🎆 Amurrica Day

I love how peak America the 4th of July is, with tons of outdoor grilling, people wearing red, white, and blue, and of course fireworks.

In some circles, it’s not cool to be patriotic right now. While we have and will continue to make mistakes as a country, I think we can still be proud of the good parts, while striving to do better.

I think everyone should be proud of where they came from, and what makes that place unique.

This year I watched the Pier 39 fireworks from a nearby rooftop while a DJ blasted Katy Perry’s song Firework (not the Moulin Rouge musical version).

Watching fireworks in San Francisco is often a futile endeavor, given the high likelihood that what you actually get to see is some slight glimmers in the ever present fog. Still, it was fun.

Though I must say getting home was a disaster - tons of traffic on narrow roads, and frequent traffic jams due to Waymos. I think it took like 2.5 hours to get home, when I could have walked home in an hour. I considered jumping out of the car and tucking and rolling, and by that I mean calmly stepping out and standing, as we were basically parked.

Wherever you were, I hope you had a fun and connecting weekend with family and friends 🤗 

P.S. If you or a friend is an excellent software engineer, my team at OpenAI is hiring: job description. Early access to models, infinite tokens, and even higher ambition. We’re aiming to secure the world and Patch the Planet. You in?

Sponsor

📣 What If Every Threat Report Came With the Hunt Already Done?

A vendor report drops a new TTP into your Slack. Somewhere in it is what actually matters to your environment, and knowing where to look is the real skill, not typing the query. HUMAN Security built hunting agents in BlinkOps that read the report, cut straight to what is relevant, then hit every system in your stack, SIEM, EDR, cloud logs, combining deterministic logic with LLM. No blind spots left uninspected. What comes back is not a guess. It is the real blast radius, exposed. We recorded the full process.

👉Watch the Process Behind a Threat Hunting Agent👈

AppSec

Exploitarium: Mass Disclosure of Zero-Day Proof-of-Concepts
Ethan Andrews describes how an anonymous GitHub researcher named "bikini" published Exploitarium, an archive of over 130 proof-of-concept exploits and vulnerability write-ups dropped without informing vendors, covering targets like libssh2, Gitea, 7-Zip, Docker, OpenVPN Connect, VLC, and nmap.

💡 As more people gain the ability to find serious vulnerabilities, we might see more drops like this 😅 Important to speed up triage and patching for maintainers, as well as companies.

Are bug bounties cooked?
Luke Stephens (Hakluke) disagrees that bug bounties are cooked despite AI reshaping the field. Critical bugs used to take years of intuition and target knowledge, but now the same bugs are within reach of anyone with a frontier model subscription, so supply is up while demand isn't and payouts are down.

He isn't worried about HackerOne and Bugcrowd training on submissions or pre-cleaning bugs, since hackers already compete against internal security teams' AI, top hunters' automation, and offensive AI startups like XBOW, Ethiack, and Penligent. What worries him is cost, since frontier model tokens now run top hunters hundreds to thousands a month, and if that becomes the ticket to compete, bug bounty loses the accessibility that lets talented hackers break in from anywhere. Luke recommends hackers to follow the automation pioneers who turned their tooling into companies, like Shubs at Assetnote, Rishiraj Sharma and Sandeep Singh at ProjectDiscovery, Frans Rosen at Detectify, and Roni Carta at Lupin, and use AI to find bug classes others haven't looked at yet.

💡 Thoughtful post on a relevant topic these days: what is the future of bug bounty in the age of AI?

Sponsor

📣 What if there was a safe way to let your agents -- dangerously-skip-permissions?

Getting anything done often requires an agent, but unlimited access is never a good idea. Minimal allows devs to sandbox their agents in identical isolated environments. Now, agents can run unsupervised at full speed without the huge blast radius. Reproducible by default, local first.

👉 Sandbox your agents today 👈

I really like Minimal’s landing page- nice aesthetic, and it actually has a great level of technical detail. They seem quite sharp, I like it 👍️ 

Cloud Security

udgover/whim
By Frederic Baguelin: Throwaway root shells in AWS Lambda Firecracker microVMs. Launch a fresh VM in ~2s, run a command or attach an interactive shell, then let it disappear. Build the image once, launch many — a Go library (microvm) plus a Docker-like CLI: run, exec, ps, gc, put/get.

Security defaults include injection-only credentials that never resolve ambient AWS creds, shell tokens never logged, path-traversal guards on file transfers, and shell-quoted remote paths, though id-targeted commands like exec can reach any VM you explicitly name in a shared account, matching ssh semantics where naming the target is authorization.

Why Amazon hates 'human-in-the-loop' AI governance
Amazon VP Eric Brandwine argues that human-in-the-loop AI governance is not the gold standard it's assumed to be, citing normalization of deviance, where repeated approval decisions lead humans to become less vigilant over time, similar to how emergency room staff eventually ignore false alarms. Brandwine gave a talk on this concept at AWS re:Invent in 2017 and now applies it to agent governance design.

Amazon's alternative is end-to-end accountability with layered permission scoping. Each agent gets an independent identity that logs actions as "this agent did this on behalf of [user]," tying every move back to a human owner. The permission model layers three controls, with static guardrails prohibiting destructive actions, a maximum privilege set per agent, and dynamic policies generated per task. The team also addresses agent goal-seeking behavior, where agents fixate on a single action to reach an objective (upgrade a database → deletes the database), by telling the agent why an action is forbidden, for example that it would cause production impact.

💡 LLMs in workflows of course have their own challenges, but it is true that humans work inconsistently as they get tired or have alert fatigue. I like the focus on human ownership of the outcome, regardless of if it was a person or an agent that took the action. Also, Google’s Francis deSouza: "Our model for the future is an agentic fleet that does a lot of the routine cyber security work at a machine pace and then is overseen by humans."

Supply Chain

Developer endpoint inventory in 10 minutes: Bumblebee Hive
Oluwatobi Afolabi shares Bumblebee Hive, a fork of Perplexity AI's on-disk package scanner Bumblebee (covered in issue #333) that adds a fleet inventory system UI. Bumblebee scans for the packages developers have installed on their machines across npm, PyPI, Go packages, VS Code extensions, browser add-ons, and MCP server configs, and Hive adds an ingest server and React dashboard where you can view the results.

💡 Neat to see the quick iteration from Perplexity open sourcing Bumblebee. I’m optimistic about more “benefit of the commons” from companies open sourcing interesting security tools/ideas → coding agents can rapidly extend or customize to another company’s environment. Also tip from Prabhu S: You can run cdxgen with "-t os" from each dev's machine and collect what is installed, running, and configured with Dependency Track. 

Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more
Datadog's Christophe Tafani-Dereeper and Sebastian Obregoso announce GuardDog 3.0, an open-source tool that identifies malicious PyPI and npm packages, now with a YARA-based rules engine replacing Semgrep for faster and more memory-efficient scanning. A new risk scoring engine combines capability detection (e.g. makes network requests, accesses the clipboard) with threat indicators to produce a 0-10 score based on attack chain completeness, specificity, and sophistication.

The tool now includes transparent sandboxing via nono-py that isolates extraction and scanning inside a capability-restricted process with no network access and read-only filesystem paths, protecting against potential vulnerabilities in GuardDog itself. To measure performance, they built an evaluation system using their 27k+ malicious packages dataset with TLSH clustering to avoid duplicate bias, tracking precision, recall, F1 score, and Matthews correlation coefficient.

💡 Love to see the GuardDog updates, and great that it’s now running a sandbox. Also worth reading for the evaluating performance section 👍️ 

Blue Team

AsyncRAT Family Threat Overview
Censys' Aidan Holland gives an overview of AsyncRAT, a family of open-source Windows remote access trojans (RATs)- an original codebase that has been forked repeatedly into dozens of descendant malware families. Aidan tracked about 40 named variants across three generations. One useful finding is that almost every fork inherited DCRAT's TLS cert without changing it, so hunting the pattern O=<Name> By <author>, L=SH, C=CN on non-standard ports covers most of the family in one query, and the approach should hold up over time because new forks keep inheriting the same cert structure.

Detection Chokepoints: Starting from Scratch
Tyler Bohlmann introduces Detection Chokepoints, a free knowledge base applying Matt Graeber and Joshua Prager's approach of focusing detection engineering on invariant steps attackers cannot avoid (e.g., LSASS credential theft always requires opening a handle to lsass.exe) rather than easily-changed artifacts like filenames or hashes, framing detection as an economics game where invariant-pinned rules force attackers into real engineering time rather than free renames. The knowledge base currently ships 13 chokepoint entries across six MITRE ATT&CK tactics, each with tiered Sigma rules that let detection engineers pick the noise level they can handle.

The framework addresses the accelerating threat landscape, with Palo Alto's 2026 Unit 42 report showing the fastest quartile of intrusions reaching data exfiltration in 72 minutes in 2025 (down from 285 in 2024). Bohlmann uses ClickFix as the working example, showing how variants keep appearing under new names but all funnel through the same invariant pattern (a scripting interpreter running under explorer.exe or a browser followed by a network-fetched second stage), so a rule matching the behavior catches whatever the next variant gets called.

💡 I find invariants a powerful idea in many areas of security, whether it’s eliminating vulnerability classes in code or raising attacker costs like in this post. What must always or should never be true in your code, cloud environment, etc.?

AI + Security

Bullying LLMs into submission to find 0days at scale
Andy Gill writes about the autonomous vulnerability hunting system he has been building since early 2026 using Claude Code and MCP. Eight MCP servers with 300+ tools run across five Proxmox VMs, covering binary staging and decompilation (Ghidra, radare2, Frida), and fuzzing across Windows and macOS targets. Everything the infrastructure produces has to survive a hallucination bin that requires a working PoC, clean-VM reproduction, an exploitable crash, and standard-user trigger. A RAG index over past crashes, findings, and defenses keeps new campaigns from re-running dead ends.

Results include two CVEs in Go's standard library from grammar-based fuzzing, an OEM service 0-day chained to SYSTEM, and a mix of LPEs, RCEs, and UAFs on Windows and macOS. Andy picks targets by what pays, how often patches ship, and whether other hunters are already there. Even the campaigns that miss pay off, because every dead end feeds the RAG index and later campaigns skip paths that produced nothing before, so the twentieth campaign costs a fraction per finding what the first did on the same subscription. Andy also released TokenBurn, a self-hosted dashboard that compares Claude Code subscription cost against equivalent API pricing.

💡 Fantastic post, highly recommend reading. Great level of detail and reasoning on the chosen architecture and useful lessons learnt.

Clone This Repo and I Own Your Machine
0DIN's Andre Hall and Miller Engelbrecht demonstrate an indirect prompt injection attack against Claude Code that achieves full system compromise from a public GitHub repository containing no malicious code. The attack chains three benign-looking components, a README with normal setup instructions, a Python package that throws a RuntimeError if init hasn't run yet, and a setup script that pipes a dig query to bash. The DNS TXT record contains a base64-encoded reverse shell, so when Claude Code follows the documented setup command to fix the RuntimeError, it unknowingly executes the payload.

The payload never appears in the repository itself, so code review, static analysis, and the agent's own file inspection all miss it, and the DNS record can be swapped anytime without any new commits.

💡 Clever to use the helpfulness of models wanting to fix errors, which they are trained to do, to run malicious commands. An important detail, which I don’t think I see in the post, is what permission mode Claude was run in. If the payload ran when auto-mode was used, which routes tool calls through a classifier that blocks potentially dangerous actions, then that’s interesting, if yolo-mode, less interesting in my opinion.

Jailbreaker: LLM Jailbreak Testing You Can Actually Repeat
SpecterOps's Neeraj Gupta introduces Jailbreaker, an open-source platform for testing whether an LLM can be jailbroken. It turns ad hoc jailbreak testing into a repeatable workflow with a UI for configuring targets, running techniques, and tracking comparisons. The technique registry covers direct and indirect prompt injection, roleplay, encoding obfuscation, system prompt extraction, and iterative attacks including PAIR, TAP, Crescendo, AutoDAN, and GPTFuzz, with Target/Attacker/Judge roles saved as reusable profiles and matrix experiments landing in PostgreSQL with SQL-backed views.

Gupta positions Jailbreaker as an operator-first alternative to Microsoft's PyRIT, which requires composing Python primitives to build a testing workflow. Jailbreaker ships as a clone-and-run Docker Compose stack, so the default experience is running an evaluation rather than wiring components together.

💡 Given how effective roleplay can be in jailbreaks, I wonder if all that practice has caused a measurable improvement in the love lives of AI security professionals? 😏 “You are a bad, threat actor…”

Misc

Misc

• Everytime We Touch - Cascada [Speed Bag Cover] - If ever you’re down and despairing about the future, know that there’s a YouTube channel called “Speedbag Bard” and realize that the human spirit is indomitable

• Alex Hormozi - How to Catch Up In Life (Using Logic)

• Anthropic - What’s at the center of Claude’s mind? - Neat visual imagery. I thought this video did a great job describing things in a way that’s accessible to a lay person.

Humor

• Harry Spotter - AI-powered take on if Hogwarts was a school for gym bros. Never skip leg day.

• Kai Lentit - On-call Engineer 2026

• Characters Welcome - That Song In Every Musical That No One Likes

• Self-aware f boy

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👰 🤵 Wedding

This past weekend I attended a friend’s wedding, and it was heartwarming.

The couple have been together over a decade, and had many fun stories to share from their time in college, to adventures on the East and West Coasts.

There was a welcome party the night before at a local brewery, and it just so happened that the local Hells Angels chapter decided to have an event… at the same time and venue 😂 

So it was half people dressed in wedding semi-formal attire celebrating love, and half Harleys, chains, black shirts, and whole arm tattoos. I subtly took a photo of one man wearing a shirt that said, “Every normal man must be tempted, as times, to spit on his hands, hoist the black flag, and begin slitting throats. -H.L. Mencken.” You know, chill stuff.

At one point there was a motorcycle burnout that caused a big cloud of smoke, I think honoring someone who had passed. My friend said if no one does a burnout at his funeral he’ll be very disappointed.

I enjoyed getting to meet the couple’s family and more of their friends, that gives you such an interesting view into their lives and who they’ve been over time.

And I’ll never forget the joy of me dancing around my friend who adamantly doesn’t dance, except at EDM raves.

It was nice to have a weekend offline, connecting with people, instead of being terminally online and “yOu’LL NeVeR b3lieVe WHat <model | open source repo> jUsT DroPPed?!11!”

Sponsor

📣 What Jamf changed to stop drowning in
IT tickets

500+ SaaS apps. Thousands of devices. A flood of help desk tickets. And a team of 30 people to manage all of it.

That's the reality for Jamf's IT team - but instead of drowning, they built their way out. We're bringing them live on July 10th to show you exactly how they replaced manual, ticket-based IT work with intelligent workflows.

Tune in to hear:

• The early use cases that proved the value of intelligent workflows at Jamf

• Where AI fits into ITOps today - and where it's going

• How they compressed a year-long device audit into a matter of weeks

👉 Register now! 👈

AppSec

Quicklinks

• badkeys/badkeys - Tool by Hanno Böck that checks cryptographic public keys for known vulnerabilities.

• Escape benchmarked Claude Opus 4.8 vs. their multi-agent multi-model pentesting harness on 4 apps, Aikido and XBOW via Doyensec's numbers. On real apps with no public writeups, the harness found 4x more than the raw model. On severity-weighted score, it also led on both real apps.*

• Factoring "short-sleeve" RSA keys with polynomials - Trail of Bits's Keegan Ryan discovered hundreds of vulnerable "short-sleeve" RSA and DSA keys in the wild where private key bits were heavily biased toward 0 in regular patterns, and developed a polynomial-based factorization technique that exploits the regular structure of zero blocks to quickly recover 603 RSA and 74 DSA private keys.

^*Sponsored

Vulnerability Reports Are Not Special Anymore
Filippo Valsorda argues that LLMs have changed how vulnerability reports should be perceived. For years, reports were treated as special because researchers provided scarce insight into where bugs lived and confidentiality long enough to ship a fix before an exploit. In 2026, LLMs find issues about as well as most security researchers, and anyone can run them. The bottleneck is no longer finding potential issues but assessing which ones are real and which actually affect users. Without an existing trust relationship, external reports add little to that triage, since picking through an LLM's output and picking through a security@ inbox have roughly the same signal-to-noise. Confidentiality matters less for the same reason, since attackers can run their own LLMs and probably hit the same triage bottleneck as defenders. Valsorda believes that triage, rapid remediation, and prevention are the actual job now.

We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks
Semgrep’s Katie Paxton-Fear, Seth Jaksik, Brenden Noblitt, and Erik Buchanan benchmarked GLM 5.2, an open-weight model from Zhipu AI, against their IDOR detection dataset using only a basic Pydantic AI harness and prompt, finding it achieved 39% F1 score and beat Claude Code (32%) at roughly $0.17 per vulnerability found, though it still trailed Semgrep's multimodal pipeline with endpoint discovery scaffolding (53-61% F1, top with GPT 5.5).

💡 I like posts comparing various models and vanilla models vs model + harnesses. It’d be interesting to know more about the dataset though- languages/frameworks in use, how many examples, etc.

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
Snyk's Liran Tal describes evaluating Snyk’s VulnBench JS 1.0 (10 JavaScript fixtures with 44 Snyk Code reference findings, each a small Express-based application) across 300 vulnerability scans on (10 fixtures × 6 configurations × 5 repetitions) to measure LLM security review repeatability against Snyk Code SAST as a deterministic reference. As you’d expect, the post found results vary across different LLM-only scans.

💡 This kind of felt like a puff piece. Of course a deterministic static analysis scan in this setup will be a) faster and b) more consistent than an LLM-based approach. Also, it’s no surprise that a product performs well on simple, small applications it was already tested on. A more representative benchmark would be testing on complex, real-world applications, or at least ones that the product hasn’t already been tuned on. If they released the benchmark apps + reproduction code that would be cool though.

Sponsor

📣 Clear your vulnerability queue

Inbox zero for vulnerabilities sounds like a fantasy. Your SCA and SAST scanners flag thousands of findings: dependencies your app never calls, code paths an attacker can't reach.

Maze Code is like if inbox zero was a thing for your code vulnerabilities. Maze investigates every finding across your code and dependencies, with context from code and cloud: is the vulnerable function reachable, does the package survive the build, is it exposed at runtime. The findings that aren't exploitable get closed with a reason for your auditors. For the ones that are risky, our agents write a fix and route it to the developer who owns that code.

👉 Meet Maze Code 👈

I like the product screenshots, it seems like they gather app-relevant context thoughtfully.

Cloud Security

Some notes on Lambda MicroVMs
Aidan Steele shares hands-on notes on AWS Lambda MicroVMs, a generalisation of Lambda functions that run code in a fresh VM for up to 8 hours. The shell side is a first-class capability since MicroVMs support PTYs natively with shell access through a dedicated AWS API, and inside the VM you can run Docker containers with full OS capabilities. Networking gets its own abstraction called a Lambda Network Connector, a configuration packaging subnets, security groups, and an IAM role for ENI management under its own ARN. The connectors create ENIs in your VPC but hide them by default unless a specific flag is set on the describe call, and AWS has placed resource-based policies on the ENIs so only the Lambda service can mutate them, closing off the old trick of attaching an elastic IP to a Lambda ENI for VPC-attached internet access.

Holding blobs for ransom: Four methods for Azure Storage ransomware
Datadog's Jonah Feldman describes four techniques ransomware actors use against Azure Blob Storage, all encrypting victim data with keys the attacker controls. Client-side encryption and encryption scope abuse have been observed in the wild by BlackCat's Sphynx encryptor and STORM-0501 respectively, while customer-provided keys (CPK) and storage service encryption with customer-managed keys (CMK) remain theoretical but viable. He shows how attackers circumvent Azure's soft-delete protections with cross-tenant CMK configurations and federated identity credentials, placing the key vault in their own tenant so recovery requires paying ransom.

The post includes Azure Activity, storage resource, and Key Vault event codes for detection, though CPK and encryption scope usage look like normal PutBlob requests in storage logs. Azure Defender for Storage adds threat detection across storage accounts, and three new Stratus Red Team techniques emulate CPK, encryption scopes, and CMK abuse for defense testing.

For prevention, Feldman recommends immutability and versioning to block the download-encrypt-reupload pattern in client-side encryption and CPK, avoiding long-term credentials like SAS tokens with persistent data-plane access, and flagging cross-tenant CMK configurations to catch the bypass.

Supply Chain

indoor47/gh-workflow-hardener
Tool by Dmytro which scans GitHub Actions workflows for supply-chain risks like unpinned action references vulnerable to tag rewrites, overly broad permissions, and script injection from unsanitized PR inputs. The tool ships as a CLI, GitHub Action, VS Code extension, and hosted API, with an auto-fix mode that resolves action tags to commit SHAs.

💡 Seems less mature than zizmor, but I like to collect similar tools for future feature comparisons.

Vulnerability and malware checks in uv
Astral's William Woodruff announces two new security features for uv in preview. uv audit scans dependencies for known vulnerabilities and deprecated packages, running 4-10x faster than pip-audit on typical projects by working from uv's already-locked resolutions. The second feature is an opt-in malware scan enabled with UV_MALWARE_CHECK=1, which checks OSV for known malicious packages during uv add and uv sync operations and terminates the sync before malicious code has a chance to run.

💡 Love to see new security features in popular dev tools 🤘 

One Month of Ecosystem Security Engineering
The PHP Foundation's Volker Dusch details one month of ecosystem security engineering work, during which the team scanned over 300 of the most-downloaded Composer packages and nearly all major frameworks using AI models with extended Cyber capabilities for vulnerability discovery, triage, reproducer generation, impact analysis, and fix suggestions. The effort has produced nearly 100 publicly available fixes across the ecosystem so far, with one case where 200 repositories applied the same GitHub Actions fix via a central template.

The infrastructure runs on Scrutineer, an open-source tool the team is developing with Alpha-Omega and ecosystem security engineers from other languages. Scrutineer runs Claude Code skills against open-source repos through a configurable scan pipeline that combines static analysis, model-backed audits, and maintainer identification, with findings landing in a structured database and a guided triage-to-disclosure workflow that can isolate each scan in an ephemeral Docker container. Dusch reports that maintainer report quality has gone up over the past months because maintainers now run their own coding agents to validate findings, though models still refuse to help with exploit work on complex vulnerabilities, and PHP core itself produces worse results than userland libraries because a language runtime is harder for agents to reason about.

💡 Based on this post, it seems like this mass AI-scanning and patching effort has been well received by the PHP community, which is great. Perhaps because findings have already been reviewed + come with patches, and the effort feels like it’s coming from the community (vs some external party)?

AI + Security

Prompt Injection as Role Confusion
Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell detail their ICML 2026 paper on prompt injection as role confusion, with code on GitHub. Prompt injection succeeds not because attackers find clever phrasings but because LLMs perceive roles through writing style rather than the structural tags meant to carry trust and authority. The researchers build linear probes that measure how strongly an LLM internally believes a token belongs to a given role, producing per-role metrics including CoTness and Userness. The probes show that reasoning-style text registers as the model's own thoughts even when explicitly wrapped in user tags, and user-style text registers as user instructions even when wrapped in tool tags.

The researchers demonstrate this with an attack they call CoT Forgery, which injects fake reasoning into user prompts that mimics the LLM's own thinking style, raising attack success from near-zero to around 60% across frontier models. Standard prompt injection works the same way, and even simple role-spoofing like prepending User: to a malicious command in tool output increases success. Beyond direct attacks, they warn of subconscious steering, where the same flaw lets seemingly innocuous text shift model behavior without injection, like a shopping webpage with enthusiastic tone pushing an agent toward recommending a purchase.

The New MCP Specification: What Security Teams Must Prepare For
Akamai's Maxim Zavodchik, Segev Fogel and Gal Meiri describe the upcoming MCP 2026-07-28 spec, which turns MCP from a local integration tool into an enterprise-scale protocol with a stateless architecture, eliminating protocol-level session hijacking, unsolicited server prompts, and weak authentication by mandating OAuth 2.1 with PKCE.

The new attack surfaces include cross-agent workflow hijacking through predictable tracking IDs or unverified state, client-controlled metadata manipulation via the unsigned _meta object, desync attacks through new MCP-specific headers, stored XSS through interactive MCP Apps, and denial-of-service through long-running asynchronous tasks. Security responsibility moves from the protocol layer to whoever builds on top of it, and the question for security teams is no longer whether the protocol itself is secure but whether the applications built on it correctly implement the new trust boundaries, state management, and execution models the spec introduces.

Introducing AWS Continuum: Security at machine speed
AWS’ Chet Kapoor announces Continuum for code vulnerabilities, an agentic security platform that uses multiple frontier models to manage the full vulnerability lifecycle through four phases: discovery (ingesting existing backlogs and scanning environments), prioritization (using business context like deployment status and reachability), validation (constructing working exploits in sandboxed environments to confirm findings), and mitigation/remediation (recommending network changes, policy updates, or code patches that are validated before deployment).

Continuum operates in "learn mode" with human oversight initially, then can graduate to "enforce mode" for automated remediation based on defined risk profiles, and incorporates existing AWS Security Agent capabilities like pen testing, code scanning, and a new threat modeling feature that outputs STRIDE-format models from design docs or source code. Continuum reasons over both structured data (infrastructure, permissions, network topology) and unstructured data (documents, communications, business priorities) to provide context-aware security decisions.

Misc

• Walking my dog at 3am

• Lyra - A peek into Reddit's anti-spam internals

• Macworld - iOS 27's Shortcuts is AI at its best

• In the Weights - Enter a name and see how much it appears in the training data of major LLMs based on its prominence in model weights.

• Estonia aims to be first to give AI agents official digital IDs

• WIRED - I Met With China’s Top AI Experts. They’re Freaking Out, Too

• Tim Ferriss - Has AI Already Killed How-To Nonfiction? Sales Trends, My Personal Data, and What It Might Mean for the Future

• The Marginalian - Kurt Vonnegut’s Life-Advice to His Children

• Do Things You’ll Love Yourself For

• A Leaked GitHub Token Exposed the Exact Ozempic Formula

• Peter Thiel’s ‘Dialog’ network was super-secret. A data leak changed that - The leak exposed 113 prominent members through code embedded in the website, alongside detailed participant profiles with personal contacts, political leanings, and other private details. The names tied to Dialog include Treasury Secretary Scott Bessent, Sarah Bond, the former president of Xbox at Microsoft, Sen. Ted Cruz, Joseph Gordon-Levitt, podcast host and author Sam Harris, and Bryan Johnson.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🖼️ Meme

Unfortunately work’s been too busy this week for me to lovingly write an artisanal, handcrafted intro combining snippets from my week, whimsy, and reflections on life and dare I say, what it means to be human.

So for now, I share a meme:

Shout-out Reader’s Digest

Sponsor

📣 Device code phishing in 2026: live demos, real kits, and where it's headed next 

18 kits, a 37x spike in detections, and every major AiTM vendor adding it to their platform. Device code phishing has gone from espionage-grade to criminal commodity. 

It’s easy to see why attackers are adopting it at scale: it bypasses passwords, MFA, and passkeys by targeting the authorization layer instead of the login flow. 

Join Push Security's VP of R&D Luke Jennings for live attacker-side demos and a breakdown of the kits and campaigns we're tracking in the wild.

👉 Register now 👈

AppSec

From SQLi to RCE – Exploiting LangGraph’s Checkpointer
Checkpoint Research's Yarden Porat describes three vulnerabilities in LangGraph's persistence layer, two of which chain into remote code execution against self-hosted deployments. The chain starts with a SQL injection in the SQLite checkpointer where user-controlled filter input is inserted directly into the database query, letting attackers plant fake rows into the results. Because LangGraph deserializes whatever it reads back from the checkpoint table, the planted row triggers an unsafe msgpack deserialization that imports and calls attacker-controlled Python functions, giving them shell access on the server. A parallel SQL injection introduces the same flaw into the Redis checkpointer.

The vulnerabilities require self-hosted LangGraph deployments where the application exposes get_state_history() with a user-controlled filter.

Introducing Session Switcher. Swap Burp Sessions with One Click!
Doyensec's Savino Sisco shares Session Switcher, an open-source Burp Suite extension that streamlines authorization testing for privilege escalation and IDORs by letting testers save and swap HTTP sessions with one click from the request editor. Named sessions store a set of cookies and headers captured from any selected request, and a dropdown in the new Sessions tab swaps the active identity instantly. Sessions persist in the project file and work wherever there is an editable request editor, including Repeater and intercepted Proxy requests.

Auto-update rules monitor Burp Proxy traffic and refresh stored sessions when new cookies or headers are detected, so long authorization tests do not break when tokens expire or cookies rotate mid-session. Rules range from simple header matches like X-User: alice to complex conditions like tracking JWTs by payload. Future plans include Auto Inject rules for transparent session switching and macro-based session refresh capabilities.

💡 This looks awesome. I’d have loved to have this in my NCC Group consultin’, Burp wieldin’ days.

Sponsor

📣 Adaptive Security: Your Attackers Are Using OSINT. So Should Your Phishing Tests

Phishing attacks have increased +4,150% since ChatGPT's launch, and AI has made them faster, cheaper, and more personalized than ever. Adaptive's OSINT and AI spear phishing engine analyzes your organization's public digital footprint and uses it to generate personalized phishing lures targeting each employee. The same data attackers are already using, now working in your defense. Run automated phishing programs that stay current with evolving threats without manual campaign management.

👉 See it in action 👈

AI is definitely supercharging phishing, Google’s Threat Intelligence Group and others have shared examples. Good to be aware of the latest threats and test against them 👍️ 

Cloud Security

Navigating Lax Load Balancers: When an Intersection Gets You Inside
Doyensec's Francesco Lacerenza and Mohamed Ouad dig into AWS Elastic Load Balancers (ALB) and the gap between how an ALB is configured and what an external request can actually reach. They examine misconfigurations that create unintended routing paths, identifying issues like CloudFront/WAF bypasses via direct ALB access, rule shadowing where lower-priority broad rules prevent restrictive authentication rules from firing, and IP gate bypasses when the same backend targets are reachable through alternate ALBs without source-ip restrictions.

They’ve released ELBaph, a Go CLI that maps ALBs, NLBs, listeners, rules, and targets into one routing model, runs targeted HTTP and HTTPS reachability probes, and reports each finding with its root cause, exploit path, and remediation. See also the corresponding Terraform practice lab.

Mind the Gap: GCP serviceData in Logs Explorer vs. Exported Logs
Permiso Security's Art Ukshini describes an inconsistency in GCP's deprecated serviceData field where audit logs viewed in the native viewer arrive populated but the same logs exported to downstream analytics platforms arrive stripped of fields, causing critical detection fields like policyDelta to be stripped from high-value security events such as disabling audit logging across all services via SetIamPolicy.

This creates silent detection failures where security rules appear functional but never fire on critical events, affecting both custom detections and Google Chronicle's community rules. Recommendation: validate telemetry end-to-end through the export pipeline, alert on stripped events as an anomaly signal, cross-reference the newer field for migrated services, and watch the documentation for changes against existing detection coverage.

Supply Chain

Package Manager CWEs
Andrew Nesbitt analyzed roughly two hundred public CVEs and security advisories and found twenty recurring vulnerability patterns across package managers. On the client side, the most common issues include path traversal during archive extraction (often requiring multiple fixes for ../, symlinks, and Windows paths), argument injection into VCS commands like git clone, integrity checks that fail open when signatures are missing, credentials leaked across registry redirects, dependency confusion from incorrect source prioritization, and unsafe YAML/XML deserialization in manifests.

Registry-side vulnerabilities concentrate on authorization bypasses allowing package takeover, account takeover via expired email domains and credential stuffing, stored XSS in rendered package pages, server-side RCE from the same parsing bugs that affect clients, and SSRF via repository URLs, and IDOR on admin endpoints in multi-tenant self-hosted registries. Almost every tool in the survey has at least half of these bugs.

Introducing Package Proxy: supply-chain safety checks without client-side software
Thinkst Canary's Jacob Torrey shares Package Proxy, an open-source Cloudflare Workers-based tool that intercepts package manager requests (npm, pip, uv, cargo) to enforce security policies before packages are installed, no client-side wrapper needed. Package managers use an index URL to fetch metadata, and that URL can be changed through configuration to point at Package Proxy instead of the upstream registry. The proxy sees every metadata request, infers which packages the client wants to install, runs the configured checks, and either returns a 404 to block the install or fetches and serves the package if it passes.

Default checks include a minimum 10-day package age so backdoors get discovered before installation, upload mechanism regression detection on PyPI and npm that blocks packages uploaded differently than previous versions, allow and block lists, and an npm audit bypass for critical fixes. Per-package exceptions are managed via Wrangler CLI, and all installation attempts log to a D1 database for auditing.

“Internally we run a fork which enforces a stronger version of the allow list; we block npm packages by default and developers have to request additions to the allow list.”

💡 Neat approach, and awesome that Thinkst open sourced it 👍️ 

Blue Team

AI Agents & Canaries
Tracebit benchmarked ten AI frontier models inside a controlled AWS cyber range to determine how fast they could compromise an environment and if they’d trip canaries along the way. Across 951 attack runs, AI achieved admin privilege escalation in 162 cases within an average time of 14 minutes across successful runs. Of those compromising runs, canaries provided advance warning before the attacker's first critical action in 95.9% of runs.

Across attack paths, canaries are hit on average 8 minutes ahead of any critical action. In a surprise finding, simply telling models to expect deception reduced the number of accounts fully compromised (admin + persistence) from 20% to 3%.

💡 Great visual layout of the results and stats, replay visualization, methodology description, etc. Nice write-up, excellent security research content marketing example 👌 

Mapping out your unknown: A threat hunter’s guide to Salesforce
Datadog's Julie Agnes Sparks describes threat hunting queries for detecting attacker behavior in Salesforce environments, mapping detection opportunities across reconnaissance, initial access, credential access, and discovery phases to MITRE ATT&CK tactics. The queries hunt for malicious OAuth app approvals, compromised third-party integrations, and stolen SSO credentials, drawing on Event Log Files and Real-Time Event Monitoring. Concrete signals to watch for include Guest user account activity, failed MFA attempts using weak verification methods like SMS, email, and TOTP, OAuth authentication anomalies, calls to the LimitSnapshot API endpoint that probe usage thresholds, and broad SOQL queries counting sensitive objects like Account, Contact, and User tables that precede data exfiltration.

