Mountain High Enough

To keep me from sending to you bae.

Literally as I was starting to write this intro, my home Internet went out. After a moment I realized I had gotten a text a few days ago- scheduled maintenance with my Internet provider 😅 

So now I’m finishing this issue via hot spotting with my phone.

I’ve wondered sometimes what I’d do if there was some sort of force majeure world or personal event that put my ability to finish the newsletter in jeopardy.

We cut to- *Movie trailer voice* In a world, where there’s too much security news…

*Inception bong* One terminally online hacker fights the info deluge for the people…

But today… *insert plot device like aliens arriving, natural disasters, Sharknado, etc.*

It could be any of these, I’ve got range.

I’ve offered this CTA to Netflix several times over 6 years, and heard back once. Still working on manifesting it 🙏 

Sponsor

📣 Threats Don’t Need Malware.
They Need Your Identity.

No custom malware. No zero-days. Just your own admin tools, cloud APIs, and trusted processes repurposed without triggering a single alert. Varonis Threat Labs' 2026 Attacker's Playbook maps the full attack chain with real-world case studies and exposes how trust gets weaponized by threats at every stage. Discover the tactics. Close the gaps.

👉 Get the Playbook 👈

AppSec

falcosecurity/prempti
Tool by Falco that brings Falco to AI coding agents. Prempti intercepts every tool call (shell commands, file writes and reads, web fetches, MCP calls) at the agent's hook API before it runs and produces allow/deny/ask verdicts from customizable Falco YAML rules, with an LLM-friendly explanation fed back to the agent on denials so it can adapt. Because interception happens at the hook level rather than the kernel, rules see what the agent declares but not the runtime behavior of compiled binaries or the side effects MCP servers later produce, so Prempti is positioned as a cooperative policy layer to use alongside OS-level containment rather than as a replacement for it.

Running Codex safely at OpenAI
OpenAI walks through how they deploy Codex internally, with security controls including sandboxed execution environments, approval workflows for high-risk actions, and an auto-review subagent that automatically approves low-risk operations to reduce friction. They enforce network policies that allowlist expected destinations and require approval for unfamiliar domains, manage authentication through OS keyrings pinned to their ChatGPT enterprise workspace, and use macOS managed preferences with admin-enforced requirements files to maintain consistent security baselines.

Codex exports OpenTelemetry logs containing user prompts, tool approvals, execution results, and network policy decisions, which OpenAI feeds into an AI-powered security triage agent that correlates endpoint alerts with agent intent to distinguish between legitimate behavior and genuine security incidents.

💡 Auto-review mode is neat, I find Codex almost never prompts me in normal usage. Also, the Codex logs → security triage agent is very interesting, I’m curious to know more. Could you detect when an agent is going off the rails, or prompt injected and doing some C2 behavior? Or detecting an insider threat type situation? Lots of applications 🤔 

Automating Security Operations with AI: Triaging Renovate PRs
Marco Lancini writes up how he combined Renovate with Claude Code Routines to automate the review of dependency update PRs, using a custom Claude skill that posts a structured upgrade risk matrix back to each PR. The skill detects stack type (e.g. Python, JavaScript) from the PR title and classifies bumps as High, Medium, or Low based on semver plus how the package actually behaves (e.g. has a history of breaking changes), not just version distance. From there it greps source code for actual imports to flag dead dependencies, queries Context7 for breaking changes, and scans for deprecated config patterns like TypeScript's baseUrl or Next.js's middleware.ts. The cloud routine fires on each new [RENOVATE]-prefixed PR (Renovate runs monthly), runs the skill read-only without approval prompts, and posts the risk matrix via gh pr comment. A 14-day minimumReleaseAge filter sits in front of the whole pipeline to block supply-chain attacks.

💡 Excellent example of automating a toil-heavy workflow: reviewing package updates. Marco kindly released the full Skill prompt he uses, which is thorough and handles a number of edge cases, and is definitely worth reviewing 🤘 

Sponsor

📣 Adaptive Security: Hyperrealistic Phishing Simulations Across Email, Voice, and SMS

Most phishing simulations are still templated emails. Adaptive runs hyperrealistic multi-channel simulations including AI-generated voice calls, OSINT-based spearphishing tailored to each target, and automated phishing programs that run in the background without manual lift. The result: measurable reductions in click rates, stronger security behaviors over time, and a workforce that's actually prepared for the threats hitting their inbox today. Rated 4.9/5 on G2 and Gartner.

👉 See It in Action 👈

AI-powered spearphishing and deepfakes are pretty worrying to be honest, they’re getting quite good. I’m glad people are working on this ✊ 

Cloud Security

AWS Security Agent adds verification scripts for pentest findings
AWS Security Agent now automatically generates executable verification scripts for each confirmed penetration test finding. Verification scripts include setup instructions, documented environment variables, and redacted sensitive values.

💡 Many dynamic analysis tools have been generating curl requests, PoC scripts, etc. that reproduce findings for a decade+, long before LLMs (shout-out Burp Suite, my BFF during my consulting days). And of course fuzzers do this by construction. It seems like auto-generating PoCs is or will be table stakes for any security tool that finds vulnerabilities, which honestly is kind of a cool world to be living in.

Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments
Datadog's Seth Art introduces Pathfinding Labs, a collection of 100+ intentionally vulnerable AWS environments deployable via Terraform for practicing cloud attack paths and validating detections. The project ships a Go CLI tool (plabs) for deployment and a web catalog at pathfinding.cloud/labs with per-lab documentation. Scenarios cover self-escalation (a role granting itself admin via PutRolePolicy), one-hop and multi-hop privilege escalation chains, CSPM misconfigurations and toxic combos like a public Lambda with an admin role, and cross-account paths from dev or ops into prod. Each lab includes a demo_attack.sh script that walks the exploitation chain step-by-step, with cleanup scripts to revert artifacts after testing.

💡 Love all the OSS tools and labs that Seth and Datadog put out. Awesome!

Paved With Intent: ROADtools and Nation-State Tactics in the Cloud
Palo Alto Networks' Bill Batchelor and Eyal Rafian give an overview ROADtools, an open-source Python framework that nation-state actors like Cloaked Ursa (APT29) and Curious Serpens (APT33) have weaponized for cloud attacks, including how ROADtools evades detection and how these threat actors misuse it. The post discusses ROADtools’ roadrecon module for Entra ID enumeration via the Microsoft Graph API, the roadtx module for token manipulation, device registration, and MFA bypass, and categorize functionality in MITRE ATT&CK. They conclude with preventive controls to limit token misuse, and Cortex XQL detection queries.

💡 In security, you either die young or live long enough to see threat actors using your tools for ill.

Supply Chain

We hardened zizmor's GitHub Actions static analyzer
Trail of Bits's Alexis Challande writes up a three-month collaboration with the zizmor maintainers to bring its YAML anchor support up to full coverage, prompted by the March 2026 supply-chain attack where attackers exploited a pull_request_target misconfiguration in aquasecurity/trivy-action to backdoor LiteLLM. Zizmor’s anchor support had been best-effort since GitHub Actions added native YAML anchors in September 2025. The team fixed parsing bugs that caused crashes and wrong-location findings, surfaced deserialization edge cases that broke zizmor on otherwise valid workflows, and aligned zizmor's expression evaluator with GitHub's Known Answer Tests, validating the work against a corpus of 41,253 workflows from 6,612 high-value open-source repositories.

The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)
Wiz's Shay Berkovich found vulnerabilities in AI-powered GitHub Actions from OpenAI, Anthropic, and Google affecting repositories with 200,000+ combined stars. Among them, openai/codex-action and anthropics/claude-code-action rely on syntactical permission checks that let attackers impersonate trusted apps when allow-bots is enabled (or if a name is available to be registered, a “Dangling GitHub Apps” attack). Dependabot Deputy Confusion Injection has attackers issue @dependabot commands so dependabot appears as the github.actor on a PR, slipping past allow-lists.

Shay describes how some common authentication Actions create sensitive local secret files at runtime (e.g. GCP service account keys or others that often grant infrastructure-level access). Verbose modes in claude-code-action and run-gemini-cli leak these files via workflow logs even when the model refuses direct exfiltration.

Red Team

microsoft/RAMPART
By Microsoft: RAMPART (Risk Assessment & Measurement Platform for Agentic Red Teaming) is a pytest-native framework for safety and security testing of agentic AI applications that enables developers to write structured tests, with evaluation-driven assertions checking agent behavior against each scenario.

Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound
SpecterOps' Andrew Gomez and Andrew Luke release TailscaleHound, a BloodHound OpenGraph collector that maps Tailscale environments as queryable attack paths. It models users, devices, groups, tags, ACLs, grants, SSH rules, routes, app connectors, keys, and hybrid Azure identity links under the TS namespace.

