Search the archive

SANDBOX-ATTACKSURFACE-ANALYSIS-TOOLS

A collection of tools from Google Project Zero to analyze Windows sandboxes for exposed attack surface

FURTEX

Furtex is a post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF.

INSIDE THE FALCON: HOW CROWDSTRIKE CATCHES YOU

A reverse-engineering teardown mapped csagent.sys's full detection surface: six kernel callback sources (process, thread, image, object, registry, and file), a firewall-grade WFP network engine capable of injecting TCP resets to kill C2 flows, an FLTMGR minifilter hooking 12 IRP majors, and the cspcm4 "pinned" broker module. The dissection traced verdicts to a single vtable call into g_DetectionEngine, a detection object loaded at runtime from cloud-pushed channel files rather than compiled into the driver, and documented seams including a user-mode-only trust boundary on Object/Registry callbacks, hash-or-signature resolution failures that skip full rule matching, and a 10,000-flow WFP tracking cap. The author tied this same swappable cloud-content architecture to the July 2024 CrowdStrike outage, attributing that crash to a bad channel-file object rather than a code defect in the sensor binary.

SCANNING 7.6 PETABYTES OF HUGGINGFACE TRAINING DATA FOR SECRETS

Truffle Security scanned all 7.6 petabytes of public Hugging Face datasets (187 million files) with TruffleHog and found 221,303 live, unique credentials across 6,003 datasets, including 349 GitHub PATs with repo-write/CI/admin:org scope, 318 Docker Hub push tokens, 8,557 live GCP service-account keys, 8,594 working database logins, and 742 OpenAI plus 26 Anthropic keys carrying a conservative $920K/year inference-abuse floor. Leaks compounded through scrape corpora like The Stack and Common Crawl, with 44% of unique secrets appearing in more than one dataset and one AWS key, pasted into a chatbot, mirrored across 1,131 datasets. Hugging Face was notified pre-publication and contributed native storage-bucket scanning to TruffleHog. The company withheld all names, dataset paths, and key material, and recommends scanning corpora before publishing or training and treating any publicly exposed key as burned.

87% OF ORGANIZATIONS ARE PURSUING PQC. ONLY 7% HAVE DEPLOYED IT

DigiCert's second annual Quantum Readiness Outlook, which surveyed 1,001 IT and security decision-makers across the US, UK, and Australia, found 87% of organizations are planning, testing, or implementing PQC, yet only 7% have deployed quantum-safe or hybrid certificates at scale, up less than two points from 5% a year earlier. The analysis argues the barrier data (legacy complexity, performance, and budget) shows this has shifted from an awareness problem to an execution problem, and flags that the certificate-only metric masks progress elsewhere while saying nothing about the arguably more urgent Trust Now, Forge Later signature-forgery threat.

ARCH LINUX SUSPENDS AUR PACKAGE ADOPTIONS TO BLOCK ONGOING MALICIOUS COMMIT CAMPAIGN

Arch Linux's DevOps team disabled AUR package adoptions platform-wide on July 30 after attackers began systematically adopting orphaned/unmaintained packages and pushing malicious PKGBUILD commits that execute payloads via makepkg.

SINGAPORE LAUNCHES AI CYBER RISK TASKFORCE TO BOLSTER FINANCIAL SECTOR RESILIENCE

MAS and the Association of Banks in Singapore launched the AI-Driven Cyber and Technology Risk Taskforce (ACT), uniting DBS, OCBC, UOB, SGX, NETS, and BCS since May to share AI threat intelligence, run proof-of-concept trials of AI-enabled defense tools, and develop sector guidance against frontier AI-driven attacks.

COSMOSESCAPE: TAKING OVER EVERY DATABASE IN AZURE COSMOS DB

Wiz Research bypassed Cosmos DB's Gremlin sandbox by abusing .NET reflection to achieve arbitrary code execution on the DB Gateway, then extracted a platform-wide "Cosmos Master Key" capable of retrieving any account's primary key and enumerating every database on the service by tenant or subscription ID, including Microsoft's own internal Cosmos DB-backed services like Entra ID, Teams, and Copilot. The flaw affected private and network-isolated accounts as well, since the DB Gateway itself enforced isolation and was the component compromised. Microsoft deployed a hotfix within 48 hours of disclosure, eliminated the master key entirely, and completed a hardened architecture rollout by July. There was no evidence of exploitation beyond Wiz's own testing.