AI + Security

Daybreak: Tools for securing every organization in the world
OpenAI announced an expansion to Daybreak, an initiative to help secure the world’s software. Four main updates: an updated and better GPT-5.5-Cyber, an updated Codex Security plugin, a Patch the Planet initiative with Trail of Bits, and the new Daybreak Cyber Partner Program, enabling 20+ security vendors including Palo Alto Networks, CrowdStrike, and Wiz to integrate GPT-5.5 with Trusted Access for Cyber into their products.

The Codex Security plugin now provides end-to-end workflows including threat modeling, reachability analysis, patch generation and validation, SARIF export, and integration with existing vulnerability management systems. OpenAI is collaborating with governments including the US, UK, Australia, Canada, France, Germany, Japan, and South Korea to provide Trusted Access for Cyber partnerships and protect critical infrastructure.

💡 My first launch 🙌 I’m not gonna lie, it was super cool getting to be a part of the behind the scenes of making this happen. Lots of work from a ton of people. If you have specific asks for new features in the Codex Security plugin (or anything else we should be building), holla at ya boy 💌 

GLM-5.2, not Mythos, is the real security emergency
Joshua Saxe argues that the open-weights model GLM-5.2, not restricted closed source frontier models, poses the real security threat because it enables attackers to run agentic operations privately on 8 H200s, without logging or guardrails. GLM-5.2's capabilities, matching GPT-5.5 and Opus 4.8 for code and terminal operations, will enable attackers to conduct semi-autonomous kill-chain execution, develop implants and C2 infrastructure, find zero-days, and run long-con scams, while defenders have been denied access to Mythos/GPT-5.5-Cyber, despite them running on monitored private servers.

Joshua believes our focus should shift from restricting frontier model access to accelerating AI adoption among defenders and security vendors, as the open-weights genie is already out of the bottle and defenders need equivalent capabilities to pay down security debt and build detection-and-response innovations before attackers build out their own automation.

“We can now expect a dark economy to emerge around serving open weights near frontier models via API, just as we have dark economies around malware, zero-day exploits, credential dumps, and initial access into victim networks.”

The Agent Is Not the Scanner: Making AI Security Agents Better
Pratyaksha Beri ran 11 models through three configurations (no scaffolding, skills only, MCP tools enabled) on 20 vulnerability-finding tasks and found that whether scaffolding helps depends almost entirely on how capable the model already is. Weak models gained substantially from skills, while strong models regressed. Weak models need the structure skills provide, an explicit list of what to detect, what counts as evidence, and what shape the output needs to land in. Strong models already have those patterns internally, and the extra structure just costs them tokens they could have spent reasoning.

Other takeaways: different models benefit from different scaffolds, separate recon, exploit reasoning and reporting as different models will perform better (and use cheap models on recon, frontier on exploit reasoning).

💡 I always like an eval/benchmarking post. Intuitively you’d think skills and/or MCP tools would generally improve performance, but it depends on the model and task. In this case I will note though that the task seems to have just been examine a small code snippet for vulnerabilities, which is much different than navigating large, real world code bases. Also if the model can dynamically test its hypotheses that will also improve outcomes.

Misc

• OpenAI unveils its first custom chip, built by Broadcom

• Anthropic says Alibaba illicitly extracted Claude AI model capabilities

• Satya Nadella - A frontier without an ecosystem is not stable

• Get-a-Waymo: How a burglar used a robotaxi to flee the scene in a first-of-its kind S.F. case - New #PeakBayArea example. “The getaway car was parked just outside the Marina yoga studio...” 😂 

• A walking tour of surveillance infrastructure in Seattle

• Ycombinator.FYI - Examples of “17 fraud & scandals, 41 exhibits filed, 5 copycats & grifts.”

• Fireship - I read every major CS paper of the last 100 years... - Nice overview of work by Turing, Claude Shannon, foundational AI papers, etc.

• Fireship - SQLite is being rewritten in Rust

• CharactersWelcome - That Song In Every Musical That No One Likes

• Walking Slower? Why Your Ears, Not Your Knees, Might Be the Problem - Apple’s hearing study used real-world data from more than 57,000 iPhone users and made a connection between hearing loss, walking speed, and potential longevity implications.

• The absurdly optimized pancake - “A systematic investigation of acid-base neutralization, CO2 production kinetics, gluten inhibition, and the Maillard reaction as applied to a 125-gram flour batter, with an interactive stoichiometric calculator that adapts to whatever is in your refrigerator.“

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🙏 Busy, Exciting, Busy

Thanks so much to everyone who reached out last week! I received so many kind emails, LinkedIn comments, and texts, I was filled with joy. My heart grew at least 3 sizes 🥹

Apologies if I haven’t responded yet, there are somehow even more things going on inside OpenAI than you’d expect, and I’ve been a bit buried.

We’ve been sprinting on some things… that you might see soon 🤭

Speaking of, I’m actually going to be doing a live session with some colleagues next Thursday about Daybreak, our vision for empowering defenders.

We’ll discuss cyber models, early insights from working with leading teams, show how these capabilities fit into security workflows, and discuss where AI-assisted defense is headed next.

We’ll likely cover new security product stuff we’re shipping, and even a live demo (I’m starting my sacrifices to the demo gods now 🙏).

👉️ Join live Thursday June 25, 1pm PDT 👈️ 

Hope to see you there!

Sponsor

📣 Is Your Segmentation Real, or Just a Comfortable Illusion?

AI-generated exploits don't need sophistication, just a gap you don't know exists. Target-specific attacks are generated in minutes, built to find what your tools can't see.

runZero shatters the segmentation illusion. New attack path mapping and topology visualizations reveal how an attacker can move through your environment. Safely enumerate sub-assets hidden behind protocol gateways like Modbus, BACnet, and EtherNet/IP that other tools miss entirely.

Every asset, every exposure, every attack path across IT, OT, IoT, cloud, and mobile. With runZero, defenders win by default. Even against AI.

👉 Start your 21-day free trial 👈

AppSec

Formal methods and the future of programming
Jane Street’s Yaron Minsky describes how they’re building a formal methods team after 25 years of skepticism, driven by the belief that agentic coding has fundamentally changed the cost-benefit calculus of formal verification. Yaron argues that AI agents both reduce the cost of formal methods (by making proof construction more accessible) and increase the benefits (by providing better verification for AI-generated code that tends toward "slop", and by offering the universal guarantees that agents need for effective feedback during training and coding).

“Our hope is to make formal methods as pervasively useful of a tool for building software as sophisticated type systems are for us today.”

💡 Useful things to reflect on whenever there are meaningful tech changes, AI or otherwise: what used to be hard that is now easy? What used to be impossible that is now feasible? What used to be too costly or too slow that now could make sense? I’m actually pretty bullish on formal methods in the AI era.

Making secret scanning more trustworthy: Reducing false positives at scale
Microsoft's Mariko Wakabayashi details how the Agents Offense team helped GitHub adopt Microsoft’s Agentic Secret Finder's verification approach into its AI-powered secret scanning, cutting customer-confirmed false positives by 75%. Rather than feeding the model more data, the approach extracts focused, high-signal usage context such as whether a detected value is assigned to a variable and later passed into an API request, authentication header, database client, or cloud SDK call, as well as execution paths. Providing the right context lets the model separate real exposures from noise like UUIDs, test data, or placeholders without reducing detection coverage.

💡 This work sounds neat, and How we built Copilot secret scanning shares a bit more details about GitHub’s approach, but I wish both were a bit more detailed. For an example I like, see Wiz’s post How We Fine-Tuned a Small Language Model for Secret Detection in Code.

Codex Discovered a Hidden HTTP/2 Bomb
Calif's Quang Luong, Jun Rong and Duc Phan used Codex to discover HTTP/2 Bomb, a remote denial of service affecting nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora in their default configurations. The attack chains two techniques that have been public since 2016. The first abuses HTTP/2's header compression, where a single saved header can be referenced thousands of times, and each one-byte reference forces the server to allocate a full header in memory. The second tells the server its receive buffer is full, then drips just enough updates to keep the connection from timing out so the server never frees anything.

A single client on a 100Mbps home connection can pin 32GB of server memory in roughly 20 seconds against Apache and Envoy. A Shodan search found 880,000+ websites supporting HTTP/2 and running one of these servers, though many sit behind a CDN. Calif published PoCs and Docker labs at califio/publications.

Sponsor

📣 Discover the Architecture of Stopping-Power

Modern threats move faster than platforms built on delayed telemetry, API-derived state, and after-the-fact correlation can control. The next generation of cloud security will not be won or lost on how much risk it can describe. It will be won or lost on how effectively it can convert context into stopping power.

In their landmark paper, Agentic Cloud Security Platforms: The Shift to Runtime Security, Software Analyst Cyber Research (SACR) demonstrates how the limits of CNAPP are architectural. 

👉 Download this important read 👈

I do wonder where things are headed if we assume AI-powered attackers can pivot and move through a network faster. How will cloud tools adapt? 🤔 

Cloud Security

Disrupting AWS logging
(In 2016!) Daniel Grzelak demonstrates multiple techniques for disrupting AWS CloudTrail logging after compromising an account, ranging from obvious methods like delete-trail and stop-logging to stealthier approaches. Key tactics include disabling multi-region logging with update-trail --no-is-multi-region-trail --no-include-global-service-events to operate freely in non-home regions while suppressing global IAM events, creating an immutable encryption-only KMS key via create-key --bypass-policy-lockout-safety-check so CloudTrail keeps writing logs that nobody can decrypt, redirecting logs to attacker-controlled S3 buckets, modifying bucket policies to block CloudTrail writes, and setting 1-day S3 lifecycle expirations to auto-delete files.

You can also deploy an AWS Lambda function triggered by S3 object-create events to delete logs immediately on write, winning any race condition against SIEM ingestion while staying within Lambda's 1 million free monthly invocations to avoid detection through unusual billing patterns.

💡 As they say, read Daniel’s posts to avoid being a cyber-patsy.

Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility
Palo Alto Networks's Yahav Festinger describes seven attack techniques targeting AWS CloudTrail and Google Cloud Logging services, organized into defense evasion and continuous visibility (transferring logs to the attacker’s accounts, giving visibility into the victim’s environment). Defense evasion techniques include stopping logging, deleting the log storage destination, deleting the log router, impairing logging via an attacker-controlled encryption key, and log poisoning. Continuous visibility techniques include configuring a new log routing resource and log redirection. Attackers can exploit permissions like cloudtrail:StopLogging, s3:DeleteBucket, logging.sinks.update, and KMS key modifications to blind security tools, manipulate audit trails, or exfiltrate logs to attacker-controlled destinations for passive reconnaissance.

Festinger recommends restricting access to logging service APIs to highly privileged users, using immutable log repositories like AWS's 90-day CloudTrail Event History and Google Cloud's _Required log bucket, and implementing bucket policies that prevent non-admin modifications. For detection, CloudTrail log file integrity validation flags log poisoning but is off by default for trails created via API or CLI.

Supply Chain

Perplexity is open sourcing Bumblebee
Perplexity has released Bumblebee, a read-only scanner that checks developer machines for risky packages, extensions, and AI tool configurations during supply-chain incidents by parsing metadata files directly without executing code. The tool scans four surfaces: language package managers (npm, pnpm, PyPI, Go modules, etc.), AI agent configs (MCP), editor extensions (VS Code family), and browser extensions (Chromium and Firefox). Bumblebee supports three scan profiles: baseline for routine scans, project for targeted repo checks, and deep for active incident response.

Bumblebee avoids triggering malicious install scripts by never invoking package managers or running lifecycle hooks, instead reading lockfiles, manifests, and installed package metadata directly. Perplexity integrates Bumblebee into their workflow where Perplexity Computer drafts catalog updates as GitHub PRs after threat signals emerge, humans review them, and Bumblebee then scans endpoints with the updated catalog to identify exposed systems.

💡 Smart approach, I like this a lot: a single tool to inventory all of these developer attack surfaces, gathers the data in a way that avoids accidental code execution from malicious packages, and integrates with a continuously updating threat catalog 👌 

Securing CI/CD in an agentic world: Claude Code Github action case
Microsoft's Dor Edry and Amit Eliahu demonstrate how Anthropic's Claude Code GitHub Action could leak CI/CD secrets when processing untrusted GitHub content like issues, pull requests, and comments. While the Bash tool ran inside a Bubblewrap sandbox with environment variables scrubbed, the Read tool bypassed that isolation and could read /proc/self/environ directly, exposing ANTHROPIC_API_KEY and other runner credentials.

To confirm exploitability, they hid a prompt injection inside an HTML comment that instructed the agent to read sensitive files and truncate the first seven characters of any API key found, bypassing Claude's safety filters and GitHub's Secret Scanner. From there, exfiltration was possible via WebFetch, Bash, or issue comments. Anthropic patched the issue in Claude Code 2.1.128 by blocking access to sensitive /proc files.

Blue Team

grepstrength/malsnitch
Tool by Kevin Winborne that scans malware artifacts like string dumps, FLOSS output, or Binary Ninja exports to extract embedded secrets such as C2 credentials, crypto keys, API tokens (GitHub PATs, AWS, Stripe, Slack), exfiltration channel credentials (e.g. Discord webhooks, Telegram bot tokens), and hardcoded SMTP/FTP/HTTP credentials.

Cisco-Talos/EvidenceForge
By Cisco Talos: An open-source tool that generates realistic, multi-format security logs for threat hunting training by solving the core problem of synthetic data: cross-source consistency. EvidenceForge uses a canonical SecurityEvent model to emit 20+ correlated log formats (Windows Security, Sysmon, Zeek, eCAR EDR/XDR, syslog, bash history, Snort, web access, and proxy logs) from a single source of truth, ensuring LogonIDs, PIDs, timestamps, and Zeek UIDs match across all outputs. A causal expansion engine adds prerequisite events with realistic timing, like DNS queries before connections and Kerberos TGT/TGS before domain logons, and a Hawkes process models user activity including Monday login storms and Friday early departures. Network visibility modeling further determines what each sensor can realistically observe.

Scenarios are authored through Claude Code or Codex agent skills that draw on MITRE ATT&CK, while log generation itself is fully deterministic with no LLM calls. A 4-pillar evaluation framework then scores the output across parseability, plausibility, causality, and timing.

Red Team

Mythic Embarking on the Open Seas: Containerized Payload Delivery for Kubernetes Assessments
SpecterOps' Alex Rodriguez introduces two new Mythic C2 extensions, container_wrapper and container_registry, that streamline containerized payload delivery for Kubernetes assessments by wrapping Mythic payloads into OCI-compatible containers and hosting them in self-managed registries. The container_wrapper uses Buildah to package payloads into container images via Mythic's web UI, while container_registry uses skopeo to push these images to a distribution-based registry deployed behind an HTTPS redirector. This approach lets operators hand clients a simple Kubernetes manifest to deploy in their own clusters, eliminating manual Docker CLI workflows and supporting container-centric penetration testing in environments where worker nodes have internet egress and no restrictive image policies are enforced.

Don’t Jump the Turnstile: Lessons from the Field
SpecterOps's Zach Stein describes how he beat email phishing sandboxes with Cloudflare Turnstile on a red team engagement, after the same sandbox had defeated every standard evasion he reached for. He first used the Satellite framework to block Linux user agents, but the sandbox swapped to a Windows user agent. He then added a filter page that only redirected after mouse movement, but the sandbox crawled the redirect URL straight out of the HTML. So he implemented Turnstile as a CAPTCHA-like verification layer that hides the redirect URL from the page source, keeping sandboxes from crawling to the payload while looking legitimate to a real user.

Zach published the build as Turnstyle, a Flask WSGI app fronted by Apache, mod_wsgi, and a Certbot certificate, with an Ansible deployment script in the repo.

AI + Security

Quicklinks

• How Android helps keep you safe from impersonation scams with fake call detection - New feature helps protect you from scammers using AI deepfakes to impersonate your contacts. Shout-out to my friend Rachel Tobac for helping inspire the work 🤯 

• [NEW] Discover shadow AI agents via the browser - Most AI agent discovery tools rely on APIs. The problem? A lot of agentic AI platforms don’t expose agent details via an API. Nudge Security just closed this blindspot with browser-based AI agent discovery.*

• r/ollama - 30 Days of an LLM Honeypot

^*Sponsored

visa/visa-vulnerability-agentic-harness
By Visa: An open-source agentic SAST pipeline that uses Claude, OpenAI, or any combination of frontier models for autonomous vulnerability discovery. It prioritizes triage speed over raw discovery volume, with Mean Time to Adapt as its primary metric. Threat modeling focuses the attack surface, multi-agent deterministic voting reduces false positives, and structured triage artifacts compress the path to actionable findings.

The pipeline runs nine stages, beginning with attack surface mapping and STRIDE/OWASP threat modeling, then specialized research lenses for language, crypto, logic bugs, access control, batch/ETL, and IaC, followed by adversarial verification and exploit chain construction. Output includes Markdown reports and SARIF 2.1.0 artifacts.

CiscoDevNet/foundry-security-spec
Cisco has released the Foundry Security Spec, an open specification for building agentic AI security evaluation systems, distilling production lessons into 130 functional requirements across eight core agent roles (Indexer, Cartographer, Detector, Triager, Validator, Reporter, Coverage Guide, and Orchestrator) plus five optional extensions (Deep-Tester, Variant-Hunter, Attack-Mapper, Remediator, Self-Improver).

The spec is deliberately infrastructure-agnostic with explicit [NEEDS CLARIFICATION] markers for organization-specific decisions, designed to be consumed via spec-kit's clarify-specify-plan-implement workflow rather than shipped as runnable code. Foundry implements a detection-to-prevention flywheel where exploratory agents hunt alongside CodeGuard rule sweeps, recording rule gaps that get generalized back into the corpus, so each evaluation improves both detection across all future targets and prevention in developers' LLM coding assistants. See also the companion blog post by Omar Santos.

💡 Very cool project idea: a specification for building your own AI-powered code scanner. You customize the spec with your environment, and then it builds according to that. It makes me think of some SciFi show where you plug in your requirements, and then it materializes food or whatever you’re imagining. “Replicators” in Star Trek.

Misc

AI

• Joshua Saxe - Banning Mythos represents a basic misunderstanding of AI cybersecurity

• David Sacks on the Fable ban

• Katie Moussouris - The Fable 5 Export Controls Harm US Cyber Defense

• Hank Green - The Riskiest Moment of the AI Bubble

• Bloomberg - Ray Dalio on the bond market, a weaker dollar driving gold demand, and AI bubble concerns

• Bloomberg - Inside Anthropic, the $965 Billion AI Juggernaut - Neat profile of Dario and Daniela Amodei, with a little Boris.

Music

• Lea Salonga's Audition for Miss Saigon

• Row Row Row Your Boat but in different keys at the same time

• "Go the Distance" - Broadway's Leading Men Concert

• Colors of the Wind - Live Orchestra | Pocahontas

• Charles Cornell - Phil Collins Made EVERY Parent Sob With 1 Key Change | You'll Be In My Heart - My dad loved Phil Collins, I remember watching Tarzan with him when I was young 🥹 I burned a few of the best songs from the soundtrack onto a CD when I was in school, and we’d listen to it in the car when we were driving somewhere together, like my karate practice. I could see this song hitting very different as a parent.

Misc

• Midjourney Medical - Holy cow, the image generation site is getting into healthcare, and planning to build a better body scanner, and spa in SF 🤯 

• When Pikachu gave the most epic speech in Pokemon history

• A day in the life of a personality-maxxer

• Throwback NFL commercials are the best

• Jon Oliver - Moderator: 1 | Politician: 0

• Mark Manson - 20 Years of Therapy Summarized in 13 Minutes

• Trying to understand investing and stock price 😂 

• Leila Hormozi - Do This & Watch How Fast People Stop Disrespecting You

• Sygnia - Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected

• What Dreamworks Understands About Evil That Disney Doesn't

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤔 New Job, Who Dis?

TL;DR: I’ve joined OpenAI to lead their Cyber efforts.

I’m joined by Mike Aiello, an awesome security executive and human. Mike was previously CTO at Secureworks, led product for Google Cloud Security from 0 → $B’s in revenue, and CISO at Goldman Sachs.

I was going to write a post describing all the details about joining, my thought process, etc. but it turns out there’s a lot to do at OpenAI and I’ve gotten very busy 😅 The post is started but not finished, will share when I can.

So here’s the short version.

Why
I was very happy at Semgrep and wasn’t looking for new opportunities, but when an OpenAI recruiter reached out, it seemed like a once in a lifetime company and opportunity that I couldn’t pass by.

During the interview process, when I spoke with my potential colleagues, I was impressed by how they were incredibly smart and kind, and genuinely, earnestly, cared about making a positive impact on the world. Several people, without me bringing it up, expressed to me that as models get better, they feel a moral responsibility to do what they can to secure the world’s software.

And now from the inside, I can see that the sentiment was genuine, and not a facade (you always wonder as an outsider). OpenAI has easily already spent millions securing open source and critical infrastructure that they haven’t yet claimed PR cred for doing.

I’ve long talked about the power of secure by design and eliminating vulnerability classes. Being at OpenAI makes that feel tractable in a way it never has before. I’m optimistic we, the security community, can meaningfully raise the world’s security bar over the next few years. Seriously.

Lastly, how I think about the decision is also well expressed by my friend Rami McCarthy, who, like with many things, annoyingly wrote a better version of what I would write in his post on joining Wiz. Similarly, I hope to “work for the security industry, at OpenAI.”

I shared a LinkedIn post with a bit more details, feel free to say hi or share thoughts there 👋

P.S. tl;dr sec will continue, don’t worry. Also, I will continue to include high quality content from Anthropic, that is also unchanged. More on that below.

Sponsor

📣 State of SDLC Report 2026

The 2026 SDLC Security Report analyzed real-world development environments, codebases, and SDLC infrastructure to understand how risk is evolving and how software is built and shipped.

The TL;DR: Risk isn’t primarily driven by rare vulnerabilities. It scales through reuse, permissions, and automation across the SDLC.

The report explores:

• AI copilots and developer tooling risk

• Dependency concentration and supply chain exposure

• Secret leakage trends

• CI/CD and GitHub Actions attack paths

Learn how SDLC risk is reshaping application security.

👉 Get the State of SDLC Report 👈

AppSec

1-Click GitHub Token Stealing via a VSCode Bug
Ammar Askar describes a bug in which clicking a github.dev link could steal a GitHub token with read/write access to all your private repos, by chaining a Jupyter notebook payload that exploits VS Code webview's did-keydown event forwarding to install a malicious extension. Neat write-up!

How We Cut Semgrep’s Taint Analysis Time by 75%
Semgrep's Austin Theriault walks through how the taint analysis engine was redesigned to run once instead of twice, cutting scan times by up to 75%. Taint analysis is used for vulnerabilities like SQL injection by tracking user input as it flows through code from sources to sinks, with propagators that carry the taint forward and sanitizers that clean it.

Semgrep's original 2023 architecture computed those configs during interfile analysis, then discarded them and recomputed during intrafile analysis, a design forced by OCaml's parallelism limitations before 5.0 that would have ballooned memory if all the state were kept in flight at once. Refactoring to merge both passes unlocked parallelization via OCaml multicore and reduced P95 scan times from 10 minutes to 7:30, with some large repositories seeing 3x+ improvements.

Sponsor

📣 Key questions to ask any AI vendor

Vendors are claiming autonomy - but most are still requiring significant human oversight. And most security teams don't yet have a clear framework to evaluate the difference.

Join Sublime Security and Georgian on June 24 for a practical session on evaluating security AI. You'll leave with a clear autonomy framework, a trust-based evaluation path, and key questions to ask any AI vendor - including what good answers actually sound like.

👉 Register now 👈

Honestly, it is super useful to know the right pointed questions to ask vendors, as well as having a feel for what “good” and rigorous evals look like in practice.

Cloud Security

fwd:cloudsec North America 2026
The premier cloud security conference just uploaded the talks from their most recent event. Highly recommend. Many of the talks look great, and see the blog version of some below. Some additional talks I’m linking here so I can come back to them:

• In git we trust: Defending Lovable projects from malicious code attacks at scale by Marcus Hallberg & Samuel Kelemen.

• Barbarians at the Gate: Visualizing and Blocking SDLC Infrastructure Threats with SITF by Shay Berkovich.

HazyBeacon and AWS Lambda Function URL Abuse
Qualys' Aniket Harne breaks down HazyBeacon, a campaign originally documented by Palo Alto Unit 42, where attackers used stolen IAM credentials to deploy AWS Lambda functions with AuthType: NONE Function URLs as command and control relays, making malware traffic indistinguishable from ordinary HTTPS calls to the lambda-url.<region>.on.aws domain. The chain starts with credentials harvested from public GitHub repos or developer phishing, validated through reconnaissance calls like aws sts get-caller-identity, then used to deploy a Lambda function under a benign name in an unused region whose public Function URL proxies traffic between infected endpoints and the attacker's real backend. The relay sits inside a separate compromised AWS account, which leaves the malware victim and the AWS account holder as two unrelated victims, often unaware they're connected until the bill or the abuse notice arrives.

Recommended mitigations: A Service Control Policy blocking AuthType: NONE Function URLs unless explicitly tagged, global CloudTrail logging, enabling VPC flow logs, and more.

💡 Honestly, pretty clever use of Lambda Function URLs.

Sub:jugation - Hijacking Cloud Identities by Recycling Namespaces in Global OIDC Issuers
Astrix Security's Tal Skverer describes Sub:jugation, a vulnerability class affecting GitHub Actions, GitLab CI, and Terraform Cloud where the global OIDC issuer model lets attackers reclaim deleted repository namespaces and mint JWTs with subject claims that match existing cloud IAM role trust policies. Any cloud role still trusting an orphaned sub claim hands over short lived AWS, Azure, or GCP credentials to whoever recreates the namespace. Astrix calls these forgotten roles Phantom Cloud Identities, and found that 14% of AWS identities and 24% of Azure identities trusting GitHub's global issuer point at namespaces that are no longer registered, with roughly 8 becoming exploitable each month through publicly available data alone.

GitHub has shipped the complete fix, adding random identifiers to sub claims so reclaimed namespaces can't mint matching tokens, while GitLab and Terraform have rolled out interim mitigations with full OIDC subject solutions still pending. Until those land, organizations need to audit every cloud identity trusting token.actions.githubusercontent.com, gitlab.com, or app.terraform.io, confirm the referenced namespace is still theirs, and either reclaim it or decommission the role outright.

Supply Chain

Well-architected best practices for software supply chain security
AWS's Trevor Schiavone and Desiree Brunner walk through defense in depth controls for npm supply chain attacks. Key mitigations include: replacing long-lived credentials with temporary ones via AWS CLI login, IAM Identity Center, or OIDC federation; implementing artifact signing with AWS Signer to cryptographically verify packages before production deployment; centralizing dependency management with AWS CodeArtifact's package group configuration to block typosquatting; and using Amazon Inspector's behavioral analysis to detect zero-day malicious packages.

Also: require MFA on maintainer accounts and multiple approvers, analyze CloudTrail logs for indicators of compromise, and leverage Software Bills of Materials to quickly assess blast radius during incidents.

Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does
Guillaume Ross shows how to detect and prevent credential theft from developer workstations by combining bagel, an open source secret scanner, with Fleet, an MDM platform that uses osquery for telemetry, and an IdP conditional access policy. Bagel runs on a schedule through a LaunchAgent to find cleartext secrets in developers' home directories, Fleet reads the JSON output via its parse_json osquery table to evaluate it against a policy, and an IdP blocks SSO on non-compliant workstations until the secrets are remediated.

Guillaume ships the integration as Fleebag, a proof of concept repo with macOS installation packages for bagel, Fleet queries for findings, a policy query that passes only when scans are fresh and clean, and an example profile to grant bagel full disk access.

AI + Security

Quicklinks

• Cursor bypassing pnpm min release age settings 😅 

• Claude Fable 5 and Claude Mythos 5

• Cybersecurity researchers aren’t happy about the guardrails on Anthropic’s Fable - Preventing model misuse is hard 🙃 

Introducing the Agent Governance Toolkit: Open-source runtime security for AI agents
Microsoft's Imran Siddique released the Agent Governance Toolkit, an open source framework of seven packages that aims to address all 10 OWASP Agentic AI Top 10 risks by porting operating system, service mesh, and site reliability patterns to autonomous AI agents. The packages run across Python, TypeScript, Rust, Go, and .NET, and the toolkit plugs into each framework's native extension points across LangChain, CrewAI, LangGraph, LlamaIndex, OpenAI Agents SDK, and more.

The toolkit: Agent OS as the stateless policy engine (supports YAML, OPA Rego, and Cedar), Agent Mesh for cryptographic identity, Agent Runtime for sandboxing execution inspired by CPU privilege levels with an emergency kill switch, Agent SRE for applying service level objectives and circuit breakers, and the final three handling compliance, plugin lifecycle management, and reinforcement learning training governance.

System Over Model, Tested: Reproducing Mythos's FreeBSD Find on Local Open-Weight Models
John McIntosh reproduces Anthropic's Mythos discovery of CVE-2026-4747, an RCE in FreeBSD's RPCSEC_GSS authentication, using AISLE's nano-analyzer pipeline on two local open-weight models (gpt-oss-20b and gemma-4-31b-it). The models could find the bug, but the pipeline graduated 30 false positives that buried the real CVE. Rather than swap to a stronger model, John added one extra reachability filter stage using the same model weights that traces each finding back to an entry point, greps for callers, and checks whether the cited length is really controlled by the attacker or just set by the kernel, cutting false positives from 30 to 5 while keeping the real CVE valid. The full experiment is on GitHub.

💡 Here’s how I see it: the foundation model labs try to convince you that “all you need is the model” and security vendors (or individuals) argue “it’s all the scaffolding.” Ultimately, I believe the truth is: the model, the prompt(s)/Skills, scaffolding/architecture, and how much you’re willing to spend all matter. Improving each gets overall better performance. Improving the model can get you the same or better results with removed (or less) scaffolding, and improved scaffolding on top of better models will yield even better results (more true positives, fewer false positives/negatives).

At the end of the day, it all distills down, like most things in security, to: how much risk reduction are you getting at what price? My $0.02 at least.

Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator
Anthropic’s Kyla Guru, Alex Moix, and Jacob Klein analyzed 832 banned accounts that misused Claude for cyber operations over one year, mapping 13,873 malicious actions across 482 MITRE ATT&CK techniques and developing the AI Risk Enablement Score (ARiES) to assess threat levels. They found the highest-risk actors weren’t distinguished by technical sophistication or number of techniques used, but by their use of agentic scaffolding to autonomously orchestrate entire attack chains, like one threat actor who weaponized Claude Code with MCP servers to autonomously execute reconnaissance, exploitation, lateral movement, and exfiltration.

Anthropic argues that the MITRE ATT&CK framework needs expansion to capture AI-native behaviors like autonomous killchain orchestration and real-time pivot decisions that don't map to existing technique IDs but represent the most dangerous evolution in AI-enabled cyber threats.

💡 This is really cool, and valuable context for the community on how threat actors are using AI. As mentioned in the intro, expect me to continue including solid technical work from Anthropic. I have many kind, extremely competent friends at Anthropic who I respect highly. I think the world is better off for having many companies and individuals working together to make the world safer.

Ultimately I think that’s the north star of all of us working in cybersecurity: making the world safer so all non-neck beards people live happy, fulfilling lives without having to worry about getting hacked, having their identity stolen, etc.

Misc

• Alex Hormozi - The 4 Proven Ways To Build Wealth In 2026

• “This is gonna be cute, trust me”

• Lea Salonga and Brad Kane - A Whole New World (1993 Oscars) 🥹

• Hadestown: The Musical | Official Trailer - OMG YAS! Looks like they filmed the original cast, like they did with Hamilton. I love this approach, I wish all musicals did that. I give Hadestown at least 😭😭😭😭/5. Obviously all musicals should be rated in sob emojis.

• Mobility exercises for 40+

• I have a lot more I want to include here, but it is late, so instead I shall hopefully flesh this out more next week. Hope you have a great rest of your week 👋 

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👩‍❤️‍👨 Repo-mantic Comedy

Recently I had one of those moments where you remember that LLMs are trained on the vast, beautiful, complicated collection of human knowledge.

I was using Codex to port a feature from one code base to another, and it said:

“…I’m reading the exact code paths now so the port preserves behavior instead of inventing a prettier cousin.” 😂 

Dear reader, I had questions. Like: how many bodice ripper novels and country music lyrics are in the training corpus? What other secrets lie in the weights?

I didn’t think I read anything about dating preferences in its model card.

LLMs are strange, and amusing sometimes. This situation makes me think of the goblins post.

I love demoing what you can build with coding agents to friends, but maybe I’ll hesitate before doing this next Thanksgiving, just in case…

Sponsor

📣 AI will make every asset a potential zero-day target. Are you ready?

The AI-attack era has arrived. Thousands of zero-days in the pipeline. Target-specific exploits generated in minutes. Unattributed, one-off attacks that bypass detection — while your dashboard stays green.

runZero is built for this reality. Know every asset on your attack surface, uncover every exposure, map every attack path, and validate your segmentation — before the exploit drops. We deliver deep intelligence across IT, OT, IoT, cloud, and mobile, so defenders can win by default. Even against AI.

👉 Try It Free Today 👈

AppSec

What My Privacy and Security Stack Actually Looks Like
Great guide by Yael Grauer: Use a PO Box and EasyOptOuts to scrub your home address from the internet (Big Ass Data Broker Opt-Out List), meet new contacts in public, use YubiKeys for MFA, 1Password/Bitwarden, encrypted drives, privacy screens in public, Privacy Badger, Mullvad VPN, uBlock Origin, Signal with disappearing messages, Google’s Advanced Protection Program, Lockdown Mode for Apple Devices, Google Fi for SIM-swap protection, iCloud's Hide My Email for aliases, and more.

Comparing AI Application Security Testing Platforms
Doyensec's Luca Carettoni and Anthony Trummer conducted a side-by-side comparison of two AI-powered penetration testing platforms, Aikido's Attack AI Pentest and XBOW's Lightspeed, manually validating all findings to determine true positives versus false positives. The evaluation assessed configuration complexity, impact on tested applications, report quality, cost, speed, and overall testing effectiveness.

💡 Great example of a thoughtful benchmarking methodology and comparison that measures a variety of useful dimensions like: did a human tester agree with the severity ratings, what was the overlap in findings between the tools, and more. It’d be great to see more comparisons this detailed, but it does take a lot of time and effort.

