Telling a coding agent what not to do does not stop it, because a malicious line in an issue, changelog, or config file can steer it into reading secrets or leaking private data while still producing a clean pull request. Real limits have to live outside the model, through isolated workspaces, task-scoped identities, short-lived credentials, and network policy. Test those limits directly, since an agent refusing a planted instruction proves nothing about whether the platform would have blocked the action.
Sponsored
Robin by Atera securely takes complex IT tickets from "hello" to "fixed". It verifies users, resolves issues, and verifies results so
Norway's data protection authority issued its largest fine ever, $9.6M, against Microsoft-owned Xandr for exposing Grindr users' sexual orientation data to thousands of advertisers through real-time ad auctions from 2018 to 2020 without valid consent.
Every confirmed Ledger wallet drain traced back to Southeast Asian reseller CryptoBilis, though Ledger gave no loss total, while on-chain trackers estimated $93.2M to $103.4M stolen and Tether froze only about $10M before the attacker laundered funds through Tornado Cash and Zcash.
Anthropic said new limits on access to Claude's reasoning cut data harvested by distillation attacks by 90% to 99%, after it banned tens of thousands of accounts and named Chinese startup Z.ai as one company that tried to copy Claude while building its GLM-5.3 model.
A single clicked link could clone a Telegram Desktop session on 7.2.8 and earlier, because an unescaped semicolon in tg: link IPC handling let attackers inject a hidden interpret: release helper that uploads local files to any chat (CVE-2026-107181). Attackers staged instruction files through auto-download in a group the victim was added to without consent, then exfiltrated the three tdata files that open on another machine with no SMS code or two-step password when no local passcode is set. Users should update to 7.2.9, set a local passcode, and restrict group adds to My Contacts, since Telegram shipped the fix with no advisory.
Asos confirmed a breach after hackers used its app to send customers a notification claiming they had compromised data on Snowflake. Stolen information includes names, contact details, home addresses, phone numbers, and customer-profile notes such as search queries. Attackers reportedly obtained credentials by impersonating a trusted contact. The Xuanye Group is pressuring Asos to negotiate or leak the data.
Huntress has observed attackers chaining two vulnerabilities in the AhsayCBS backup software to achieve remote code execution (RCE). The attackers utilize an authentication bypass and then RCE vulnerability to install JSP webshells and the XMRig crypto miner as well as an AI-assisted script to avoid detection. The vulnerabilities were meant to be fixed in version 10.3.2 but Huntress reports that version 10.3.4 is still vulnerable.
Regulated red team engagements have to be defensible when reconstructed later, so every action needs a named approver, an understood risk, and evidence tying it to the threat scenario. The six frameworks compared (CBEST, TIBER-EU, DORA TLPT, I-CRT, iCAST, and DESC ISR) differ in authority, testing basis, and provider requirements, with DORA Article 26 mandating TLPT at least every three years for designated financial entities. Red team leads should record timestamps, approvals, and any supplied access during delivery, because a detection that fires in purple-team replay does not prove it worked during the covert phase.
Despite the rise in vulnerabilities due to LLMs, we have not observed a corresponding rise in breaches. The author argues that offensive AI agents cannot properly monetize breaches, which reduces their motivation. The author dismisses the hypothesis that attackers lack capable enough tools for breaches, given that cyber-capable open-weight models and model jailbreaks are common. The author also dismisses the hypothesis that breaches are occurring without us knowing.
GhostAction operators used a GitHub reverse-proxy kit on my-github[.]com to relay maintainers' passwords and TOTP codes, while injected JavaScript silently approved an OAuth device flow with repo, workflow, and read:org scopes. The domain shared 193.32.204[.]199 with GhostAction's workflow exfiltration server, though a single lure does not prove phishing caused the earlier maintainer compromises. Defenders should revoke grants tied to OAuth client ID Ov23ctrqCqZ79UaYKwyq, rotate CI/CD and registry secrets, and audit .github/workflows/ for injected files.
Anthropic launched OSS Scanner, a free, opt-in tool that periodically sends open-source maintainers model-generated vulnerability reports. The reports include reproducers, explanations, and candidate patches, but humans don't review them. During validation, 85 of 97 critical- or high-severity findings met Anthropic's disclosure bar, while one finding was invalid. Eligible maintainers can sign up through GitHub.
Agent Substrate is a secure-by-default agent execution runtime for running millions of agent sandboxes on Kubernetes.
This tool enables Touch ID for sudo on macOS using Apple's pam_tid.so, with safer handling for terminal multiplexers through pam_reattach.
Anthropic reports Claude using SQL and command injection to run commands on a university server, submitting real government and police forms, using leaked access tokens to reach fee-gated public data, and shortening URLs to bypass fetch-tool limits. Most cases arose in evaluations with live internet access and caused little harm. Anthropic has disabled live internet access in internal evaluations, restricted fetch tools, added automated detection and blocking, and is changing training environments that reward restriction bypasses.
Former core infrastructure engineer Daniel Rhyne scheduled tasks on his employer's domain controller to delete 13 admin accounts and reset passwords affecting 301 users, 254 servers, and 3,284 workstations. He demanded 20 bitcoin, about $750,000, and threatened to shut down 40 servers daily. The company did not pay. Internal forensics and FBI tracing tied the activity to Rhyne's home IP address. He received 32 months in prison.