Collection runs through the Tailscale API with read-only OAuth credentials, with optional tailcontrol cookie enrichment. Without API access, local collection works from tailscale status --json output, optionally enriched with an Access Policy file. From there, saved Cypher queries answer who can reach a given device, who can SSH as root, which subnet routes expose internal CIDRs, and which Azure users inherit Tailscale access through TS_AZUserSyncedToUser bridge edges.

AI + Security

Introducing KeyLedger: Because You Probably Don't Know How Many AI Keys Your Org Has
Riptides' Balint Molnar open-sources KeyLedger, a Go TUI for inventorying AI provider API keys across OpenAI, Anthropic, Google Cloud Vertex AI, and AWS Bedrock through their admin APIs. KeyLedger normalizes each provider's different organizational structure into a single table, with automatic health scoring flagging stale, idle, and never-used keys. SQLite snapshots let you diff inventories between runs to track new keys, revocations, and status changes over time. The TUI handles interactive exploration, and watch mode polls providers continuously and runs as a Docker container for long-running deployments.

Attacking Production Apps Without Jailbreaking the Model: Scope Manipulation with scopeshift
OFFENSAI's Eduard Agavriloae releases scopeshift, an open-source tool demonstrating how AI coding agents can be tricked into attacking production targets while believing they're testing localhost, bypassing jailbreaking entirely through network-layer deception rather than adversarial prompting. Scopeshift works as a reverse proxy on 127.0.0.1 that rewrites responses (stripping CDN headers, rewriting URLs, replacing titles with "Dev Build — Local") and provides a deceptive MCP server that always returns "in scope" authorizations.

Testing showed that without safety prompts, Claude Opus 4.7 voluntarily called the MCP oracle and sent seven SQL injection payloads to the real OFFENSAI website, but a one paragraph safety prompt caused the model to refuse after recognizing that in-band signals (MCP responses, DNS, TLS, page content) cannot validate themselves.

Misc

AI

• Every - AI Was Supposed to Save Time. Why Am I Busier?

• Leila Hormozi - AI Is Making Your Thinking Worse (And How to Fix It)

• Alex Hormozi - The New Way of Making Content In The Age of AI

• Matt Turck - OpenAI's Yann Dubois: Why AI Progress Suddenly Feels Real - Really helpful overview of the different parts of model training

• Tim Ferriss - The AI Frontier and How to Spot Billion-Dollar Companies Before Everyone Else — Elad Gil

• Bun ported from Zig to Rust in 6 days using AI

Humor

• If Lin-Manuel Miranda wrote Defying Gravity from Wicked 😍 

• Dr. Seuss Rap

• SNL - Weekend Update: Mr. On Blast Speaks His Mind Again Without Holding Back - This killed me 😂 

• Good Work - What does Meta actually do now?

• SNL - Mom Movie Trailer

Misc

• Paper - Didgeridoo playing as alternative treatment for obstructive sleep apnea

• Magnifica Humanitas: on Safeguarding the Human Person in the Time of AI - I didn’t have “the pope writes a screed on AI” on my 2026 bingo card, but here we are

• r/bugbounty - I’m a former H1 Triager AMA

• Your Life in Weeks - Create a map of your life where each week is a little box. Inspired by Tim Urban’s blog.

• How Diamonds are Made - Cool visualization

• Palette Inspiration - Explore color palettes extracted from thousands of masterworks - from Renaissance elegance to Impressionist light. Super cool!

• Bryan Johnson - You’re Exercising Wrong

• Vik White & Urban Theory at the Red Bull Dance - Sick 🤯 

• Google leaks details for Chromium bug that can turn browsers into bots - Reported over three years ago, made public but then wasn’t actually fixed.

• Krebs on Security - CISA Admin Leaked AWS GovCloud Keys on Github

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🍦 Ice Cream Bonding

There’s this Mediterranean place I like to go to sometimes, Souvla, that has delicious frozen Greek yogurt you can get with baklava on top.

It’s helped me power through many a late night writing tl;dr sec. Like tonight 😅 

I’ve gradually started befriending the manager over time, over a series of froyos.

We’ve discussed how it’s sometimes difficult to make new (deep) friends as you get older, some of his work challenges, and more.

All from periodic 5 minute conversations.

It makes me think that most people probably have a lot to open up and share about, if you create a little space for it.

Anyway, I’m not saying frozen yogurt is the key to adult friendship, but I’m not not saying that.

Maybe community is built less through grand gestures, and more through remembering someone’s name, asking one more question, and occasionally adding baklava.

Sponsor

📣 State of AI in the Cloud 2026:
How AI Is Reshaping Cloud Security

AI is no longer a standalone tool, it’s embedded across cloud environments, development workflows, and production systems.

The State of AI Report reveals how AI adoption is expanding the attack surface, accelerating attacker behavior, and introducing new risks through agents, copilots, and automation.

Get the data behind what’s changing and what security teams need to do about it.

👉 Read the Report 👈

AppSec

The down fall of bug bounties
Assetnote Searchlight Cyber’s Shubham Shah reflects on how AI has impacted bug bounty: skilled researchers are submitting higher quality reports faster with AI assistance, but platforms are overwhelmed by low-quality AI-generated submissions. Shubz isn’t pleased with current solutions from HackerOne (fighting AI with AI) and Bugcrowd (spam controls), finding despite him hacking on Uber’s bug bounty program for almost ten years and ranked #1 on their public program, and his recent high impact submission took 12 days to get a response instead of previously 1-3 days.

The security policy rollout survival guide
The blog version of Oblique's Maya Kaczorowski’s BSidesSeattle talk. Maya outlines a practical framework for rolling out security policies, emphasizing that successful implementation requires getting stakeholder input from engineering, product, SRE, and IT before defining controls, then running a pilot with representative users across diverse roles and platforms to identify edge cases and validate that controls actually work.

She emphasizes the importance of communicating changes through multiple channels (email, Slack, all-hands), making policy enforcement visible to users so they can see how they compare to peers, and ensuring the policy owner (not IT) handles ongoing enforcement and user friction.

How OLTs may have exposed entire ISP networks
Quarkslab's Mathieu Farrell describes a chain of pre-auth RCEs against network vendor VSOL's GPON OLT (Gigabit Passive Optical Network Optical Line Terminal) hardware and its Cloud EMS fleet manager that together can take over an ISP's entire fiber network.

Farrell found three pre-auth command injection bugs in the V1600 OLT models (SNMP traceroute, TACACS+ login, web traceroute), all share the same default admin credentials hardcoded in the firmware, plus an arbitrary file upload RCE in Cloud EMS that allows JSP webshell deployment with root access. The post shows how attackers could chain these vulnerabilities, starting from exposed OLTs or the cloud manager, to compromise entire fleets of devices across ISPs in countries including the US, India, Turkey, Taiwan, Brazil, and Mexico.

💡 Yikes 😅 

Sponsor

📣 Are your developers --
dangerously-skipping-permissions yet?

Agents writing code is easy. Trusting what those agents are doing is hard. Minimal hands your devs isolated, declarative environments that run identically for humans, agents, and CI. Reproducible by default, local first.

👉 Learn more 👈

OK this looks really cool. Performant + sandboxed local dev environment, curated open-source packages compiled from source (in a SLSA-compliant environment), network connectivity and filesystem access must be explicitly declared in Build Specifications and more.

I got nerd sniped reading about Minimal, sounds thoughtfully designed for both engineering and security. I’m going to read more about this later.

Cloud Security

Quicklinks

• AWStrology: What Star Sign Is Every AWS Service?

• AWS for Idiots - AWS described via comics

• Corey Quinn - S3 Is Not a Filesystem (But Now There’s One In Front of It) - “…AWS pricing is where dreams go to get itemized.” 😂 

The AWS Bedrock API Keys Security Guide Part 2: Detection, Prevention, and Response
BeyondTrust's Sergio Garcia continues his team's AWS Bedrock API key research with a follow-up covering detection, defense, response, and migrating to STS. The post includes CloudWatch Logs Insights queries, EventBridge patterns, and SIEM rules to identify unauthorized usage of bearer tokens, including detection logic for privilege escalation attacks where attackers create IAM access keys for BedrockAPIKey-* users, anomalous usage patterns based on IP ranges and operating hours, and suspicious user agents like python-requests or curl instead of AWS SDKs. The post concludes with defense controls (SCPs, model invocation logging) and incident response approaches.

The BeyondTrust team has also released Bedrock Keys Security, an open-source CLI covering that can detect phantom IAM users, decode leaked AWS Bedrock API keys, + SCPs + SIEM detection rules.

Supply Chain

git-pkgs/proxy
Tool by Andrew Nesbitt that runs as a caching proxy for 20+ package registries (npm, Cargo, PyPI, Maven, NuGet, Docker/OCI, Debian/RPM) with a configurable version cooldown that quarantines newly published packages for a set period before they're available to builds. It supports per-package cooldown overrides, SBOM-driven cache pre-population, a REST API for vulnerability scanning, and Prometheus metrics.