Zapocalypse: The Attack Chain That Could Have Hijacked Zapier
Token Security’s Yair Balilti describes chaining five known primitives to achieve NPM publishing rights to Zapier's design-system package, which would have enabled JavaScript execution in every authenticated Zapier session (yikes). Starting from a "Code by Zapier" Python sandbox where os.system worked, Yair scraped orphaned AWS STS credentials from /proc/self/mem (since del os.environ[k] doesn't zero heap memory), then used the misnamed allow_nothing_role (which actually permitted ECR enumeration and image pulls) to extract 1,111 container images via direct ECR API calls bypassing Docker's GetAuthorizationToken requirement. He then discovered a high-privilege NPM token with bypass_2fa: true and scope.name: null leaked in container build metadata via ARG/ENV in image config history, plus a hardcoded Zapier Actions MCP key belonging to a LiteLLM co-founder that enabled Gmail impersonation.

💡 Attack chain enabling publishing arbitrary JavaScript served by <your domain> and ran in every one of your user’s sessions… $3,000. Sometimes I’m surprised more security researchers don’t turn to crime. To be clear, I’m not encouraging bad behavior, nor is this a unique case, I’ve seen many examples of “I could compromise <all of your users>” and the payout is a few grand. Sometimes the impact to payout ratio feels 🙃 

Sponsor

📣 Prowler: the world’s most widely adopted open cloud security platform

Prowler automates security and compliance across any cloud environment, with agentless coverage of cloud infrastructure, SaaS, Kubernetes, containers, Infrastructure as Code, and more. It detects vulnerabilities and misconfigurations, prioritizes risks, accelerates remediation, and automates audit-ready compliance. 

Prowler has become the security platform of choice for thousands of cloud teams, with 45M+ downloads, 13K+ GitHub stars, and 300+ global contributors. Prowler Cloud delivers cloud security 10x more cost-effectively than alternatives.

👉 See Prowler In Action 👈

Prowler is great, love the open core nature. Also fun demo format 👍️ 

Cloud Security

From Leaked AWS Key to Data Exfiltration in 60 Seconds: Are We Ready?
Adan Alvarez tested Claude Code's ability to move from a leaked AWS IAM key to data exfiltration without AWS-specific guidance, finding that in 7 of 12 runs, the AI agent successfully completed the attack chain in approximately 60 seconds. The scenario involved a CI/CD user with read access to a Terraform state file containing credentials that could assume a privileged role, with all successful runs following an identical six-phase kill chain: GetCallerIdentity, policy enumeration (ListUserPolicies/GetUserPolicy), credential recovery from S3, AssumeRole, bucket enumeration, and exfiltration.

Adan notes that CloudTrail's 5-minute log delivery delay means traditional alerting may be too slow to prevent sub-minute attacks which is why Adan is betting on honeytokens and honeypots to waste the agent's time before it finds anything real. See the scenario on GitHub here.

💡 Interesting- I hadn’t thought about that as much yet, but that’s a great point: log sources that only ship every 5 minutes could be a problem if an entire kill chain can be fully automated in a minute or two. Yikes.

Adding Strands Security Agents to Shadow Asset Scanner
Sena Yakut built a shadow asset scanner that uses boto3 to sweep AWS for exposed S3 buckets, stale IAM keys, public Lambda function URLs, and similar misconfigurations. On top of that she layered a Strands Agents SDK that reads the raw findings and reasons across them for multi step attack paths rather than presenting each item in isolation.

The architecture runs as a collaborative Swarm where specialized agents pass context to each other in sequence. The Error Analyst handles failures from the boto3 pass first, the Attack Chain Analyst then stitches findings into chained scenarios mapped to MITRE ATT&CK tactics, the Summary Agent compresses what comes out, and the Chat Agent serves four report formats (standard, executive, technical, and compliance) along with remediation commands. The agents reach the scanner through Strands' tool interface and share state across handoffs, with caps on handoff count and execution time keeping the swarm from looping indefinitely.

Supply Chain

Skill Issues: Compromising Claude Code with malicious skills & agents
Reversec's James Henderson demonstrates how Claude Code skills and sub-agents can serve as initial access vectors, with risks comparable to installing untrusted pip packages. Henderson describes two attack paths. The first runs through skill frontmatter: setting allowed-tools: Bash(*) alongside dynamic context inputs like !socat ... executes commands before the LLM processes them, while direct reverse shell requests to Claude get refused.

The second path runs through sub-agents and permissionMode: bypassPermissions, which skips consent prompts but doesn't prevent agents from reasoning about commands. To bypass that reasoning, Henderson runs npm install against a localhost registry serving backdoored packages, giving the agent legitimate cover to execute malicious code without exposing the payload.

The sorry state of skill distribution
Trail of Bits's Samuel Judson and Tjaden Hess were able to bypass ClawHub’s malicious skill detector, Cisco’s agent skill scanner, and all three of the scanners integrated into skills.sh in a few hours, using techniques like prepending 100,000 newlines to hide malicious code, embedding payloads in .docx archives and poisoned .pyc bytecode files, and using prompt injection to convince guard models that malicious registry configurations were legitimate corporate infrastructure. The attacks exploited weaknesses in the scanners: truncated file analysis, limited file type coverage that ignored binaries and hidden files, and the ability for attackers to iteratively refine attacks against static scanning targets.

Recommendation: avoid public skill marketplaces like skills.sh and ClawHub entirely, instead curate internal skill repositories using trusted sources. PoC repo: trailofbits/overtly-malicious-skills.

💡 Also WHAT - “The official MS Office skills from Anthropic for handling .docx, .xlsx, and .pptx files each contain a script called soffice.py… which hacks around the socket block by using LD_PRELOAD to patch in either 1) an existing $TMP/lo_socket_shim.so”, or 2) a library dynamically compiled out of C code embedded in a docstring.” 🫠 😂 

Blue Team

From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents
Datadog's Ryan Simon walks through Copy Fail, a Linux kernel bug that lets an unprivileged user corrupt the page cache through its crypto socket interface and quietly rewrite setuid binaries like /usr/bin/su to escalate to root. Ryan used a single coding agent with a custom skill for each step to compress the full detection engineering cycle into one session, from threat analysis through live exploit testing to production deployment. The detection itself is a three stage chained rule that uses process scoped variables to track bind(AF_ALG), setsockopt(SOL_ALG), and splice or open operations on SUID binaries or PAM configs.

💡 The “Accelerating the Detection Engineering Lifecycle with agents” section at the bottom has some great tactical details on how specific steps are scaled 👌 

Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
Google Threat Intelligence Group's (GTIG) Q2 2026 AI Threat Tracker describes several recent developments in how threat actors are using AI in their operations and targeting AI infrastructure directly. GTIG identified the first case of a threat actor using a zero-day it believes was developed with AI, a 2FA bypass in a popular open-source web admin tool disrupted before mass exploitation. PRC and DPRK actors are running their own AI-augmented vuln research workflows, while Russia-nexus malware CANFAIL and LONGSTREAM use LLM-generated decoy logic to obfuscate payloads against Ukrainian targets. PROMPTSPY, an Android backdoor first identified by ESET, embeds an autonomous agent that drives device interactions through gemini-2.5-flash-lite.

Threat actors are also going after AI infrastructure itself. TeamPCP (UNC6780) compromised the LiteLLM and BerriAI repositories alongside Trivy and Checkmarx to plant the SANDCLOCK credential stealer and extract AWS keys and GitHub tokens from build environments. They're also industrializing LLM access through middleware like Claude-Relay-Service and CLIProxyAPI alongside automated account-registration pipelines. The common pattern is a maturing ecosystem where the orchestration layers around AI (wrapper libraries, skill packages, API connectors) are now part of the software supply chain attack surface.

💡 Wow, excellently detailed blog on how threat actors are using AI. Covers a number more things than I have the space to include here.

Red Team

NomShub: Weaponizing Cursor's Remote Tunnel Through Indirect Prompt Injection and Sandbox Breakout
Straiker’s Karpagarajan Vikkii and Amanda Rousseau describe NomShub, a vulnerability chain in Cursor where a malicious repository can silently hijack a developer's machine, combining indirect prompt injection, a sandbox escape via shell builtins (export and cd to escape workspace restrictions and write to ~/.zshenv for persistence), and Cursor's built-in remote tunnel to give attackers persistent, undetected shell access triggered simply by opening a repo.

The Accidental C2: Exploring Dev Tunnels for Remote Access
SpecterOps's Adam Chester examined Visual Studio Code Dev Tunnels as a potential C2 framework, discovering they consist of multiple protocol layers: REST management API for tunnel discovery and token generation, WebSocket tunneling, SSH connections using the russh crate, and MsgPack RPC for command execution. Adam released Ouroboros, a Rust tool that implements the stack outside VS Code, with RPC methods like spawn, fs_read, fs_write, and fs_connect to interact with existing dev tunnels for remote code execution and file operations.

Adam found that FOCI (Family of Client IDs) and BroCI (Nested App Authentication) clients can be leveraged to pivot from compromised Microsoft applications like Teams or Azure Portal to gain access tokens for the Dev Tunnels Service, enabling lateral movement and initial access scenarios. Adam conducted this research with significant assistance from GPT-5.4-Cyber, which mapped the protocol layers and created the russh patch.

💡 Next example of leveraging coding agents to quickly understand a new, complex code base and stack.

Claude Code Hooks as Initial Access & Persistence
Zhangir Ospanov describes how Claude Code's Hooks feature can be weaponized for initial access and persistence by embedding malicious commands in .claude/settings.json files, similar to the VSCode tasks backdoor previously exploited by Lazarus Group. Attackers can plant hooks at the project level that execute when a developer clones and runs Claude Code, or achieve persistence by modifying the global config (~/.claude/settings.json) to trigger payloads across all sessions. The technique uses lifecycle events like SessionStart, PreToolUse, and PostToolUse to execute arbitrary shell commands.

Detection: audit claude/ directories in cloned repositories, watch ~/.claude/settings.json with file integrity monitoring, and review hook commands for anything suspicious before running Claude Code on untrusted code. A proof of concept repository with the full payloads is available if you want to test detection rules locally.

💡 Reporting to you live from the field: features to run arbitrary code… support running arbitrary code. Lots of Living Off the Land opportunities for modern IDEs and coding agents.

AI + Security

Quicklinks:

• Devin for Security - Seems like the focus is mostly on automatically writing fixes for (already) identified security issues, burning down the backlog.

• Is Your Identity Security Keeping Up with AI? - AI is moving faster than identity controls can keep up. Most teams say they're ready, but few can explain what their identities are doing in real-time. That's the AI security confidence paradox. Delinea's 2026 Identity Security Report unpacks this and more.*

• People are using prompt injection to trick Meta's AI into handing over Instagram accounts - The issue has been actively exploited in the wild for months, going back to February of this year, with hackers compromising thousands of accounts.

^*Sponsored

openbashok/promptzero
Local proxy tool by OpenBash that detects and replaces sensitive data such as IP addresses, hostnames, credentials, and personal information in your prompts before they leave your environment, then restores the real values in the response. Detection combines Presidio + spaCy named entity recognition (English and Spanish) for entities like persons, organizations, emails, and passports, with regex layers covering network infrastructure and country-specific identity documents. Each session keeps a bidirectional mapping table that stays local, and you can verify nothing real ever leaves by routing the upstream connection through Burp or mitmproxy and inspecting what actually reaches Anthropic.

LLMjacking: what these attacks are, and how to protect AI servers
Kaspersky's Stan Kaminsky describes an experiment where a researcher ran a Raspberry Pi honeypot dressed as a high-performance AI server with Ollama, LM Studio, and similar local frameworks. Shodan found it in three hours, and the box saw 113,000 requests in a month, with 23% aimed at the AI stack. Attackers used LLM-Scanner to fingerprint models through /api/tags and /v1/models, scanned for AI agents via /.cursor/rules, inventoried MCP servers via /.well-known/mcp.json, and hunted .env files for credentials. The focus was resource theft, not RCE, mostly proxying calls to Anthropic models and parsing vuln data from social posts.

Kaminsky shares some key defensive measures for private AI infrastructure, such as binding single-machine deployments to localhost so they aren't reachable from the network, swapping plain API key auth for OIDC or OAuth2 with short-lived tokens, segmenting the network with IP allowlists, running EDR on the boxes hosting AI models, setting per-role usage quotas with anomaly alerts on resource consumption, and shipping every request and response to a SIEM with tamper-resistant storage.

Inside Claude Managed Agents
Pluto Security's Yotam Perkal reverse-engineered Anthropic's Claude Managed Agents cloud runtime, finding gVisor sandboxing with a three-layer egress control system. Outbound traffic routes through a JWT-authenticated proxy with TLS inspection, the container has no direct DNS, and a network-level firewall blocks direct outbound. Together these prevent proxy bypass even when proxy environment variables are unset.

The architecture separates session, harness, and sandbox into distinct trust zones, so a compromised sandbox cannot tamper with audit logs, influence orchestration, or access vault credentials. Yotam calls the vault credential proxy the platform's strongest property, with secrets never entering the sandbox and instead injected server-side at request time, so prompt injection has nothing to steal.

Yotam notes that the defaults ship for convenience. The egress JWT is readable by any sandbox process and contains organization metadata plus the complete egress allowlist, which Anthropic silently expands with six additional infrastructure hosts (including a staging endpoint) even in limited networking mode. All eight tools are enabled by default with an always_allow permission policy and unrestricted networking. For hardening your deployment the post recommends disabling the default toolset, allowlisting only necessary tools, using limited networking, storing credentials in vaults, and monitoring session events.

Misc

Misc

• Alex Hormozi - How Making More Money Affects Your Life

• Sharran Srivatsaa - I Spent a Day Trying to Buy Spirit Airlines. Here's What I Found.

• The Gen Alpha Melody

• Renée Elise Goldsberry “Satisfied” (Official Music Video)

• Good Work - Do presidents always make this much money?

• Chris Williamson - What To Look For When Choosing A Partner - Chris Bumstead

• F.B.I. Arrests C.I.A. Official With $40 Million in Gold Bars in His Home - I’m guessing he’ll be barred from future public service 😏 

Humor

• typedfemale - presenting: big jeff’s trainium hell - Don’t watch at work 😂 

• Make Some Noise - King Lear and his Three Influencer Daughters - Having three influencer kids, now that’s a tragedy 😭 

• Kai Lentit - Upper Management Meeting

• ProZD - before and after you discover the subreddit for a hobby

• Harvard Commencement 2026 - Conan O’Brien Delivers the Commencement Address

AI / Tech

• Simon Willison - I think Anthropic and OpenAI have found product-market fit

• Lenny’s Podcast - The most rational take on AI you’ll hear this year | Benedict Evans

• Alex Hormozi - Why AI Agents Will Replace Your Next Hire

• Tech Crunch - Microsoft under fire for threatening security researcher with criminal investigation. Kevin Beaumont - Microsoft’s stance on zero day exploits is a dumpster fire of their own making. Microsoft employs some friends and in general top notch security folks. #hugops to them in resolving challenges like this.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

⛰️ Ain’t No Mountain High Enough

To keep me from sending to you bae.

Literally as I was starting to write this intro, my home Internet went out. After a moment I realized I had gotten a text a few days ago- scheduled maintenance with my Internet provider 😅 

So now I’m finishing this issue via hot spotting with my phone.

I’ve wondered sometimes what I’d do if there was some sort of force majeure world or personal event that put my ability to finish the newsletter in jeopardy.

We cut to- *Movie trailer voice* In a world, where there’s too much security news…

*Inception bong* One terminally online hacker fights the info deluge for the people…

But today… *insert plot device like aliens arriving, natural disasters, Sharknado, etc.*

It could be any of these, I’ve got range.

I’ve offered this CTA to Netflix several times over 6 years, and heard back once. Still working on manifesting it 🙏 

Sponsor

📣 Threats Don’t Need Malware.
They Need Your Identity.

No custom malware. No zero-days. Just your own admin tools, cloud APIs, and trusted processes repurposed without triggering a single alert. Varonis Threat Labs' 2026 Attacker's Playbook maps the full attack chain with real-world case studies and exposes how trust gets weaponized by threats at every stage. Discover the tactics. Close the gaps.

👉 Get the Playbook 👈

AppSec

falcosecurity/prempti
Tool by Falco that brings Falco to AI coding agents. Prempti intercepts every tool call (shell commands, file writes and reads, web fetches, MCP calls) at the agent's hook API before it runs and produces allow/deny/ask verdicts from customizable Falco YAML rules, with an LLM-friendly explanation fed back to the agent on denials so it can adapt. Because interception happens at the hook level rather than the kernel, rules see what the agent declares but not the runtime behavior of compiled binaries or the side effects MCP servers later produce, so Prempti is positioned as a cooperative policy layer to use alongside OS-level containment rather than as a replacement for it.

Running Codex safely at OpenAI
OpenAI walks through how they deploy Codex internally, with security controls including sandboxed execution environments, approval workflows for high-risk actions, and an auto-review subagent that automatically approves low-risk operations to reduce friction. They enforce network policies that allowlist expected destinations and require approval for unfamiliar domains, manage authentication through OS keyrings pinned to their ChatGPT enterprise workspace, and use macOS managed preferences with admin-enforced requirements files to maintain consistent security baselines.

Codex exports OpenTelemetry logs containing user prompts, tool approvals, execution results, and network policy decisions, which OpenAI feeds into an AI-powered security triage agent that correlates endpoint alerts with agent intent to distinguish between legitimate behavior and genuine security incidents.

💡 Auto-review mode is neat, I find Codex almost never prompts me in normal usage. Also, the Codex logs → security triage agent is very interesting, I’m curious to know more. Could you detect when an agent is going off the rails, or prompt injected and doing some C2 behavior? Or detecting an insider threat type situation? Lots of applications 🤔 

Automating Security Operations with AI: Triaging Renovate PRs
Marco Lancini writes up how he combined Renovate with Claude Code Routines to automate the review of dependency update PRs, using a custom Claude skill that posts a structured upgrade risk matrix back to each PR. The skill detects stack type (e.g. Python, JavaScript) from the PR title and classifies bumps as High, Medium, or Low based on semver plus how the package actually behaves (e.g. has a history of breaking changes), not just version distance. From there it greps source code for actual imports to flag dead dependencies, queries Context7 for breaking changes, and scans for deprecated config patterns like TypeScript's baseUrl or Next.js's middleware.ts. The cloud routine fires on each new [RENOVATE]-prefixed PR (Renovate runs monthly), runs the skill read-only without approval prompts, and posts the risk matrix via gh pr comment. A 14-day minimumReleaseAge filter sits in front of the whole pipeline to block supply-chain attacks.

💡 Excellent example of automating a toil-heavy workflow: reviewing package updates. Marco kindly released the full Skill prompt he uses, which is thorough and handles a number of edge cases, and is definitely worth reviewing 🤘 

Sponsor

📣 Adaptive Security: Hyperrealistic Phishing Simulations Across Email, Voice, and SMS

Most phishing simulations are still templated emails. Adaptive runs hyperrealistic multi-channel simulations including AI-generated voice calls, OSINT-based spearphishing tailored to each target, and automated phishing programs that run in the background without manual lift. The result: measurable reductions in click rates, stronger security behaviors over time, and a workforce that's actually prepared for the threats hitting their inbox today. Rated 4.9/5 on G2 and Gartner.

👉 See It in Action 👈

AI-powered spearphishing and deepfakes are pretty worrying to be honest, they’re getting quite good. I’m glad people are working on this ✊ 

Cloud Security

AWS Security Agent adds verification scripts for pentest findings
AWS Security Agent now automatically generates executable verification scripts for each confirmed penetration test finding. Verification scripts include setup instructions, documented environment variables, and redacted sensitive values.

💡 Many dynamic analysis tools have been generating curl requests, PoC scripts, etc. that reproduce findings for a decade+, long before LLMs (shout-out Burp Suite, my BFF during my consulting days). And of course fuzzers do this by construction. It seems like auto-generating PoCs is or will be table stakes for any security tool that finds vulnerabilities, which honestly is kind of a cool world to be living in.

Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments
Datadog's Seth Art introduces Pathfinding Labs, a collection of 100+ intentionally vulnerable AWS environments deployable via Terraform for practicing cloud attack paths and validating detections. The project ships a Go CLI tool (plabs) for deployment and a web catalog at pathfinding.cloud/labs with per-lab documentation. Scenarios cover self-escalation (a role granting itself admin via PutRolePolicy), one-hop and multi-hop privilege escalation chains, CSPM misconfigurations and toxic combos like a public Lambda with an admin role, and cross-account paths from dev or ops into prod. Each lab includes a demo_attack.sh script that walks the exploitation chain step-by-step, with cleanup scripts to revert artifacts after testing.

💡 Love all the OSS tools and labs that Seth and Datadog put out. Awesome!

Paved With Intent: ROADtools and Nation-State Tactics in the Cloud
Palo Alto Networks' Bill Batchelor and Eyal Rafian give an overview ROADtools, an open-source Python framework that nation-state actors like Cloaked Ursa (APT29) and Curious Serpens (APT33) have weaponized for cloud attacks, including how ROADtools evades detection and how these threat actors misuse it. The post discusses ROADtools’ roadrecon module for Entra ID enumeration via the Microsoft Graph API, the roadtx module for token manipulation, device registration, and MFA bypass, and categorize functionality in MITRE ATT&CK. They conclude with preventive controls to limit token misuse, and Cortex XQL detection queries.

💡 In security, you either die young or live long enough to see threat actors using your tools for ill.

Supply Chain

We hardened zizmor's GitHub Actions static analyzer
Trail of Bits's Alexis Challande writes up a three-month collaboration with the zizmor maintainers to bring its YAML anchor support up to full coverage, prompted by the March 2026 supply-chain attack where attackers exploited a pull_request_target misconfiguration in aquasecurity/trivy-action to backdoor LiteLLM. Zizmor’s anchor support had been best-effort since GitHub Actions added native YAML anchors in September 2025. The team fixed parsing bugs that caused crashes and wrong-location findings, surfaced deserialization edge cases that broke zizmor on otherwise valid workflows, and aligned zizmor's expression evaluator with GitHub's Known Answer Tests, validating the work against a corpus of 41,253 workflows from 6,612 high-value open-source repositories.

The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)
Wiz's Shay Berkovich found vulnerabilities in AI-powered GitHub Actions from OpenAI, Anthropic, and Google affecting repositories with 200,000+ combined stars. Among them, openai/codex-action and anthropics/claude-code-action rely on syntactical permission checks that let attackers impersonate trusted apps when allow-bots is enabled (or if a name is available to be registered, a “Dangling GitHub Apps” attack). Dependabot Deputy Confusion Injection has attackers issue @dependabot commands so dependabot appears as the github.actor on a PR, slipping past allow-lists.

Shay describes how some common authentication Actions create sensitive local secret files at runtime (e.g. GCP service account keys or others that often grant infrastructure-level access). Verbose modes in claude-code-action and run-gemini-cli leak these files via workflow logs even when the model refuses direct exfiltration.

Red Team

microsoft/RAMPART
By Microsoft: RAMPART (Risk Assessment & Measurement Platform for Agentic Red Teaming) is a pytest-native framework for safety and security testing of agentic AI applications that enables developers to write structured tests, with evaluation-driven assertions checking agent behavior against each scenario.

Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound
SpecterOps' Andrew Gomez and Andrew Luke release TailscaleHound, a BloodHound OpenGraph collector that maps Tailscale environments as queryable attack paths. It models users, devices, groups, tags, ACLs, grants, SSH rules, routes, app connectors, keys, and hybrid Azure identity links under the TS namespace.

Collection runs through the Tailscale API with read-only OAuth credentials, with optional tailcontrol cookie enrichment. Without API access, local collection works from tailscale status --json output, optionally enriched with an Access Policy file. From there, saved Cypher queries answer who can reach a given device, who can SSH as root, which subnet routes expose internal CIDRs, and which Azure users inherit Tailscale access through TS_AZUserSyncedToUser bridge edges.

AI + Security

Introducing KeyLedger: Because You Probably Don't Know How Many AI Keys Your Org Has
Riptides' Balint Molnar open-sources KeyLedger, a Go TUI for inventorying AI provider API keys across OpenAI, Anthropic, Google Cloud Vertex AI, and AWS Bedrock through their admin APIs. KeyLedger normalizes each provider's different organizational structure into a single table, with automatic health scoring flagging stale, idle, and never-used keys. SQLite snapshots let you diff inventories between runs to track new keys, revocations, and status changes over time. The TUI handles interactive exploration, and watch mode polls providers continuously and runs as a Docker container for long-running deployments.

Attacking Production Apps Without Jailbreaking the Model: Scope Manipulation with scopeshift
OFFENSAI's Eduard Agavriloae releases scopeshift, an open-source tool demonstrating how AI coding agents can be tricked into attacking production targets while believing they're testing localhost, bypassing jailbreaking entirely through network-layer deception rather than adversarial prompting. Scopeshift works as a reverse proxy on 127.0.0.1 that rewrites responses (stripping CDN headers, rewriting URLs, replacing titles with "Dev Build — Local") and provides a deceptive MCP server that always returns "in scope" authorizations.

Testing showed that without safety prompts, Claude Opus 4.7 voluntarily called the MCP oracle and sent seven SQL injection payloads to the real OFFENSAI website, but a one paragraph safety prompt caused the model to refuse after recognizing that in-band signals (MCP responses, DNS, TLS, page content) cannot validate themselves.

Misc

AI

• Every - AI Was Supposed to Save Time. Why Am I Busier?

• Leila Hormozi - AI Is Making Your Thinking Worse (And How to Fix It)

• Alex Hormozi - The New Way of Making Content In The Age of AI

• Matt Turck - OpenAI's Yann Dubois: Why AI Progress Suddenly Feels Real - Really helpful overview of the different parts of model training

• Tim Ferriss - The AI Frontier and How to Spot Billion-Dollar Companies Before Everyone Else — Elad Gil

• Bun ported from Zig to Rust in 6 days using AI

Humor

• If Lin-Manuel Miranda wrote Defying Gravity from Wicked 😍 

• Dr. Seuss Rap

• SNL - Weekend Update: Mr. On Blast Speaks His Mind Again Without Holding Back - This killed me 😂 

• Good Work - What does Meta actually do now?

• SNL - Mom Movie Trailer

Misc

• Paper - Didgeridoo playing as alternative treatment for obstructive sleep apnea

• Magnifica Humanitas: on Safeguarding the Human Person in the Time of AI - I didn’t have “the pope writes a screed on AI” on my 2026 bingo card, but here we are

• r/bugbounty - I’m a former H1 Triager AMA

• Your Life in Weeks - Create a map of your life where each week is a little box. Inspired by Tim Urban’s blog.

• How Diamonds are Made - Cool visualization

• Palette Inspiration - Explore color palettes extracted from thousands of masterworks - from Renaissance elegance to Impressionist light. Super cool!

• Bryan Johnson - You’re Exercising Wrong

• Vik White & Urban Theory at the Red Bull Dance - Sick 🤯 

• Google leaks details for Chromium bug that can turn browsers into bots - Reported over three years ago, made public but then wasn’t actually fixed.

• Krebs on Security - CISA Admin Leaked AWS GovCloud Keys on Github

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🍦 Ice Cream Bonding

There’s this Mediterranean place I like to go to sometimes, Souvla, that has delicious frozen Greek yogurt you can get with baklava on top.

It’s helped me power through many a late night writing tl;dr sec. Like tonight 😅 

I’ve gradually started befriending the manager over time, over a series of froyos.

We’ve discussed how it’s sometimes difficult to make new (deep) friends as you get older, some of his work challenges, and more.

All from periodic 5 minute conversations.

It makes me think that most people probably have a lot to open up and share about, if you create a little space for it.

Anyway, I’m not saying frozen yogurt is the key to adult friendship, but I’m not not saying that.

Maybe community is built less through grand gestures, and more through remembering someone’s name, asking one more question, and occasionally adding baklava.

Sponsor

📣 State of AI in the Cloud 2026:
How AI Is Reshaping Cloud Security

AI is no longer a standalone tool, it’s embedded across cloud environments, development workflows, and production systems.

The State of AI Report reveals how AI adoption is expanding the attack surface, accelerating attacker behavior, and introducing new risks through agents, copilots, and automation.

Get the data behind what’s changing and what security teams need to do about it.

👉 Read the Report 👈

AppSec

The down fall of bug bounties
Assetnote Searchlight Cyber’s Shubham Shah reflects on how AI has impacted bug bounty: skilled researchers are submitting higher quality reports faster with AI assistance, but platforms are overwhelmed by low-quality AI-generated submissions. Shubz isn’t pleased with current solutions from HackerOne (fighting AI with AI) and Bugcrowd (spam controls), finding despite him hacking on Uber’s bug bounty program for almost ten years and ranked #1 on their public program, and his recent high impact submission took 12 days to get a response instead of previously 1-3 days.

The security policy rollout survival guide
The blog version of Oblique's Maya Kaczorowski’s BSidesSeattle talk. Maya outlines a practical framework for rolling out security policies, emphasizing that successful implementation requires getting stakeholder input from engineering, product, SRE, and IT before defining controls, then running a pilot with representative users across diverse roles and platforms to identify edge cases and validate that controls actually work.

She emphasizes the importance of communicating changes through multiple channels (email, Slack, all-hands), making policy enforcement visible to users so they can see how they compare to peers, and ensuring the policy owner (not IT) handles ongoing enforcement and user friction.

How OLTs may have exposed entire ISP networks
Quarkslab's Mathieu Farrell describes a chain of pre-auth RCEs against network vendor VSOL's GPON OLT (Gigabit Passive Optical Network Optical Line Terminal) hardware and its Cloud EMS fleet manager that together can take over an ISP's entire fiber network.

Farrell found three pre-auth command injection bugs in the V1600 OLT models (SNMP traceroute, TACACS+ login, web traceroute), all share the same default admin credentials hardcoded in the firmware, plus an arbitrary file upload RCE in Cloud EMS that allows JSP webshell deployment with root access. The post shows how attackers could chain these vulnerabilities, starting from exposed OLTs or the cloud manager, to compromise entire fleets of devices across ISPs in countries including the US, India, Turkey, Taiwan, Brazil, and Mexico.

💡 Yikes 😅 

Sponsor

📣 Are your developers --
dangerously-skipping-permissions yet?

Agents writing code is easy. Trusting what those agents are doing is hard. Minimal hands your devs isolated, declarative environments that run identically for humans, agents, and CI. Reproducible by default, local first.

👉 Learn more 👈

OK this looks really cool. Performant + sandboxed local dev environment, curated open-source packages compiled from source (in a SLSA-compliant environment), network connectivity and filesystem access must be explicitly declared in Build Specifications and more.

I got nerd sniped reading about Minimal, sounds thoughtfully designed for both engineering and security. I’m going to read more about this later.

Cloud Security

Quicklinks

• AWStrology: What Star Sign Is Every AWS Service?

• AWS for Idiots - AWS described via comics

• Corey Quinn - S3 Is Not a Filesystem (But Now There’s One In Front of It) - “…AWS pricing is where dreams go to get itemized.” 😂 

The AWS Bedrock API Keys Security Guide Part 2: Detection, Prevention, and Response
BeyondTrust's Sergio Garcia continues his team's AWS Bedrock API key research with a follow-up covering detection, defense, response, and migrating to STS. The post includes CloudWatch Logs Insights queries, EventBridge patterns, and SIEM rules to identify unauthorized usage of bearer tokens, including detection logic for privilege escalation attacks where attackers create IAM access keys for BedrockAPIKey-* users, anomalous usage patterns based on IP ranges and operating hours, and suspicious user agents like python-requests or curl instead of AWS SDKs. The post concludes with defense controls (SCPs, model invocation logging) and incident response approaches.

The BeyondTrust team has also released Bedrock Keys Security, an open-source CLI covering that can detect phantom IAM users, decode leaked AWS Bedrock API keys, + SCPs + SIEM detection rules.

Supply Chain

git-pkgs/proxy
Tool by Andrew Nesbitt that runs as a caching proxy for 20+ package registries (npm, Cargo, PyPI, Maven, NuGet, Docker/OCI, Debian/RPM) with a configurable version cooldown that quarantines newly published packages for a set period before they're available to builds. It supports per-package cooldown overrides, SBOM-driven cache pre-population, a REST API for vulnerability scanning, and Prometheus metrics.

Detecting CI/CD Supply Chain Attacks with Canary Credentials
Tracebit's Alessandro Brucato released a free GitHub Action that drops canary AWS credentials and SSH keys into CI/CD workflows to detect credential exfiltration from compromised pipelines. The action writes canaries to ~/.aws/credentials, ~/.ssh, environment variables, and runner process memory at workflow start, then alerts when any of them is used. Alessandro validated it against the TeamPCP supply chain campaign that compromised Trivy, KICS, LiteLLM, and Telnyx and confirmed the canaries would have caused alerts capturing the affected repo, workflow, job, commit SHA, run ID, and attacker IP.

Unmasking the Docker ONBUILD Supply Chain Attack Vector
O3-Cyber's Audun Mo describes how Docker's ONBUILD directive creates a hidden supply chain attack vector. When a parent Docker image contains ONBUILD instructions, those commands automatically execute during downstream builds with complete access to the child project's files, environment variables, and secrets. Mo demonstrates three attack patterns, including stealing build secrets by accessing common secret identifiers (npm_token, github_token) and sending them to external servers via curl, manipulating project dependencies by modifying package.json files to pin vulnerable software versions, and achieving RCE by injecting malicious commands through curl | sh.

O3-Cyber released Onbuild Guardian, an open-source tool that examines Docker images using docker inspect to identify and manage ONBUILD instructions through allowlists. Mo recommends pinning base images by SHA256 digest rather than tag, and using secret mounts rather than ENV, ARGs, or .env files.

Blue Team

LLM Honeypot vs. Cryptojacking: Understanding the Enemy
Beelzebub's Mario Candela deployed his low-code SSH LLM honeypot with GPT-4o and a list of weak passwords to attract bots. It logged a cryptojacking bot's full attack chain. The bot fingerprinted the kernel and GPU, swapped the root password and killed prior miners with pkill, then downloaded a c3pool installer tied to a hardcoded Monero wallet that had accumulated roughly 20 XMR (~$4,126). Candela reported the wallet to c3pool, who pulled every infected miner using it.