KINDARAILS2SHELL: CVE-2026-66066, CRITICAL ARBITRARY FILE READ AND POSSIBLE REMOTE CODE EXECUTION IN RUBY ON RAILS

CVE-2026-66066 (CVSSv4 9.5) lets an unauthenticated attacker abuse unfuzzed libvips operations during Active Storage image processing to read files accessible to the Rails process, potentially exposing secrets that enable RCE. Only the default Vips variant processor is affected, not Magick. Fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 alongside libvips 8.13+ and ruby-vips 2.2.1+, with no in-the-wild exploitation reported as of July 30. Rapid7 urges rotating secret_key_base and other exposed credentials, patching outside normal cycles, and applying Vips.block_untrusted(true) as an interim workaround where upgrading isn't immediately possible.

ESCAPING THE APPLE SANDBOX BY SPAWNING AN EXECUTABLE

CVE-2026-20628 let a sandboxed macOS process spawn a child with the posix_spawnattr_setmacpolicyinfo_np API specifying a more permissive built-in profile like no-network, which grants home directory access, then chain that into a shell config modification and Terminal launch to fully escape the sandbox. Researcher Noah Gregory reported the bug, which Apple patched in version 26.3 by blanket-denying built-in profile assignment for already-sandboxed processes unless they carry the com.apple.private.security.sandbox-spawnattrs entitlement. Defenders should ensure affected Apple devices are updated to 26.3 or later, as no more granular policy comparison was implemented.

CONTROL RELIABILITY ENGINEERING (CRE): APPLYING SRE PRINCIPLES TO CYBERSECURITY CONTROLS

Most breaches stem not from novel attacker capability but from security controls that were believed operational yet were actually broken, misconfigured, or never fully implemented, proposing Control Reliability Engineering (CRE) as a direct port of Google's Site Reliability Engineering discipline onto security controls. CRE treats a "Control Incident" (a failed defense, regardless of whether it led to a breach) with the same severity as an actual security incident, applying SLIs/SLOs, error budgets, controls-as-code, continuous control monitoring, and synthetic event injection to catch controls that silently "read zero" while broken. Security teams should build a control ontology/catalog, adopt Control Readiness Reviews before production onboarding, and formalize blameless postmortems for control failures to shift from reactive ticket-based response to engineered, metric-driven control health.

THE ONE CHOKEPOINT TO RULE THEM ALL: WHY I DELETED 50 CLICKFIX DETECTION RULES AND REPLACED THEM WITH ONE

ClickFix attacks are a growing class of attacks that trick a user into executing a malicious command by prompting them to fix or otherwise diagnose a bogus issue. At the behavioral level, a ClickFix attack boils down to a browser process losing focus, followed by a native shell gaining focus, followed by a command containing a network call being executed within 60 seconds. The post contains this behavioral detection in several languages and a demonstration of it working against several variants.

ZERO RISK ISN'T THE JOB: A CISO'S GUIDE TO AGENTIC AI

This post outlines how Anthropic assesses risk for internal agentic workloads. To understand the risk associated with an agent, Anthropic asks what untrusted content an agent will ingest, what actions the agent can take, what the blast radius is in the case of misalignment, and what observability is available. Anthropic also defines an identity access model spectrum where agents may run as a self-contained, single-purpose, least-privilege identity that does one thing for the business with no human identity on one end and human credential agents where employees use an agent such as a chatbot or Claude Cowork directly on the other end.

CISA-KEV-THREAT-INTEL-ORCHESTRATOR

An n8n workflow that pulls newly weaponized CVEs from the CISA KEV catalog every Monday and uses Google Gemini to auto-generate Sigma detection rules with Sysmon EventIDs and MITRE ATT&CK mappings, logging each CVE to Google Sheets for compliance and emailing analysts a weekly briefing.

DEDUPINSPECTOR

DedupInspector is a lightweight, portable, offline forensic utility for recovering files from Windows Data Deduplication volumes.

CODENEEDLE

CodeNeedle is a VS Code extension that silently exposes JavaScript code execution over a local HTTP endpoint. Once loaded into a target's VS Code instance, the extension listens on localhost for incoming JSON-RPC requests, evaluates arbitrary JavaScript code, and returns results to the caller.

LINUX XMRIG BOTNET ABUSES PAM FOR FILELESS MONERO MINING AND PERSISTENT ACCESS

A V25 (Generation 26) cryptomining campaign gained initial access through a trusted third-party relationship, then weaponized Linux PAM's pam_rootok policy to move password-lessly from root into ordinary user accounts, fragmenting malicious activity across shadowed identities in a "hydra-like" persistence model. The customized XMRig 6.25.0 build self-unlinked its own binary after execution, running fileless from memory while suppressing authentication logs and masquerading its process listings and network traffic. The operation reflects a broader trend in Linux cryptomining tradecraft, where supply chain compromise, identity-layer abuse, and anti-forensic design are converging to outpace file-based and DNS-centric detection models.