Detecting CI/CD Supply Chain Attacks with Canary Credentials
Tracebit's Alessandro Brucato released a free GitHub Action that drops canary AWS credentials and SSH keys into CI/CD workflows to detect credential exfiltration from compromised pipelines. The action writes canaries to ~/.aws/credentials, ~/.ssh, environment variables, and runner process memory at workflow start, then alerts when any of them is used. Alessandro validated it against the TeamPCP supply chain campaign that compromised Trivy, KICS, LiteLLM, and Telnyx and confirmed the canaries would have caused alerts capturing the affected repo, workflow, job, commit SHA, run ID, and attacker IP.

Unmasking the Docker ONBUILD Supply Chain Attack Vector
O3-Cyber's Audun Mo describes how Docker's ONBUILD directive creates a hidden supply chain attack vector. When a parent Docker image contains ONBUILD instructions, those commands automatically execute during downstream builds with complete access to the child project's files, environment variables, and secrets. Mo demonstrates three attack patterns, including stealing build secrets by accessing common secret identifiers (npm_token, github_token) and sending them to external servers via curl, manipulating project dependencies by modifying package.json files to pin vulnerable software versions, and achieving RCE by injecting malicious commands through curl | sh.

O3-Cyber released Onbuild Guardian, an open-source tool that examines Docker images using docker inspect to identify and manage ONBUILD instructions through allowlists. Mo recommends pinning base images by SHA256 digest rather than tag, and using secret mounts rather than ENV, ARGs, or .env files.

Blue Team

LLM Honeypot vs. Cryptojacking: Understanding the Enemy
Beelzebub's Mario Candela deployed his low-code SSH LLM honeypot with GPT-4o and a list of weak passwords to attract bots. It logged a cryptojacking bot's full attack chain. The bot fingerprinted the kernel and GPU, swapped the root password and killed prior miners with pkill, then downloaded a c3pool installer tied to a hardcoded Monero wallet that had accumulated roughly 20 XMR (~$4,126). Candela reported the wallet to c3pool, who pulled every infected miner using it.

Tales of an Ollama Honeypot (Part 1): Abuse Patterns
Marco Pedrinazzi deployed an Ollama honeypot on a VPS, let Censys and Shodan index it, and logged 6,461 events from 324 unique IPs over 32 days. Most IPs enumerated the server, then sent short liveness prompts like greetings or arithmetic to see whether it was worth deeper testing, hitting both Ollama's native API and its OpenAI-compatible endpoints. The honeypot also caught prompt injection wrapped in fake "security audit" pretexting to extract system prompts and environment variables, local file disclosure via malicious Modelfiles, and SSRF probes via /api/pull and /api/push.

Marco has also published three detection rules for NOVA, an open-source prompt-pattern-matching framework, covering credential harvesting (env dumps, K8s tokens, cloud metadata URLs), system prompt and Modelfile disclosure, and liveness probing, designed for honeypot deployment.

AI-powered honeypots: Turning the tables on malicious AI agents
Cisco Talos's Martin Lee walks through how generative AI can rapidly deploy adaptive honeypots that masquerade as full computing environments. His implementation combines a listener that accepts network connections, a simulated vulnerability that grants access once triggered, and an AI framework that responds to attacker instructions. By swapping the AI's system prompt, the same code can impersonate a Linux bash shell or a BusyBox-based smart fridge, creating what Martin calls a "hall of mirrors", a controlled environment where attackers see plausible but distorted reflections of real targets and reveal their methodologies in real time. AI-orchestrated attacker tooling trades stealth for speed, making them easier to detect, and the AI agents lack the awareness to spot a fake environment once they arrive.

💡 AI is making honeypots and deception much simpler to do at scale and convincingly. Lots of cool work to be done here.

Red Team

C0axx/CanaryHunter
Tool by Curtis Ringwald for red teamers to spot common canary tokens in docs, configs (AWS, WireGuard, Kube), the Registry, and MySQL dumps before triggering them, with a firewall rule that drops outbound traffic to every known canary IP.

0xNslabs/CanaryTokenScanner
Tool by NeroTeam Security Labs to spot embedded canary tokens and tracking URLs inside Office documents (.docx, .xlsx, .pptx) and PDFs before opening them. The scanner reads Office files as ZIP archives in memory and searches PDFs across both raw bytes and Flate/deflate-decompressed streams, filtering common schema domains to cut false positives.

xFreed0m/ghosttype
Tool by Roei Sherman that extracts credentials from AI tool conversation history for Claude Code, Cursor, Codex CLI, and ChatGPT Desktop. Detection runs TruffleHog as a subprocess in filesystem mode for its 800+ detectors and live verification against provider APIs, paired with an in-tree pattern engine (30 regexes plus 10 heuristic patterns) for loose context signals TruffleHog misses. Findings from either engine link back to the source conversation file with severity, detector name, and verification status, so triage can filter to credentials the provider confirms are live.

AI + Security

Quicklinks 

• You Need AI That Reduces Maintenance Costs - “The math only works if the LLM decreases your maintenance costs, and by exactly the inverse of the rate it adds code.”

• [Free Guide] The 4 steps to get ahead of agentic AI risks - Agentic AI is already inside your organization. And most of the time, nobody in IT or security approved it. This free guide is for security, IT, and risk leaders who need to get ahead of agentic AI, before it becomes a liability.*

• Thousands of Vibe-Coded Apps Expose Corporate and Personal Data on the Open Web - RedAccess’ Dor Zvi found >5K apps from Lovable, Replit, Base44, and Netlify had “no security or authentication”, leaked PII, were phishing sites, etc.

^*Sponsored

Malicious Coding Agent Skills and the Risk of Dynamic Context
Datadog's Nick Frichette and Ryan Simon demonstrate how malicious Claude Code skills can bypass model-level prompt injection defenses using dynamic context commands (!ls syntax), which execute before the model reviews the skill content. They analyzed the Clawsights skill, a real-world credential theft attempt that exfiltrates GitHub tokens, finding that while Claude Opus 4.6 correctly identified and blocked the original malicious skill, adding dynamic context commands allowed the attack to succeed because those commands run during preprocessing.

Recommendations: organizations can mitigate this by setting "disableSkillShellExecution": true in managed settings, review .claude/skills/ directories (including nested folders and --add-dir paths), require code review for .claude/ changes, and monitoring for suspicious patterns like allowed-tools: Bash(*), external URLs, and commands performing reconnaissance or attempting network access.

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)
Asim Viladi built a multi-agent LLM harness that has turned up 30+ findings (20+ CVEs) over the past few months, mostly in network-reachable services. Originally aimed at documentation-code mismatches, the harness two remote unauthenticated out-of-bounds writes in the Linux kernel's ksmbd and a chained unauthenticated RCE-to-root path in CUPS.

Under the hood, the harness chains a target seeder, hypothesis generators reading docs and source for invariants, hunters iterating PoCs in isolated VMs, report writers, and a conductor redirecting stuck agents, with an external grader outside the loop because frontier models will otherwise inflate findings or edit their own objectives. Asim also tried activation steering on the hypothesis generator, both drunkenness for creativity and abliteration to bypass refusals. The drunkenness produced no new vulnerability classes and abliteration ended up being more useful, making models refuse less.

Asim found granular role separation most helps smaller models, as swapping in Codex or Claude collapses the harness into a single end-to-end hunter. In some cases smaller models running for days can match what a frontier model one-shots. Asim's next bets are looped LLMs and RL-trained task decomposition, which would let models do their own scaffolding instead of needing hand-tuned harnesses.

Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark
Microsoft's Autonomous Code Security team, led by Taesoo Kim, built MDASH, their multi-model agentic scanning harness, which has found 16 new Windows vulnerabilities across the networking and authentication stack including four RCEs.

MDASH is structured as an agentic discovery and remediation pipeline that scans, debates, deduplicates, and proves candidate findings, chaining 100+ specialized AI agents across an ensemble of frontier and distilled models, with extensible plugins for Microsoft-specific context foundation models may not have. On benchmarks, it found 21 of 21 planted vulnerabilities with zero false positives on a private test driver, hit 9^% (of 28) and 100% (of 7) confirmed MSRC cases in clfs.sys and tcpip.sys, and scored 88.45% on the public CyberGym benchmark of 1,507 real-world vulnerabilities (prior leader: 83.15%).

The post argues that the orchestration/harness is critical and gives a performance boost over a base model + simple prompt, and that this architecture allows MDASH to absorb future model improvements without being rewritten.

💡 Looks like Microsoft hired Taesoo Kim (the Georgia Tech professor whose Team Atlanta won DARPA’s AIxCC) + a bunch of that team, and that’s now the Microsoft Autonomous Code Security team. Neat. Looking forward to seeing more from them!

Misc

Misc

• An OpenAI model has disproved a central conjecture in discrete geometry

• X thread: GitHub employee had a poisoned VS Code extension → ~3,800 GitHub-internal repos exfiltrated

• kageroumado/phosphene - A video wallpaper engine for macOS Tahoe

• Older Adults Outnumber Children in 11 States and Nearly Half of U.S. Counties - And wait until you see Congress!