Tales of an Ollama Honeypot (Part 1): Abuse Patterns
Marco Pedrinazzi deployed an Ollama honeypot on a VPS, let Censys and Shodan index it, and logged 6,461 events from 324 unique IPs over 32 days. Most IPs enumerated the server, then sent short liveness prompts like greetings or arithmetic to see whether it was worth deeper testing, hitting both Ollama's native API and its OpenAI-compatible endpoints. The honeypot also caught prompt injection wrapped in fake "security audit" pretexting to extract system prompts and environment variables, local file disclosure via malicious Modelfiles, and SSRF probes via /api/pull and /api/push.

Marco has also published three detection rules for NOVA, an open-source prompt-pattern-matching framework, covering credential harvesting (env dumps, K8s tokens, cloud metadata URLs), system prompt and Modelfile disclosure, and liveness probing, designed for honeypot deployment.

AI-powered honeypots: Turning the tables on malicious AI agents
Cisco Talos's Martin Lee walks through how generative AI can rapidly deploy adaptive honeypots that masquerade as full computing environments. His implementation combines a listener that accepts network connections, a simulated vulnerability that grants access once triggered, and an AI framework that responds to attacker instructions. By swapping the AI's system prompt, the same code can impersonate a Linux bash shell or a BusyBox-based smart fridge, creating what Martin calls a "hall of mirrors", a controlled environment where attackers see plausible but distorted reflections of real targets and reveal their methodologies in real time. AI-orchestrated attacker tooling trades stealth for speed, making them easier to detect, and the AI agents lack the awareness to spot a fake environment once they arrive.

💡 AI is making honeypots and deception much simpler to do at scale and convincingly. Lots of cool work to be done here.

Red Team

C0axx/CanaryHunter
Tool by Curtis Ringwald for red teamers to spot common canary tokens in docs, configs (AWS, WireGuard, Kube), the Registry, and MySQL dumps before triggering them, with a firewall rule that drops outbound traffic to every known canary IP.

0xNslabs/CanaryTokenScanner
Tool by NeroTeam Security Labs to spot embedded canary tokens and tracking URLs inside Office documents (.docx, .xlsx, .pptx) and PDFs before opening them. The scanner reads Office files as ZIP archives in memory and searches PDFs across both raw bytes and Flate/deflate-decompressed streams, filtering common schema domains to cut false positives.

xFreed0m/ghosttype
Tool by Roei Sherman that extracts credentials from AI tool conversation history for Claude Code, Cursor, Codex CLI, and ChatGPT Desktop. Detection runs TruffleHog as a subprocess in filesystem mode for its 800+ detectors and live verification against provider APIs, paired with an in-tree pattern engine (30 regexes plus 10 heuristic patterns) for loose context signals TruffleHog misses. Findings from either engine link back to the source conversation file with severity, detector name, and verification status, so triage can filter to credentials the provider confirms are live.

AI + Security

Quicklinks 

• You Need AI That Reduces Maintenance Costs - “The math only works if the LLM decreases your maintenance costs, and by exactly the inverse of the rate it adds code.”

• [Free Guide] The 4 steps to get ahead of agentic AI risks - Agentic AI is already inside your organization. And most of the time, nobody in IT or security approved it. This free guide is for security, IT, and risk leaders who need to get ahead of agentic AI, before it becomes a liability.*

• Thousands of Vibe-Coded Apps Expose Corporate and Personal Data on the Open Web - RedAccess’ Dor Zvi found >5K apps from Lovable, Replit, Base44, and Netlify had “no security or authentication”, leaked PII, were phishing sites, etc.

^*Sponsored

Malicious Coding Agent Skills and the Risk of Dynamic Context
Datadog's Nick Frichette and Ryan Simon demonstrate how malicious Claude Code skills can bypass model-level prompt injection defenses using dynamic context commands (!ls syntax), which execute before the model reviews the skill content. They analyzed the Clawsights skill, a real-world credential theft attempt that exfiltrates GitHub tokens, finding that while Claude Opus 4.6 correctly identified and blocked the original malicious skill, adding dynamic context commands allowed the attack to succeed because those commands run during preprocessing.

Recommendations: organizations can mitigate this by setting "disableSkillShellExecution": true in managed settings, review .claude/skills/ directories (including nested folders and --add-dir paths), require code review for .claude/ changes, and monitoring for suspicious patterns like allowed-tools: Bash(*), external URLs, and commands performing reconnaissance or attempting network access.

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)
Asim Viladi built a multi-agent LLM harness that has turned up 30+ findings (20+ CVEs) over the past few months, mostly in network-reachable services. Originally aimed at documentation-code mismatches, the harness two remote unauthenticated out-of-bounds writes in the Linux kernel's ksmbd and a chained unauthenticated RCE-to-root path in CUPS.

Under the hood, the harness chains a target seeder, hypothesis generators reading docs and source for invariants, hunters iterating PoCs in isolated VMs, report writers, and a conductor redirecting stuck agents, with an external grader outside the loop because frontier models will otherwise inflate findings or edit their own objectives. Asim also tried activation steering on the hypothesis generator, both drunkenness for creativity and abliteration to bypass refusals. The drunkenness produced no new vulnerability classes and abliteration ended up being more useful, making models refuse less.

Asim found granular role separation most helps smaller models, as swapping in Codex or Claude collapses the harness into a single end-to-end hunter. In some cases smaller models running for days can match what a frontier model one-shots. Asim's next bets are looped LLMs and RL-trained task decomposition, which would let models do their own scaffolding instead of needing hand-tuned harnesses.

Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark
Microsoft's Autonomous Code Security team, led by Taesoo Kim, built MDASH, their multi-model agentic scanning harness, which has found 16 new Windows vulnerabilities across the networking and authentication stack including four RCEs.

MDASH is structured as an agentic discovery and remediation pipeline that scans, debates, deduplicates, and proves candidate findings, chaining 100+ specialized AI agents across an ensemble of frontier and distilled models, with extensible plugins for Microsoft-specific context foundation models may not have. On benchmarks, it found 21 of 21 planted vulnerabilities with zero false positives on a private test driver, hit 9^% (of 28) and 100% (of 7) confirmed MSRC cases in clfs.sys and tcpip.sys, and scored 88.45% on the public CyberGym benchmark of 1,507 real-world vulnerabilities (prior leader: 83.15%).

The post argues that the orchestration/harness is critical and gives a performance boost over a base model + simple prompt, and that this architecture allows MDASH to absorb future model improvements without being rewritten.

💡 Looks like Microsoft hired Taesoo Kim (the Georgia Tech professor whose Team Atlanta won DARPA’s AIxCC) + a bunch of that team, and that’s now the Microsoft Autonomous Code Security team. Neat. Looking forward to seeing more from them!

Misc

Misc

• An OpenAI model has disproved a central conjecture in discrete geometry

• X thread: GitHub employee had a poisoned VS Code extension → ~3,800 GitHub-internal repos exfiltrated

• kageroumado/phosphene - A video wallpaper engine for macOS Tahoe

• Older Adults Outnumber Children in 11 States and Nearly Half of U.S. Counties - And wait until you see Congress!

• Jen Easterly: A brief note to new cybersecurity grads trying to land that first job - Don’t compete with AI, learn to lead it. Strengthen your technical foundation. Go where the growth is (go to areas that are exploding, not saturated). Find opportunities to build experience.

• Advice Jeff Bezos received early at Amazon: “You have enough ideas to destroy Amazon.”

• wrlovely/years - A personal longevity system built on Claude Code. Your DNA, bloodwork, scans, and visit notes live as markdown in a private git repo, with slash commands to organize and analyze them.

• typefully/minimal-twitter - Minimal theme for Twitter.

• Beatboxing with a dog 😂 

AI + Design

• Claude Code frontend-design Skill

• Introducing Claude Design by Anthropic Labs - Collaborate with Claude to create polished visual work like designs, prototypes, slides, one-pagers, and more.

• OpenAI docs - Designing delightful frontends with GPT-5.4

• cyxzdev/Uncodixfy - A rule set that forces Codex models to stop relying on its usual UI habits.

• Introducing ChatGPT Images 2.0 - Some pretty impressive example images

• An attempt to detect AI design patterns in Show HN pages

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

☀️ My Least Favorite Type of Tan(Stack)

I had a fun personal anecdote to share but I didn’t have time to write it up this week.

For now, #HugOps to everyone dealing with yet another supply chain attack.

I hope you’re getting the support you need 🫂 

Sponsor

📣 Cloud Security Has Changed.
Has Your Strategy?

Agentic AI is reshaping cloud risk. AI agents, machine identities, and distributed data systems are creating new privilege pathways, dark data, and attack surfaces that traditional posture tools were not built to govern. Join Palo Alto Networks product leaders to learn how Cortex Cloud helps teams secure identity, data, and AI across the modern cloud stack.

👉 Watch Webinar 👈

AppSec

V4bel/dirtyfrag
Dirty Frag, discovered and reported by Hyunwoo Kim, is a universal Linux LPE vulnerability class that chains two page-cache write bugs (xfrm-ESP and RxRPC) to achieve deterministic root privilege escalation without race conditions across major distributions including Ubuntu, RHEL, Fedora, and openSUSE.

Copy Fail Flaw: 5 YARA Rules for Detection and Remediation
ReversingLabs' Maik Morgenstern covers Copy Fail (CVE-2026-31431), a Linux kernel privilege escalation that lets any unprivileged user write 4 bytes into the in-memory copy of any readable file, including system binaries like /usr/bin/su. That's enough to neuter the password check, so the next run of su returns a root shell. The on-disk file is never touched, so standard file integrity tools see nothing. The exploit runs identically on every major Linux distribution shipped since 2017, making shared-kernel environments (multi-tenant servers, CI/CD pipelines, container clusters) the highest-risk targets.

Within a day, ReversingLabs had observed more than a dozen variants in the wild, including compiled C reimplementations of the original PoC and a separate rootsecdev toolkit that targets /etc/passwd instead of /usr/bin/su. Most were trivial reformattings with different hashes but identical execution, so ReversingLabs built a five-tier YARA ruleset anchored on a cryptographic string the exploit fundamentally depends on. High-confidence rules catch the original Theori PoC and the rootsecdev toolkit. Medium-confidence rules cover reimplementations of the core technique along with compiled and dropper variants. A broad hunting rule covers Python, C, and Go variants that combine the cryptographic string with a known target binary.

Sponsor

📣 Browser & identity attacks matrix —
open-source from Push Security

Most attack frameworks weren't built for how breaches actually happen today. Attackers don't need network access or endpoint compromise; they go straight for the browser and identity layer. Push Security's Browser & Identity Attacks Matrix maps 51 techniques across 10 tactic phases, covering AiTM phishing, ClickFix, device code phishing, OAuth consent abuse, extension supply chain attacks, and more.

It's open-source, community-maintained, and built for how modern attacks actually work.

👉 Map your identity attack surface 👈

This is super cool! Probably the best breakdown I’ve seen of modern browser and identity based attacks, including some subtle stuff + a number that Push Security discovered iirc. And neat that it’s open source 👍️ 

Cloud Security

BigQuery threat model report
Google Cloud published a threat model for BigQuery covering 14 attack vectors across data confidentiality, integrity, and availability, each mapped to STRIDE categories and MITRE ATT&CK tactics. The model surfaces schema tampering to corrupt downstream pipelines, privilege escalation and service account impersonation, data exfiltration via export jobs to attacker-controlled Cloud Storage buckets, persistence through hard to detect IAM bindings on datasets or scheduled queries, spoofing via leaked service account keys or OAuth tokens, and cost-based denial of service from resource-intensive queries that drain on-demand budgets or starve slot capacity for other users.

The recommended mitigations are mostly standard cloud hygiene anchored in BigQuery specifics, including least privilege IAM with regular audits via Security Command Center, VPC Service Controls perimeters to limit egress, Cloud Audit Log monitoring for suspicious calls like SetIamPolicy and datasets.patch, Workload Identity Federation instead of service account keys, custom query quotas to bound DoS impact, and table snapshots for recovery.

The vulnerabilities include “JIT ghost identity” creation, provider collision via Unicode homoglyphs (one IdP using a Cyrillic character that passes as distinct from its ASCII twin), username parsing attacks where security checks and downstream code disagree on the <ProviderName>_<sub> format, and IdP identifier hijacking where unclaimed email domains route auth flows to providers an attacker controls. All four come from the same mistake. Security sensitive attributes like tenantID or role get read straight from federated tokens an attacker controls, rather than computed on the server from a verified email domain. AttributeMapping makes this worse. A malicious IdP can inject arbitrary values into custom user attributes, bypassing Cognito's write controls.

Supply Chain

Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
Wiz's Rami McCarthy, Amitai Cohen, and Benjamin Read describe the most recent Internet-is-on-fire npm supply chain attack by TeamPCP that compromised TanStack, UiPath, and Mistral AI packages. The GitHub Actions exploit chain: the forked a repo and renamed it (to evade fork-list searches), oopened a PR that triggered the pull_request_target workflow, the attacker’s fork code poisioned the GitHub Actions cache with a malicious pnpm store, and when a legitimate maintainer PR was later merged into main, the release workflow restored the poisoned cache. The attacker-controlled binaries then extracted OIDC tokens directly from runner process memory to publish malicious packages without stealing npm credentials. The post provides IOCs, detection guidance, and remediation steps.

YMMV but I came across these:

• GLPMC/Tanstack-Worm-Detector

• omarpr/mini-shai-hulud-ioc-scanner

Shai-Hulud Goes Open Source
Datadog's Ryan Simon, Sebastian Obregoso, and Greg Foss analyze the complete source code of the Shai-Hulud offensive framework attributed to TeamPCP, which was briefly published on GitHub before being removed. The TypeScript/Bun-based modular toolkit harvests credentials from 100+ file paths, extracts GitHub Actions Runner.Worker memory via /proc/<pid>/mem, enumerates AWS Secrets Manager/SSM across 17 regions, and exfiltrates data using hybrid encryption to git-tanstack[.]com or GitHub dead-drop repos.

The framework poisons npm packages via stolen tokens and OIDC abuse while forging complete Sigstore provenance bundles (Fulcio certificates + Rekor transparency logs), establishes persistence through VSCode tasks and Claude Code SessionStart hooks, and implements a destructive deadman switch (rm -rf ~/) that triggers on GitHub token revocation. 19 of 22 previously documented TeamPCP TTPs are present in the codebase.

💡 Great breakdown, and honestly pretty thoughtful tooling.

Blue Team

ridgelinecyberdefence/vanguard
Tool that packs the full incident response lifecycle into a single Go binary, including Velociraptor, Volatility, KAPE, and the standard forensics stack, plus 28 MITRE-mapped IR use cases (ransomware, BEC, lateral movement, credential theft, rootkit detection). Runs on Windows or Linux with built-in case management, tamper-evident evidence handling, and full air-gapped support.

gadievron/honeyslop
Gadi Evron, John Cartwright, Daniel Cuthbert, and Michal Kamensky created honeyslop, a collection of deliberately vulnerable-looking code canaries designed to identify AI-hallucinated vulnerability reports by embedding unique UUIDs, fake function names (like zqx_tarnish_v3), and a fabricated CVE-2025-99919 that self-identify slop reports when grep'd.

💡 “Quick PoC, vibe-coded as a joke (not production-grade),” but I like the idea.

referefref/OpenAIPot
Tool by James Brine that poses as an OpenAI-compatible API endpoint to catch attackers using stolen or planted credentials. Valid keys pass through to OpenAI, while decoy keys trigger a system prompt swap that injects deceptive content into the response. Repeat attempts trigger IP blocking with realistic out-of-tokens errors so attackers don't realize they've been caught, and logs feed into SIEMs and Slack via integrations mapped to MITRE Engage.

Red Team

We get paid to break into buildings for a living. Ask us anything!
Reddit AMA with TrustedSec's Paul Koblitz, Costa Petros and David Boyd answering questions about physical penetration testing, drawing on years of experience breaking into buildings for clients.

Redefining AI Red Teaming in the Agentic Era
Dreadnode's Raja Sekhar Rao Dheekonda released an agentic AI red teaming system built on their open-source SDK (45+ attack strategies, 450+ prompt transforms, 130+ scorers). The operator describes the objective in plain English, and the agent selects attacks and transforms, generates an executable workflow, runs it with full tracing, and returns a structured assessment with severity ratings and compliance tags. That's the orchestration work operators currently do by hand with frameworks like PyRIT, Garak, and Promptfoo. The methodology and full attack catalog can be found in the arXiv paper.

In a case study against Meta's Llama Scout, the agent ran 674 attacks across 68 harmful-content objectives in 3 hours with zero code, succeeding 85% of the time and identifying 232 critical findings. Across the three jailbreak strategies tested, Crescendo (gradual conversational escalation) and Graph of Attacks (exploring prompt variations) both hit 100%, while Tree of Attacks (branching prompt search) needed about three times as many tries to reach 96%. Even asking plainly, with no jailbreak technique at all, still produced harmful content 80% of the time.

Elze recommends leaning on layers attackers can't study as easily: host hardening (WDAC, ASR rules, LSA Protection), SIEM detections built on raw telemetry rather than EDR verdicts, and identity-layer detection (Entra ID risk policies, token theft indicators, directory changes).

AI + Security

distil-labs/distil-ai-slop-detector
Chrome extension by Distil Labs that detects AI-generated text with a smaller, 242MB fine tuned model (Gemma 3 270M with GPT OSS 120B (teacher)) that can run entirely in-browser, plus a Claude Desktop skill and CLI for training your own classifiers using the same distillation pipeline.

Daybreak: Frontier AI for cyber defenders
OpenAI announces Daybreak, which seems like their version of Project Glasswing, with an extra focus on making software resilient by design. “Defenders can bring secure code review, threat modeling, patch validation, dependency risk analysis, detection, and remediation guidance into the everyday development loop so software becomes more resilient from the start.” Partner quotes from Cloudflare, Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Akamai, and Fortinet.

Mythos finds a curl vulnerability
Daniel Stenberg digs into the Mythos scan of curl's 178K lines of C. The report flagged five "confirmed" vulnerabilities, but after the curl security team's review three were documented API behavior, one was "just a bug," and only one became a low-severity CVE. The results match what curl has already seen from AISLE, Zeropath, and OpenAI Codex Security, which together triggered 200 to 300 bugfixes over the past 8-10 months. Daniel so far finds that AI tools are good at finding usual and established kinds of errors, not (yet) finding novel kinds of bugs.

“My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos.”

Behind the Scenes Hardening Firefox with Claude Mythos Preview
Mozilla's Brian Grinstead, Christian Holler, and Frederik Braun detail how Mozilla built an agentic harness on top of their existing fuzzing infrastructure that writes and runs reproducible test cases to confirm bugs, scales across ephemeral VMs, and integrates with their security lifecycle for dedup, tracking, and triage. Running Claude Mythos Preview, Mozilla found 271 bugs in Firefox 150, including sandbox escapes, race conditions, and use-after-free bugs that fuzzers miss.

Audit logs also validated existing defenses, showing the model repeatedly trying prototype pollution sandbox escapes only to get shut down by Mozilla's frozen-prototypes architecture. Looking ahead, Mozilla plans to wire the pipeline into CI to scan patches as they land, and recommends other projects build similar pipelines now.

💡 Great example of the power of a target-specific (in this case, Firefox) harness providing additional value on top of a capable underlying model. I also liked: the description of building a hardening pipeline, how the right architecture eliminated classes of vulnerabilities, and more context around the number and type of bugs found.

Misc

Misc

• Interesting photography trick examples

• Aakash Gupta - The future of cinema is ScreenX, a 270-degree field of view

• Relentless - How to Start a Cult | Lulu Cheng Meservey

• Ari at Home meets Wayne Brady - Freestyle creating beats and rapping

• Turning my toddler’s stories into songs - Catchy actually, and 🥹

• Best Crazy Frog Remix

• Why are chains used to guide rain down? - Apparently someone is creating informational songs around random facts. Probably the music, script, and video shots are all AI generated. Kind of interesting though.

Tech

• facebookincubator/below - A time traveling resource monitor for modern Linux systems

• GitLab Act 2 - Open letter from GitLab that they’re restructuring, and a likely “workforce reduction”

• Building for the future - Cloudflare is laying off 1,100 (~20%) employees to prepare for “the agentic AI era”

AI

• OpenAI Flips the Script - Every CEO Dan Shipper explains why OpenAI’s coding app has become his daily driver for work, head of growth shares useful workflows.

• Fiona Fung, Eng Director for Claude Code - Running an AI-native engineering org

• Claude for Creative Work - Anthropic released MCP connectors that integrate Claude with creative software including Blender, Autodesk Fusion, Adobe Creative Cloud, Ableton, Splice, SketchUp, Resolume, and Affinity by Canva.

• Agents for financial services and insurance - Anthropic released ten agent templates for financial services workflows including pitch building, KYC screening, and month-end closing, available as plugins in Claude Cowork/Code or as cookbooks for Claude Managed Agents. Repo: anthropics/financial-services.

• Theo on Anthropic, Cursor, and xAI/SpaceX - Some interesting (potential) dynamics I hadn’t though of

• Pieter Levels - Replaced all his Chrome extensions with his own vibe coded one

• Your CEO is suffering from AI psychosis

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🫶 Friend Visit

Last weekend I visited my good friend Aaron and his partner, staying at their place in southern California, and it was delightful.

There’s something special about meeting a friend’s partner and seeing their place, you get such a lovely insight into who they are and what they value. The bookshelves, the photos from their couple trips, the unique items they’ve picked up along the way.

We played a few rounds of this board game, Forbidden Island, which was a lot of fun, would recommend. Clint analytical brain was fully engaged, and people were amused 😅 

I managed to delay doing an AI-powered Deep Research about optimal strategies until I was at the airport on the way back. It wasn’t easy.

Aaron was a work friend who became a normal friend over many Wednesday dinners. And after several months I got upgraded to his non burner phone (not a joke) 🙌 

We had talked about me coming down to stay with him for a weekend… and I actually did it! It was kind of going out on a limb, as we’d never spent more than a few hours together at a time, but I’m really glad I did. We had a great time, and I feel like we grew a lot closer in just a few days.

Maybe there’s someone you really click with at work or from some hobby, and if you put yourself out there and spend more time with them (even if it feels cringe to ask), that could end up being a great friendship 🤔 

Sponsor

📣 AI ROI: You know the AI bill, but what are the outcomes?

Leadership is asking: are we getting value from AI? Which tools are worth the spend? Where are we exposed? Right now, most teams can only answer with invoice data.

Harmonic Security Usage Explorer closes that gap. It automatically classifies every AI interaction across your organization into the use cases driving real work, specific to your business. Get actual patterns to understand how your teams use AI, how much time they spend, the cost, and where risk lives.

CIOs rationalize spend, CISOs get risk in context, & AI committees get proof of impact.

Early access is now open. Request your spot.

👉 Get early access 👈

AppSec

The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework
Jonathan Dunn reverse-engineered the URL decoding pipelines of 8 major frontend frameworks (React Router, Next.js, Vue Router, Angular, SvelteKit, Nuxt, Ember, and SolidStart) to understand how Client Side Path Traversal (CSPT) vulnerabilities arise when encoded slashes (%2F) in dynamic route parameters get decoded and interpolated into fetch URLs. Labs GitHub repo.

💡 Wow, super detailed, awesome post. Also, this story about Jason Haddix’s mentorship 🥹

C/C++ checklist challenges, solved
Trail of Bits recently added a C/C++ security checklist to their Testing Handbook, and in this post, Graham Sutherland and Paweł Płatek share walkthroughs of two C/C++ challenges. They also released c-review, a Claude skill that runs the C/C++ checklist as LLM prompts against a codebase, tuned to the platform and threat model.

The first challenge is a Linux ping program with a command injection bug, where two undocumented behaviors in standard IP address functions (one accepting trailing garbage, the other reusing a shared buffer between calls) let an attacker bypass the input validation. The second is a Windows driver where a missing safety flag and an incomplete registry read combine to escalate from a local crash to full kernel code execution. By planting two crafted registry values, an attacker tricks the driver into copying arbitrary data onto the kernel stack and overwriting a function pointer.

Sponsor

📣 Adaptive Security: Security Awareness Training Built for AI Threats

AI is changing how attacks are executed. Deepfakes, voice clones, and AI-generated spearphishing across email, SMS, and voice are now table stakes for attackers. Adaptive Security's next-generation platform simulates these exact threats, scores individual employee risk using real behavior and OSINT exposure, and auto-delivers personalized training tied to what each person experienced. Trusted by security teams at PayPal, Ramp, Bose, and more. 

👉 Book a Demo 👈

There’s been a big rise in AI-powered deepfake attacks, it’s great to see people tackling it 👍️ 

Cloud Security

Global S3: Another C2 Channel for AgentCore Code Interpreters
Sonrai's Nigel Sood builds on Kinnaird McQuade‘s prior research on DNS-based exfiltration from sandboxed AWS Bedrock AgentCore Code Interpreters, showing that the interpreter's documented global S3 access can also serve as a bidirectional Command & Control (C2) channel. Sood extended McQuade's open-source PoC so a client inside the sandbox polls an external bucket for shell commands, executes them, and writes output back via presigned PUT URLs. Unlike the DNS path AWS has since mitigated, this isn't a Bedrock vulnerability since S3 access is intended behavior, so customers have to handle it themselves. Sood recommends VPC mode with Gateway Endpoints and strict Endpoint Policies limiting access to specific buckets.

AWS Credential Isolation for Local AI Agents
EngSecLabs' Alex Smolen walks through how to safely hand AWS credentials to local AI agents, recommending combining elhaz, a credential broker daemon that manages auto-refreshing STS credentials via Unix socket, with trailtool for generating least-privilege IAM policies from CloudTrail logs (based on what the agent actually uses).

Alex arrives at this recommendation based on challenges with other approaches: environment variables leak to every process and only capture a snapshot that expires mid-session, mounting ~/.aws/ hands over every profile on the host (and agent deny lists don't catch bash subprocesses reading the file directly), and metadata emulation breaks on macOS because Docker Desktop's loopback doesn't reach the host. Sockets sidestep all of that because the mount itself becomes the access control. If you don't bind the socket into a container, the credentials don't exist there at all, so each agent ends up with its own scoped identity by default.

What the March 2026 Threat Technique Catalog update means for your AWS environment
AWS' Shannon Brazil and Cydney Stude documented three new threat techniques the AWS Customer Incident Response Team has seen in live incidents. Attackers are abusing Cognito refresh tokens (30-day default, configurable up to 10 years) to maintain access without invalidating legitimate sessions, using ec2:DeregisterImage to permanently delete AMIs (unrecoverable unless Recycle Bin retention is enabled), and using UpdateAssumeRolePolicy to attach new principals to existing IAM roles instead of creating new ones.

The post emphasizes that attackers are increasingly using legitimate AWS API calls in illegitimate contexts rather than exploits, requiring security teams to monitor for contextual anomalies like unexpected principals or timing. Most cloud monitoring is tuned for creation events (new roles, new logins, new AMIs) and rarely covers modifications or token refreshes on what's already there. AWS published CloudTrail detection queries for each.

Supply Chain

Quicklinks

• BSidesSF 2025 talk - Scalably Securing Third-party Dependencies in Heterogeneous Environments by Anthropic’s Ziyad Edher and Chris Norman

• Are you prepared for Mythos? Stay ahead of zero-days with Chainguard - AI is finding and weaponizing zero-days faster than any disclosure process can publish them. The answer isn't patching faster. When a registry gets poisoned, you don't want to beat the clock. You want to be on a supply chain the attack never touches.*

• NIST Updates NVD Operations to Address Record CVE Growth - Due to a 264% surge in CVE submissions between 2020 and 2025, going forward NIST will only enrich CVEs: in CISA's KEV catalog, affecting critical software, and software used within the federal government.

_*Sponsored

FilippoBau/depcut
Tool by Filippo Baudanza that cuts Dependabot noise by checking whether vulnerable npm symbols are actually imported in JavaScript/TypeScript codebases. It parses imports with tree-sitter, extracts vulnerable symbols from GHSA data (with an optional LLM fallback), and matches them against a lockfile-scoped dependency graph to classify each alert as REACHABLE, UNREACHABLE, or INDETERMINATE, and outputs JSON or SARIF for CI pipelines.

Practical Package Security: The Unofficial Guide
Wiz's Rami McCarthy gives a nice survey of actionable best practices to shrink your attack surface, protect execution environments, control package ingestion, and catch compromises early. Rami recommends minimizing dependencies, adding install cooldowns via your package manager or Renovate or Dependabot so the ecosystem catches malware first, locking package versions with hash verification, using wrapper tools like Datadog’s supply-chain-firewall, and turning off install scripts via npm's ignore-scripts or pnpm's onlybuiltdependencies.

Larger organizations can add registry proxies or private package repositories, plus cloud-based development environments and zero trust production to limit damage when malicious code runs. On the detection side, plant honeytokens in CI pipelines.

Blue Team

weirdmachine64/SharkMCP
Tool by Mohamed Benchikh that wraps Wireshark's sharkd interface as an MCP server so LLMs can dig through PCAP files with natural language. Each capture gets its own sharkd subprocess for packet inspection, protocol analysis, conversation tracking, and stream reassembly across TCP, UDP, TLS, HTTP, and VoIP, while heavy queries are cached in memory so pagination stays fast.

Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
SentinelOne's Juan Andres Guerrero-Saade and Vitaly Kamluk uncovered fast16, a 2005 sabotage framework (five years before Stuxnet) that selectively targets high-precision calculation software, patching code in memory to tamper with results to produce inaccurate calculations across an entire facility (e.g. those used in nuclear weapons research). fast16 is the earliest known Windows malware to embed a Lua VM, and combines a wormable Lua-powered binary with a kernel driver that scans executables for 101 code patterns, then surgically rewrites floating-point routines.

The fast16 name had already appeared in the 2017 ShadowBrokers leak inside NSA's Territorial Dispute list, and Unix-style source control markers in the binaries point to long-term development by government or military engineers. The main binary sat on VirusTotal for nearly a decade, missed by almost every antivirus engine, before SentinelLABS pieced it together.

Red Team

tahaafarooq/Fenrir
Tool by Taha Afarooq that uses eBPF to capture SSH, PAM, sudo, and su credentials at the kernel level. The Go agent deletes itself from disk and runs only in memory, poses as a legitimate system process, and exits if it detects defensive tools (Wireshark, Sysdig, Falco, Tetragon), or VM/container environments (Docker, Kubernetes, Cuckoo, Joe Sandbox). Captured credentials are smuggled out over encrypted network traffic to a companion fenrir-channel C2 with a web dashboard.

Mine the Gap: Open-Source Tools for Measuring the AI Offense-Defense Gap
Dreadnode's Jayson Grace and Martin Wendiggensen released two open-source tools for evaluating AI agents in head-to-head red versus blue engagements, since existing benchmarks miss what happens when both sides operate autonomously against shared infrastructure.

DreadGOAD is a fork of the GOAD Active Directory lab packaged for AWS, with Terraform/Terragrunt provisioning, golden AMIs, private networking via SSM, automated validation of 50+ AD vulnerabilities, and a variant generator that randomizes entity names so agents can't memorize their way through. Ares runs on top: seven red team agents (recon, credential access, cracking, ACL abuse, privilege escalation, lateral movement, coercion) reach domain dominance through Golden Ticket persistence in under six minutes with a 95%+ success rate, while three blue team agents (triage, threat hunting, lateral analysis) investigate the same telemetry.

Every attacker action is recorded as ground truth, so blue team agents are scored on how accurately they reconstruct what actually happened, not against static checklists or curated log dumps.

💡 Lots of really cool ideas in this post- automatically generating variants of a vulnerable environment so you can test how agents perform, measuring the performance of red vs blue autonomous agents, recording actions for future ground truth, and open sourcing the core parts 🤘 Great work.

AI + Security

OpenAI releases open-source model that strips personal data from text
OpenAI released Privacy Filter, an open-source 1.5B model that detects and redacts eight PII categories including names, emails, phone numbers, account numbers, and secrets like API keys. It runs locally on a laptop or in-browser with a 128K token context window, uses single-pass labeling instead of generation, and ships under Apache 2.0 on GitHub and Hugging Face.

💡Useful for data loss prevention and log scrubbing, though weaker on non-English text and non-Latin scripts, so keep a human in the loop.

Google wants AI defense to be as fast as AI offense
Frederic Lardinois covers Google Cloud's Next '26 security announcements. Google added three new AI agents to Google Security Operations for threat hunting, detection engineering, and third-party context, alongside an existing triage agent that has processed over 5 million alerts in the past year and reduced 30-minute analyses to roughly 60 seconds. Wiz, recently acquired by Google, extended its AI-Application Protection Platform across Databricks, AWS, Azure, and Salesforce, is adding inline AI security hooks in IDEs and agent workflows, and shipped a dynamic AI-BOM to inventory shadow AI- the AI frameworks, models, and IDE extension in your environment. Mythos Preview will be available through Google’s Vertex AI for defensive use.

Finding Zero-Days with Any Model
Niels Provos argues that discovering novel vulnerabilities with AI is not just a frontier-model capability but an orchestration problem. He demonstrates using his open-source IronCurtain framework with commercial models (Opus 4.6, Sonnet 4.6) and open-weight models (GLM 5.1) that he can replicate Anthropic's 1998 OpenBSD TCP SACK finding and discover new zero-days in widely-deployed software, with each scan costing $30-150 per codebase.

Niels was able to find these vulnerabilities using IronCurtain (which supports arbitrary workflows structured as finite-state machines (FSM) via plain YAML definitions) by building a specialized vulnerability discovery workflow that has a central Orchestrator agent that acts as a strategic router that then decides which specialized agent to dispatch next based on an append-only execution journal.

Introducing AIMap: Security Testing For AI Agent Infrastructure
Bishop Fox's Aashiq Ramachandran announces AIMap, an open-source tool that discovers, fingerprints, scores, and tests internet-exposed AI agent infrastructure by querying Shodan and fingerprinting endpoints across MCP servers, Ollama, vLLM, LiteLLM, LangServe, Gradio, ComfyUI, and other AI frameworks using Nuclei templates and live HTTP checks.

AIMap assigns risk scores (0-10) based on authentication status, exposed tools, CORS policies, TLS configuration, and system prompt leakage, and includes protocol-specific attack modules for MCP servers (tool enumeration, unauthorized tool invocation, and prompt injection via tool descriptions), Ollama instances (model listing, model weight extraction, and prompt injection), and OpenAI-compatible endpoints (model enumeration, completion abuse, and system prompt extraction).