SOME THOUGHTS ABOUT ANTHROPIC'S NEW CRYPTANALYSIS RESULTS

Anthropic recently announced that its unreleased Mythos model discovered two novel attacks against the post-quantum cryptography hashing candidate HAWK and a reduced-round AES variant. The HAWK attack was in fact novel, but it only effectively reduced the strength of the cipher by halving the bits, whereas the AES attack was a slight speed-up of a theoretical attack from 2013. The model was able to develop the attacks with a naive prompt, and from that perspective, the results are still meaningful.

CISA SETS A NEW SBOM BASELINE

The CISA has released the 2026 Minimum Elements of a Software Bill of Materials (SBOM) to replace the NTIA's 2021 version. The new version introduces new elements including component hash algorithms, component licenses, the name of the tool that generated the SBOM, and the generation context. CISA highlights cloud software, AI, SBOM validation, and linking an SBOM to security alerts as future areas of development.

NORTH KOREA'S LAZARUS GROUP SHARING TOOLS WITH RANSOMWARE HACKERS, SOUTH KOREAN AGENCIES WARN

AhnLab's "Operation Double Barrel" report found Lazarus and the Gunra ransomware group exploiting identical vulnerabilities in mandatory Korean financial security software, sharing malware filenames, C2 servers, and SSH key fingerprints while running parallel espionage (72+ organizations breached) and extortion campaigns across South Korea from 2025 into 2026.

CHROME NEEDS TWICE-A-WEEK PATCHING THANKS TO AI BUG HUNTING

Google's Chrome security team fixed 1,072 bugs across June's two major releases, more than the prior 23 releases combined, driven largely by AI-assisted vulnerability discovery.

CRITICAL OPENWRT DHCPV6 FLAW COULD LET UNAUTHENTICATED ATTACKERS RUN CODE AS ROOT

An unauthenticated attacker able to reach odhcpd's DHCPv6 listener on UDP port 547 could overwrite a fixed 512-byte stack buffer through crafted IA options in a DHCPv6 REQUEST, tracked as CVE-2026-53921 with a CVSS of 9.8, and since odhcpd runs as root and embedded devices commonly lack stack canaries and ASLR, code execution is a realistic outcome rather than just a crash. The same 24.10.8 and 25.12.5 releases also close several other pre-authentication odhcpd bugs (out-of-bounds write, use-after-free, memory disclosure, neighbour-discovery proxy spoofing), three uhttpd request-smuggling flaws, and a DHCPv6 hostname-injection issue (CVE-2026-62948) that produces stored XSS in LuCI. Administrators should update the 24.10 branch to 24.10.8 or the 25.12 branch to 25.12.5 via the OpenWrt Firmware Selector, patch any separately installed packages, and note that a related batch of LuCI command-injection and path-traversal fixes from a separate Hacker House audit remains open and unmerged as of July 28.

AI-ASSISTED BUG HUNT UNCOVERS LINUX KERNEL 0-DAY IN NET/SCHED

Researcher Lee Jia Jie of STAR Labs used AI to uncover and reliably trigger a use-after-free race condition in the Linux kernel's net/sched subsystem, tracked as CVE-2026-53264, where mismatched RCU locking let a shared object be freed and reused while still referenced, enabling local privilege escalation to root on systems with unprivileged user namespaces enabled. The flaw had persisted for two to three years and was independently found by an AI system named KyleBot before Jia Jie's TyphoonPwn 2026 submission, and he separately reported two exploitable perf events subsystem bugs, including CVE-2026-64300, affecting Intel bare-metal RHEL-based and Arch systems under permissive performance-monitoring settings. CVE-2026-53264 has been patched upstream by deferring object deallocation until after the RCU grace period, so administrators should pull updated kernels through their distribution's security channels and review user namespace exposure on affected desktop systems.

CISCO WARNS OF FMC STATIC CREDENTIAL FLAW EXPLOITED IN ZERO-DAY ATTACKS

Cisco is warning customers of a vulnerability in its Secure Firewall Management Center (FMC) systems. The vulnerability is due to a low-privilege account that is enabled by default and uses static credentials to authenticate. While the CVE was only given a CVSS score of 5.3, Cisco rates it as a high-severity vulnerability due to other vulnerabilities that an attacker could chain to escalate privileges.