• Jen Easterly: A brief note to new cybersecurity grads trying to land that first job - Don’t compete with AI, learn to lead it. Strengthen your technical foundation. Go where the growth is (go to areas that are exploding, not saturated). Find opportunities to build experience.

• Advice Jeff Bezos received early at Amazon: “You have enough ideas to destroy Amazon.”

• wrlovely/years - A personal longevity system built on Claude Code. Your DNA, bloodwork, scans, and visit notes live as markdown in a private git repo, with slash commands to organize and analyze them.

• typefully/minimal-twitter - Minimal theme for Twitter.

• Beatboxing with a dog 😂 

AI + Design

• Claude Code frontend-design Skill

• Introducing Claude Design by Anthropic Labs - Collaborate with Claude to create polished visual work like designs, prototypes, slides, one-pagers, and more.

• OpenAI docs - Designing delightful frontends with GPT-5.4

• cyxzdev/Uncodixfy - A rule set that forces Codex models to stop relying on its usual UI habits.

• Introducing ChatGPT Images 2.0 - Some pretty impressive example images

• An attempt to detect AI design patterns in Show HN pages

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

☀️ My Least Favorite Type of Tan(Stack)

I had a fun personal anecdote to share but I didn’t have time to write it up this week.

For now, #HugOps to everyone dealing with yet another supply chain attack.

I hope you’re getting the support you need 🫂 

Sponsor

📣 Cloud Security Has Changed.
Has Your Strategy?

Agentic AI is reshaping cloud risk. AI agents, machine identities, and distributed data systems are creating new privilege pathways, dark data, and attack surfaces that traditional posture tools were not built to govern. Join Palo Alto Networks product leaders to learn how Cortex Cloud helps teams secure identity, data, and AI across the modern cloud stack.

👉 Watch Webinar 👈

AppSec

V4bel/dirtyfrag
Dirty Frag, discovered and reported by Hyunwoo Kim, is a universal Linux LPE vulnerability class that chains two page-cache write bugs (xfrm-ESP and RxRPC) to achieve deterministic root privilege escalation without race conditions across major distributions including Ubuntu, RHEL, Fedora, and openSUSE.

Copy Fail Flaw: 5 YARA Rules for Detection and Remediation
ReversingLabs' Maik Morgenstern covers Copy Fail (CVE-2026-31431), a Linux kernel privilege escalation that lets any unprivileged user write 4 bytes into the in-memory copy of any readable file, including system binaries like /usr/bin/su. That's enough to neuter the password check, so the next run of su returns a root shell. The on-disk file is never touched, so standard file integrity tools see nothing. The exploit runs identically on every major Linux distribution shipped since 2017, making shared-kernel environments (multi-tenant servers, CI/CD pipelines, container clusters) the highest-risk targets.

Within a day, ReversingLabs had observed more than a dozen variants in the wild, including compiled C reimplementations of the original PoC and a separate rootsecdev toolkit that targets /etc/passwd instead of /usr/bin/su. Most were trivial reformattings with different hashes but identical execution, so ReversingLabs built a five-tier YARA ruleset anchored on a cryptographic string the exploit fundamentally depends on. High-confidence rules catch the original Theori PoC and the rootsecdev toolkit. Medium-confidence rules cover reimplementations of the core technique along with compiled and dropper variants. A broad hunting rule covers Python, C, and Go variants that combine the cryptographic string with a known target binary.

Sponsor

📣 Browser & identity attacks matrix —
open-source from Push Security

Most attack frameworks weren't built for how breaches actually happen today. Attackers don't need network access or endpoint compromise; they go straight for the browser and identity layer. Push Security's Browser & Identity Attacks Matrix maps 51 techniques across 10 tactic phases, covering AiTM phishing, ClickFix, device code phishing, OAuth consent abuse, extension supply chain attacks, and more.

It's open-source, community-maintained, and built for how modern attacks actually work.

👉 Map your identity attack surface 👈

This is super cool! Probably the best breakdown I’ve seen of modern browser and identity based attacks, including some subtle stuff + a number that Push Security discovered iirc. And neat that it’s open source 👍️ 

Cloud Security

BigQuery threat model report
Google Cloud published a threat model for BigQuery covering 14 attack vectors across data confidentiality, integrity, and availability, each mapped to STRIDE categories and MITRE ATT&CK tactics. The model surfaces schema tampering to corrupt downstream pipelines, privilege escalation and service account impersonation, data exfiltration via export jobs to attacker-controlled Cloud Storage buckets, persistence through hard to detect IAM bindings on datasets or scheduled queries, spoofing via leaked service account keys or OAuth tokens, and cost-based denial of service from resource-intensive queries that drain on-demand budgets or starve slot capacity for other users.

The recommended mitigations are mostly standard cloud hygiene anchored in BigQuery specifics, including least privilege IAM with regular audits via Security Command Center, VPC Service Controls perimeters to limit egress, Cloud Audit Log monitoring for suspicious calls like SetIamPolicy and datasets.patch, Workload Identity Federation instead of service account keys, custom query quotas to bound DoS impact, and table snapshots for recovery.

The vulnerabilities include “JIT ghost identity” creation, provider collision via Unicode homoglyphs (one IdP using a Cyrillic character that passes as distinct from its ASCII twin), username parsing attacks where security checks and downstream code disagree on the <ProviderName>_<sub> format, and IdP identifier hijacking where unclaimed email domains route auth flows to providers an attacker controls. All four come from the same mistake. Security sensitive attributes like tenantID or role get read straight from federated tokens an attacker controls, rather than computed on the server from a verified email domain. AttributeMapping makes this worse. A malicious IdP can inject arbitrary values into custom user attributes, bypassing Cognito's write controls.

Supply Chain

Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
Wiz's Rami McCarthy, Amitai Cohen, and Benjamin Read describe the most recent Internet-is-on-fire npm supply chain attack by TeamPCP that compromised TanStack, UiPath, and Mistral AI packages. The GitHub Actions exploit chain: the forked a repo and renamed it (to evade fork-list searches), oopened a PR that triggered the pull_request_target workflow, the attacker’s fork code poisioned the GitHub Actions cache with a malicious pnpm store, and when a legitimate maintainer PR was later merged into main, the release workflow restored the poisoned cache. The attacker-controlled binaries then extracted OIDC tokens directly from runner process memory to publish malicious packages without stealing npm credentials. The post provides IOCs, detection guidance, and remediation steps.

YMMV but I came across these:

• GLPMC/Tanstack-Worm-Detector

• omarpr/mini-shai-hulud-ioc-scanner

Shai-Hulud Goes Open Source
Datadog's Ryan Simon, Sebastian Obregoso, and Greg Foss analyze the complete source code of the Shai-Hulud offensive framework attributed to TeamPCP, which was briefly published on GitHub before being removed. The TypeScript/Bun-based modular toolkit harvests credentials from 100+ file paths, extracts GitHub Actions Runner.Worker memory via /proc/<pid>/mem, enumerates AWS Secrets Manager/SSM across 17 regions, and exfiltrates data using hybrid encryption to git-tanstack[.]com or GitHub dead-drop repos.

The framework poisons npm packages via stolen tokens and OIDC abuse while forging complete Sigstore provenance bundles (Fulcio certificates + Rekor transparency logs), establishes persistence through VSCode tasks and Claude Code SessionStart hooks, and implements a destructive deadman switch (rm -rf ~/) that triggers on GitHub token revocation. 19 of 22 previously documented TeamPCP TTPs are present in the codebase.

💡 Great breakdown, and honestly pretty thoughtful tooling.

Blue Team

ridgelinecyberdefence/vanguard
Tool that packs the full incident response lifecycle into a single Go binary, including Velociraptor, Volatility, KAPE, and the standard forensics stack, plus 28 MITRE-mapped IR use cases (ransomware, BEC, lateral movement, credential theft, rootkit detection). Runs on Windows or Linux with built-in case management, tamper-evident evidence handling, and full air-gapped support.

gadievron/honeyslop
Gadi Evron, John Cartwright, Daniel Cuthbert, and Michal Kamensky created honeyslop, a collection of deliberately vulnerable-looking code canaries designed to identify AI-hallucinated vulnerability reports by embedding unique UUIDs, fake function names (like zqx_tarnish_v3), and a fabricated CVE-2025-99919 that self-identify slop reports when grep'd.

💡 “Quick PoC, vibe-coded as a joke (not production-grade),” but I like the idea.

referefref/OpenAIPot
Tool by James Brine that poses as an OpenAI-compatible API endpoint to catch attackers using stolen or planted credentials. Valid keys pass through to OpenAI, while decoy keys trigger a system prompt swap that injects deceptive content into the response. Repeat attempts trigger IP blocking with realistic out-of-tokens errors so attackers don't realize they've been caught, and logs feed into SIEMs and Slack via integrations mapped to MITRE Engage.