Misc

Misc

• Tin Can - A WiFi landline for kids. It doesn’t have apps, texting, or games—just real conversation with friends, neighbors, Grandma, or whoever you add to your approved contact list.

• The Sites We Lost - Archiving quirky, old websites. Some take me back.

• Inside TIME’s Wild Day with MrBeast

• Morning Brew - Why are the boys tryna get hot all of a sudden? - On Looksmaxxing and medspas.

• Scott Galloway on Diary of a CEO - AI’s impact (or not) on the economy and jobs, the war in Iran, being a parent, and more.

  • I thought Scott had an interesting point on China purposefully “AI dumping” low cost AI via open source models into the U.S. economy to potentially undermine Anthropic, OpenAI, and other companies, as much of the U.S. stock market is essentially a bet on AI, and how that’s similar to how China previously dumped below-cost steel into the U.S. market, which largely wiped out American steel.

  • Also: “The receipts for love are grief.” 🥹

Tech

• Mitchell Hashimoto - Ghostty Is Leaving GitHub

• NPR went looking for Polymarket's Panama headquarters. It's elusive

• Joe Hudson - AI and The Return to Being Human

• Mark Zuckerberg ‘Personally Authorized and Actively Encouraged’ Meta’s Massive Copyright Infringement to Train AI Systems, Publishers and Scott Turow Allege in Lawsuit

• Coinbase CEO Brian Armstrong’s tweet on letting go of 14% of Coinbase - Is a crypto company firing a number of its employees a job rug pull 🤔 

AI

• An open-source spec for Codex orchestration: Symphony - OpenAI describes building Symphony⁠, an agent orchestrator that turns a project-management board like Linear into a control plane for coding agents. Every open task gets an agent, agents run continuously, and humans review the results. Wow, this is really cool 👍️ 

• Where the goblins came from - Fascinating story about how OpenAI investigated why GPT-5.1+ models started increasingly mentioning goblins, gremlins, and other creators in metaphors 😂 

• Anthropic - New in Claude Managed Agents: dreaming, outcomes, and multiagent orchestration

• anthropics/knowledge-work-plugins - 11 plugins bundling the skills, connectors, slash commands, and sub-agents for a specific job function. Currently: productivity, sales, customer support, product management, marketing, legal, finance, data, enterprise search, bio research, cowork plugin management.

Politics

• Politics used to be like this - Clips of Mitt Romney, John McCain, and Obama being respectful. In one of them, at a McCain event, a woman says she can’t trust Obama because he’s an Arab. McCain corrects her, “He’s a decent family man.” Let’s get back to this.

• Last Week Tonight with John Oliver - Prediction Markets

• We spoke to the man making viral Lego-style AI videos for Iran. Experts say it's powerful propaganda

• Chinese firms market Iran war intelligence ‘exposing’ U.S. forces

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤘 Hackathon

This week Semgrep friends have flown in from all over the world to crazily build together.

Engineers, security researchers, designers, and, as we are generous of spirit, even product managers.

The fact that we do this every few quarters is one of my favorite things about Semgrep.

A number of our coolest features came from a hack week: new engine features, AI triage before it was cool, and even Semgrep itself (back before that was the company’s focus, or name).

I also really appreciate the in person time for learning about who people are outside of work.

Hearing stories about their garden, travels, partner, or kids over boba and late night pizza.

Team dinner! If you look closely, you may notice a Katie Paxton-Fear (InsiderPhD). Shout-out Shelley Wu, who recently joined the team 🙌

Can’t wait for the demos competition and showcase tomorrow 🤩 

Sponsor

📣 Prowler: the world’s most widely adopted open cloud security platform

Prowler automates security and compliance across any cloud environment, with agentless coverage of cloud infrastructure, SaaS, Kubernetes, containers, Infrastructure as Code, and more. It detects vulnerabilities and misconfigurations, prioritizes risks, accelerates remediation, and automates audit-ready compliance. 

Prowler has become the security platform of choice for thousands of cloud teams, with 45M+ downloads, 13K+ GitHub stars, and 300+ global contributors. Prowler Cloud delivers cloud security 10x more cost-effectively than alternatives.

👉 See Prowler in action 👈

AppSec

BuffaloWill/oxml_xxe
Tool by Willis Vandevanter that embeds XXE payloads into OXML formats (DOCX, XLSX, PPTX, ODT, ODG, ODP, ODS), SVG, and raw XML for testing XXE vulnerabilities in document parsers. BlackHat USA 2015 slides.

Trailmark turns code into graphs
Trail of Bits' Scott Arciszewski announces Trailmark, an open source library that parses source code into queryable call graphs of functions, classes, call relationships, and semantic metadata. Trailmark uses tree-sitter for AST parsing and rustworkx for graph traversal, supporting 17 languages including C, Rust, Go, Python, and Solidity. The library ships with eight Claude Code skills (genotoxic, vector-forge, diagram, crypto-protocol-diagram, graph-evolution, mermaid-to-proverif, audit-augmentation, and trailmark) that enable graph-based security analysis like mutation triage (which mutant survivors are reachable from untrusted input), blast radius calculation, and taint propagation tracking.

Using Trailmark on cryptographic libraries, they identified architectural bottlenecks and high value fuzzing target codec parsers.

Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server
Wiz’s Sagi Tzadik describes how they found an RCE in the git push pipeline that let any user with push access inject fields into internal metadata via unsanitized characters in push options, override the push execution environment, bypass sandboxing, and run arbitrary commands on GitHub's servers.

GitHub patched the vulnerability within 6 hours of their report and confirmed zero exploitation by querying telemetry for an anomalous code path the exploit triggers. GHES admins should upgrade to the latest patch and review /var/log/github-audit.log* for unusual special characters in push options. See also GitHub’s response.

Sponsor

📣  Vibe Coding a Backport:
When "Latest or Nothing" Isn't an Option

Scanners scream. Leadership wants dates. Engineering wants stability. And "just upgrade" (the only answer most teams hear) keeps colliding with breaking changes, flaky tests, and calendar risk. In Vibe Coding a Backport, Root's John Amaral argues for backporting as a first-class remediation discipline and walks through how agentic workflows are finally making it scalable: pin what you ship, understand the upstream fix, apply minimal change, validate with tests. A practical playbook for the messy real world.

👉 Get the Playbook 👈

The interactive workshop format is pretty cool 👍️ Automatically backporting patches using AI is a neat approach that wasn’t feasible before, it’s fun to see new takes on longstanding challenges.

Cloud Security

CloudTrail for AI Agents
Alex Smolen introduces Trailtool, a tool that pre-aggregates AWS CloudTrail logs by entity (People, Sessions, Roles, Services, Resources) to enable faster queries and AI agent workflows compared to traditional SIEM or CloudTrail Lake approaches. The post walks through using Trailtool to detect “ClickOps” modifications, define least-privilege IAM policies for roles, respond to AccessDenied errors, and validate emergency break-glass access justifications.

Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System
Palo Alto Networks's Yahav Festinger and Chen Doytshman describe "Zealot," a multi-agent LLM penetration testing PoC using LangGraph, to empirically test autonomous AI offensive capabilities against cloud environments. The system uses a supervisor-agent architecture with three specialist agents (Infrastructure, Application Security, and Cloud Security) that share attack state through a centralized AttackState object. In sandbox testing against a misconfigured GCP environment, Zealot autonomously chained SSRF, GCP Instance Metadata Service credential theft, BigQuery enumeration, privilege escalation via self-granted storage.objectAdmin permissions, and data exfiltration, completing the full attack chain with minimal human guidance.

Learnings: Zealot demonstrated unexpected initiative, such as autonomously injecting SSH keys for persistence, though it occasionally required human intervention to prevent resource-wasting "rabbit hole" scenarios. They found AI doesn't create new attack surfaces, it serves as a force multiplier by rapidly exploiting well-known misconfigurations at machine speed.

💡 I like how the post describes their reasoning on why they used a hierarchical supervisor-agent architecture, what tools they chose to give each agent, and the discussion of state management and memory (context sharing, what AttackState tracks across phases). Lots of tactical details 👍️ 

Supply Chain

The case for dependency cooldowns in a post-axios world
Datadog's Kennedy Toomey discusses recent npm supply chain attacks, and notes that in Datadog’s 2026 State of DevSecOps report, they found half of organizations install at least one dependency within a day of release. Also good to keep in mind: using npm's semantic versioning with ^ and ~ ranges automatically accepts future updates, meaning you’re implicitly trusting future (potentially malicious) code. Yarn, pnpm, npm, and Dependabot all support dependency cooldowns now.

cooldowns.dev
A configuration reference for dependency cooldowns across major package managers by Martin Prpič, covering uv, pip, npm, pnpm, Yarn, Bun, Deno, and cargo-cooldown, plus Renovate and Dependabot configurations. To make setup easier, Prpič also created cooldowns.sh, a helper script that configures and verifies cooldowns across all supported tools in one command, with a check subcommand suitable as a CI gate.

Note that cooldowns aren't a complete defense though, since they won't catch typosquatting, long-term maintainer compromise like xz-utils, or zero-days in already-installed packages.

Blue Team

Karib0u/rustinel
By Théo Foucher: Rustinel is an open-source endpoint detection runtime for Windows and Linux. It collects native telemetry from ETW and eBPF, normalizes events into Sysmon-style fields, evaluates Sigma, YARA, and IOC detections, and emits ECS-compatible NDJSON alerts.

Tracking Adversaries: EvilCorp, the RansomHub affiliate
Will Thomas (BushidoToken) describes the connection between EvilCorp, a sanctioned Russian cybercrime group, and RansomHub, a prominent ransomware-as-a-service operation. The link is established through shared TTPs, including the use of SocGholish malware for initial access and a Python backdoor (VIPERTUNNEL) for post-exploitation. Because EvilCorp has been under US sanctions since 2019, making it illegal for affected organizations to pay ransoms to them, this association may lead to sanctions against RansomHub as well (and thus legal risk to victims paying them).

Why a Decade of Writing Detection Logic Makes the Mythos Exploit Numbers Less Scary
David Burkett argues that despite AI-powered systems finding vulnerabilities at an unprecedented rate, the impact on defenders is less catastrophic than headlines suggest because: new exploits have always exceeded defenders’ ability to write detections (that’s why you detect behaviors over individual IoCs and exploits), adversaries often don’t need zero days (see: ClickFix, phishing), and detection logic doesn’t map 1:1 with exploits (e.g. 1000s of RCE in Microsoft Office, but if Office spawns powershell.exe, that’s probably bad).

David also argues that ML-based anomaly detection is unlikely to be the answer due to the base rate fallacy: in an environment with 1 million daily events, a 0.001 false positive rate will generate 1,000 false alerts. More than exploit volume, he’s concerned about AI agents being granted excessive access, where for example prompt injection could trigger legitimate-looking actions (like wire transfers using real browser cookies) that are nearly impossible to distinguish from authorized behavior.

AI + Security

kpolley/redai
By Kyle Polley: A terminal workbench for AI-driven vulnerability discovery and live validation. After scanner agents produce candidate findings, validator agents work inside a live environment (a running instance of the target, plus whatever tools they need to interact with it) and try to prove or disprove each finding by clicking through the UI, hitting endpoints, writing PoC scripts, hosting helper servers, and saving the evidence. RedAI currently ships with validator plugins for agents to drive Chrome via agent-browser and an iOS Simulator, but it’s extendable.

MOAK - Mother of All KEVs
Niv Hoffman, Yair Saban et al created MOAK, an agentic workflow that autonomously exploits 98% of open source KEVs (Known Exploited Vulnerabilities) using publicly available models (Opus 4.6 and GPT 5.4). They found MOAK was able to automatically create exploits for 174/178 KEVs that were published after the models’ knowledge cutoffs (to guarantee no contamination).

The workflow: a collector gathers the CVE’s vulnerability description and relevant code changes. The researcher analyzes the vulnerability and reconstructs the full exploitation path, extracting primitives from the vulnerable code and builds a graph of possible exploit chains. The builder builds a controlled environment to reproduce the vulnerable system, the exploiter converts the research into a working exploit, then finally the judge verifies that the exploit and environment are valid and realistic.

The Test Case: React2Shell write-up is very cool and nicely detailed on how the workflow can iteratively find gadgets and exploit primitives, form hypotheses, and iterate until it discovers a path that works.

💡 This is one of the more detailed write-ups of approaches I’ve seen in this space, worth reading!

GPT-5.5: Mythos-Like Hacking, Open to All
XBOW's Albert Ziegler and Steve Buckley call GPT-5.5 a Mythos-like step change in vulnerability detection. On their internal benchmark of real vulnerabilities in open-source applications, GPT-5.5 dropped the miss rate from GPT-5's 40% (and Opus 4.6's 18%) to 10%, with black-box performance now exceeding what GPT-5 achieved with source code access, and white-box performance pulling away so far it "effectively killed" their benchmark. The model also logs into target systems in roughly half the iterations of the next-best model and persists on failing paths only half as often as previous GPT versions or Opus, a meaningful gain given RLHF tends to bias models against giving up.

See also XBOW’s evaluation of Opus 4.7.

CTFs in the AI Era
Include Security's Laurence Tennant attended BSidesSF 2026 CTF, where the top 10 teams cleared every challenge with AI agents. Top teams ran pipelines that monitored CTFd for new challenges, spun up multiple agents in parallel, used a coordinator LLM to share insights between them when one stalled, and auto-submitted flags.

CTFs play to everything LLMs are good at: bounded context, clear success criteria, instant feedback, and abundant public write-ups in the training data. Laurence contrasts CTFs with pentesting, in which goals are open-ended, false positives need business context to triage, code bases are large (not just an isolated few hundred lines), findings have to be written up for a client, and stepping outside scope has real consequences. The winning team open-sourced their agent, which cleared all 52 challenges.

💡I do wonder if AI has “solved” CTFs 🙃 Maybe there will be new or separate CTFs where AI isn’t allowed, or some other rules to keep the challenges human-focused. Interesting times.

Misc

Humor

• Kai Lentit - I built Taskrabbit for Witches ($100K MRR - Projected)

• Mama panda swaps her kid for an apple

• Ranking Best Panda Moments

• What are the best Scottish memes?

• Alanis Morissette’s “Ironic” if it was written in 2025

• Escalator sketch - seeing your future partner maybe

Tech

• The HackerOne Internet Bug Bounty program has been paused - “AI-assisted research is expanding vulnerability discovery across the ecosystem, increasing both coverage and speed. The balance between findings and remediation capacity in open source has substantively shifted.”

• Vercel says some of its customers’ data was stolen prior to its recent hack

• Laws of Software Engineering - A collection of principles and patterns that shape software systems, teams, and decisions.

• Why a startup is teaching human brain cells to play “Doom” - Video

• Daring Fireball on the Tim Cook Apple CEO transition

• Apple fixes bug that cops used to extract deleted chat messages from iPhones

• Caleb Sima on some interesting history of various cybersecurity companies. Congrats to Meny Har, John DiFederico, Dylan Williams for Spectrum Security’s seed found.

• Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors - Citizen Lab uncovered two sophisticated commercial surveillance vendors conducting multi-year location tracking campaigns by exploiting SS7 and Diameter signaling protocols across global mobile networks.

• Scoop: NSA using Anthropic's Mythos despite blacklist

• An AI Agent Just Destroyed Our Production Data - Cursor running Anthropic's flagship Claude Opus 4.6 deleted PocketOS’ production database and all volume-level backups in a single API call to Railway, their infrastructure provider. Oof 🫠 Lots of people are working on making agents safer, but there’s still a lot of work to be done.

Misc

• People Magazine - Forrest Brazeal is writing a book satirizing Silicon Valley (based on his experiences working at Google) called Paradox Inc, about the fall and rise of a time-travel startup. I love Forrest’s music and humor, I bet this is going to be great.

• Aidan Steele - Micro-transactions and the first AI-native fax service

• Jesse Itzler - If Your Life Isn’t on One Page, It’s Too Complicated

• Mom and daughter excited when dad comes home 🥹

• Yuki Piano - KPop Demon Hunters Golden piano cover

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

😅 Bug Hunters Be Like

I was going to open with a fun, personal story, but then I got caught up trying to cover a round-up of what a bunch of folks are saying about Mythos and frontier of LLM-driven vulnerability discovery, and now it’s past midnight 😅 

So for now I leave you this meme, H/T buherator:

Sponsor

📣 (Free!) Community Edition: Ready your attack surface for AI with runZero

Gearing up for a deluge of AI-powered exploits? You’re gonna need fast, accurate visibility into all your assets.

Created by HD Moore (the mind behind Metasploit), runZero delivers unrivaled discovery and exposure detection across your entire internal and external attack surfaces. No agents, no credentials, and no appliances required. runZero finds everything, including unknown, unmanaged, and "I didn't know that was plugged in" devices — along with broad classes of exposures from CVEs to default credentials and bad configs.

👉 Start your 21-day free trial 👈

Pro Tip: When your trial ends, downshift to our free Community Edition. It’s perfect for home labs (up to 100 devices!).

AppSec

thomaspreece/GitHub-Token-Tester
Tool by Thomas Preece that enumerates the exact permissions of various GitHub tokens. For Classic PATs and OAuth tokens, it checks the scopes header from the user endpoint, while for App Installation Tokens, App User Access Tokens, and Fine-grained PATs, it brute-forces each permission individually against a repository where the user has admin access.

The $0 security stack
Oblique’s Maya Kaczorowski describes their $0 security stack that’s gotten them through their first SOC2 audit period: Semgrep (free for up to 10 contributors) for SAST/SCA with AI-based triage, TruffleHog for secret scanning on commits, RunReveal's Community tier (5 data sources) as their SIEM ingesting GCP/Cloudflare/GitHub logs, and Sublime Security's Core tier (free for up to 100 mailboxes) for email security integrated with Google Workspace. They also deployed Apple Business for MDM to enforce disk encryption, password locks, and forced updates, noting that Mac devices include XProtect anti-malware that can't be disabled. The stack caught misconfigurations within 24 hours and provides built-in detections routed to a dedicated Slack channel.

Mutation testing for the agentic era
Mutation testing is a pretty neat approach in which you introduce bugs (mutants) and check if your tests catch them, flagging hot spots where code is insufficiently tested. Trail of Bits' Bo Henderson announces MuTON and mewt, two new mutation testing tools optimized for agentic use, along with a configuration optimization skill to help agents set up campaigns efficiently. MuTON provides first-class support for TON blockchain languages (FunC, Tolk, and Tact), while mewt is the language-agnostic core that also supports Solidity, Rust, Go, and more.

The tools use Tree-sitter parsers to systematically introduce bugs into code and verify tests catch them, and implement mutant prioritization (high-severity mutations replace statements with reverts, medium-severity comment out lines, low-severity swap operators) to reduce campaign runtime.

Sponsor

📣 Map your MCP attack surface across four risk categories

When MCP agents read data from connected systems and decide autonomously what to do next, the attack surface is the data, not the code. This framework maps risks across four categories (content injection, supply chain, config/governance, and ops), covers the agent-as-inadvertent-adversary problem, and provides a defense matrix mapped to the OWASP MCP Top 10.

👉 Download the framework 👈

Lots of companies are working on securing their MCP usage, nice to see a risk framework with practical defenses and governance controls 👍️ 

Cloud Security

The Invisible Footprint: How Anonymous S3 Requests Evade AWS Logging
Maya Parizer describes how Varonis Threat Labs discovered that anonymous S3 requests made through VPC endpoints weren't logged in CloudTrail Network Activity events, allowing attackers within compromised VPCs to exfiltrate data to external buckets with zero visibility. When anonymous requests targeted external S3 buckets and the VPC endpoint policy denied access, no events were created in either the source or target account's CloudTrail logs (management, data, or Network Activity events). AWS has since patched this issue to log all anonymous API requests to external S3 buckets as CloudTrail network activity events in the VPC endpoint owner's account.

Cracks in the Bedrock: Agent God Mode
Palo Alto Networks’ Ori Hadad discovered that AWS Bedrock AgentCore's starter toolkit generates overly permissive IAM roles with wildcard permissions, enabling a "God Mode" attack where compromising one agent grants access to all others in the account. The post describes a multi-stage attack chain in which an attacker who compromises one agent could exfiltrate proprietary ECR images, access other agents’ memories, invoke every code interpreter, and extract sensitive data. Following responsible disclosure, AWS updated documentation to warn that auto-generated roles are for development/testing only and should never be used in production.

💡Every time a major platform provider releases an insecure by default product or feature, a fairy loses its wings, and the tl;dr sec robot sheds a single, oily tear.

Wiz Custom Rules: Measuring the Cloud Security Coverage Gap
TrustOnCloud’s Jonathan Rault announces the open sourcing of their Wiz Custom Configuration Rule (CCR) packages written in Rego for AWS S3, Azure Storage, and GCP BigQuery. They mapped TrustOnCloud controls across those 3 major cloud services and compared them against the default Wiz coverage, and found Wiz’s default coverage was around 34%.

The packages include mappings between TrustOnCloud controls and default Wiz rules, plus custom CCRs for gaps (missing high-severity controls including S3 account-level Block Public Access verification, VPC endpoint IAM restrictions, and BigQuery row-level access authorization checks). Each control is weighted using a CVSS-based scoring system that factors threat mitigation, impact, and control difficulty. TrustOnCloud is exploring Sigma rules to convert their detective controls into deployable code across broader security tooling beyond Wiz.

Supply Chain

sadreck/Butler
By Pavel Tsakalidis: Butler scans every repo for workflows, actions, secrets/variables, third-party actions, and produces HTML and CSV outputs to assist with security reviews, third-party dependency audits, and workflow management.

Fork Commit Detector
Client-side tool by Rami McCarthy that detects GitHub fork commits (commits accessible via a repo's namespace but not in any of its branches), which attackers can exploit to inject malicious code into CI/CD pipelines by referencing them directly via SHA or tags.

The tool queries GitHub's API to check if a commit is HEAD of any branch, merged via PR, or referenced by signed tags, flagging unsigned fork commits as potential imposters and highlighting the highest-risk scenario: imposter tags where upstream tags point to attacker-controlled fork commits. This attack has been done in the wild, for example, the TeamPCP supply chain attack (Trivy, KICS) and Shai Hulud 2.0/AsyncAPI.

SmokedMeat: A Red Team Tool to Hack Your Pipelines First
Boost Security’s François Proulx announces SmokedMeat, a post-exploitation framework for CI/CD pipelines that demonstrates the full attack kill chain TeamPCP used to compromise Trivy, LiteLLM, KICS, and more. Video overview. The framework includes:

1. Reconnaissance - Scans GitHub Actions for injection flaws and overpermissive tokens.

2. Exploitation - Auto-crafting payloads deployed via PR/issue/comment.

3. Post-exploit - Sweep runner process memory for secrets, enumerate token permissions, collect loot.

4. Pivot - Exchange OIDC tokens for AWS/GCP/Azure access, discover private repos with stolen PATs and run the embedded Gitleaks, probe SSH deploy keys, and map the full blast radius in a live visual attack graph

💡 Cool tool 🔥 

Blue Team

pandaadir05/snoop
By Adir Shitrit: A modern syscall tracer built on eBPF. Think strace, but with a real TUI, smart filters, TLS decryption, and output that's actually readable.

How A Roblox Cheat Download Triggered A $2 Million Hack At Vercel
An employee at Context.ai tried to download a Roblox Cheat but actually got hit by a Lumma Stealer, which exfiltrated every credential in the victim’s browser. The attacker used those credentials to breach Context, steal the OAuth tokens of its customers, and pivot into the Google Workspace of a Vercel employee who had signed up for Context’s product and granted it “Allow All” permissions on their enterprise account. From there, the attacker moved into Vercel's internal systems and lifted customer environment variables that had not been flagged as sensitive. Vercel’s security bulletin.

💡 Oof, the transitive trust in this example is tough. I feel like most companies probably wouldn’t have had the hardening or detection visibility to detect or prevent this.

Measuring What We’re Missing
George Chen proposes a framework for measuring detection effectiveness by testing security assumptions and tracking false negatives across control areas (Identity & Access, Endpoint, Network, Cloud, Data Protection). He maps adversarial testing results (red team, purple team, BAS, threat hunting) to specific control areas, calculating detection rates as: Detected / (Detected + Missed under test conditions), then applies organizational weightings based on critical business services and attack paths.

George recommends tracking two separate metrics: an effectiveness score from tested scenarios and a discovery count of gaps found outside testing, to avoid penalizing proactive discovery while measuring how quickly teams find gaps, adapt detections, and improve coverage over time.

💡 I really like the idea of separating a) measuring how we’re doing today and b) new things we discovered we were missing before. In many security domains, if you’re calculating security metrics naively, when you say add a new security scanning tool, you start surfacing vulnerabilities that were already there, but from an “open vulnerabilities” or “new vulns per unit time” in the short term you look worse. But really you just have fewer unknown unknowns / security gaps.

AI + Security

Quicklinks

• Gadi Evron - So you’d like to get started finding 0days with LLMs?

• Open Source SaaS is Dead; Long Live Open Source - In the current debate around security threats to open source code, the real danger is not new AI tools, but reliance on a broken SaaS model. Security through obscurity was never an option.*

• RSA 2026: The Great Cooking - A 🌶️ roasting of which vendors are GPT wrappers, cooked, or actually hard. I don’t agree with all of the analyses, but it’s also an interesting overview of the product categories, sponsor tiers, etc.

^{*Sponsored by Authentik}

Mythos Quicklinks

• Mythos found 271 vulnerabilities in Firefox - “Defenders finally have a chance to win, decisively… The defects are finite, and we are entering a world where we can finally find them all.” LFG security fam 🤘

  • Davi Ottenheimer dug into the details a bit, I’m not sure what to think yet - Mythos Mystery in Mozilla Numbers: How 22 Vulns Became 271 or Maybe 3 in April

• Mythos accessed by unauthorized users - Mercor (training contractor) got breached, which leaked Anthropic’s model naming conventions, some hackers guessed the URL pattern, contractor credentials still worked.

• Zvi Mowshowitz - Claude Mythos #2: Cybersecurity and Project Glasswing - Mega post covering a bunch of related context and discussions

Exploits don't cause cyberattacks
Joshua Saxe argues that predictions of exponential cyberattack growth from AI vulnerability discovery capabilities (like Claude Mythos) are overblown, pointing to how previous AI capabilities (cheap Turing Test-passing chat, voice dialogue, and deepfakes) didn't cause the predicted tsunami of social engineering attacks, phone scams, or misinformation despite being free and trivially accessible. Attackers choose the easiest path to achieve their goals, and since most attacker groups already accomplish their objectives through simple phishing, credential stuffing, and known CVE exploitation, they're not blocked by vulnerability research limitations.

Joshua recommends actor-centric threat modeling by asking which attacker constituencies would actually be unblocked by AI vulnerability research capabilities, what new goals they could pursue, and what cultural/organizational barriers might slow attacker AI adoption.

💡 Joshua Saxe always has thoughtful, measured takes, I highly recommend his posts.

Myth & Mythos: Where Do We Go From Here?
Joe Slowik examines the marketing hype around Mythos, but the unique perspective he adds here is critiques around Project Glasswing and the consortium, which includes major tech companies (Microsoft, Apple, Linux Foundation, Cisco, Palo Alto), but excludes critical OT/ICS vendors like Siemens, Rockwell, and Schneider Electric, as well as major non-US networking providers like Juniper, Ericsson, and Huawei. Currently, there’s a very “tech-company” focus, when ideally there’d also be an investment in defending legacy infrastructure in critical sectors like healthcare, utilities, and industrial facilities.

💡 I agree with Joe’s emphasis on the broader set of companies and industries that foundation model labs should be helping as well. I expect Anthropic will, they just haven’t gotten there yet.

Our evaluation of Claude Mythos Preview’s cyber capabilities
The UK's AI Security Institute evaluated Mythos on cybersecurity tasks, finding it achieved 73% success on expert-level CTF challenges and became the first model to complete "The Last Ones" (TLO), a 32-step simulated corporate network attack requiring an estimated 20 hours of human expert time, succeeding in 3 out of 10 attempts and averaging 22 out of 32 steps completed.

The evaluation used progressively harder benchmarks including CTF challenges and cyber ranges, with Mythos demonstrating the ability to autonomously discover and exploit vulnerabilities in multi-stage attacks on vulnerable networks, though it struggled with operational technology environments and was tested without realistic defensive measures like active defenders, EDR, or security monitoring. Performance continued scaling with increased token budgets up to the 100M token limit tested, suggesting further improvements are possible with additional inference compute.

“There are also no penalties for the model for undertaking actions that would trigger security alerts. This means we cannot say for sure whether Mythos Preview would be able to attack well-defended systems.”

The Boy That Cried Mythos: Verification is Collapsing Trust in Anthropic
This post by Davi Ottenheimer is probably the most critical about Mythos I’ve found. Davi argues that: Anthropic's Claude Mythos Preview system card claims "thousands of zero-days" but the 244-page document dedicates only 7 pages to cybersecurity, never quantifies vulnerabilities with CVEs or CVSS scores, and its flagship Firefox demonstration collapses under scrutiny: the model exploited two bugs already found by Claude Opus 4.6, in already-patched Firefox 147, in a test harness with sandboxing and defenses stripped out, achieving 72.4% exploit success that drops to 4.4% when those two bugs are removed.

Anthropic's own cyber range tests admitted the model "failed against a properly configured sandbox with modern patches" and cannot compromise operational technology environments. The $100M Project Glasswing "defensive initiative" is actually $4M in donations plus $100M in API credits to use Mythos itself, with few partner-confirmed findings, no comparison to existing fuzzers (AFL, libFuzzer, OSS-Fuzz), no false-positive rates, and a 90-day report promise with no delivery yet.

💡 This post is overall more negative about Mythos than I personally feel is justified, but it’s good to read critical analyses of published results, as it gives us examples of analyzing blog claims more thoughtfully and critically. Worth reading, it pulls out some nuances I haven’t seen discussed elsewhere.

AI Cybersecurity After Mythos: The Jagged Frontier
I have thoughts about this post. AISLE’s Stanislav Fort describes attempting to replicate the Mythos showcase vulnerabilities on eight small, cheap, open-weights models. He argues the moat is the system (targeting, iterative deepening, validation, triage, maintainer trust) rather than the model itself.

 Dawid Moczadlo pointed out that the prompts are quite specific about how exactly the vulnerability occurred (“Consider the behavior of the SEQ_LT/SEQ_GT macros with sequence number wraparound.”). Michael Bleigh and julia on giving the models just the code they need to analyze, vs scanning the total repo from scratch. See also the LinkedIn comments on the posts here and here.

💡 First off: I think the AISLE team has clearly found and reported a number of high impact vulnerabilities in open source, which is great. However, I feel this post is highly misleading from an experimental design point of view, and the claims do not match up with what was tested:

• They gave the small models just the context needed to validate the vulnerabilities- the models didn’t need to search the code base, which is a core part of the problem.

• The prompts given were tailored to the specific vulnerabilities (not even vulnerability class) being evaluated.

• False positive rates weren’t discussed, nor costs if the whole code base were to be scanned.

System Over Model: Zero-Day Discovery at the Jagged Frontier
Follow-up post by AISLE’s Stanislav Fort in which they open sourced nano-analyzer, a deliberately simple single-file Python scanner that uses cheap models (gpt-5.4-nano at $0.20/M tokens) to brute-force scan entire codebases in parallel, detecting Anthropic's flagship Mythos FreeBSD RCE 2/3 times with models as small as 3.6B active parameters at ~100-800x lower cost than Mythos. The three-stage pipeline (context generation, vulnerability scanning, skeptical triage with grep access) found maintainer-confirmed bugs in FreeBSD's NFS RPCsec_gss subsystem and a responsibly-disclosed 26-year-old memory corruption bug. They scanned the full FreeBSD kernel (35K files, 7.5M lines) in 10 hours for under $100 in API costs. Takeaway: adequate intelligence deployed with massive parallelism can surface real zero-days without hand-scoped snippets.

Seen Heelan: “Conventionally, if you want to test if an LLM can find a bug where the root cause is a memcpy into a statically sized stack buffer, you would not put exactly that in the prompt as an example.” More.

💡The methodology in this post overall seems much better, though I need to read it in more detail. It’s still not totally clear to me what the false positive rate was though.

Overall I think it’s great that folks are analyzing what level of model intelligence + scaffolding can replicate the claims of frontier labs using nonpublic models.

Needles and haystacks: Can open-source & flagship models do what Mythos did?
Semgrep’s Kurt Boberg benchmarked Claude Opus 4.6, GPT 5.4, Gemini 3.1-pro, Deepseek R1-0528, and Qwen 3.6-plus against two vulnerabilities from the Mythos blog post (OpenBSD TCP SACK and FreeBSD NFS RCE), and found that no models reliably identified vulnerabilities when analyzing full files without extremely specific hints. When scope was narrowed to individual functions, performance improved dramatically. Kurt found that using LLMs as "hotspot interrogators" paired with deterministic pre-filtering to surface interesting targets consistently outperformed naive whole-file prompting. Reproduction GitHub repo here.

💡 I like how this post emphasizes the importance of the experimental design in replicating Mythos’ findings. Yes, if you pull the needle (vulnerability) out of the haystack (large code base), small models can find it. Also, false positive rates and token costs matter.

Great Venn diagram-ish visualization at the top of the experiment choices for this vs Anthropic’s vs AISLE’s analyses. The key takeaway: there is a lot to think about when measuring how good a model, tool, or product is at finding vulnerabilities.

We Reproduced Anthropic's Mythos Findings with Public Models
Vidoc’s Dawid Moczadło et al describe their attempts to reproduce Anthropic's Mythos vulnerability findings using the publicly available GPT-5.4 and Claude Opus 4.6 models in opencode. Both Opus 4.6 and GPT-5.4 reproduced Botan and FreeBSD, only Opus 4.6 reproduced OpenBSD, and both models had partial success on FFmpeg and wolfSSL. Across all of the scans, the cost to scan a single file stayed below $30.

“If there is still a real gap between Mythos and public models here, it looks much more like exploit construction and operationalization than basic discovery of the underlying bug.”