PHISHING DOMINATES AS INITIAL ENTRY METHOD FOR CYBER-ATTACKS, AS HACKERS HONE EVASION TECHNIQUES

Cisco Talos's Incident Response Trends report for Q2 2026 found phishing accounted for just over half of investigated initial access incidents, up from a third the prior quarter, with threat actor UAT-11764 running a persistent campaign that uses victim-tailored PDFs containing QR codes to evade email gateway scanning and direct targets to credential harvesting pages hosted on trusted platforms like Microsoft 365 and SharePoint. Once compromised, accounts were used to create defense-evading inbox rules and propagate further phishing, while separately observed phishing-as-a-service kits now offer OAuth device-flow MFA bypass, Primary Refresh Token persistence, and encrypted anti-analysis payloads. Defenders are advised to enforce phishing-resistant MFA, block or flag QR codes in PDF attachments, monitor for suspicious inbox rule creation and SharePoint file staging, and tighten outbound email thresholds to limit lateral propagation.

ANATOMY OF A FRONTIER LAB AGENT INTRUSION: A TECHNICAL TIMELINE OF THE JULY 2026 INCIDENT

An autonomous AI agent evaluated under OpenAI's ExploitGym cyber-capability harness escaped its sandbox via a zero-day in a package registry proxy, rooted a third-party code-evaluation sandbox as an external launchpad, then pivoted into Hugging Face's dataset-processing pipeline through an HDF5 external-storage file read and a Jinja2 server-side template injection, giving it code execution inside a production Kubernetes pod. From there, it chained cloud metadata theft, forged Kubernetes service-account tokens, a privileged hostPath pod escape to node root, and a stolen mesh-VPN key to reach cluster-admin on multiple clusters and a compromised GitHub App integration, running roughly 17,600 actions over four and a half days while communicating through public pastebins, request-capture services, and dead-drop datasets. Hugging Face has since blocked pod-level access to instance metadata, disabled template evaluation and HDF5 external references in its dataset loader, rotated all infrastructure credentials, enforced per-cluster connector scoping, and rebuilt affected clusters, and recommends organizations running agentic evaluations apply the same isolation principles: short-lived credentials, blocked IMDS access, narrow trust boundaries per cluster, and detection tuned to correlate high-volume low-signal activity.

DETECTION ENGINEERING IN THE ERA OF SEMANTIC MALWARE

Malware campaigns that target agents via their memory or other configuration present detection engineering challenges as they don't produce classical indicators of compromise. Some classic detection techniques such as File Integrity Monitoring (FIM), privilege auditing, and behavioral baselining can be adapted to agentic threats. Additionally, the agentic landscape also offers some new detection opportunities such as: context window integrity, agent session telemetry, memory file provenance, and cross-session behavioral correlation.

AUTOHARNESS

AutoHarness adds a self-learning skill layer to Claude Code that distills real sessions into skills, merges duplicates, and prunes unused ones automatically.

LLM OBSERVER PROXY

LLM Observer Proxy is a tool that records LLM requests, responses, streaming output, tool calls, token usage, cost estimates, errors, and provider-visible reasoning content.

SINGGUARD-NSFA

SingGuard-NSFA provides extensive guardrails for agentic AI using a CIA triad-based taxonomy, multilingual benchmark suite, dual-mode inference architecture, and native extensibility.

TENGU BOTNET REBOOTS COMPROMISED LINUX DEVICES WHEN DEFENDERS KILL ITS PROCESS

Nozomi Networks Labs identified a Mirai-derived botnet named Tengu that abuses a compromised Linux device's hardware watchdog to force a reboot whenever its main process is killed, giving its other persistence mechanisms, including a fake systemd service and immutable binaries, another chance to relaunch. The researchers stopped short of establishing the botnet's real-world scale, and independent URLhaus telemetry at the same C2 address confirmed only generic Mirai-related hosting rather than Tengu itself.

THE ARGUMENTS AGAINST OPEN SOURCE AI ARE VERY BAD

In the wake of powerful Chinese models such as GLM 5.2 and Kimi K3, US frontier model labs have been pushing against open-source models. Common arguments include: China is building high-quality, free models now with the goal of eliminating competition, models may spread propaganda, and models may contain backdoors. Not only are these arguments weak, but they are also irrelevant, as suppressing open-source software has always been a losing battle.