Red Team

We get paid to break into buildings for a living. Ask us anything!
Reddit AMA with TrustedSec's Paul Koblitz, Costa Petros and David Boyd answering questions about physical penetration testing, drawing on years of experience breaking into buildings for clients.

Redefining AI Red Teaming in the Agentic Era
Dreadnode's Raja Sekhar Rao Dheekonda released an agentic AI red teaming system built on their open-source SDK (45+ attack strategies, 450+ prompt transforms, 130+ scorers). The operator describes the objective in plain English, and the agent selects attacks and transforms, generates an executable workflow, runs it with full tracing, and returns a structured assessment with severity ratings and compliance tags. That's the orchestration work operators currently do by hand with frameworks like PyRIT, Garak, and Promptfoo. The methodology and full attack catalog can be found in the arXiv paper.

In a case study against Meta's Llama Scout, the agent ran 674 attacks across 68 harmful-content objectives in 3 hours with zero code, succeeding 85% of the time and identifying 232 critical findings. Across the three jailbreak strategies tested, Crescendo (gradual conversational escalation) and Graph of Attacks (exploring prompt variations) both hit 100%, while Tree of Attacks (branching prompt search) needed about three times as many tries to reach 96%. Even asking plainly, with no jailbreak technique at all, still produced harmful content 80% of the time.

Elze recommends leaning on layers attackers can't study as easily: host hardening (WDAC, ASR rules, LSA Protection), SIEM detections built on raw telemetry rather than EDR verdicts, and identity-layer detection (Entra ID risk policies, token theft indicators, directory changes).

AI + Security

distil-labs/distil-ai-slop-detector
Chrome extension by Distil Labs that detects AI-generated text with a smaller, 242MB fine tuned model (Gemma 3 270M with GPT OSS 120B (teacher)) that can run entirely in-browser, plus a Claude Desktop skill and CLI for training your own classifiers using the same distillation pipeline.

Daybreak: Frontier AI for cyber defenders
OpenAI announces Daybreak, which seems like their version of Project Glasswing, with an extra focus on making software resilient by design. “Defenders can bring secure code review, threat modeling, patch validation, dependency risk analysis, detection, and remediation guidance into the everyday development loop so software becomes more resilient from the start.” Partner quotes from Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Akamai, and Fortinet.

Mythos finds a curl vulnerability
Daniel Stenberg digs into the Mythos scan of curl's 178K lines of C. The report flagged five "confirmed" vulnerabilities, but after the curl security team's review three were documented API behavior, one was "just a bug," and only one became a low-severity CVE. The results match what curl has already seen from AISLE, Zeropath, and OpenAI Codex Security, which together triggered 200 to 300 bugfixes over the past 8-10 months. Daniel so far finds that AI tools are good at finding usual and established kinds of errors, not (yet) finding novel kinds of bugs.

“My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos.”

Behind the Scenes Hardening Firefox with Claude Mythos Preview
Mozilla's Brian Grinstead, Christian Holler, and Frederik Braun detail how Mozilla built an agentic harness on top of their existing fuzzing infrastructure that writes and runs reproducible test cases to confirm bugs, scales across ephemeral VMs, and integrates with their security lifecycle for dedup, tracking, and triage. Running Claude Mythos Preview, Mozilla found 271 bugs in Firefox 150, including sandbox escapes, race conditions, and use-after-free bugs that fuzzers miss.

Audit logs also validated existing defenses, showing the model repeatedly trying prototype pollution sandbox escapes only to get shut down by Mozilla's frozen-prototypes architecture. Looking ahead, Mozilla plans to wire the pipeline into CI to scan patches as they land, and recommends other projects build similar pipelines now.

💡 Great example of the power of a target-specific (in this case, Firefox) harness providing additional value on top of a capable underlying model. I also liked: the description of building a hardening pipeline, how the right architecture eliminated classes of vulnerabilities, and more context around the number and type of bugs found.

Misc

Misc

• Interesting photography trick examples

• Aakash Gupta - The future of cinema is ScreenX, a 270-degree field of view

• Relentless - How to Start a Cult | Lulu Cheng Meservey

• Ari at Home meets Wayne Brady - Freestyle creating beats and rapping

• Turning my toddler’s stories into songs - Catchy actually, and 🥹

• Best Crazy Frog Remix

• Why are chains used to guide rain down? - Apparently someone is creating informational songs around random facts. Probably the music, script, and video shots are all AI generated. Kind of interesting though.

Tech

• facebookincubator/below - A time traveling resource monitor for modern Linux systems

• GitLab Act 2 - Open letter from GitLab that they’re restructuring, and a likely “workforce reduction”

• Building for the future - Cloudflare is laying off 1,100 (~20%) employees to prepare for “the agentic AI era”

AI

• OpenAI Flips the Script - Every CEO Dan Shipper explains why OpenAI’s coding app has become his daily driver for work, head of growth shares useful workflows.

• Fiona Fung, Eng Director for Claude Code - Running an AI-native engineering org

• Claude for Creative Work - Anthropic released MCP connectors that integrate Claude with creative software including Blender, Autodesk Fusion, Adobe Creative Cloud, Ableton, Splice, SketchUp, Resolume, and Affinity by Canva.

• Agents for financial services and insurance - Anthropic released ten agent templates for financial services workflows including pitch building, KYC screening, and month-end closing, available as plugins in Claude Cowork/Code or as cookbooks for Claude Managed Agents. Repo: anthropics/financial-services.

• Theo on Anthropic, Cursor, and xAI/SpaceX - Some interesting (potential) dynamics I hadn’t though of

• Pieter Levels - Replaced all his Chrome extensions with his own vibe coded one

• Your CEO is suffering from AI psychosis

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🫶 Friend Visit

Last weekend I visited my good friend Aaron and his partner, staying at their place in southern California, and it was delightful.

There’s something special about meeting a friend’s partner and seeing their place, you get such a lovely insight into who they are and what they value. The bookshelves, the photos from their couple trips, the unique items they’ve picked up along the way.

We played a few rounds of this board game, Forbidden Island, which was a lot of fun, would recommend. Clint analytical brain was fully engaged, and people were amused 😅 

I managed to delay doing an AI-powered Deep Research about optimal strategies until I was at the airport on the way back. It wasn’t easy.

Aaron was a work friend who became a normal friend over many Wednesday dinners. And after several months I got upgraded to his non burner phone (not a joke) 🙌 

We had talked about me coming down to stay with him for a weekend… and I actually did it! It was kind of going out on a limb, as we’d never spent more than a few hours together at a time, but I’m really glad I did. We had a great time, and I feel like we grew a lot closer in just a few days.

Maybe there’s someone you really click with at work or from some hobby, and if you put yourself out there and spend more time with them (even if it feels cringe to ask), that could end up being a great friendship 🤔 

Sponsor

📣 AI ROI: You know the AI bill, but what are the outcomes?

Leadership is asking: are we getting value from AI? Which tools are worth the spend? Where are we exposed? Right now, most teams can only answer with invoice data.

Harmonic Security Usage Explorer closes that gap. It automatically classifies every AI interaction across your organization into the use cases driving real work, specific to your business. Get actual patterns to understand how your teams use AI, how much time they spend, the cost, and where risk lives.

CIOs rationalize spend, CISOs get risk in context, & AI committees get proof of impact.

Early access is now open. Request your spot.

👉 Get early access 👈

AppSec

The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework
Jonathan Dunn reverse-engineered the URL decoding pipelines of 8 major frontend frameworks (React Router, Next.js, Vue Router, Angular, SvelteKit, Nuxt, Ember, and SolidStart) to understand how Client Side Path Traversal (CSPT) vulnerabilities arise when encoded slashes (%2F) in dynamic route parameters get decoded and interpolated into fetch URLs. Labs GitHub repo.

💡 Wow, super detailed, awesome post. Also, this story about Jason Haddix’s mentorship 🥹

C/C++ checklist challenges, solved
Trail of Bits recently added a C/C++ security checklist to their Testing Handbook, and in this post, Graham Sutherland and Paweł Płatek share walkthroughs of two C/C++ challenges. They also released c-review, a Claude skill that runs the C/C++ checklist as LLM prompts against a codebase, tuned to the platform and threat model.

The first challenge is a Linux ping program with a command injection bug, where two undocumented behaviors in standard IP address functions (one accepting trailing garbage, the other reusing a shared buffer between calls) let an attacker bypass the input validation. The second is a Windows driver where a missing safety flag and an incomplete registry read combine to escalate from a local crash to full kernel code execution. By planting two crafted registry values, an attacker tricks the driver into copying arbitrary data onto the kernel stack and overwriting a function pointer.