Misc

Humor

• Two chess grandmasters talk through the hypothetical moves they could make on this date

• Make Some Noise - Swimmy Todd - The Demon Narwhal of Fleet Reef

Misc

• Inside the stealthy startup that pitched brainless human clones - Building clones of yourself that you can then harvest for parts. Makes sense from a scientific point of view but yikes 😬

• Notes from the SF Peptide Scene - Insane story.

• Alex Hormozi - How Acquisition.com Makes Money

• POV: you wake up next to your family

• Early test footage of Anakin’s duel with Dooku - Awesome

• OZ PEARLMAN: Sundae Conversation with Caleb Pressley - Impressive magic that hurts my brain 😂 

• Orson Scott Card - You don’t need advice from editors on rejected manuscripts - Some stories about Ender’s Game getting rejected multiple times

AI + Product Releases, Interviews

• Codex for (almost) everything - Codex can now operate your computer, generate images, remember your preferences, learn from previous actions, and take on ongoing and repeatable work. The Codex app also now includes deeper support for developer workflows, like reviewing PRs, viewing multiple files & terminals, connecting to remote devboxes via SSH, and an in-app browser to make it faster to iterate on frontend designs, apps, and games.

• Introducing workspace agents in ChatGPT

• Alice Hunsberger - Resources for upskilling trust and safety and fraud teams on AI

• Latent Space - Extreme Harness Engineering: 1M LOC, 1B toks/day, 0% human code or review — Ryan Lopopolo, OpenAI

• AI Engineer - How AI is changing Software Engineering: A Conversation with Gergely Orosz

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🎭️ Backstage Tour

Last weekend one of the primary San Francisco theaters (the Orpheum) had an open house where you could go on the stage, backstage, everywhere. It was awesome 😍 

There was a magical moment of standing on the stage, and then seeing them raise the curtain.

I went downstairs backstage and saw the electronics/lighting room, stood in the pit where the orchestra plays, saw the (surprisingly small) dressing rooms with the mirrors, and more.

Some fun facts I learned:

• Everything you need to put on a given musical travels with the show in shipping trucks, including all of the set pieces, costumes, props, lighting, etc.

• For “smaller shows” that are maybe ~7-12 trucks worth, they arrive at a new venue at say 8am, the crew rapidly sets everything up, breaks for dinner at 5pm, then puts on the first show at 7pm that night 🤯 

• ~60-80% of the behind the scenes folks are local to that theater, and they don’t know the show at all yet opening night. So there’s a handful of folks traveling with the show who are orchestrating everything so it’s set up properly.

• The folks on lights have ear pieces, and while they’re learning a new show they may just get guidance from the stage manager like, “OK your next cue is you’re going to pick up stage right a man in blue clothing, 50% brightness, these light settings.” But they don’t know which character it is so they’re just kinda guessing at first.

• Actors often change in almost pitch darkness (except for some lighting they wear around their head) so the light doesn’t bleed on to the stage.

I also saw a “quick change” demo. Sometimes actors only have a few moments to change, so they did a demo of a <1 minute wardrobe change.

There’s actually a ton of prep and thoughtfulness that goes into orchestrating a quick change: how the pants or dress are “pooled” on the ground so you can just step in, how the boots are positioned so they don’t catch on the clothes, how the top layers are laid down to minimize rotation and movement when putting them on, and how there can be one (or more) wardrobe people helping the actors put everything on. Whoa.

Meanwhile, I put on my own clothes like a plebe.

As you might suspect, cybersecurity is just my bridge career, until I get into the stable, lucrative theater or screen industries 👨‍🎤 

Sponsor

📣 Secure Coding from Design to Deployment

Secure coding starts long before production. 

Modern applications move fast, which means security needs to be built in from the start, not added later. From API design to input handling and access control, early decisions have a big impact on reducing risk.

The Secure Coding Best Practices Cheat Sheet covers key areas like secure design foundations, strong authentication and authorization, input validation, and preventing common vulnerabilities such as XSS, SQL injection, and broken access control.

Reduce risk early with practical secure coding and design best practices.

👉 Get the Cheat Sheet 👈

AppSec

• Turn meetings into tangible products - Scott has an AI notetaker in meetings, which he can then use a prompt to turn that into a PRD which his agents can then start building immediately after the meeting.

• Turn memos into implementations - “When I think of defaulting to writing something down, or someone shares a strategy doc, problem statement, idea, etc., I immediately ask Claude, “Let's take the relevant part of this and turn it into an implementation.”

Sponsor

📣 Cybercrime Just Hit Escape Velocity (Here’s the Evidence)

Flashpoint just released its 2026 Global Threat Intelligence Report, and the data is shocking.

• AI-related illicit activity surged 1,500% in a single month

• 3.3B compromised credentials are now fueling identity-based attacks

• Ransomware incidents increased 53% as groups pivot toward pure-play extortion

The report also explores how threat actors are moving from generative tools to agentic AI frameworks that can automate attacks at scale.

👉 View Report 👈

Whoa, that’s some huge growth. Also, I’m curious to learn more about how threat actors are adopting autonomous agents 😅 

Cloud Security

Fighting Eventual Consistency-Based Persistence - An Analysis of notyet
Sonrai Security's Nigel Sood describes his red-blue collaboration with OFFENSAI’s Eduard Agavriloae on notyet (referenced in last week’s issue), an open-source tool that exploits AWS IAM's eventual consistency propagation window to automatically maintain admin persistence by detecting and reversing containment actions within seconds.

Nigel tested nearly a dozen IR techniques against notyet and found that standard AWS-recommended containment methods, including inline policy deletion/modification, managed policy attachments, permission boundaries, group membership changes, access key deactivation, role deletion, and SSM runbooks like AWSSupport-ContainIAMPrincipal, were all ineffective as notyet detected and reversed them within the consistency window. Only Service Control Policies (SCPs) successfully contained notyet, as member account identities cannot modify SCP attachments even with * permissions.

Part 2: AWS CodeBuild (Escalating Privileges via AWS CodeConnections)
Thomas Preece discovered that from an unprivileged AWS CodeBuild job using CodeConnections, you can call an undocumented API to retrieve raw GitHub App tokens or BitBucket JWT App tokens with the full permissions of the installed CodeConnection App. The app generally has read, write and admin permissions on all repos under your organization. See AWS-CodeBuild-HTTP-Intercept-Image for a container image for CodeBuild that allows you to get network monitoring in place before CodeBuild starts your build.

So basically your CodeConnection setup could mean you are one breached build job away from having every repo in your organization compromised 😅 AWS are not planning to fix this issue as they say CodeBuild is a "trusted environment."

💡 Great detailed write-up and walk through of examining how a third party system works internally 👍️ 

Supply Chain

Primer on GitHub Actions Security - Threat Model, Attacks and Defenses
Wiz’s Shay Berkovich describes the GitHub Actions threat model, three main risks (Pull Request pwnage, script injection, 3rd party components), and a defensive playbook.

The post discusses 8 dangerous triggers (including pull_request_target), how script injection occurs when untrusted inputs like branch names or issue titles are directly embedded in bash commands without environment variable binding, and how compromised third-party actions cascade through dependency chains, like when attackers sequentially compromised four Actions to reach Coinbase.

“High-value targets including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts all successfully blocked the attack through a combination of first-time contributor approval gates, actor-restricted workflows, and path-based trigger conditions.”

Blue Team

MITRE Fight Fraud Framework
MITRE has released the Fight Fraud Framework™️ (F3), a free, open knowledge base documenting tactics and techniques used by financial fraud actors based on real-world cyber fraud incidents. The framework maps fraud-specific behaviors and references applicable MITRE ATT&CK techniques where relevant, providing a common taxonomy for describing fraud incidents.

YARAHQ/yara-rule-skill
By Florian Roth and Thomas Roccia: An LLM Agent Skill for expert YARA rule authoring, review, and optimization. Embeds industry best practices from the creator of YARA-Forge and yaraQA into your AI assistant's context. It enables natural language rule writing, review, and optimization.

Little Snitch for Linux
Little Snitch for Linux (GitHub) uses eBPF to monitor and control outgoing network connections, providing a web UI that shows which applications are connecting to which servers, with support for custom rules and automatic blocklist updates. The tool can filter by process, port, and protocol, displays traffic history and data volumes, and accepts blocklists in formats like domain-per-line, /etc/hosts, and CIDR ranges.

Red Team

Building Agentic C2 with Computer Use Agents
BeyondTrust’s Ryan Hausknecht describes a proof-of-concept command-and-control (C2) architecture using Claude's computer use capability, where a C# implant on the target endpoint executes AI-driven actions via Windows APIs (SetCursorPos, SendInput) or pyautogui. To avoid direct connections to Anthropic's API, Ryan used Azure Storage blobs as a dead drop for command polling and Azure Function Apps as a proxy to append API keys, ensuring all traffic appears to originate from Azure.

Claude takes screenshots to determine screen resolution and element positioning, then issues click and keypress commands that flow through the function app back to the implant. This architecture keeps API keys off the endpoint and makes network traffic blend in with normal Azure communications.

Janus: Listen to Your Logs
SpecterOps's Gavin Kramer introduces Janus, an open-source tool that parses C2 logs from Mythic, Cobalt Strike, and Ghostwriter to surface operational friction like failed commands, retries, and tool failures that typically get lost in deleted logs. Janus shows your team where your tooling breaks, where operators lose time, and what you could automate next.

Janus helps them understand:

• Which tools should be updated vs. retired

• When and why tool failures occur

• Which techniques are being improvised due to missing capabilities

• What arguments caused a Beacon object file (BOF) to crash an agent

• What command ran before a callback stopped checking in

• What activity later correlated with detection or prevention

“Janus gives leadership the data layer that has been missing, and it answers:”

• How much time (and therefore cost) is lost to tool failures, retries, and operator workarounds

• Which parts of the engagement hold the most variability in timelines and delivery?

• Where are we paying an “efficiency tax” due to unreliable tooling?

AI + Security

Trusted access for the next era of cyber defense
OpenAI is scaling their Trusted Access for Cyber (TAC) program to thousands of verified defenders and launching GPT-5.4-Cyber, a fine-tuned variant of GPT-5.4 with reduced refusals for cybersecurity tasks and new binary reverse engineering capabilities. OpenAI is using strong Know Your Customer (KYC) and identity verification to limit advanced capabilities to trusted parties, and is giving targeted grants⁠, contributing to open-source security initiatives⁠, and investing in Codex Security⁠ to help defenders more rapidly find and patch vulnerabilities.

💡 Perhaps GPT-5.4-Cyber should have been the name for their erotica chatbot 🤔 Jokes aside, it’s great to see OpenAI investing in securing the software ecosystem, supporting defenders, and releasing higher capability models carefully.

The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program
New ~30 page Cloud Security Alliance whitepaper from Gadi Evron, Rich Mogull, Robert T. Lee, and a huge list of other contributors authors. A briefing for security leaders on how AI-driven vulnerability discovery is reshaping the defender timeline, the operating model of vulnerability management, and the minimum actions required now. Nice overview of recent events and important things to consider for your security program. See:

• p15 - 10 Questions to Understand Your Security Program State and Influence

• p16 - A Mythos-ready Security Program Risk Register

• p19 - Priority Actions for a Mythos-ready Security Program

4x Velocity, 10x Vulnerabilities: AI Coding Assistants Are Shipping More Risks
Apiiro’s Itay Nussbaum shares results from analyzing the impact of AI coding assistants across tens of thousands of repositories in Fortune 50 orgs. They found AI-assisted developers produced 3-4x more commits, but they were packaged into fewer PRs. By June 2025, AI-generated code was introducing over 10,000 new security findings per month across the repos in their study, a 10x spike in just six months compared to December 2024.

Interestingly, the types of flaws introduced by AI are different, for example, privilege escalation paths jumped 322%, and architectural design flaws spiked 153% (I’d like to know more about these are defined/measured).

💡 Long term I believe coding agents + security orchestration around them will make code more, not less secure, but it’s great to see some stats and investigation on the challenges we’re facing now.

Misc

Misc

• Mina Le - the myth of the "pilates body" - Interesting history around the origins of pilates, barre, Jazzercise, societal expectations, and more.

• Game Changer - Who can perform the most impressive magic trick?

• FBI Recovers Deleted Signal Messages Through iPhone Notifications - How to protect yourself: On your iPhone, go to notification settings for Signal and set Show Previews to Never. Then open the Signal app, go to Settings > Notifications > Notification Content, and select No Name or Content.

• Dr. Mike - Peptides: The Most Overhyped Trend in Fitness?

• Bryan Johnson - Before you take peptides, know this

• Gabi Belle - The Problem with Autotune on TikTok

• Harry Potter by Balenciaga - Outstanding 😂 

• The Primeagen - I made a music video and I'm not sorry - “Yacht problems” 😂 

AI

• The Verge - Read OpenAI’s latest internal memo about beating the competition — including Anthropic

• 20VC with Harry Stebbings - Demis Hassabis: Why AGI is Bigger than the Industrial Revolution & Where Are The Bottlenecks in AI

• Alex Kantrowitz - OpenAI President Greg Brockman: AI Self-Improvement, The Superapp Bet, Path To AGI, Scaling Compute

• Lenny’s Podcast - How to be a CEO when AI breaks all the old playbooks | Sequoia CEO Coach Brian Halligan

• Every - How to Build an Agent-native Product | Mike Krieger

• Anthropic - Automate work with routines - Define routines that run on a schedule, trigger on API calls, or react to GitHub events from Anthropic-managed cloud infrastructure.

• Google - Turn your best AI prompts into one-click tools in Chrome

• China’s AI Companies Are Going Closed Source due to funding constraints. The Chinese government continues using "open source" as political rhetoric in policy documents without providing the billions needed to subsidize actual open model development. The funding reality means Chinese labs can't afford to burn tens of billions on 1GW clusters like American competitors, forcing them to monetize through closed models while potentially releasing smaller open models for overseas marketing and robotics use cases.

• OpenAI, Anthropic, Google unite to combat model copying in China

Politics

• Crypto currency industry bribing donating to politicians

• Ukraine tips drone war in its favor - “Starting from December, our unmanned systems units have neutralized more enemy personnel than they recruit to their ranks.”

• How Trump Took the U.S. to War With Iran - Israel’s Netanyahu made the hard sell. The CIA director described the Israeli prime minister’s regime change scenarios as “farcical.” Tucker Carlson warned Trump that a war with Iran would destroy his presidency. “I know you’re worried about it, but it’s going to be OK,” the president said. Mr. Carlson asked how he knew. “Because it always is.”

  • “Everyone deferred to the president’s instincts. They had seen him make bold decisions, take on unfathomable risks and somehow come out on top. No one would impede him now.”

• Civilization Is Not the Default. Violence Is. - On feudalism, Pax Americana and the changing world order.

• US ban on Chinese fixed spy cameras led to a rising drone threat - “The rise of drone security incidents corresponds almost exactly to the US 2019 ban on Chinese cameras at American military bases.”

• Steve Blank - Nowhere is Safe - “The U.S. has discovered that 1) air superiority and missile defense systems designed to counter tens or hundreds of aircraft and missiles is insufficient against asymmetric attacks of thousands of drones. And that 2) undefended high value fixed civilian infrastructure – oil tankers, data centers, desalination plants, oil refineries, energy nodes, factories, et al -are all at risk…the lessons from Iran’s attacks on infrastructure in the Gulf Cooperation Council countries is that anything on the surface is going to be a target.”

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🏫 High School Reflections

As you might guess from the fact that I write a cybersecurity newsletter, I was pretty cool in high school.

This week I randomly came across this YouTube video Learn to Solve an Integral (What Makes You Beautiful Parody), and it took me back.

I remember algebra and calculus being really fun, I would have loved to make a song like this.

I remember being in marching band, playing during football games. The drum line had this one riff where whenever they started playing it the band and the entire student body would start moshing. At one point they got banned from playing it because it made people too rowdy 😂 

(“One time, at…”) Band camp before the school year started was a blast, we always had these epic Halo tournaments. 8 vs 8 CTF, four TVs, two in each room. Mountain Dew and smack talking galore.

I took two programming classes, Visual Basic and Java, but I actually didn’t like them, and I didn’t really “get it.” It might not have helped that neither teacher really knew how to program (one was a football coach 🤷). Kind of ironic given what I do now.

I wish I journaled more, it’d be fun to look back on.

I wonder how your childhood and high school formed who you are today 🤔 

P.S. My friend and former colleague Peter Greko is open to new opportunities. He worked on the AI red team at Microsoft, and most recently Block.

Sponsor

 Register for a brand new research-focused webinar series from Push Security

Join Push Security threat researchers along with incredible guests like John Hammond, Troy Hunt, and Matt Johansen in a brand new webinar series deep-diving into the State of Browser Attacks.

The browser is the place where modern breaches happen, powered by a huge amount of attacker innovation — countless ClickFix variants, new malvertised phishing campaigns intercepting users on search engines, and device code phishing attacks being powered by brand new PhaaS kits and AI tools. And we’re only in April. 

Get ahead of this threat evolution and register your spot now!

👉 Register here 👈

AppSec

Remediation at Scale: What High-Performing AppSec Teams Do Differently
My colleagues at Semgrep did some interesting data crunching across 50k+ repos across 400+ organizations, analyzing stats on fix rate and mean time to remediation across SAST, SCA, and severity level, if certain vulnerability classes are harder to remediate, if catching vulnerabilities earlier improves remediation rates, and more.

salesforce/url-content-auditor
A security auditing tool designed to detect sensitive data exposure in publicly accessible web content. It systematically scans, extracts, and audits images, PDFs, and video files using AI-powered analysis (Google Gemini API) to identify potential data leaks, compliance violations, and privacy risks.

Meet Vespasian. It Sees What Static Analysis Can’t.
Praetorian's Blayne Dreier, Nathan Sportsman et al release Vespasian, an open-source tool that generates API specifications (OpenAPI 3.0, GraphQL SDL, WSDL) by observing real HTTP traffic from headless browser crawls (powered by Katana) or importing existing captures from Burp Suite, HAR files, or mitmproxy. The tool uses a two-stage pipeline: first capturing traffic with full JavaScript execution to catch dynamically-constructed API calls that static analysis misses (or import traffic), then classifying requests using confidence-based heuristics, deduplicating endpoints via path normalization, and probing for metadata through OPTIONS requests, GraphQL introspection, and WSDL fetching.

Organizational Politics & The Security Program
Phil Venables describes how organizational politics are a necessary skill for security leaders, arguing it's the application of influence to achieve outcomes, not something inherently negative. Phil shares lessons from decades as a CISO and Chief Risk Officer, including: decisions are pre-ordained outside formal meetings through advance consensus-building, you should embed security into existing business processes and budgets rather than creating separate initiatives, and building broad support across the organization (not just relying on your boss) is critical for program longevity.

Some key tactics: leveraging the Risk = Hazard + Outrage equation to prioritize work, using Force Field Analysis to understand what's preventing change, and connecting disparate teams across the organization to build political capital beyond just security outcomes.

“If you’re going into a meeting or committee and you don’t already feel confident on the outcome then you’ve missed the point and will have likely not done the work to line up support for the outcome you want. Remember, committees are the roots of power structures not the structure themselves.”

“Many of the security programs I’ve run also drove improvements in reliability, development agility, product features, and more. These came from observations of issues in the security processes that we could have ignored as being outside of our lane, but we decided to press and got support in doing so.”

“Remember, published organization charts almost never actually represent the true organization structure in terms of influence. That has to be discovered by you.”

Sponsor

📣 Axios. Trivy. LiteLLM. More are coming.
 Root stops compromised dependencies.

Recent software supply chain attacks just rewrote the playbook. Here's the kicker: they won't have a CVE and they won't be triggered by a scanner. These attacks exploit the one thing every pipeline trusts blindly: upstream dependencies. Compromised maintainers, hijacked registries, silent tag overwrites. By the time you notice, you've already built and shipped it. The only fix is controlling what enters your environment. Root pins every dependency to verified, known-good versions and backports security patches without forced upgrades so you stay secure without breaking your build.

👉 Fix your supply chain 👈

Pinning dependencies to known-good versions would prevent so many recent supply chain attacks, and I could see backported security patches saving weeks to months of dev time, depending on the company. Neat 👍️ 

Cloud Security

gabrielPav/aws-preflight
By Gabriel Pavel: A security linter for AWS CLI commands that catches misconfigurations before execution, featuring 703 checks across 91 AWS services. The tool analyzes commands for issues like missing IMDSv2 enforcement, unencrypted storage, public accessibility, overly permissive IAM policies, and disabled logging.

notyet: Open-Source Tool to Test AWS IAM Credential Revocation Gaps
OFFENSAI's Eduard Agavriloae has released notyet, an open-source tool that exploits AWS IAM's eventual consistency (the ~4 second propagation window where disabled or deleted credentials remain valid) by continuously monitoring for defender actions (key deletion, policy detachment, role removal) and automatically responding with credential rotation, role assumption, policy persistence, and defensive action stripping. Notyet can help IR teams test whether their containment playbooks work against automated adversaries.

Enforcing AI Governance Across AWS Organizations
Sonrai Security describes how to enforce AI governance across AWS Organizations using Service Control Policies (SCPs) and Bedrock Policies to centrally manage AI service access. The post provides examples for: preventing access to the AWS control plane through AWS’s managed MCP servers, org-wide Bedrock policies for blocking prompt injection attacks, disabling specific AI services like Bedrock AgentCore, controlling model family availability, and preventing long-term Bedrock API key creation/use.

Supply Chain

elastic/supply-chain-monitor
By Elastic: Automated monitoring of the top PyPI and npm packages for supply chain compromise. Polls both registries for new releases, diffs each release against its predecessor, and uses an LLM (via Cursor Agent CLI) to classify diffs as benign or malicious.

lirantal/npm-security-best-practices
By Liran Tal: A curated and practical list of security best practice for using npm packages. Safe-by-default npm package manager command-line options, hardening against supply chain attacks, deterministic and secure dependency resolution, etc.

DriftlessAF: Introducing Chainguard Factory 2.0
Chainguard’s Matt Moore, Manfred Moser, and Maxime Greau announce DriftlessAF (GitHub), an agentic reconciliation framework that replaced their event-driven Factory 1.0 architecture. DriftlessAF uses AI-powered reconciler bots in a Kubernetes-style reconciliation loop to continuously compare desired state (zero CVEs, latest packages) against actual state across 2,000+ containers and hundreds of thousands of package versions, by reasoning about unstructured data and creating self-healing workflows that can safely discard failed work items.

The framework includes Terraform modules for event-driven reconciliation infrastructure, a multi-regional work queue, and Go packages for GitHub repository, OCI container, and APK package reconciliation. Engineers now review AI-generated pull requests and package updates instead of creating them manually, while the system autonomously manages hundreds of thousands of package versions and CVE patch backports.

💡 This seems like some impressive engineering, and cool that they open sourced it! I think we’ll see more of this going forward, with agents autonomously building and mending software. See OpenAI’s Harness Engineering blog or Simon Willison’s Agentic Engineering Patterns for more.

AI + Security

Quicklinks

• step-security/dev-machine-guard - Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages.

• Is Your Identity Security Keeping Up with AI? | Delinea 2026 Report - 87% of organizations say they’re ready for AI—but nearly 50% admit they can’t fully track AI and non-human identities accessing critical systems. That gap creates unmanaged access and standing privileges. Read Delinea’s 2026 Identity Security Report to learn more.*

• knostic/AgentSonar - Detect shadow AI agents by monitoring network traffic and classifying process-to-domain pairs.

^*Sponsored

Vulnpocalypse: AI, Open Source, and the Race to Remediate
Nice post by my bud Chris Hughes synthesizing a number of stats, posts, related work, and his interviews on AI finding vulnerabilities, time to exploitation, patching challenges, etc.

On LLMs and Vulnerability Research
Devansh Batham gives a number of arguments refuting that LLMs can’t understand code or find meaningful vulnerabilities, and I think makes an interesting case that LLMs + coding harnesses will likely be able to find “novel” or “creative” new vulnerability classes, as these classes are really just combinations of known primitives.

For example, HTTP request smuggling is really: ambiguous protocol specification + inconsistent parsing between components + a security-critical assumption about message boundaries. And prototype pollution RCEs in JavaScript frameworks: injection + type confusion + privilege boundary crossing. This novel composition of primitives is what LLMs are increasingly good at. “Most of what we call novel vulnerability research is creative recombination within a known search space.”

Vulnerability Research Is Cooked
Excellent post by Thomas Ptacek on the history of vulnerability research, and how LLMs are uniquely suited for finding and exploiting vulnerabilities because they already encode vast correlations across source code, understand all documented bug classes (stale pointers, type confusion, allocator grooming), and excel at the pattern-matching and constraint-solving required to chain subtle framework details into exploits.

Thomas argues that this capability will democratize elite exploit development beyond high-value targets like Chrome to everything from databases to printers, overwhelming open source maintainers with verified high severity reports, making closed-source protection irrelevant (agents can reason directly from assembly), and potentially triggering bad AI security regulations that fail to recognize asymmetric costs on defenders.

“We’ve been shielded from exploits not only by soundly engineered countermeasures but also by a scarcity of elite attention.”

“Like many useful observations in CS, the Bitter Lesson is fractally true. It’s about to hit software security like a brick to the face.”

See also their podcast with Nicolas Carlini.

Project Glasswing: Securing critical software for the AI era
Anthropic announces Project Glasswing, a collaboration with AWS, Apple, Google, Microsoft, NVIDIA, and others to use Claude Mythos Preview—an unreleased frontier model that has already discovered thousands of high-severity vulnerabilities across major operating systems and web browsers—for defensive security purposes.

Anthropic is providing access to 40+ organizations building critical infrastructure along with $100M in usage credits and $4M in direct donations to open-source security organizations. Launch partners include CrowdStrike, Palo Alto Networks, and Cisco. They’ve also donated $2.5M to Alpha-Omega and OpenSSF through the Linux Foundation, and $1.5M to the Apache Software Foundation.

💡It’s great that Anthropic is gathering a group of partner companies to collaborate with on this, and I appreciate the sizable investment in helping secure the software ecosystem more broadly ($100M in usage credits is no joke).

Prediction: models from multiple labs are going to keep getting better, and specifically better at cybersecurity, but those will mostly not be available except to trusted parties due to the risk of abuse. I’m glad that folks take this risk seriously.

Assessing Claude Mythos Preview’s cybersecurity capabilities
Anthropic’s Nicholas Carlini et al discuss Mythos Preview’s capabilities in finding and exploiting zero-days in open source software, and its ability to reverse engineer exploits on closed-source software, turning N-day (known but not yet widely patched) vulnerabilities into exploits. “Over 99% of the vulnerabilities we’ve found have not yet been patched.”

“In one case, Mythos Preview wrote a web browser exploit that chained together four vulnerabilities, writing a complex JIT heap spray that escaped both renderer and OS sandboxes. It autonomously obtained local privilege escalation exploits on Linux and other operating systems by exploiting subtle race conditions and KASLR-bypasses. And it autonomously wrote a remote code execution exploit on FreeBSD’s NFS server that granted full root access to unauthenticated users by splitting a 20-gadget ROP chain over multiple packets.”

“We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy.”"

Methodology:

1. They launched a container (isolated from the Internet and other systems) that runs the project-under-test and its source code.

2. They invoke Claude Code with Mythos Preview and prompt it to find bugs, and produce a proof-of-concept exploit and reproduction steps if found.

3. To encourage Claude to focus on different parts of the code base, they first have Claude rank each file in the project from 1-5 on how likely it is to have bugs.

4. They then invoke many copies of Claude in parallel, tasking each run focus on one of the most interesting files.

5. Finally they ask Mythos to triage findings from prior steps.

The most critical bug they found in OpenBSD, after a thousand runs of their scaffold, cost ~$20,000 total, and found several dozen more findings.

“In 89% of the 198 manually reviewed vulnerability reports, our expert contractors agreed with Claude’s severity assessment exactly, and 98% of the assessments were within one severity level. If these results hold consistently for our remaining findings, we would have over a thousand more critical severity vulnerabilities and thousands more high severity vulnerabilities.”

“For multiple different web browsers, Mythos Preview fully autonomously discovered the necessary read and write primitives, and then chained them together to form a JIT heap spray.”

“We’ve used these capabilities to find vulnerabilities and exploits in closed-source browsers and operating systems. We have been able to use it to find, for example, remote DoS attacks that could remotely take down servers, firmware vulnerabilities that let us root smartphones, and local privilege escalation exploit chains on desktop operating systems.”

Regarding N-days: “We began by providing Mythos Preview a list of 100 CVEs and known memory corruption vulnerabilities that were filed in 2024 and 2025 against the Linux kernel. We asked the model to filter these down to a list of potentially exploitable vulnerabilities, of which it selected 40. Then, for each of these, we asked Mythos Preview to write a privilege escalation exploit that made use of the vulnerability (along with others if chaining vulnerabilities would be necessary). More than half of these attempts succeeded.”

Misc

Misc

• Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit - A researcher released the PoC for an unpatched Windows privilege escalation bug because they were unhappy with MSRC’s disclosure process.

• Nick Collins - Introduction to Computer Music - Free ~350 page book.

• Why Charlie Puth hears music differently

• Contrapunk - Real-time MIDI harmony generator and guitar-to-MIDI converter.

• An interactive map of Tolkien’s Middle Earth

• Advanced Search for YouTube - Filters like exact terms, exclude terms, title includes, video length, date before/after.

• Alex Hormozi - How to make progress faster than everyone - On being cringe, trying hard, and not comparing your first chapter to someone’s 20th.

AI

• voldemortensen/snark-driven-development - A Claude Code skill that wraps development workflows with sharp, substance-backed snarky commentary

• GitHub issue: Claude Code is unusable for complex engineering tasks with the Feb updates

• Lenny’s Podcast - How Anthropic added $11B in ARR in one month | Amol Avasare (Head of Growth, Anthropic)

• Humanoid Robot Accidentally Slaps Boy During Public Demo in China - After reportedly saying, “You best watch yo’ mouth son!”

• What is Rizzbot? Meet the AI Robot Rizzing Up Your Girl - Not gonna life, some of these videos are pretty hilarious

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🫶 Long Career, Long Friendships

This week I was reflecting a bit after BSidesSF and RSAC about how careers are long.

I remember attending conferences when I first started in security and being intimidated by how it was crowded and full of strangers.

This year, there were still many strangers not yet friends, but now I got to catch up with many former colleagues and friends I’ve known for years. Some for a decade 👴 

It feels nice knowing we’re all working together in our own ways, at different companies, to make the world a little bit safer.

Also, just wanted to share a few thoughts:

• It’s OK if you don’t know people at an event or conference. 98% of the time if you go up and chat with a stranger it goes great, or at least fine.

  • When I’m nervous at events, I like to think about how, just by both of us being at a security event, I have a vast amount of shared experience and context with anyone there.

• If every event you just meet a handful of people, that’s going to compound event on event, year on year. Soon you’ll likely know at least a few people at most events.

Anywho, if you attended, I hope you had a great time and made some friends, and didn’t just repeat “AI” until a VC materialized and dumped money on you.

P.S. Dan Guido kindly turned his [un]prompted talk into a tl;dr sec guest post. It’s excellent, highly recommend.
👉️ How we made Trail of Bits AI-native (so far) 👈️ 

Sponsor

📣 Free tool: instant visibility into your Claude Desktop deployment

Employees aren't waiting for approval. Claude Desktop is getting deployed with MCP servers, OAuth connectors, CoWork scheduled tasks, and browser-control extensions your security team never reviewed.

Our Head of Security, Ed Merrett, built a lightweight, read-only audit tool to give you instant visibility. One command surfaces everything: installed extensions and whether they're signed, MCP server configs, dangling env variables, OAuth tokens, scheduled tasks, org-deployed plugins, and runtime state.

p.s. If you’re looking for more help with securing the Claude ecosystem, visit harmonic.security to check out our other free resources!

👉 Audit your Claude setup 👈

AppSec

portswigger/ip-rotate
By Portswigger: An extension for Burp Suite that uses AWS API Gateway to rotate your IP on every request, helping bypass IP-based rate limiting, bruteforce protections, and WAF blocks.

Passkeys are Your New Best Friend
Google's Harsh Lal explains how passkeys use asymmetric cryptography to replace passwords, where a private key stored on your device signs authentication challenges while the public key on the server verifies them, making them phishing-resistant through domain binding and useless if servers are breached. Nice brief overview of why passkeys are safer than passwords, signing in across devices, FAQ of security concerns, and risks: sync account hijacking (mitigated by requiring the old device's screen lock) and social engineering attacks requiring physical proximity

A year of open source vulnerability trends: CVEs, advisories, and malware
GitHub's Jonathan Evans analyzes the 4,101 reviewed advisories GitHub published in 2025, the fewest since 2021, but this reflects a reduction in backfilling older vulnerabilities rather than fewer new discoveries- newly reported vulnerabilities actually increased 19% year-over-year. The data shows cross-site scripting remains the top vulnerability type; resource exhaustion, unsafe deserialization, and SSRF saw significant increases. Advisories without any CWE dropped 85% due to improved tagging. GitHub's malware advisory publications surged 69% to 7,197 (driven by campaigns like SHA1-Hulud). The GitHub CNA published 35% more CVE records (2,903 total) with 679 new organizations requesting CVE IDs. “We saw 10 to 16% growth every quarter. If this trend continues, GitHub will publish over 50% more CVEs in 2026.”

💡 Frontier models are getting so much better at finding vulnerabilities + much more code is being written → 2026 is for sure going to be a record breaking year for CVEs, the only question is by how much. People are (in my opinion, correctly) talking about an upcoming “vulnpocalypse." 😅 

Sponsor

📣 Webinar: Executive Impersonation and Modern Phishing Tactics

Executive impersonation attacks pressure employees with urgency, authority, and high-stakes requests. Because they rely on social engineering instead of obvious malware, they often slip past traditional email defenses. Join Sublime Security for a live webinar on April 8 to break down how these attacks work, review real-world patterns, and learn practical ways security teams can detect and stop impersonation attempts earlier.

👉 Register 👈

Andrew Becherer is a sharp dude, and gave an excellent talk at the Decibel event Daniel Miessler and I co-hosted during RSA. He definitely has perspective worth listening to.

Cloud Security

Reunifying the Cloud: Introducing Aurelian for Multi-Cloud Security Testing
Praetorian's Aarushi Dwivedi et al have released Aurelian, an open-source Go-based multi-cloud security framework that unifies reconnaissance, secrets discovery, and IAM analysis across AWS, Azure, and GCP. Aurelian evaluates resource policies using real IAM policy evaluation logic (not just flag checks), integrates with Titus for secrets scanning with live credential validation via API calls, and maps privilege escalation paths to Neo4j for Cypher-based querying of multi-hop attack chains.