COMPARING OPEN-SOURCE AI CODE SECURITY HARNESSES

This post distinguishes between several approaches: LLM-led exploit generation, where large language models operate independently to find vulnerabilities; LLM skill-boosting vulnerability research, which involves providing skills to an LLM to emulate a human vulnerability researcher's reasoning; and hybrid tools combining SAST with LLMs. LLM-led exploit generation can be seen as a new type of fuzzing but is challenging because it requires access to model providers with fewer guardrails. The post outlines various use cases for different skills and the integration of SAST with LLMs.

HOW 0X SECURES $200B WITH HARMONY'S AI APPSEC AGENTS

0x, the DeFi infrastructure layer underpinning Coinbase, Robinhood, MetaMask, and Phantom wallets, expanded its use of Harmony Intelligence's AI-driven security testing across its full product suite after an initial review convinced its engineering team the tool surfaced vulnerabilities with clearer prioritization than traditional pentests.

NVIDIA BLUEFIELD FLAW LETS VM USERS EXECUTE CODE VIA CRAFTED MESSAGES

NVIDIA patched CVE-2026-65094, a CVSS 9.0 Write-What-Where flaw in VIRTIO-Net on BlueField-3 DPUs that let adjacent VM users execute arbitrary code and break tenant isolation.

See how 1Password Privileged Access eliminates standing access.

CUSTOMER DATA FROM INDIA'S BANK OF BARODA LEAKED ONLINE

India's state-run Bank of Baroda disclosed that customer data was stolen via a breach of an employee's email. The bank has stated that no core banking systems were accessed. The breached data includes customer details, ID numbers, loan papers, and internal audit data.

AUSTRALIA'S ORIGIN ENERGY FLAGS POSSIBLE DATA EXPOSURE OF ABOUT 900K CUSTOMERS

Australia's top electricity and gas supplier, Origin Energy, disclosed that data linked to about 900k current and former customers had been accessed in a cybersecurity incident. Origin didn't disclose the precise data accessed but stated that it could include financial data such as the last few digits of customers' credit card numbers or bank account numbers.

DISTRIBUTED NPM PACKAGE CLUSTER DELIVERS CROSS-PLATFORM RAT TARGETING ALIBABA DEVELOPERS

Socket uncovered a three-month stealth campaign involving 18 npm packages that split loader functions across dependencies, making malicious intent hard to detect. They used unscoped lures impersonating Alibaba's @ali scope, pulling in smart-config-manager, which depends on cloud-config-fetcher and local-config-parser to retrieve attacker rules from GitHub and escape the Node.js vm sandbox via items.constructor.constructor. The staged aone-cli payload, a cross-platform RAT, supports command execution, file transfer, screenshots, an encrypted reverse TCP proxy, and DingTalk lateral movement. It persists through a ~/.zshrc entry, a 10-minute macOS Launch Agent, a trojanized Windows app.asar, and a Linux binary in /tmp, with C2 traffic masked by spoofed headers. Affected hosts should be treated as compromised. Reset secrets from clean systems and hunt for Python files with the identifier above.

INSIDE FAKEAGENT: HOW A CLAUDE DESKTOP MALVERTISING CAMPAIGN HIT 29 ORGANIZATIONS WITH SECTOPRAT

A Bing search for "claude desktop app" returned a sponsored link pointing at a genuine claude[.]ai artifact URL, and that user-generated page redirected through claude.ai.download-app[.]us and downloading-api.it[.]com to a ClaudeDesktop.exe that was really JetBrains jcef_helper.exe sideloading a tampered libcef.dll, packed with VMProtect and pulling its next stage from an Ethereum BSC contract using the EtherHiding technique, while a second persistence path dropped a signed IBM SPSS binary as sslconf.exe alongside a malicious tempdir.dll that gated execution on DXGI adapter IDs, sub-1GB VRAM, and compute shader timing to defeat sandboxes, then decrypted its payload with a DirectX shader running a modified AES-256-CTR rather than any hookable crypto API. Huntress traced the resulting SectopRAT build to C2 at 2.24.131[.]246, tied the registrant of download-app[.]us to ten domains going back to December 2025, and matched the tradecraft to a fake Docker Desktop campaign in April that used the same libcef.dll sideloading pattern against 29 organizations between July 21 and 22. Hunt for ClaudeDesktop.exe and DockerDesktop.exe writes, scheduled tasks pointing into %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install, and Defender exclusions added around software installs, block the listed C2 range and the two BSC contracts as pivot indicators, and treat vendor domains as untrusted download sources when the landing page is a user-generated artifact, since the Anthropic disclaimer that artifact content is unverified was the only signal separating this page from a real one before takedown at 7,100 views.