Sponsor

📣 Adaptive Security: Security Awareness Training Built for AI Threats

AI is changing how attacks are executed. Deepfakes, voice clones, and AI-generated spearphishing across email, SMS, and voice are now table stakes for attackers. Adaptive Security's next-generation platform simulates these exact threats, scores individual employee risk using real behavior and OSINT exposure, and auto-delivers personalized training tied to what each person experienced. Trusted by security teams at PayPal, Ramp, Bose, and more. 

👉 Book a Demo 👈

There’s been a big rise in AI-powered deepfake attacks, it’s great to see people tackling it 👍️ 

Cloud Security

Global S3: Another C2 Channel for AgentCore Code Interpreters
Sonrai's Nigel Sood builds on Kinnaird McQuade‘s prior research on DNS-based exfiltration from sandboxed AWS Bedrock AgentCore Code Interpreters, showing that the interpreter's documented global S3 access can also serve as a bidirectional Command & Control (C2) channel. Sood extended McQuade's open-source PoC so a client inside the sandbox polls an external bucket for shell commands, executes them, and writes output back via presigned PUT URLs. Unlike the DNS path AWS has since mitigated, this isn't a Bedrock vulnerability since S3 access is intended behavior, so customers have to handle it themselves. Sood recommends VPC mode with Gateway Endpoints and strict Endpoint Policies limiting access to specific buckets.

AWS Credential Isolation for Local AI Agents
EngSecLabs' Alex Smolen walks through how to safely hand AWS credentials to local AI agents, recommending combining elhaz, a credential broker daemon that manages auto-refreshing STS credentials via Unix socket, with trailtool for generating least-privilege IAM policies from CloudTrail logs (based on what the agent actually uses).

Alex arrives at this recommendation based on challenges with other approaches: environment variables leak to every process and only capture a snapshot that expires mid-session, mounting ~/.aws/ hands over every profile on the host (and agent deny lists don't catch bash subprocesses reading the file directly), and metadata emulation breaks on macOS because Docker Desktop's loopback doesn't reach the host. Sockets sidestep all of that because the mount itself becomes the access control. If you don't bind the socket into a container, the credentials don't exist there at all, so each agent ends up with its own scoped identity by default.

What the March 2026 Threat Technique Catalog update means for your AWS environment
AWS' Shannon Brazil and Cydney Stude documented three new threat techniques the AWS Customer Incident Response Team has seen in live incidents. Attackers are abusing Cognito refresh tokens (30-day default, configurable up to 10 years) to maintain access without invalidating legitimate sessions, using ec2:DeregisterImage to permanently delete AMIs (unrecoverable unless Recycle Bin retention is enabled), and using UpdateAssumeRolePolicy to attach new principals to existing IAM roles instead of creating new ones.

The post emphasizes that attackers are increasingly using legitimate AWS API calls in illegitimate contexts rather than exploits, requiring security teams to monitor for contextual anomalies like unexpected principals or timing. Most cloud monitoring is tuned for creation events (new roles, new logins, new AMIs) and rarely covers modifications or token refreshes on what's already there. AWS published CloudTrail detection queries for each.

Supply Chain

Quicklinks

• BSidesSF 2025 talk - Scalably Securing Third-party Dependencies in Heterogeneous Environments by Anthropic’s Ziyad Edher and Chris Norman

• Are you prepared for Mythos? Stay ahead of zero-days with Chainguard - AI is finding and weaponizing zero-days faster than any disclosure process can publish them. The answer isn't patching faster. When a registry gets poisoned, you don't want to beat the clock. You want to be on a supply chain the attack never touches.*

• NIST Updates NVD Operations to Address Record CVE Growth - Due to a 264% surge in CVE submissions between 2020 and 2025, going forward NIST will only enrich CVEs: in CISA's KEV catalog, affecting critical software, and software used within the federal government.

_*Sponsored

FilippoBau/depcut
Tool by Filippo Baudanza that cuts Dependabot noise by checking whether vulnerable npm symbols are actually imported in JavaScript/TypeScript codebases. It parses imports with tree-sitter, extracts vulnerable symbols from GHSA data (with an optional LLM fallback), and matches them against a lockfile-scoped dependency graph to classify each alert as REACHABLE, UNREACHABLE, or INDETERMINATE, and outputs JSON or SARIF for CI pipelines.

Practical Package Security: The Unofficial Guide
Wiz's Rami McCarthy gives a nice survey of actionable best practices to shrink your attack surface, protect execution environments, control package ingestion, and catch compromises early. Rami recommends minimizing dependencies, adding install cooldowns via your package manager or Renovate or Dependabot so the ecosystem catches malware first, locking package versions with hash verification, using wrapper tools like Datadog’s supply-chain-firewall, and turning off install scripts via npm's ignore-scripts or pnpm's onlybuiltdependencies.

Larger organizations can add registry proxies or private package repositories, plus cloud-based development environments and zero trust production to limit damage when malicious code runs. On the detection side, plant honeytokens in CI pipelines.

Blue Team

weirdmachine64/SharkMCP
Tool by Mohamed Benchikh that wraps Wireshark's sharkd interface as an MCP server so LLMs can dig through PCAP files with natural language. Each capture gets its own sharkd subprocess for packet inspection, protocol analysis, conversation tracking, and stream reassembly across TCP, UDP, TLS, HTTP, and VoIP, while heavy queries are cached in memory so pagination stays fast.

Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
SentinelOne's Juan Andres Guerrero-Saade and Vitaly Kamluk uncovered fast16, a 2005 sabotage framework (five years before Stuxnet) that selectively targets high-precision calculation software, patching code in memory to tamper with results to produce inaccurate calculations across an entire facility (e.g. those used in nuclear weapons research). fast16 is the earliest known Windows malware to embed a Lua VM, and combines a wormable Lua-powered binary with a kernel driver that scans executables for 101 code patterns, then surgically rewrites floating-point routines.

The fast16 name had already appeared in the 2017 ShadowBrokers leak inside NSA's Territorial Dispute list, and Unix-style source control markers in the binaries point to long-term development by government or military engineers. The main binary sat on VirusTotal for nearly a decade, missed by almost every antivirus engine, before SentinelLABS pieced it together.

Red Team

tahaafarooq/Fenrir
Tool by Taha Afarooq that uses eBPF to capture SSH, PAM, sudo, and su credentials at the kernel level. The Go agent deletes itself from disk and runs only in memory, poses as a legitimate system process, and exits if it detects defensive tools (Wireshark, Sysdig, Falco, Tetragon), or VM/container environments (Docker, Kubernetes, Cuckoo, Joe Sandbox). Captured credentials are smuggled out over encrypted network traffic to a companion fenrir-channel C2 with a web dashboard.

Mine the Gap: Open-Source Tools for Measuring the AI Offense-Defense Gap
Dreadnode's Jayson Grace and Martin Wendiggensen released two open-source tools for evaluating AI agents in head-to-head red versus blue engagements, since existing benchmarks miss what happens when both sides operate autonomously against shared infrastructure.

DreadGOAD is a fork of the GOAD Active Directory lab packaged for AWS, with Terraform/Terragrunt provisioning, golden AMIs, private networking via SSM, automated validation of 50+ AD vulnerabilities, and a variant generator that randomizes entity names so agents can't memorize their way through. Ares runs on top: seven red team agents (recon, credential access, cracking, ACL abuse, privilege escalation, lateral movement, coercion) reach domain dominance through Golden Ticket persistence in under six minutes with a 95%+ success rate, while three blue team agents (triage, threat hunting, lateral analysis) investigate the same telemetry.

Every attacker action is recorded as ground truth, so blue team agents are scored on how accurately they reconstruct what actually happened, not against static checklists or curated log dumps.

💡 Lots of really cool ideas in this post- automatically generating variants of a vulnerable environment so you can test how agents perform, measuring the performance of red vs blue autonomous agents, recording actions for future ground truth, and open sourcing the core parts 🤘 Great work.

AI + Security

OpenAI releases open-source model that strips personal data from text
OpenAI released Privacy Filter, an open-source 1.5B model that detects and redacts eight PII categories including names, emails, phone numbers, account numbers, and secrets like API keys. It runs locally on a laptop or in-browser with a 128K token context window, uses single-pass labeling instead of generation, and ships under Apache 2.0 on GitHub and Hugging Face.

💡Useful for data loss prevention and log scrubbing, though weaker on non-English text and non-Latin scripts, so keep a human in the loop.

Google wants AI defense to be as fast as AI offense
Frederic Lardinois covers Google Cloud's Next '26 security announcements. Google added three new AI agents to Google Security Operations for threat hunting, detection engineering, and third-party context, alongside an existing triage agent that has processed over 5 million alerts in the past year and reduced 30-minute analyses to roughly 60 seconds. Wiz, recently acquired by Google, extended its AI-Application Protection Platform across Databricks, AWS, Azure, and Salesforce, is adding inline AI security hooks in IDEs and agent workflows, and shipped a dynamic AI-BOM to inventory shadow AI- the AI frameworks, models, and IDE extension in your environment. Mythos Preview will be available through Google’s Vertex AI for defensive use.