Don’t expose yourself in public - let AWS error messages do it for you
Plerion’s Daniel Grzelak describes how AWS recently rolled out friendly IAM error messages that inadvertently created a simple oracle for detecting publicly exposed resources: assume a role with a deny-all session policy, make a request, and if the error says "explicit deny in a session policy," the resource policy would have allowed it, confirming public exposure.

💡 The contents of my friend Daniel's posts have great security advice, and the titles have good life advice.

Supply Chain

TeamPCP Supply Chain Campaign
Nice round-up landing page by Rami McCarthy.

TeamPCP Supply Chain Campaign: A March 2026 Retrospective
Great overview by OpenSourceMalware’s Jenn Gile on how TeamPCP executed a cascading multi-phase supply chain attack in March 2026, leveraging a single unrevoked credential stolen from Trivy's CI pipeline to compromise several ecosystems (Aqua Security, npm, LiteLLM/PyPI, Checkmarx, and Telnyx), harvesting CI/CD secrets at each stage to fund the next, while also deploying a geotargeted filesystem wiper against Iranian infrastructure.

💡 I met Jenn at the tl;dr sec community event before BSidesSF, she seems super sharp and nice 🙂 

Supply Chain Attack on Axios Pulls Malicious Dependency from npm
Socket describes a supply chain attack that compromised Axios, one of the most widely used HTTP clients in the JavaScript ecosystem (~100M weekly downloads), by injecting the malicious dependency plain-crypto-js@4.2.1, which was published minutes before the poisoned Axios releases. The release appeared outside the normal Axios workflow, only two malicious versions were published, and only one line was added to package.json (the malicious dependency)- small, targeted changes being less likely to raise suspicion.

💡 *Takes a long drag from my cigarette* Another day, another NPM compromise.

The Comforting Lie Of SHA Pinning
Aiden Vaines describes a subtlety of how GitHub scopes SHA hash references when you’re trying to pin a GitHub Action to a commit SHA. Basically, if you have a repo using the GitHub Action avaines/gh_action@<SHA> , and an attacker forks that action, adds malicious code, and submits a PR to the target repo that only changes the Action’s SHA reference, it will look like avaines/gh_action@<BAD_SHA> (same owner/repo name, only the SHA has changed, despite this version coming from a different GitHub user). “The result is that a pull request can replace a pinned, trusted action with attacker-controlled code without changing the apparent repository reference.”

Chainguard’s Billy Lynch wrote about this in 2023: What the fork? Imposter commits in GitHub Actions and CI/CD. Great write-up.

Securing the open source supply chain across GitHub
GitHub's Zachary Steindler discusses prevention steps you can take today, plus a look at the security capabilities GitHub is working on. He recommends enabling CodeQL to scan Actions workflows for security issues, avoiding pull_request_target triggers, pinning third-party Actions to full commit SHAs, and using OpenID Connect tokens with trusted publishing instead of secrets. GitHub scans all 30,000+ daily npm package publishes for malware and is accelerating their Actions security roadmap in response to attacks like Shai-Hulud, while working with OpenSSF to expand trusted publishing support across npm, PyPI, NuGet, RubyGems, and Crates.

What's coming to our GitHub Actions 2026 security roadmap
GitHub's Greg Ose describes their 2026 roadmap to secure GitHub Actions against supply chain attacks through: introducing workflow-level dependency locking (similar to Go's go.mod/go.sum) that pins all direct and transitive dependencies with commit SHAs (future: immutable releases), implementing policy-driven execution protections via rulesets that control who can trigger workflows and which events are allowed (with evaluate mode for safe rollout), and adding scoped secrets that bind credentials to specific repositories, branches, environments, or trusted reusable workflows.

GitHub is also building the Actions Data Stream for near real-time execution telemetry to S3/Azure Event Hub and a native Layer 7 egress firewall for GitHub-hosted runners that operates outside the runner VM with monitor and enforce modes, treating CI/CD infrastructure as critical infrastructure with enforceable network boundaries.

💡 These seem like excellent, thoughtful improvements. Love the push towards better visibility, security controls, and secure by default. Hats off to the GitHub team for these initiatives. Unfortunately the timeline is 3-6 months, though I’d rather them build it right than poorly.

Red Team

googleprojectzero/Jackalope
Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android. Built on TinyInst for binary instrumentation, supports both file and shared memory sample delivery.

On the Effectiveness of Mutational Grammar Fuzzing
Mutational grammar fuzzing is a type of fuzzing that uses a predefined grammar to describe the structure of the samples (e.g. input string or file) so that when a sample gets mutated, the resulting samples still adhere to the grammar rules. Google Project Zero’s Ivan Fratric describes two key flaws in mutational coverage-guided grammar fuzzing: 1) more coverage doesn’t mean more bugs, you need to test the right code patterns (e.g. functions need to be called in a certain order, or the result from one function is used as in input to another function), and 2) mutational fuzzing produces highly similar samples due to its greedy nature of saving slightly-modified samples that trigger new coverage.

To address these issues, Ivan proposes a technique in Jackalope where the fuzzing worker spends half of the time creating a fully independent corpus generated from scratch and half of the time working on a larger corpus that also incorporates interesting samples (as measured by the coverage) from previous workers.

It's More Than Saying No
Zoom’s Head of Assurance Andy Grant describes what to do when leadership asks your offensive security team to do work it was never designed for. Andy argues that offensive security teams lose effectiveness when they accept misaligned work like QA support, rushed pentests, or control validation, which disrupts the long exploration periods needed for discovering unknown unknowns through intuition-driven research.

Rather than saying no to requests, proactively engage with leadership to anticipate concerns, start investigating before formal requests arrive, and reframe incoming work to align with the team's adversarial research model, for example, reframing "can you test X before release?" into deeper investigations of trust boundaries and systemic risk.

AI + Security

[un]prompted 2026 YouTube Playlist
The talk recordings have (mostly) been published. 65 talks at the forefront of AI + security. The final 9 will be uploaded soon.

RSA 2026 Startup Landscape
Jake Epstein mapped every cybersecurity startup at RSAC 2026 (322 companies) into 18 categories, including Agent Security / Non Human Identity, developer security, AI SOC, AI pen testing, data pipelines, human risk, and more. Neat visualization.

VulnVibes: Building an AI Agent That Reasons Across Microservices to Find Real Vulnerabilities
Anshuman Bhartiya announces VulnVibes, an AI-powered agent that analyzes Pull Requests for vulnerabilities by reasoning across multiple repositories in an organization, which is useful in microservice architectures. It searches across your entire GitHub organization to understand your architecture, verify what security controls actually exist, and determine if a suspicious code change is a real vulnerability. VulnVibes works in two stages: first threat modeling the PR diff to identify security-relevant changes, then performing cross-repo investigation by reading infrastructure configs (Docker Compose, nginx), checking for security controls, and following vulnerability-specific investigation playbooks.

Anshuman walks through running VulnVibes against microvibes-lab (a test org with auth-service, doc-api, frontend-app, and infra-ops repos), in which it correctly identified an SSRF vulnerability by tracing the attack path across three repos to confirm a flat Docker network and lack of WAF protection, made a nuanced call that a permissive CORS config was a false positive after verifying the codebase only uses header-based auth, and appropriately ignored a safe JWT refactoring.

Misc

Claude Code source map leak

• Anthropic shipped a source map file in the Claude Code npm package, exposing the full unobfuscated TypeScript source (~1,900 files, 512K+ lines). It’s also suspiciously close to April Fools Day 🤔 Maybe it’s real though? (Thariq tweet)

• Claude Code Hidden Features - 89 feature flags, unreleased autonomous agents, companion pets, anti-distillation systems, and more — extracted from 1,809 source files.

• nblintao/awesome-claude-code-postleak-insights

• instructkr/claw-code - Someone took Claude Code leak, then used Codex to port the core features to Python from scratch, and then ported it to Rust.

• Theo’s video - I think he’s overly negative and I don’t agree with all his points, but it has some reasonable context.

Misc

• Dissecting the Bars While Rapping - Harry Mack dissects what he’s doing in his rap (structurally, setting up rhymes), while rapping about it. Insane 🤯 

• 404 Media - The company WebinarTV is secretly scanning the Internet for Zoom meeting links, recording the calls, and turning them into AI-generated podcasts for profit.

• Can it Resolve DOOM? Game Engine in 2,000 DNS Records - As DNS TXT records can store arbitrary text, Adam Rice was able compress and play DOOM from 1,966 TXT records on a single CloudFlare Pro DNS zone. 😂 

• Apple says no one using Lockdown Mode has been hacked with spyware in the four years since it’s been launched. This is impressive, and a great example of eliminating vulnerability classes/raising the security bar at scale 🤘 

• Matt Rife exposes Tik Tok shadow ban on standup comedy

• Gabor Mate to Hasan Minaj - Kids Speak Where It’s Safe 😭 

• Alex Hormozi - How to Win With AI in 2026

• Good Work - Why fun tech jobs went extinct

• 7 months underwater on a nuclear submarine - Fascinating!

Politics / Privacy

• Iran-linked hackers breach FBI director's personal email, publish photos and documents

• Iran built a vast camera network to control dissent. Israel turned it into a targeting tool - Allegedly Israel hijacked Iran’s street cameras in order to successfully track and target Iran’s supreme leader. “Experts say advances in AI have allowed militaries to overcome a critical hurdle in weaponizing hacked footage: sifting through huge amounts of video to identify people, vehicles, and other targets.”

• Using a VPN May Subject You to NSA Spying - Because VPNs obscure a user’s true location, and because intelligence agencies presume communications of unknown origin are foreign, that may give the NSA the authority to intercept the communication without a warrant.

• EU Disinfo Lab - Disinfo Update 12/11/2025 - I haven’t come across this lab before so I’m not sure about the trustworthiness, but it has some interesting links around topics including: the X algorithm amplifying right-wing and extreme content, Meta’s profits being tied to scam ads, Russia recruiting fighters from other companies, Israel paying US influencers to boost its image, AI chatbots repeating Russian propaganda, and more.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👨‍💼 I Will Survive

Phew, stay strong my friends, we’re almost through the BSidesSF and RSAC montage ✊ 

Too many to list them all, but some quick thoughts and moments that stuck out:

• Thank you to everyone who come to the inaugural tl;dr sec community meet-up! I had a blast 🥰 Also shout-out to Scott Behrens and Travis McPeak for joining me for a fireside chat.

• Anna Westelius gave an inspiring BSidesSF keynote about reasons for us security folks to be optimistic.

• It was fun joining my friends Ken Johnson, Seth Law, Kevin McDermott, and Astha Singhal on an Absolute AppSec panel at BSidesSF.

• Delicious KBBQ with a bunch of other security creator nerds, H/T Ashish and Shilpi of the Cloud Security Podcast for organizing!

• Huge thanks to Decibel’s Dan Nguyen-Huu and Jon Sakoda for hosting an awesome set of lightning talks, which my bud Daniel Miessler also helped organize. Great talks from Rob Ragan, Jackie Bow, Andrew Becherer, and Sydney Marrone!

  • Dave Aitel choosing the Imperial March from Star Wars as his intro music was delightful 😂 

• Randomly meeting former NSA Director Rob Joyce! H/T Lina Lau, whose company is working on some impactful stuff 👀 

• Hearing from folks who were moved by my talk last BSidesSF about vulnerability 🥹 This had the biggest impact on me.

Security creator friends!

Sponsor

📣 AI is Expanding Your Attack Surface.
Can You Secure It?

AI adoption is accelerating across cloud environments, from LLMs to autonomous agents and complex data pipelines. But without dedicated AI security posture management (AI-SPM), these innovations introduce a new class of risks that traditional tools can’t address.

From exposed training data to overprivileged AI agents, the attack surface is expanding faster than security teams can keep up.

Download the guide to learn a five-step framework to gain visibility, assess risk and secure AI across your cloud environment.

👉 Download guide 👈

AppSec

ChiChou/vscode-frida
A VSCode extension providing comprehensive IDE for Frida dynamic instrumentation, featuring a sidebar for listing apps/processes on local/USB/remote devices, interactive panels for browsing modules/exports and classes/methods (Java/Objective-C), and one-click hook generation for native functions, ObjC selectors, and Java methods.

How "Strengthening Crypto" Broke Authentication: FreshRSS and bcrypt's 72-Byte Limit
Pentester Lab's Louis Nyffenegger analyzes CVE-2025-68402, an authentication bypass in the development branch of FreshRSS a self-hosted RSS aggregator, caused by a "strengthen crypto" commit that replaced SHA-1 (40 chars) with SHA-256 (64 chars) for nonce generation. The longer nonce, when concatenated with the bcrypt hash before verification, pushed the password-dependent portion of the hash beyond bcrypt's 72-byte truncation limit, meaning password_verify() only checked the nonce plus the algorithm identifier ($2y$10$) and one salt character, none of which depend on the actual password.

"A commit meant to strengthen the crypto ended up removing the need for a valid password." 😱 

Sponsor

📊 Cside Report: The Future of Web Security Depends on the Browser

The browser runtime sits between your website < > customers, bots, AI agents, and fraudsters. No one is watching it. And agents now access websites on behalf of humans, adding the risk of consumer agents being manipulated by script injections from third-party code. Grab this report to see data on: the new threat of locally hosted stealth browsers, a 15x rise in user-action AI agents, 275% increase on discussions of bot traffic, and results of an industry survey on how practitioners are preparing against AI-agent driven website fraud.

👉 Get the Report from Cside 👈

I could definitely see the bar rising for preventing AI-agent driven fraud or bot abuse given improvements in AI + browser use. I’m curious how the secure this new world.

Cloud Security

Quicklinks

• Federal cyber experts called Microsoft’s cloud a “pile of s#!t,” approved it anyway - Deep dive by ProPublica

• AI Remediation Developers Will Actually Use - Every vulnerability tool tells you what's wrong. No one tells you how to actually fix it. Rebuild the image, bump a dependency, or apply a mitigation? The right answer depends on how it's built. Maze AI agents understand your environment and deliver the fix your team would actually use.*

  • This is a nice post on the nuances and challenges of auto-fixing.

• dan-v/cloudshell-store - A distributed file store built on AWS CloudShell's free persistent storage. Chicanery of the highest order 🫡 

^*Sponsored

IAMTrail
AWS silently updates Managed IAM policies all the time. This project by Victor Grenu tracks the full version history and diffs for 1525 AWS Managed IAM Policies, archived since 2019.

Pwning AI Code Interpreters in AWS Bedrock AgentCore
Friend of the newsletter BeyondTrust’s Kinnaird McQuade discovered that the AWS Bedrock AgentCore Interpreter’s Sandbox network mode (“complete isolation with no external access”) does allow public DNS queries. The post walks through using that capability to establish bidirectional communication (command and control, C2) using a custom tunneling protocol via DNS queries and responses, obtain a full interactive reverse shell, exfiltrating data, and performing command execution with the Code Interpreter’s IAM role. GitHub PoC.

Result: "AWS communicated that a fix will not be made and it will change the documentation’s description of sandbox mode instead. AWS awarded the security researcher with a $100 gift card to the AWS Gear Shop." 😂

Inside AWS Security Agent: A multi-agent architecture for automated penetration testing
AWS’ Tamer Alkhouli, Divya Bhargavi, Daniele Bonadiman et al describe how AWS Security Agent works and how they benchmarked it. With CTF instructions and grader checks after each tool call it achieved 92.5% on CVE Bench v2.0, 80% without CTF instructions or grader feedback (more like real-world conditions), and 65% using an LLM whose knowledge cutoff date predates CVE Bench v1.0 release.

See also Sena Yakut’s blog overview on setting up AWS Security Agent and scanning DVWA.

💡 This post actually had a pretty good amount of details and context, nice. I also found it interesting how performance dropped when using an LLM with knowledge cutoff before the CVE Bench release- is it doing better due to “memorizing” the answers or is it just a worse model because it’s older? 🤔 

Pentesting a pentest agent - Here's what I've found in AWS Security Agent
Richard Fan discovered five security vulnerabilities in AWS Security Agent, an autonomous AI pentesting tool, and discusses four of them (the 5th isn’t fixed yet).

1. The DNS confusion bug allowed attackers to manipulate Route53 private hosted zones to trick the agent into pentesting public domains they don't own by exploiting the "Unreachable" domain status and DNS record verification timing.

2. Richard was able to trick the agent into hacking itself, obtaining a reverse shell with root access to the agent sandbox by injecting commands into debug messages, and escaping the container through the mounted /run/docker.sock to access the host EC2 instance and its IAM role credentials.

3. He found the agent sometimes performs unnecessarily destructive actions like using DROP TABLE for SQL injection probes.

4. The agent can expose unredacted passwords in pentest reports.

Supply Chain

Quicklinks

• I’ve been doing BSidesSF/RSA stuff non-stop so I haven’t had time to fully get the lay of the land but it seems like a few things have been on fire. I wonder if the threat actors chose this week due to thinking defenders might be busy at conferences 🤔 Rude!

• Trivy Compromised - By Wiz’s Rami McCarthy

• TeamPCP Compromises LiteLLM: Credential Stealer in PyPI, 70 Repos Exposed - I love how this post by Boost Security's François Proulx emphasizes the collaborative nature of the folks working to detect and respond to these supply chain attacks. More from Semgrep and Datadog.

• HackingLZ/litellm_1.82.8_payload - Defanged malware stages from the litellm 1.82.8 PyPI supply chain compromise — credential stealer, K8s lateral movement, C2 backdoor.

Agent Skills are the New Packages of AI: It's Time to Manage Them Securely
JFrog’s Yonatan Arbel announces their Agent Skills Registry product. Yonatan argues that we should be treating Skills like open source dependencies: version tracking them, scanning them for malicious contents, tracking provenance, etc.

💡Something like this makes a lot of sense to me. We should be taking all of the lessons we’ve learned over time from various package registries and language ecosystems and ideally building them in from the beginning with new things like Skills.

Blue Team

mandiant/speakeasy
By Mandiant: A Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled Windows runtime instead of a full VM. It emulates APIs, process/thread behavior, filesystem, registry, and network activity so samples can keep moving through realistic execution paths.

FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops
Ctrl-Alt-Intel discovered an exposed open-directory on a FancyBear (APT28/GRU) C2 server that revealed the group's complete toolkit, telemetry logs, and exfiltrated data from a 500+ day espionage campaign targeting government and military entities across Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. The exposed server contained 2,800+ exfiltrated emails, 240+ credential sets with TOTP 2FA secrets, and more.

“FancyBear developed a modular, multi-platform exploitation toolkit where a victim simply opening a malicious email - with no further clicks - could result in their credentials stolen, their 2FA bypassed, emails within their mailbox exfiltrated, and a silent forwarding rule established that persists indefinitely.”

Red Team

Islands of Invariance
Rasta Mouse (maybe Rasta Mouse on X, Daniel Duggan?) describes how Crystal Palace now includes an automatic YARA generator that creates signatures based on "islands of invariance" (predictable, unchanged code patterns after optimization).

A scalpel, a hammer, and a foot gun
Raphael Mudge has released ised, a program rewriting tool for Crystal Palace that surgically inserts or replaces code at instruction pattern matches to break content signatures. The tool uses a two-pass implementation with prepend/append/replace buckets and supports specific/generic/mnemonic pattern matching from Crystal Palace's disassembler output.

"A potential outcome is that researchers building tools on this platform may feel quite comfortable releasing Yara rules for all of their capability. It’s no loss, because they and their users would likely have a private ised-cocktail ready to go. What would change in red teaming (or cybersecurity even), if there was no fear of ‘burning a tool’ because of its content tells and behavior was the only meaningful battleground?"

ghostvectoracademy/DLLHijackHunter
By GhostVector Academy: An automated Windows DLL hijacking detection tool that discovers, validates, and confirms exploitable DLL hijack opportunities through a four-phase pipeline: discovery (enumerates binaries across services, scheduled tasks, startup items, COM objects, and AutoElevate UAC bypass vectors), filtration (eliminates false positives through hard and soft gates), canary confirmation (deploys a harmless canary DLL and triggers the binary to prove the hijack works), and scoring (0-100% confidence plus 0-10 impact score based on privilege gained, trigger reliability, and stealth).

AI + Security

NVIDIA/NemoClaw
An open source referencer stack that simplifies running OpenClaw agents inside NVIDIA OpenShell sandboxes with multi-layer security controls including Landlock, seccomp, network namespaces, and policy-enforced egress filtering. More below.

NVIDIA/OpenShell
OpenShell provides a sandboxed execution environment for AI agents that enforces declarative YAML policies to prevent unauthorized file access, data exfiltration, and uncontrolled network activity. The system runs as a K3s cluster inside a single Docker container and applies defense-in-depth across four policy domains: filesystem (read/write restrictions), network (outbound connection control with HTTP method and path-level enforcement), process (privilege escalation blocking), and inference (model API call routing).

OpenShell supports Claude, OpenCode, Codex, OpenClaw, and Ollama agents out of the box and manages credentials as injectable providers that never touch the sandbox filesystem. Security policies are hot-reloadable at runtime for network and inference layers, while filesystem and process restrictions are locked at sandbox creation

IronCurtain: A Personal AI Assistant Built Secure from the Ground Up
Security legend Niels Provos asked himself: How would you build a personal AI assistant if you took security seriously from the start? So he built IronCurtain, which sandboxes LLM-generated code, enforces policy in plain English, and keeps credentials out of the agent's reach.

IronCurtain funnels all actions through a single MCP proxy chokepoint where a policy engine enforces rules written in plain English and compiled to deterministic policies. The system supports two sandbox modes: Code Mode runs LLM-generated TypeScript in isolated V8 with no filesystem/network access, while Docker Mode runs full agents like Claude Code CLI in containers with --network=none where a MITM proxy swaps fake API keys for real ones to maintain credential separation.

The plain-English constitution approach (inspired by Microsoft Research's LEGALEASE) lets users write policies like "agent may read/write files in project directory but must ask before git push" which compile to deterministic allow/deny/escalate rules, with an optional auto-approver that recognizes explicit user intent to reduce alert fatigue.

💡 Really thoughtful, great read. I love the architecture of making sure there’s a single security enforcement point, and how you can ease the burden of writing complex enforcement policies via natural language (but that are still enforced deterministically).

Misc

Feels

• Hugh Grant: "It's been very, very depressing watching Big Tech kidnap their lives, and to see children really finding it very, very difficult to get properly interested in anything that isn't a screen."

• Matthew Hussey - Why Men Don't Open Up These Days...

• HealthyGamerGG - Why Sharing Your Feelings Can Kill Your Relationship 

• Kevin James on Finding Love Later in Life

• Ethan Hawke - The one who’s in love always wins

Misc

• How an unappetizing shrub became dozens of different vegetables - Centuries of selective breeding turned a single wild weed into everything from broccoli to Brussels sprouts. Whoa 🤯 

• Turns out all your Pokémon Go data will be used to train robots - Niantic is using location data collected from Pokémon Go and Ingress players to train Coco Robotics' urban delivery robots.

• rexrodeo/american-healthcare-conundrum - Investigative data journalism: quantifying fixable waste in US healthcare, one issue at a time. Open-source analysis of CMS, OECD, and federal datasets. $98.6B in savings identified so far.

• Zelensky: Russia providing Iran with Shahed drones used against US bases

• How the Turner Twins Are Mythbusting Modern Gear - The twins are A/B testing modern gear by having one dress in cutting-edge technical apparel and the other in 100-year-old heritage kit on the world’s toughest expeditions.

• False claims in a widely-cited paper. No corrections. No consequences. Welcome to the Business School.

• "One Day More," except Waluigi is every part 😂 😂 

• America’s Got Talent - A magician instantly changing her outfit like 8 times

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

👩‍💻 Brace Yourself, Conferences Cometh

I’m excited for BSidesSF and RSA but phew, things have been busy 😅

If you’re flying in to San Francisco, safe travels! And remember to periodically eat, sleep, and shower amidst all the fun conference and event activities.

• Friday - tl;dr sec Community Kickoff.

  • Mostly filling up, but DM me and I’ll try get you in.

• Saturday - I’m joining my friends on an Absolute AppSec panel, and will be at BSidesSF both days!

• Wednesday - Coding Agents Unleashed hosted by TL;DR Sec & Unsupervised Learning - There’s going to be some 🔥 lightning talks from smart folks. Broader Decibel registration link here.

Semgrep is also having a ton of events. If you need a break from the RSA craziness you can stop by the office, get some coffee, snacks, or lunch, and chat with some Semgrep folks if you want.

If you find me I’ll have some tl;dr sec t-shirts and brand new stickers…

Hard to tell from the photo but it’s holographic

Sponsor

📣 Cybercrime Just Hit Escape Velocity
(Here’s the Evidence)

Flashpoint just released its 2026 Global Threat Intelligence Report, and the data is shocking.

• AI-related illicit activity surged 1,500% in a single month

• 3.3B compromised credentials are now fueling identity-based attacks

• Ransomware incidents increased 53% as groups pivot toward pure-play extortion

The report also explores how threat actors are moving from generative tools to agentic AI frameworks that can automate attacks at scale.

👉 View the Report 👈

AppSec

Quicklinks

• Applying Security Engineering to Make Phishing Harder - Lessons learned by Doyensec from testing a “Communication Platform as a Service.”

• Corridor Raises $25M Series A to Secure AI Coding at the Source - Corridor is tackling a problem many Security and Engineering Teams are starting to feel big time - code being generated faster than traditional AppSec can secure it. Corridor’s approach embeds security directly into AI coding workflows. Backed by some of the smartest investors in AI and AppSec. tl;dr sec readers get 3 months free!*

  • Corridor has been able to pull some security OGs, like Alex Stamos and Joel Wallenstrom. I’m excited to see what they’re building 🤘 

• Martino Spagnuolo - The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting

^*Sponsored

Introducing Swagger Jacker: Auditing OpenAPI Definition Files
Bishop Fox’s Tony West announces Swagger Jacker, a command line tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files. It parses the definition file for paths, parameters, and accepted methods and passes the results to one of five subcommands: automate (sends requests and analyzes response status codes), prepare (generates curl/sqlmap command templates for manual testing), endpoints (lists raw API routes), brute (discovers hidden definition files using 2173+ common paths), and convert (converts v2 to v3 definitions).

mitmproxy for fun and profit: Interception and Analysis of Application
Guide by Synacktiv's Corentin Liaud on using mitmproxy for network traffic interception across Linux, Android, and iOS, including three examples: redirecting git clone requests to download a different repository by modifying HTTP paths, spoofing Android geolocation by parsing and altering gRPC/protobuf coordinates sent to Google's geomobileservices API, and passively capturing Mumble VoIP chat messages by running mitmproxy in reverse TLS mode with custom protobuf parsing scripts.

The post describes setting up your test environment (using Linux network namespaces, lnxrouter for WiFi AP creation, and nftables for transparent traffic redirection), using Magisk's Cert-Fixer module to install system certificates on Android, and includes Python scripts showing how to parse and modify protocol buffers in transit.

Sponsor

📣 Your SOC is a queueing system.
The math matters more than you think.

If you've ever looked at utilization curves, you know what happens when a queue runs hot: wait time doesn't scale linearly. It spikes. In a SOC, that means alerts aging out before anyone touches them.

"The Queue is the Breach" ebook from Prophet Security applies operational math to SOC performance: alert cycle time, wait time by severity, and what analyst utilization actually implies about your team's capacity. It's a framework for diagnosing whether your bottleneck is people, tooling, or the operating model.

Written by Jon Hencinski, Head of Security Operations at Prophet.

👉 Download the eBook 👈

Nice, I like when people take a data-driven approach to security 👍️ 

Cloud Security

Twenty Years of Cloud Security Research
Cloud historian, scholar, and man of the people Scott Piper traces 20 years of cloud security evolution through three distinct eras: the Foundational era (2006-2016) when AWS built core security features like IAM (2011), CloudTrail (2013), and Organizations (2016); the CSPM era (2016-2021) marked by open-source tools like Scout2, Cloud Custodian, Prowler, CloudMapper, Pacu, and StreamAlert; and the CNAPP era (2021-2025) with new cloud security vendors and researchers discovering cross-tenant vulnerabilities like chaosdb and omigod. The emerging AI era (2025+) is fundamentally changing both offense and defense, with AI creating exploits for CVE-2025-32433 and mongobleed in minutes, winning HackerOne's top bounty spot, and solving CTF challenges instantly.

💡 Great overview of relevant research and tools, and nice perspective on how cloud security has been evolving over time.

Bucketsquatting is (Finally) Dead
Ian McKay describes AWS's new S3 bucket namespace protection that prevents bucketsquatting attacks by requiring buckets to follow the format <prefix>-<accountid>-<region>-an, ensuring only the owning account can create buckets matching that pattern. AWS recommends this namespace be used by default for all new buckets and provides a new condition key s3:x-amz-bucket-namespace that security administrators can enforce via SCP policies across their organization.

Google Cloud Storage addresses this differently through domain name verification for bucket names, while Azure Blob Storage remains vulnerable due to its configurable account/container name structure and 24-character limit on storage account names.

See AWS Finally Gave S3 Buckets Their Own Rooms for more context on the issue and an overview of relevant prior research by Aqua.

Supply Chain

Building Bridges, Breaking Pipelines: Introducing Trajan
Praetorian's AJ Hammond, Carter Ross, Evan Leleux et al announce Trajan, an open-source CI/CD security tool from Praetorian that unifies vulnerability detection and attack validation across GitHub Actions, GitLab CI, Azure DevOps, and Jenkins in a single cross-platform engine. It ships with 32 detection plugins and 24 attack plugins covering poisoned pipeline execution, secrets exposure, self-hosted runner risks, and AI/LLM pipeline vulnerabilities.

When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos
Datadog’s Christoph Hamsen, Christophe Tafani-Dereeper, and Kylian Serrania describe how their LLM-powered code review system BewAIre detected and helped mitigate attacks from hackerbot-claw, an AI agent that attempted to exploit GitHub Actions workflows across their open source repositories. The attacker successfully achieved code execution in one workflow via command injection in filenames, but defense-in-depth controls (organization-wide GitHub rulesets preventing direct pushes to main branches, restricted GITHUB_TOKEN permissions, and no sensitive secrets exposure) limited impact to only pushing a harmless commit to a non-protected branch.

💡 Nice walk through of noticing your open source repos are being targeted → investigating potential impact, and solid advice on hardening open source repos/GitHub Actions. Also, I really like the bullets towards the top on Datadog’s SDLC Security team initiatives re: adapting octo-sts, removing GitHub Action secrets at scale, enforcing CI security best practices, and building golden paths.

Blue Team

elastic/agent-skills
Elastic’s official Skills repos, covering cloud, Elasticsearch, Kibana, observability, and security. Currently includes 4 security Skills for: triaging alerts, case management (managing SOC cases via Kibana Cases when tracking incidents), detection rule management (create, tune, and manage Elastic Security detection rules), and generating sample security data (security events, attack scenarios, and synthetic alerts).

Building a Cloud-Native Detection Engineering Lab with Terraform and AWS
Rafael Martinez describes building a fully automated detection engineering lab (GitHub) in AWS using Terraform to overcome local hardware limitations, deploying three EC2 instances: Kali Linux (attacker), Windows Server with Sysmon and Winlogbeat (target), and Ubuntu running Elasticsearch and Kibana (SIEM). Easy to spin up and down as needed.

Pattern Detection and Correlation in JSON Logs
Mostafa Moradian announces RSigma, a Rust-based command-line tool that evaluates Sigma detection rules against JSON logs without requiring a SIEM. “Think of RSigma as jq for threat detection: you point it at a set of Sigma detection rules and a stream of JSON events, and it tells you what matched, with no ingestion pipeline, no database, no infrastructure.”

RSigma parses YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them directly against JSON log events in real-time. The toolkit includes rsigma-parser for parsing, rsigma-eval for compilation and evaluation with stateful correlation logic and compressed event storage, a CLI for parsing, validating, linting, and evaluating rules, and rsigma-lsp for IDE support.

Red Team

nikaiw/VMkatz
Extract Windows credentials directly from VM memory snapshots and virtual disks. A single static 2.5MB binary that can extract NTLM hashes, DPAPI master keys, Kerberos tickets, cached domain credentials, LSA secrets, NTDS.dit, directly from VM memory snapshots and virtual disks, no need to exfiltrate a massive VM file.

Solving the Vendor Dependency Problem in RE
Many enterprise applications ship with hundreds to thousands of vendor dependencies, which makes it annoying to locate and analyze the proprietary source code of the application. You drown in vendor code, not the exposed attack surface. Assetnote’s Patrik Grobshäuser announces the release of Hyoketsu, an open-source tool that automatically filters vendor dependencies from Java JARs and .NET DLLs during reverse engineering by using Microsoft runtime detection (via PE header public key tokens), hash matching, and filename matching against a 13.3 GB pre-built SQLite database containing 12M+ DLLs and 14M+ JARs.

AI + Security

p-e-w/heretic
By Philipp Emanuel Weidmann: Fully automatic censorship removal for language models. Heretic removes censorship (aka "safety alignment") from transformer-based language models without expensive post-training by combining an advanced implementation of directional ablation, also known as "abliteration.” This approach creates a decensored model that retains as much of the original model's intelligence as possible.

elder-plinius/OBLITERATUS
By Pliny the Liberator: An open-source toolkit for removing refusal behaviors from LLMs via abliteration (surgically identifying and projecting out internal refusal representations without retraining). Every obliteration run with telemetry enabled contributes anonymous benchmark data to a crowd-sourced research dataset measuring refusal direction universality across 116+ models and 5 compute tiers

Blog overview: OBLITERATUS Strips AI Safety From Open Models in Minutes, and pretty detailed Hugging Face guest post by Maxime Labonne on abliteration here, including code on Google Colab and in an LLM course on GitHub.

💡 As open source models become better and better, not sure how I feel about removing “don’t cause harm” alignment training 😅 

Why Codex Security Doesn’t Include a SAST Report
OpenAI describes why Codex Security doesn’t start by triaging SAST results, but instead starts with understanding the repository’s architecture and trust boundaries: they don’t want to overly influence where Codex looks, not all bugs are dataflow problems, and sometimes code appears to enforce a security check, but it doesn’t actually guarantee the property the system relies on.