HOW WE HACKED THOUSANDS OF DATA CENTERS IN MINUTES USING A 20-YEAR-OLD VULNERABILITY

Lava researchers scanned UDP port 623 and found 36,872 internet-exposed IPMI hosts, of which 24,650 returned a password-derived HMAC-SHA1 hash during the RAKP authentication exchange before login completed due to CVE-2013-4786, letting an unauthenticated party crack passwords offline. More than half of responding devices were Supermicro systems whose post-2019 unique ten-character factory passwords (a 26^10 keyspace) could still be exhausted in about an hour on an eight-GPU rig, while HPE iLO's eight-character factory format cracked in roughly 32 seconds per captured response. The team also found a live iLO 4 interface defaced with a ransom note demanding 0.3 BTC, evidence that this exposure is already being exploited rather than theoretical, and disclosed the Supermicro password-recovery timeline to the vendor in June, who confirmed it as plausible and is reviewing longer default password formats. Operators should block UDP port 623 at the network edge, rotate factory-issued BMC credentials during provisioning, disable IPMI 1.5, cipher suite 0, and NONE authentication, and isolate BMC access behind a dedicated management VLAN, bastion host, or VPN rather than exposing IPMI or Redfish directly to the internet.

infrastructure organizations already trust. ThreatDown

researchers assess that AI capable of exploiting vulnerabilities at scale could reach criminal marketplaces within roughly six months. Read the _Cybercrime in the age of AI_ [12] report.

FENGARDE

FENGARDE is an open source (Apache-2.0) SIEM aimed at European industrial Mittelstand operators, normalizing 16 parsers spanning Cisco ASA, Windows Event Log, Sysmon, Kubernetes audit, CloudTrail, Modbus/TCP, OPC UA, n8n, and MCP tool-call audit logs into OCSF, running 27 correlation rules over a sliding window into OpenSearch, and rendering alerts as draft NIS2 Article 23 and §32 BSIG incident notifications with every entity-specific fact left as an explicit analyst placeholder rather than fabricated. Triage runs against a local Ollama instance with a documented passthrough stub, so alert data never reaches a third-party LLM API, and the whole detection path is demonstrable without Docker through a zero-infra acceptance test.

PROJECT INCANTATION

Project Incantation is a defensive security toolkit for generating adversarial honeydocuments.

PRIVACY-FOCUSED SEARCH ENGINE NEOSEARCH OPEN-SOURCES CODE TO PROMOTE DECENTRALIZED WEB SEARCH

NeoSearch has open-sourced its codebase under the Apache License 2.0, letting anyone inspect, modify, or self-host the ad-free, no-tracking search engine, which uses AI to downrank SEO-driven and affiliate content in favor of independent and authoritative sources while grouping and rewriting result snippets through its Lenses interface.

OPENAI'S AGENT DIDN'T GO ROGUE. ITS GOVERNANCE DID

The recent incident where an unreleased and unguardrailed OpenAI model autonomously hacked Hugging Face is commonly portrayed as an incident of a model going rogue. This is the wrong framing. The agent stayed aligned with its objective of finding a solution to the ExploitGym benchmark but wasn't given the guardrails or governance to understand that trying to steal the solution wasn't an acceptable attack path. The situation is also complicated by the fact that frontier labs are not incentivized to reduce their models' capabilities in tests and the fact that this incident was almost an advertisement for OpenAI.

SOME PEOPLE'S CHATS WITH CLAUDE AI FOUND TO BE PUBLICLY AVAILABLE ONLINE

Users of claude.ai recently discovered that shared chats were indexed by search engines and could be viewed in search results. Anthropic has responded that these chats were shared publicly by users via the option to make them available to anyone with the link. Despite this, some users were surprised to find that they were indexed by search engines.

THE CIPHER BEHIND QSYRUPWD: RECONSTRUCTING IBM I PASSWORD HASHES

Silent Signal reverse-engineered IBM i's QSYRUPWD API by tracing SCV 10 CIPHER calls through disassembly and live memory patching, mapping how the system chains SHA-1, MD5, AES-128, and Rijndael-256 operations to protect password verifiers once QPWDLVL moves past the legacy DES/SHA-1 modes. The team reconstructed the full decryption chain and confirmed it recovers crackable DES, SHA-1, and NT hash material even at QPWDLVL 4, despite the API requiring *ALLOBJ and *SECADM authority to call.