Finding Zero-Days with Any Model
Niels Provos argues that discovering novel vulnerabilities with AI is not just a frontier-model capability but an orchestration problem. He demonstrates using his open-source IronCurtain framework with commercial models (Opus 4.6, Sonnet 4.6) and open-weight models (GLM 5.1) that he can replicate Anthropic's 1998 OpenBSD TCP SACK finding and discover new zero-days in widely-deployed software, with each scan costing $30-150 per codebase.

Niels was able to find these vulnerabilities using IronCurtain (which supports arbitrary workflows structured as finite-state machines (FSM) via plain YAML definitions) by building a specialized vulnerability discovery workflow that has a central Orchestrator agent that acts as a strategic router that then decides which specialized agent to dispatch next based on an append-only execution journal.

Introducing AIMap: Security Testing For AI Agent Infrastructure
Bishop Fox's Aashiq Ramachandran announces AIMap, an open-source tool that discovers, fingerprints, scores, and tests internet-exposed AI agent infrastructure by querying Shodan and fingerprinting endpoints across MCP servers, Ollama, vLLM, LiteLLM, LangServe, Gradio, ComfyUI, and other AI frameworks using Nuclei templates and live HTTP checks.

AIMap assigns risk scores (0-10) based on authentication status, exposed tools, CORS policies, TLS configuration, and system prompt leakage, and includes protocol-specific attack modules for MCP servers (tool enumeration, unauthorized tool invocation, and prompt injection via tool descriptions), Ollama instances (model listing, model weight extraction, and prompt injection), and OpenAI-compatible endpoints (model enumeration, completion abuse, and system prompt extraction).

Misc

Misc

• Tin Can - A WiFi landline for kids. It doesn’t have apps, texting, or games—just real conversation with friends, neighbors, Grandma, or whoever you add to your approved contact list.

• The Sites We Lost - Archiving quirky, old websites. Some take me back.

• Inside TIME’s Wild Day with MrBeast

• Morning Brew - Why are the boys tryna get hot all of a sudden? - On Looksmaxxing and medspas.

• Scott Galloway on Diary of a CEO - AI’s impact (or not) on the economy and jobs, the war in Iran, being a parent, and more.

  • I thought Scott had an interesting point on China purposefully “AI dumping” low cost AI via open source models into the U.S. economy to potentially undermine Anthropic, OpenAI, and other companies, as much of the U.S. stock market is essentially a bet on AI, and how that’s similar to how China previously dumped below-cost steel into the U.S. market, which largely wiped out American steel.

  • Also: “The receipts for love are grief.” 🥹

Tech

• Mitchell Hashimoto - Ghostty Is Leaving GitHub

• NPR went looking for Polymarket's Panama headquarters. It's elusive

• Joe Hudson - AI and The Return to Being Human

• Mark Zuckerberg ‘Personally Authorized and Actively Encouraged’ Meta’s Massive Copyright Infringement to Train AI Systems, Publishers and Scott Turow Allege in Lawsuit

• Coinbase CEO Brian Armstrong’s tweet on letting go of 14% of Coinbase - Is a crypto company firing a number of its employees a job rug pull 🤔 

AI

• An open-source spec for Codex orchestration: Symphony - OpenAI describes building Symphony⁠, an agent orchestrator that turns a project-management board like Linear into a control plane for coding agents. Every open task gets an agent, agents run continuously, and humans review the results. Wow, this is really cool 👍️ 

• Where the goblins came from - Fascinating story about how OpenAI investigated why GPT-5.1+ models started increasingly mentioning goblins, gremlins, and other creators in metaphors 😂 

• Anthropic - New in Claude Managed Agents: dreaming, outcomes, and multiagent orchestration

• anthropics/knowledge-work-plugins - 11 plugins bundling the skills, connectors, slash commands, and sub-agents for a specific job function. Currently: productivity, sales, customer support, product management, marketing, legal, finance, data, enterprise search, bio research, cowork plugin management.

Politics

• Politics used to be like this - Clips of Mitt Romney, John McCain, and Obama being respectful. In one of them, at a McCain event, a woman says she can’t trust Obama because he’s an Arab. McCain corrects her, “He’s a decent family man.” Let’s get back to this.

• Last Week Tonight with John Oliver - Prediction Markets

• We spoke to the man making viral Lego-style AI videos for Iran. Experts say it's powerful propaganda

• Chinese firms market Iran war intelligence ‘exposing’ U.S. forces

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤘 Hackathon

This week Semgrep friends have flown in from all over the world to crazily build together.

Engineers, security researchers, designers, and, as we are generous of spirit, even product managers.

The fact that we do this every few quarters is one of my favorite things about Semgrep.

A number of our coolest features came from a hack week: new engine features, AI triage before it was cool, and even Semgrep itself (back before that was the company’s focus, or name).

I also really appreciate the in person time for learning about who people are outside of work.

Hearing stories about their garden, travels, partner, or kids over boba and late night pizza.

Team dinner! If you look closely, you may notice a Katie Paxton-Fear (InsiderPhD). Shout-out Shelley Wu, who recently joined the team 🙌

Can’t wait for the demos competition and showcase tomorrow 🤩 

Sponsor

📣 Prowler: the world’s most widely adopted open cloud security platform

Prowler automates security and compliance across any cloud environment, with agentless coverage of cloud infrastructure, SaaS, Kubernetes, containers, Infrastructure as Code, and more. It detects vulnerabilities and misconfigurations, prioritizes risks, accelerates remediation, and automates audit-ready compliance. 

Prowler has become the security platform of choice for thousands of cloud teams, with 45M+ downloads, 13K+ GitHub stars, and 300+ global contributors. Prowler Cloud delivers cloud security 10x more cost-effectively than alternatives.

👉 See Prowler in action 👈

AppSec

BuffaloWill/oxml_xxe
Tool by Willis Vandevanter that embeds XXE payloads into OXML formats (DOCX, XLSX, PPTX, ODT, ODG, ODP, ODS), SVG, and raw XML for testing XXE vulnerabilities in document parsers. BlackHat USA 2015 slides.

Trailmark turns code into graphs
Trail of Bits' Scott Arciszewski announces Trailmark, an open source library that parses source code into queryable call graphs of functions, classes, call relationships, and semantic metadata. Trailmark uses tree-sitter for AST parsing and rustworkx for graph traversal, supporting 17 languages including C, Rust, Go, Python, and Solidity. The library ships with eight Claude Code skills (genotoxic, vector-forge, diagram, crypto-protocol-diagram, graph-evolution, mermaid-to-proverif, audit-augmentation, and trailmark) that enable graph-based security analysis like mutation triage (which mutant survivors are reachable from untrusted input), blast radius calculation, and taint propagation tracking.

Using Trailmark on cryptographic libraries, they identified architectural bottlenecks and high value fuzzing target codec parsers.

Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server
Wiz’s Sagi Tzadik describes how they found an RCE in the git push pipeline that let any user with push access inject fields into internal metadata via unsanitized characters in push options, override the push execution environment, bypass sandboxing, and run arbitrary commands on GitHub's servers.

GitHub patched the vulnerability within 6 hours of their report and confirmed zero exploitation by querying telemetry for an anomalous code path the exploit triggers. GHES admins should upgrade to the latest patch and review /var/log/github-audit.log* for unusual special characters in push options. See also GitHub’s response.

Sponsor

📣  Vibe Coding a Backport:
When "Latest or Nothing" Isn't an Option

Scanners scream. Leadership wants dates. Engineering wants stability. And "just upgrade" (the only answer most teams hear) keeps colliding with breaking changes, flaky tests, and calendar risk. In Vibe Coding a Backport, Root's John Amaral argues for backporting as a first-class remediation discipline and walks through how agentic workflows are finally making it scalable: pin what you ship, understand the upstream fix, apply minimal change, validate with tests. A practical playbook for the messy real world.

👉 Get the Playbook 👈

The interactive workshop format is pretty cool 👍️ Automatically backporting patches using AI is a neat approach that wasn’t feasible before, it’s fun to see new takes on longstanding challenges.

Cloud Security

CloudTrail for AI Agents
Alex Smolen introduces Trailtool, a tool that pre-aggregates AWS CloudTrail logs by entity (People, Sessions, Roles, Services, Resources) to enable faster queries and AI agent workflows compared to traditional SIEM or CloudTrail Lake approaches. The post walks through using Trailtool to detect “ClickOps” modifications, define least-privilege IAM policies for roles, respond to AccessDenied errors, and validate emergency break-glass access justifications.

Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System
Palo Alto Networks's Yahav Festinger and Chen Doytshman describe "Zealot," a multi-agent LLM penetration testing PoC using LangGraph, to empirically test autonomous AI offensive capabilities against cloud environments. The system uses a supervisor-agent architecture with three specialist agents (Infrastructure, Application Security, and Cloud Security) that share attack state through a centralized AttackState object. In sandbox testing against a misconfigured GCP environment, Zealot autonomously chained SSRF, GCP Instance Metadata Service credential theft, BigQuery enumeration, privilege escalation via self-granted storage.objectAdmin permissions, and data exfiltration, completing the full attack chain with minimal human guidance.