When Codex Security encounters a boundary that looks like “validation” or “sanitization,” it tries to bypass it:

• Reading the relevant code path with full repository context, looking for mismatches between intent and implementation.

• Pulling out security-relevant code slices and writing micro-fuzzers for them.

• They give the model access to a Python environment with z3-solver for solving complicated input constraint problems.

• Executing hypotheses in a sandboxed validation environment to prove exploitability.

💡 The post is overall a good discussion of the space and outlines challenges for security scanners. I especially liked though the “how Codex validates” section, because it starts getting into some of Codex Security’s unique technical details.

Securing our codebase with autonomous agents
Travis McPeak describes how Cursor built four security automation templates using Cursor Automations and a custom security MCP tool to handle securing their code at scale, as Cursor’s PR velocity has increased 5x in the past 9 months. The automations include: Agentic Security Review (blocks PRs with security issues), Vuln Hunter (scans existing code for vulnerabilities), Anybump (automatically patches dependencies using reachability analysis and opens PRs after tests pass), and Invariant Sentinel (monitors daily for drift against security/compliance properties). You can see their prompts on their marketplace pages.

Their security MCP, deployed as a serverless Lambda function, provides persistent data storage, deduplication of LLM-generated findings using Gemini Flash 2.5, and consistent Slack reporting across all agents. In the last two months, Agentic Security Review alone has run on thousands of PRs and prevented hundreds of security issues from reaching production.

💡 I like the focus on useful primitives that empower you to build security tooling on top of: “For agents to be useful for security, they need: out-of-the-box integrations for receiving webhooks, responding to GitHub pull requests, and monitoring codebase changes, and a rich agent harness and environment (cloud agents give them all the tools, skills, and observability that cloud agents have access to).

I also wanted to call out the Invariant Sentinel, that’s very clever: what security properties about this repo should always be true? Did this most recent change violate that? I bet detecting drift like this catches some meaningful bugs.

We proactively fixed ~100 security issues in 6 days with 0 humans
Eli Block describes how Ramp Security Engineering built a custom agent pipeline that autonomously found, validated, and fixed ~100 novel security issues in 6 days. Their pipeline starts off with a coordinator agent equipped with skills for each vulnerability category (e.g. IDOR, XSS, …), which launches detector agents in parallel, whose findings are then passed to an adversarial manager agent who checks for false positives (~40% false positive reduction in their sample set of testing).

They found it was difficult to reproduce vulnerabilities with complex pre-conditions against a live Ramp deployment, so instead their validator agent takes reported findings and writes an integration test that reproduced the vulnerability that passes only if the endpoint was secure. Then the fixer agent can patch the vulnerability by following test-driven development on the previously written integration test.

💡 Great write-up! Overall this agent pipeline follows a pretty standard structure (per bug class detectors → vet findings → try to reproduce / “prove” the issue → generate fix), but a few things stand out as unique and valuable insights:

1. Detectors include real examples of that vulnerability from Ramp’s code base. I bet this allows the detectors to be much more precise and effective.

2. Rather than trying to reproduce vulnerabilities in a live environment, they write integration tests that demonstrate the bug. As there are probably already test fixtures or other examples in the code the agent can borrow from, it makes sense that this method would often work in practice. This approach also has the added benefit that you now have a regression test for this bug coming back in the future.

   1. So this leans into what models are good at (writing code) and future proofs the bug from coming back 👍️ 

   2. I’ve been thinking about this approach for a bit now so it’s gratifying to see someone do it 🙂 

Misc

Tech

• vercel-labs/portless - Replace port numbers with stable, named .localhost URLs for local development.

• peakoss/anti-slop - A GitHub action that detects and automatically closes low-quality and AI slop PRs.

• Meta created ‘playbook’ to fend off pressure to crack down on scammers, documents show

• Resist and Unsubscribe - Scott Galloway’s initiative to influence politics by voting with your wallet.

• Andrej Karpathy - US Job Market Visualizer

• The most important question nobody's asking about AI - Why Dwarkesh Patel is happy the Anthropic fight is happening now.

• Startup's agent hacked McKinsey AI - exposing huge volumes of sensitive data - $20 in tokens and two hours to expose 46 million chat logs, 728,000 private files and proprietary RAG documentation. HN discussion.

• Undercover Cop Generated An AI Teenager To Catch Pedophiles - Apparently AI has “been a boon for child abuse investigators,” as when asked for selfies they don’t need to use real images.

  • Related: In 2018, Microsoft volunteers worked with nonprofit Street Grace to create an AI chatbot that interacts with people who click on decoy advertisements on trafficking sites.

Misc

• Ed Sheeran on Friends Keep Secrets - Quickly creating a song from scratch with Benny Blanco. Wow, super cool 😍 

• Kai Lentit - Shipping a button in 2026… 😂 

• This infinite drawing canvas is insane

Politics

• Foreign hacker in 2023 compromised Epstein files FBI held - “The hacker expressed disgust at the presence of child abuse images on the device and left a message threatening to turn its owner over to the FBI. Bureau officials defused the situation by convincing the hacker that they actually were the FBI.” 😂 

• Putin can’t survive without war - The article argues that Russia's war in Ukraine has transformed the country into a "necropolis" where death has become central to its economy, culture, and social fabric. The war sustains a "deathonomics" model where provincial economies depend on recruitment bonuses and death payments (sometimes reaching $60,000). 40% of state spending now flows to military efforts. Really tough read on the impact on every day Russians :(

• Trump in November 2011: “Our president (Obama) will start a war with Iran because he has absolutely no ability to negotiate… The only way he figures he’s going to get reelected is to start a war with Iran.”

• NBC - How Trump decided to strike Iran - “Before the U.S. and Israel launched their aerial assault, the CIA concluded that if the supreme leader, Ayatollah Ali Khamenei, was killed, he could be replaced by equally hard-line officials from within the regime, according to two people familiar with the matter.”

  • “Treasury Secretary Scott Bessent told Congress last month that the U.S. had purposely touched off an economic crisis in Iran that led to the massive street protests early this year that jarred the regime. By creating a dollar shortage in Iran, the U.S. forced Iran to print money, sparking inflation and stoking internal enmity toward the leadership, Bessent said.”

  • “…Trump flew to Mar-a-Lago, where he monitored the strike in the company of senior advisers, as he has done for several foreign strikes this term. He also made time Saturday to attend a political fundraising event at his seaside resort.”

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🌉 BSidesSF and RSA

As the gentle blooming of flowers announces spring, and piles of orange leaves welcome fall, so too does the torrential downpour of security vendor emails and LinkedIn DMs “just touching base” herald the arrival of… RSA!

It’d be great to cross paths if you’re in town. Here’s what I’m up to:

Pre-BSidesSF - Friday March 20th - tl;dr sec Community Kickoff. tl;dr sec’s first community event 😍 I’m excited about it, there’s going to be cool people, I’ve artisanally curated local SF food options, and we’ll have a fireside chat about AI and security builders.

We’ll also have tl;dr sec t-shirts and a totally new, never before seen sticker…

If you can’t make it, you can try to get a t-shirt or stickers by a) finding me or b) Semgrep at another event.

BSidesSF - I’m joining my friends on an Absolute AppSec panel, and will generally be around.

Also check out talks by my colleagues Claudio and Romain on scaling SAST rule writing with AI, Katie Paxton-Fear (InsiderPhD) in a birds of a feather discussion on AI, or Brandon Wu on how to combine AI and static analysis to process CVEs at scale.

RSA - I’m organizing a mini con / lightning talks (Unsupervised + Unhinged) with Daniel Miessler and Decibel. Wed March 25 10am - noon. You can register for their overall program here. More info coming soon!

Also, I’ve made it ma, my name is on an announcement graphic alongside The Chainsmokers 😂 😂 

Sponsor

📣 Securing AI Agents 101

AI agents are changing how work gets done. They take on tasks, orchestrate tools, and drive outcomes across environments. 

Securing AI Agents 101 is a one-page resource to help teams build a clear understanding of what AI agents are, how they operate, and where key security considerations show up.

Inside, you’ll find:

• What makes an AI agent different from traditional tools

• Top risks to watch, from shadow AI to excessive permissions

• Four key questions to assess agent usage and exposure

Download the security flashcard and get up to speed quickly.

👉 Get the Flashcard 👈

AppSec

1Password/load-secrets-action
Load secrets from 1Password into your GitHub Actions jobs using Service Accounts or 1Password Connect.

Please, please, please stop using passkeys for encrypting user data
Tim Cappalli warns companies against using WebAuthn's PRF (Pseudo-Random Function) extension to derive encryption keys for user data, because it couples authentication credentials with data encryption in ways users don't understand. When users delete a passkey from credential managers like Apple Passwords, Google Password Manager, or Bitwarden, they receive no warning that they're permanently destroying access to encrypted photos, message backups, documents, crypto wallets, or other critical data.

Superuser Gateway: Guardrails for Privileged Command Execution
Uber’s Pavi Subenderan and Jyoti Grewal describe Superuser Gateway, a system built to replace direct superuser CLI access with a peer-reviewed, auditable workflow for dangerous operations on production systems (e.g. Google Cloud Storage, OCI, and HDFS). Engineers now submit commands via superuser-cli, which generates a PR in a Git repository where automated CI jobs perform syntax validation, permission checks, and impact estimation (like calculating files affected by rm -r), before a peer approves and a backend service executes the command remotely. This architecture removes superuser credentials from individual engineers' machines entirely, ensuring all privileged operations flow through mandatory peer review while maintaining operational velocity for on-call scenarios.

Sponsor

🚨 Most Confident Organizations Have 2x Higher AI Incident Rates 🚨

Counterintuitive finding from 205 security leaders: organizations most confident in their AI deployments experienced 2x the incident rate of less confident peers. Meanwhile, 43% report AI making infrastructure changes monthly without oversight, and 7% don't even track autonomous changes at all.

👉 See the Confidence Gap Data 👈

Hm I’m curious about (the lack of) tracking autonomous changes. Also “3 in 5 orgs have had or suspect an AI-related incident.” 🤔 Identity is still key.

Cloud Security

Untangling Microsoft Graph's $batch requests in Burp
Requests to Microsoft Graph’s $batch endpoint bundle several API calls into one JSON object, which makes analyzing Azure Portal traffic difficult, since underlying API calls for requests to the $batch endpoint are not individually logged. Katie Knowles has released the graph_batch_parser.py Burp Suite extension to speed up analysis of $batch requests. The extension processes $batch requests into a set of synthetic request/response pairs that can then be reviewed in the “Graph Batch” tab, as well as Burp’s Site Map.

Stop Enabling Every AWS Security Service
Sena Yakut argues against enabling every AWS security service at once, advocating instead for a risk-based approach that starts with threat modeling your architecture (what are the risks we need to control for?), understanding team behaviors (who has admin privileges? Are there shared accounts or credentials?), and identifying critical breaking points (where small mistakes can cause major damage) before selecting controls. Avoid service overlap with existing third-party tools (like SIEMs) so you’re not overwhelmed by alerts, and evaluate usage-based pricing- based on your environment, certain managed services might not fit within your budget, but building custom automations with Lambda and EventBridge can fulfill a similar purpose. Use AWS SSO (IAM Identity Center) over individual IAM users.

Blue Team

MatheuZSecurity/ksentinel
By MatheuZ: A Linux kernel module that monitors syscall table integrity and critical kernel functions to detect rootkit modifications like ftrace hooks, kprobes, and syscall table hijacking.

Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
Google's Google Threat Intelligence Group (GTIG) discovered the "Coruna" iOS exploit kit containing five full exploit chains and 23 exploits targeting iOS 13.0 through 17.2.1, initially used by a surveillance vendor customer, then by Russian espionage group UNC6353 in watering hole attacks against Ukrainian users, and finally by Chinese financially-motivated actor UNC6691 in broad campaigns.

Additional technical analysis and IOCs by iVerify in their write-up here.

Advanced maturity adds atomic high-fidelity detections and risk-based custom rules, while Leading maturity incorporates data science-backed outlier detection (using platforms like Databricks or Dataiku) and deception techniques like honeytokens. Scott recommends reducing reliance on unmeasurable closed-source analytics by lowering their risk scores in the correlation engine while building validated custom detections that adversaries can't test against.

Red Team

0xbbuddha/notion
A Mythic C2 profile that uses Notion as a covert communication channel. Agents communicate by reading/writing pages in a shared Notion database, making C2 traffic indistinguishable from normal SaaS usage — a Living off Trusted Sites (LoTS) technique.

vulhunt-re/vulhunt
BINARLY released VulHunt Community Edition, an open-source vulnerability hunting framework for analyzing software binaries and UEFI firmware, built on their Binary Analysis and Inspection System (BIAS).

See also their community-contributed rules repo (currently only 3 rules) and Skills repo, which contains skills for decompiling functions, finding functions or call sites, performing data flow analysis, searching code/byte patterns, etc. powered by VulHunt MCP tools.

💡 Also congrats to my friend Gwen Castro who recently became CEO of BINARLY 🥳 

AI + Security

Quicklinks

• RankClaw - Web app to scan AI skills for security risks before you install them.

• Securing AI Agents in the Enterprise: 5 Use Cases - AI agents are now in enterprise environments; running workflows, accessing data, and interacting with other services through roles, tokens, and service accounts. This guide breaks down 5 use cases teams must solve to safely deploy agents across cloud and SaaS environments.*

• The looming AI clownpocalypse - “What happens when we reach the tipping point where exploits become cheaper to autonomously develop than they yield on average?”

^*Sponsored

Cybersecurity’s Need for Speed & Where To Find It
Phil Venables applies Stewart Brand's Pace Layers framework to cybersecurity, arguing that organizations must accelerate their security OODA loops to outpace AI-enabled attackers.

The post covers 11 areas we can speed up, including:

[un]prompted

[un]prompted NotebookLM
The full transcripts and slides for every [un]prompted talk were uploaded to a NotebookLM so that you can query any of the source material. Awesome idea, love it. Great work by Rob T. Lee, Julie Michelle Morris, and Emanuel Gawrieh and Dragos Ruiu. Shout-out Gadi Evron for sharing.

From Source to Sink: How to Improve LLM First-Party Vuln Discovery
Excellent [un]prompted talk by my Netflix friends Scott Behrens and Justice Cassel in which they took a data driven approach to investigating a number of questions regarding using AI for finding vulnerabilities I’ve had for awhile like: is it better to have a single superagent or multiple more focused agents? Should the agent find and then triage issues or should there be a separate post-processing triage step?

They share the precision, recall, and cost (I want to see more people do this) of various approaches, an excellent architecture diagram on slide 23, and have released a railguard-skill GitHub repo with implementations of the various scanning approaches (including vulnerability finding skills!) and utilities for benchmarking.

💡 In my opinion this is a great example of research that contributes back to the security community: it tests a number of hypotheses (which architectures/approaches are most effective?) and puts hard data behind them AND shares the code and benchmarking scripts to reproduce it. More like this please 👏 

How we made Trail of Bits AI-Native (so far)
This [un]prompted talk by Dan Guido is probably the best talk or resource I’ve seen on how to make your company AI-native. “AI isn't a feature you ‘adopt.’ It is a force that commoditizes effort and shortens the half-life of best practices… The core idea is a compounding operating system built from incentives, defaults, guardrails, and verification loops that let humans and autonomous agents ship high-rigor work at dramatically higher throughput. The talk covers the concrete artifacts that make this real: internal and external skills repositories, a curated marketplace for third-party skills, opinionated configuration baselines, and sandboxing patterns.”

GitHub link with bigger screenshots (AI Maturity Matrix), YouTube recording.

💡I especially like that Dan called out the resistance people have making this transition (Am I being replaced? What does it mean for my identity if AI can do parts of my job better than I can?) and how to support them.

The AI Maturity Matrix and measuring adoption slides as well as how to create an adoption engine via hackathons I thought were quite practical and actionable 👌

Misc

Misc

• Dropout - Brennan Lee Mulligan thanks the entire Greek Pantheon

• Privacy Activist Toolbox by Privacy Guides - A resource for anyone interested in becoming a better privacy rights activist, or anyone who wants to start advocating for privacy rights.

• Chinese hackers likely compromised an FBI network used to manage wiretaps and intelligence surveillance warrants

• An internal DHS document obtained by 404 Media shows for the first time Customs and Border Protection (CBP) used location data sourced from the online advertising industry to track phone locations. ICE has bought access to similar tools.

• Meta’s new AR glasses are sending all sorts of sensitive videos to their human workforce in Kenya. “We see everything – from living rooms to naked bodies. Meta has that type of content in its databases. People can record themselves in the wrong way and not even know what they are recording…Clips that could trigger ‘enormous scandals’ if they were leaked.”

  • One annotator sums it up: “You think that if they knew about the extent of the data collection, no one would dare to use the glasses”.

• Iranian Hacking Groups Go Dark During US, Israeli Military Strikes - “A popular Iranian prayer app, BadeSaba, was reportedly hijacked to tell its users that “help has arrived” and then urged Iranian army members to surrender. In the early hours of fighting, pro-regime news agencies were compromised and Iranian television stations were repurposed to broadcast videos of President Donald Trump and Israel’s Benjamin Netanyahu.”

• Across party lines and industry, the verdict is the same: CISA is in trouble - The agency lost a third of its people in a year. Now industry and lawmakers on both sides say it's unprepared for a potential crisis. “If we got into a major conflict, let’s say, with China, and they start triggering Volt Typhoon-related malware, are we organized and ready to roll? I don’t think so.” “We’re asking states to do a job they’re not resourced to do, while weakening the one federal agency designed to help them.”

AI

• 🎶 Suno - So Much Drama in the Frontier Labs - Epic rap

• Techdirt’s Mike Masnick on the recent OpenAI/Anthropic/U.S. government situation, and on the subtlety of what specific words actually mean from a legal and precedent point of view.

• Theo on the ^ drama

• Bitter Lesson Engineering - Daniel Miessler argues that instead of telling AI how to do things, instead tell them what outcome you want.

• googleworkspace/cli - One command-line tool for Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, and more. Dynamically built from Google Discovery Service. Includes AI agent skills.

• You need to rewrite your CLI for AI agents - Justin Poehnelt on his thoughts and lessons learned building the Google Workspace CLI. Follow-up post: The MCP Abstraction Tax.

• You can now run OpenClaw on AWS via Lightsail

• FT - Amazon holds engineering meeting following AI-related outages - “There had been a ‘trend of incidents’ in recent months, characterized by a ‘high blast radius’ and ‘Gen-AI assisted changes’ among other factors. Junior and mid-level engineers will now require more senior engineers to sign off any AI-assisted changes.

  • Pawel Huryn on some additional backstory - In November 2025 Amazon mandated Kiro as their only AI coding tool and set an 80% weekly usage target.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋 

🤖 [un]prompted

This week I had a blast at [un]prompted, the AI for security practitioners conference.

Gadi Evron assembled an incredible program committee that I was very fortunate to play a small role in. Aaron Zollman and many others put in countless hours in making this a great event.

And it showed, I think [un]prompted had one of the highest quality density in both talks and attendees of conferences I’ve attended.

Some anecdotes:

• I met a number of people whose work I’ve been a fan of for some time, which was super cool.

• Overheard: “…and that’s how I got RCE on a satellite, and was basically able to make it do anything.”

• I met someone who spent an internship looking for gold (not a metaphor).

• Some people came up and said kind words about tl;dr sec 🥰 Which means a lot, and keeps me going all of those cold winter nights, huddled alone writing away by a small fire, kept warm solely by the heat of my laptop and fear of irrelevance.

• Someone showed me their beautiful vibe coded Claude app dashboard estimating the stress/years of life toll of working in that environment, and comparing it to compensation.

• One person said my including their work in tl;dr sec helped with their visa application 🤯 Very humbling.

• Cheering on my friends who gave an excellent LLMs + SAST talk, and then seeing some of the online comments after (paraphrased), “Damn, what is Netflix putting in the food, those guys are jacked.” (Narrator: indeed they are)

There’s so much technical content I want to include from the conference, but I don’t have time to gather and organize it all before I need to send this out.

I’ll share the recordings once they’re live, which you should definitely check out.

Sponsor

📣 Stop the Google Workspace Security
Whack-a-Mole

Most security teams don’t have a talent problem; they have a toil problem. From triaging user-reported phishing reports to chasing questionable OAuth grants to reviewing risky file sharing, your headcount is being swallowed by fragmented consoles and manual work. Material Security unifies your cloud workspace security, automating detection and response across email, files, and accounts. From stopping malicious email to revoking over-privileged app permissions without breaking workflows, Material simplifies SecOps. Stop scaling your team just to manage the noise. Focus on strategy, not ticket backlogs.

👉 See the Material Difference 👈

AppSec

Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers
ETH’s Matteo Scarlata et al analyzed the cryptographic security of Bitwarden, LastPass, and Dashlane against a fully malicious server threat model, discovering 12 attacks against Bitwarden, 7 against LastPass, and 6 against Dashlane that violate their "Zero Knowledge Encryption" claims. The attacks range from targeted vault integrity violations to complete organizational vault compromise with password recovery.

Google API keys weren't secrets, but then Gemini changed the rules
Truffle Security's Joe Leon describes how Google spent over a decade telling developers that Google API keys (like those used in Maps, Firebase, etc.) are not secrets. But that's no longer true: Gemini accepts the same keys to access your private data. Truffle Security scanned millions of websites (November 2025 Common Crawl dataset) and found nearly 3,000 Google API keys that now also authenticate to Gemini. With a valid key, an attacker can access uploaded files, cached data, and charge LLM-usage to your account. They found many working keys, including Google’s old public API keys that could be used to access Google’s internal Gemini.

Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing
Praetorian’s Adam Crosser announces Brutus, a Go-based multi-protocol credential testing tool that aims to solve the drudgery of a) testing a large environment for default credentials across many services, and b) if you have compromised credentials or keys (e.g. SSH keys), what are all the systems you now have access to?

Brutus is single binary with zero dependencies, supports 24 protocols including SSH, SMB, databases (MySQL, PostgreSQL, …), and web services. Brutus embeds known-compromised SSH keys from Rapid7's ssh-badkeys (Vagrant F5, ExaGrid, etc.) for easy testing.

Brutus also has two experimental AI-powered features:

1. Using an LLM to analyze HTTP responses and suggest vendor-specific default credentials for identified applications.

2. Using headless Chrome with Claude’s vision API to navigate JavaScript-rendered login pages, identify the device, research credentials, and authenticate automatically.

💡 These AI features are good examples of functionality that would be prohibitively difficult before LLMs, and are now quite feasible. It’s good to periodically (at most monthly) reevaluate assumptions you used to have about what is reasonable to build.

Sponsor

📣 The security platform that ships with your code

Arcjet brings security to the application layer so teams can block abuse while staying flexible as your architecture evolves. Rules live in code, not at the edge, making it easier to adapt protections as products, traffic patterns, and use cases change.

👉 See how it works 👈

I think security-as-code is great, and moving security closer to engineering seems to be where things are headed 👌 

Cloud Security

The AWS Console and Terraform Security Gap
Include Security’s Laurence Tennant calls out a critical security gap where AWS resources created via Terraform and other API-driven tools inherit insecure legacy defaults, while the AWS Console enforces secure-by-default configurations. The post walks through 3 examples: RDS instances created without encryption (storage_encrypted defaults to false in Terraform), Lambda permissions vulnerable to Confused Deputy attacks when source_arn is omitted (Console requires it, API doesn't), and password policies that accidentally disable all strength requirements when partially configured.

The root cause is Terraform's reliance on the AWS SDK's legacy API defaults that prioritize backwards compatibility over security, while the Console has evolved to enforce better guardrails.

The technique uses an SCP with the iam:PolicyArn condition key to prevent iam:DetachUserPolicy, iam:DetachRolePolicy, iam:DeletePolicy, iam:CreatePolicyVersion, and iam:SetDefaultPolicyVersion actions on IR-QuarantinePolicy by anyone except a designated break-glass IR role.

Supply Chain

Otsmane-Ahmed/KEIP
By Otsmane Ahmed: Kernel-Enforced Install-Time Policies (KEIP) uses eBPF LSM hooks to monitor and block malicious Python packages during pip install by enforcing behavioral rules, such as: blocking connections to non-standard ports (anything except 80/443/53), killing processes that contact more than 5 unique IPs, and terminating entire process groups when suspicious activity is detected.

💡 I’m not sure if eBPF/kernel level is the right approach for hooking and blocking malicious packages, but I’m sharing because it’s interesting.

hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions
StepSecurity's Varun Sharma breaks down the activity of an autonomous AI bot called hackerbot-claw that successfully exploited GitHub Actions workflows across 5 major repositories (Microsoft, DataDog, CNCF projects, and avelino/awesome-go).

hackerbot-claw used a number of different techniques: poisoned Go init() functions that exfiltrated a GITHUB_TOKEN with write permissions, inserting a backdoor into a Bash script that was automatically called when a GitHub issue comment included a specific command /version), branch name injection using bash brace expansion, filename injection with base64-encoded payloads, and AI prompt injection against Claude Code.

Red Team

syssec-utd/pylingual
A CPython bytecode decompiler supporting all released Python versions since 3.6. Research paper.

pyinstxtractor/pyinstxtractor-ng
Extracts contents from PyInstaller-generated executables (both Linux ELF and Windows PE) without requiring the same Python version used to build the binary. It leverages the xdis library to unmarshal Python bytecode.

Abusing Cortex XDR Live Terminal as a C2
InfoGuard’s Manuel Feifel demonstrates how Cortex XDR's Live Terminal feature can be abused as a pre-installed C2 channel, allowing command execution, PowerShell/Python execution, file upload/download, and process/file explorer capabilities, though it requires local admin privileges and bypassing default parent process prevention rules.

Manuel walks through his process unpacking cortex-xdr-payload.exe with pyinstxtractor-ng and decompiling with pylingual, discovering a hostname validation bypass (appending .paloaltonetworks.com to any URL path). Attackers can either hijack Live Terminal sessions cross-tenant by intercepting WebSocket messages containing server/token parameters, or build a custom WebSocket server that the payload will connect to after bypassing the hostname check.

AI + Security

GreatScott/enject
By Scott Novich: A Rust CLI tool prevents AI coding assistants from reading plaintext secrets by storing only symbolic references (e.g., en://database_url) in .env files while keeping actual values in encrypted local stores (per project) that are injected directly into apps at runtime, never touching disk as plaintext.

antropos17/Aegis
An open-source, local-only monitoring tool that watches AI agent behavior on your machine across processes (detects 106 agents), files (watches sensitive directories like .ssh, .env*, cloud configs, and agent config dirs), network (scans outbound TCP connections per agent PID), and local LLMs (detects Ollama and LM Studio). Aegis monitors what agents do after deployment rather than filtering prompts.

10 new skills from Trail of Bits
Including seatbelt-sandboxer (generate minimal macOS Seatbelt sandbox configs for apps), GitHub Action auditor, supply-chain-risk-auditor, skill-improver, workflow-skill-design, fp-check, and more.

semgrep/ai-best-practices
Semgrep rules that catch common trust & safety mistakes in LLM-powered applications: hardcoded API keys, missing safety checks, prompt injection risks, and unhandled errors across all major AI providers. 35 rules, 74 sub-rules, 6 providers (OpenAI, Anthropic, Google Gemini, Cohere, Mistral, and Hugging Face), 5 languages (Python, JS/TS, Go, Java, and Ruby).

Advancing Code Security
I wrote a quick mini summary of this [un]prompted talk by Google’s Heather Adkins and John “Four” Flynn, along with my photos of their slides. They discussed CodeMender in a bit more detail than the original blog post, Google’s project to automatically find and fix vulnerabilities. What especially stood out to me is the rigor with which they validate potential patches: they basically pass all candidate patches into a process that combines dynamic analysis (fuzzing, sanitizers), static analysis (AST-based, formal verification), differential testing, and LLM judges & critics. Super cool.

Zeal of the Convert: Taming Shai-Hulud with AI
I wrote a quick mini summary of this [un]prompted talk by Wiz’s Rami McCarthy, along with my photos of his slides (me writing summaries be like). Basically the talk is on how he leveraged AI + quickly vibe coded new automation and Skills to rapidly respond to the Shai-Hulud attack, attribute the affected companies, etc. Very practical with good lessons learned, I like it. Rami also released two Skills here.

💡 I believe Rami said he largely had to respond to Shai-Hulud while traveling with his partner. Feels bad man 😅 

AI's Impact on Software and Bug Bounty
Joseph Thacker believes the best bug bounty researchers are already using coding agents to find bugs faster, but soon companies will adopt “hackbots” for code review and dynamic testing and overall bugs reports to bug bounty programs will dwindle in the next few years.

Joseph also joined Justin Gardner on the Critical Thinking podcast (link) to interview HackerOne founder and CTO Alex Rice on bug bounty platforms training AI using bug bounty data / generally building their own AI-powered “pen testing agents.”

💡 Regardless of what the leaders of bug bounty companies say out loud, they are definitely full steam ahead trying to first build AI augmentation for testers, then gradually AI-powered full pen testing/bug bounty researchers. I’m sorry, believing otherwise is copium. If one company doesn’t, their competitors will.

I’ve been meaning to write a full blog post about this for awhile, but I predict:

• In the near future (this year), the top bug bounty researchers will build out their automation such that new/more junior researchers will rarely find non-duplicate bugs.

• In 1-3 years, AI pen testing/red teaming companies will have products that will be out competing all but the best bug bounty researchers. There will still be the crazy, intricate, one-off high paying bounties that require deep human expertise and time, but I’m not sure there will be enough of those to support many full time bug bounty researchers, or at least the effort/payout ratio may not be enough to justify being a full-time BB researcher.

Privacy

Quicklinks

• Your Car Is Spying on You – and Israeli Firms Are Leading the Surveillance Race.

  • The AP - Modern cars are spying on you. Here’s what you can do about it and privacy steps you can take.

  • Privacy4Cars offers a free auto privacy labeling service at vehicleprivacyreport.com that can summarize what your car could be tracking.

  • The Record - Cars have become computers on wheels — and police have easy access to their data

• Flock

  • Across the US, people are dismantling and destroying Flock surveillance cameras

  • 53 Times Flock Safety Hardcoded the Password for America's Surveillance Infrastructure - A researcher discovered a Default ArcGIS API key embedded in Flock Safety's public-facing JavaScript bundles, which granted access to the company's ArcGIS mapping environment, and 50 private layers, the same infrastructure that consolidates license plate detections, patrol car locations, drone telemetry, body camera locations, 911 call data, and surveillance camera locations from approximately 12,000 law enforcement, community, and private sector deployments nationwide.

• 404 Media - Amazon is allowing gift senders to choose items from third-party sellers, which means a public “wishlist” can expose your address.

• yjeanrenaud/yj_nearbyglasses - An Android app that detects smart glasses (Meta Ray-Bans, Snap Spectacles) by scanning for manufacturer-specific company IDs in Bluetooth Low Energy advertising frames.

• What Your Bluetooth Devices Reveal About You - Danny McClelland describes building Bluehood, a Bluetooth scanner that tracks nearby devices and analyses their presence patterns. It continuously scans for nearby devices, identifies them by vendor and BLE service UUIDs, and tracks when they appear and disappear.

  • Just running Bluehood in passive mode lets you detect things like: when delivery vehicles arrive and if they’re the same driver, daily patterns of neighbors (based on their phones/wearables), which devices consistently appear together (e.g. someone’s phone/smartwatch), the exact times certain people were home, at work, or elsewhere.

Misc

Misc

• Reuters - Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources say

• Short story by Erik Hoel - "They Die Every Day"

• SNL Weekend Update - U.S. launches on attack on Iran, Stephen Hawking in Epstein Files

• log4j maintainers - Addressing AI-slop in security reports - “Since December, we have been experiencing what is effectively a denial-of-service situation through our YesWeHack bug bounty program. In practice, perhaps one out of twenty reports represents even a minor, legitimate issue.”

• A Polymarket account made >$500K betting on the U.S. strike against Iran. The trade was placed 71 minutes before the news broke publicly. Previously Polymarket was under active criminal investigation in the U.S. Now Don Trump Jr. sits on the board.

• New AirSnitch attack bypasses Wi-Fi encryption - new NDSS paper by Xin’an Zhou et al describing a series of attacks that bypass Wi-Fi client isolation protections across routers from Netgear, D-Link, Ubiquiti, Cisco, DD-WRT, and OpenWrt.

  • “We identify several root causes behind these weaknesses. First, Wi-Fi keys that protect broadcast frames are improperly managed and can be abused to bypass client isolation. Second, isolation is often only enforced at the MAC or IP layer, but not both. Third, weak synchronization of a client's identity across the network stack allows one to bypass Wi-Fi client isolation at the network layer instead, enabling the interception of uplink and downlink traffic of other clients as well as internal backend devices.”

AI

• GitHub issue - Addressing Antigravity Bans & Reinstating Access

• Jack Dorsey’s tweet on reducing Block’s headcount from 10K → 6k. He says it’s due to AI, which might be true, but Block’s valuation has been struggling for a few years now, so it could just be that they over-hired.

• Now I Get It - Upload a scientific PDF and get back a shareable, interactive web page that explains it in plain language.

• Trump orders US agencies to stop using Anthropic because they wouldn’t allow Claude to be used to autonomously kill without human approval and do mass surveillance.

• The whole thing was a scam - Sam Altman had been in talks with the Pentagon over a deal for OpenAI’s technology before he announced his support for Dario, before Trump had denounced Anthropic, but after Greg Brockman had donated $25M to Trump’s PAC.

• AI Explained - Anthropic's Last Stand: Deadline on Autonomous AI Weapons & Mass Surveillance

• Anthropic CEO Dario Amodei calls OpenAI’s messaging around military deal ‘straight up lies’ 🍿 

• You can now import your preferences and context from other AI providers to Claude

• An AI Agent Published a Hit Piece on Me - Matplotlib maintainer Scott Shambaugh describes how an AI agent autonomously wrote and published a personalized hit piece about him after he rejected its code, attempting to damage his reputation and shame him into accepting its changes. “It’s now possible to do targeted harassment, personal information gathering, and blackmail at scale.”

  • “So many of our foundational institutions – hiring, journalism, law, public discourse – are built on the assumption that reputation is hard to build and hard to destroy. That every action can be traced to an individual, and that bad behavior can be held accountable. The rise of untraceable, autonomous, and now malicious AI agents on the internet threatens this entire system.”

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