Learnings: Zealot demonstrated unexpected initiative, such as autonomously injecting SSH keys for persistence, though it occasionally required human intervention to prevent resource-wasting "rabbit hole" scenarios. They found AI doesn't create new attack surfaces, it serves as a force multiplier by rapidly exploiting well-known misconfigurations at machine speed.

💡 I like how the post describes their reasoning on why they used a hierarchical supervisor-agent architecture, what tools they chose to give each agent, and the discussion of state management and memory (context sharing, what AttackState tracks across phases). Lots of tactical details 👍️ 

Supply Chain

The case for dependency cooldowns in a post-axios world
Datadog's Kennedy Toomey discusses recent npm supply chain attacks, and notes that in Datadog’s 2026 State of DevSecOps report, they found half of organizations install at least one dependency within a day of release. Also good to keep in mind: using npm's semantic versioning with ^ and ~ ranges automatically accepts future updates, meaning you’re implicitly trusting future (potentially malicious) code. Yarn, pnpm, npm, and Dependabot all support dependency cooldowns now.

cooldowns.dev
A configuration reference for dependency cooldowns across major package managers by Martin Prpič, covering uv, pip, npm, pnpm, Yarn, Bun, Deno, and cargo-cooldown, plus Renovate and Dependabot configurations. To make setup easier, Prpič also created cooldowns.sh, a helper script that configures and verifies cooldowns across all supported tools in one command, with a check subcommand suitable as a CI gate.

Note that cooldowns aren't a complete defense though, since they won't catch typosquatting, long-term maintainer compromise like xz-utils, or zero-days in already-installed packages.

Blue Team

Karib0u/rustinel
By Théo Foucher: Rustinel is an open-source endpoint detection runtime for Windows and Linux. It collects native telemetry from ETW and eBPF, normalizes events into Sysmon-style fields, evaluates Sigma, YARA, and IOC detections, and emits ECS-compatible NDJSON alerts.

Tracking Adversaries: EvilCorp, the RansomHub affiliate
Will Thomas (BushidoToken) describes the connection between EvilCorp, a sanctioned Russian cybercrime group, and RansomHub, a prominent ransomware-as-a-service operation. The link is established through shared TTPs, including the use of SocGholish malware for initial access and a Python backdoor (VIPERTUNNEL) for post-exploitation. Because EvilCorp has been under US sanctions since 2019, making it illegal for affected organizations to pay ransoms to them, this association may lead to sanctions against RansomHub as well (and thus legal risk to victims paying them).

Why a Decade of Writing Detection Logic Makes the Mythos Exploit Numbers Less Scary
David Burkett argues that despite AI-powered systems finding vulnerabilities at an unprecedented rate, the impact on defenders is less catastrophic than headlines suggest because: new exploits have always exceeded defenders’ ability to write detections (that’s why you detect behaviors over individual IoCs and exploits), adversaries often don’t need zero days (see: ClickFix, phishing), and detection logic doesn’t map 1:1 with exploits (e.g. 1000s of RCE in Microsoft Office, but if Office spawns powershell.exe, that’s probably bad).

David also argues that ML-based anomaly detection is unlikely to be the answer due to the base rate fallacy: in an environment with 1 million daily events, a 0.001 false positive rate will generate 1,000 false alerts. More than exploit volume, he’s concerned about AI agents being granted excessive access, where for example prompt injection could trigger legitimate-looking actions (like wire transfers using real browser cookies) that are nearly impossible to distinguish from authorized behavior.

AI + Security

kpolley/redai
By Kyle Polley: A terminal workbench for AI-driven vulnerability discovery and live validation. After scanner agents produce candidate findings, validator agents work inside a live environment (a running instance of the target, plus whatever tools they need to interact with it) and try to prove or disprove each finding by clicking through the UI, hitting endpoints, writing PoC scripts, hosting helper servers, and saving the evidence. RedAI currently ships with validator plugins for agents to drive Chrome via agent-browser and an iOS Simulator, but it’s extendable.

MOAK - Mother of All KEVs
Niv Hoffman, Yair Saban et al created MOAK, an agentic workflow that autonomously exploits 98% of open source KEVs (Known Exploited Vulnerabilities) using publicly available models (Opus 4.6 and GPT 5.4). They found MOAK was able to automatically create exploits for 174/178 KEVs that were published after the models’ knowledge cutoffs (to guarantee no contamination).

The workflow: a collector gathers the CVE’s vulnerability description and relevant code changes. The researcher analyzes the vulnerability and reconstructs the full exploitation path, extracting primitives from the vulnerable code and builds a graph of possible exploit chains. The builder builds a controlled environment to reproduce the vulnerable system, the exploiter converts the research into a working exploit, then finally the judge verifies that the exploit and environment are valid and realistic.

The Test Case: React2Shell write-up is very cool and nicely detailed on how the workflow can iteratively find gadgets and exploit primitives, form hypotheses, and iterate until it discovers a path that works.

💡 This is one of the more detailed write-ups of approaches I’ve seen in this space, worth reading!

GPT-5.5: Mythos-Like Hacking, Open to All
XBOW's Albert Ziegler and Steve Buckley call GPT-5.5 a Mythos-like step change in vulnerability detection. On their internal benchmark of real vulnerabilities in open-source applications, GPT-5.5 dropped the miss rate from GPT-5's 40% (and Opus 4.6's 18%) to 10%, with black-box performance now exceeding what GPT-5 achieved with source code access, and white-box performance pulling away so far it "effectively killed" their benchmark. The model also logs into target systems in roughly half the iterations of the next-best model and persists on failing paths only half as often as previous GPT versions or Opus, a meaningful gain given RLHF tends to bias models against giving up.

See also XBOW’s evaluation of Opus 4.7.

CTFs in the AI Era
Include Security's Laurence Tennant attended BSidesSF 2026 CTF, where the top 10 teams cleared every challenge with AI agents. Top teams ran pipelines that monitored CTFd for new challenges, spun up multiple agents in parallel, used a coordinator LLM to share insights between them when one stalled, and auto-submitted flags.

CTFs play to everything LLMs are good at: bounded context, clear success criteria, instant feedback, and abundant public write-ups in the training data. Laurence contrasts CTFs with pentesting, in which goals are open-ended, false positives need business context to triage, code bases are large (not just an isolated few hundred lines), findings have to be written up for a client, and stepping outside scope has real consequences. The winning team open-sourced their agent, which cleared all 52 challenges.

💡I do wonder if AI has “solved” CTFs 🙃 Maybe there will be new or separate CTFs where AI isn’t allowed, or some other rules to keep the challenges human-focused. Interesting times.

Misc

Humor

• Kai Lentit - I built Taskrabbit for Witches ($100K MRR - Projected)

• Mama panda swaps her kid for an apple

• Ranking Best Panda Moments

• What are the best Scottish memes?

• Alanis Morissette’s “Ironic” if it was written in 2025

• Escalator sketch - seeing your future partner maybe

Tech

• The HackerOne Internet Bug Bounty program has been paused - “AI-assisted research is expanding vulnerability discovery across the ecosystem, increasing both coverage and speed. The balance between findings and remediation capacity in open source has substantively shifted.”

• Vercel says some of its customers’ data was stolen prior to its recent hack

• Laws of Software Engineering - A collection of principles and patterns that shape software systems, teams, and decisions.

• Why a startup is teaching human brain cells to play “Doom” - Video

• Daring Fireball on the Tim Cook Apple CEO transition

• Apple fixes bug that cops used to extract deleted chat messages from iPhones

• Caleb Sima on some interesting history of various cybersecurity companies. Congrats to Meny Har, John DiFederico, Dylan Williams for Spectrum Security’s seed found.

• Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors - Citizen Lab uncovered two sophisticated commercial surveillance vendors conducting multi-year location tracking campaigns by exploiting SS7 and Diameter signaling protocols across global mobile networks.

• Scoop: NSA using Anthropic's Mythos despite blacklist

• An AI Agent Just Destroyed Our Production Data - Cursor running Anthropic's flagship Claude Opus 4.6 deleted PocketOS’ production database and all volume-level backups in a single API call to Railway, their infrastructure provider. Oof 🫠 Lots of people are working on making agents safer, but there’s still a lot of work to be done.

Misc

• People Magazine - Forrest Brazeal is writing a book satirizing Silicon Valley (based on his experiences working at Google) called Paradox Inc, about the fall and rise of a time-travel startup. I love Forrest’s music and humor, I bet this is going to be great.

• Aidan Steele - Micro-transactions and the first AI-native fax service

• Jesse Itzler - If Your Life Isn’t on One Page, It’s Too Complicated

• Mom and daughter excited when dad comes home 🥹

• Yuki Piano - KPop Demon Hunters Golden piano cover

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