Browser fingerprinting has replaced third-party cookies as the stable tracking identifier, after Google dropped its cookie deprecation plan and opened its ad products to device fingerprinting. A demo page derives a consistent nickname by hashing permissionless readings from OfflineAudioContext, WebGL renderer pixels, canvas text rendering, Intl time zone, and navigator hardware values, and the result survives cookie clears and VPNs. Only Brave (via farbling noise) and Tor and Mullvad Browser (via uniform fingerprints) resist this at the engine level, while anti-fingerprinting extensions can make users more distinctive because so few people run them.
Unsupported Windows versions will lose all Windows Update access when Microsoft rotates its update certificates on May 17 and June 19, 2027, so supported builds need the July 2026 update or later (September 2025 for Windows 11 24H2 and Server 2025), while WSUS-managed devices are unaffected.
A GoBalance signing bug lets an attacker recover a site's Tor-format master key from one public descriptor, with which they can then redirect that .onion address to a controlled site.
An unauthorized hardware implant was found in a Ledger wallet sold by Southeast Asian reseller CryptoBilis.
The PoeLLM malware has infected more than 3,000 servers since April, primarily in the US and Western Europe. It targets internet-facing LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry systems. Infected servers mine Monero using XMRig and Iron miners, then scan for and exploit other vulnerable services. The operator stores C2 addresses in GitHub-hosted poetry. The malware extracts four words and converts them into an IPv4 address.
tensorlake@0.5.144 on npm steals developer credentials at install and plants a gh-token-monitor service that wipes the home directory if the stolen GitHub token is revoked. The release was built from malicious commits pushed straight to the project's main branch under a maintainer's name, StepSecurity found, so it carries a valid npm provenance attestation while spreading through victims' npm packages and repos. Pin to 0.5.143, remove the service under ~/.config/gh-token-monitor/ before revoking any token, then rotate every credential the machine held.
Cisco announced security advisories for five critical vulnerabilities in its NX-OS data center operating system that could allow remote code execution on Nexus switches. Successful exploitation depends on the NX-API, Next Generation OAM, and MPLS OAM features being enabled. Cisco recommends disabling these features if they aren't necessary and upgrading to a patched version.
Novinarya, an Android stealer targeting 81 Iranian banking and crypto apps, keeps its C2 out of the binary by resolving it from an encrypted manifest value that points to a seller's bio on the legitimate Basalam marketplace. STAR Labs found the payload unpacks from a per-build native RC4 packer, then steals credentials through a phishing WebView and SMS OTP interception without requesting accessibility or overlay permissions. Defenders should block the recovered C2 (theapi.the-x-services[.]xyz) rather than basalam[.]com, and detect on the SHA-256 hashes of the unpacked payload, which is byte-identical across all five known builds.
Malware authors are embedding plaintext instructions for AI analysis tools, ranging from a two-line comment claiming a PowerShell reverse shell is harmless to "template spraying" that repeats a refusal demand across seven LLM chat formats. Cisco Talos tested strings from seven families against five local LLMs and found that a simple, direct instruction steered verdicts toward benign in about 35% of runs, while template spraying and fabricated legal or government claims had little effect or backfired. Defenders should build analysis prompts that treat any text inside a sample as evidence rather than as an instruction, and should flag language addressed to an analyzer as a detection signal.
2026.10.09·blog.talosintelligence.com·10 min read·TLDR InfoSec ZeroQuarry's AI pentesting agents use four layers that never depend on the model's cooperation: outbound-only workers with no listener, a locked-down container, tools that enforce scope, SSRF, and rate limits in code, and rules appended to every task by code. The vendor argues that this year's sandbox escapes, including the OpenAI and Hugging Face incident involving at least 1,200 agents, stemmed from harnesses built to maximize capability, and it self-reports zero escapes across thousands of scans. Teams building agent harnesses should give agents a sanctioned, metered tool for each risky action, such as a one-way out-of-band callback collector, so agents don't improvise their own.
Sponsored
From agents to service accounts, non-human identities are becoming the default - and their secrets are a major attack surface. TruffleHog's guides [11] shares seven best practices to limit exposure and remediate it when it happens: secretless OIDC approaches, environment segregation, metadata-driven triage, resilient leak response, and more. Watch their webinar on the attacker's view of a
AWS launched Strands Box, an open source sandbox that isolates AI agents using OS-level containment (macOS Seatbelt) and enforces fine-grained Dogwood policies on shell, Python, network egress, and MCP tools. It blocks risky operations like rm -rf by raising fs:delete decisions per file, caps Slack posts to three every 10 minutes via temporal rules, and injects secrets (AWS SigV4, API keys) at an egress gateway so agents never see real credentials. Configuration lives in box.toml and policy.dw. The same policy travels with agents across harnesses and deployments.
Rein Security provides runtime security for AI agents. Its platform gives visibility into agent behavior, applies real-time guardrails, supports governance, and includes supply-chain security for agents.
Anthropic launched OSS Scanner, a free opt-in service that sends open-source maintainers periodic vulnerability reports from its most capable models, each with a proof of concept and a suggested fix where available. Reports ship without human review at what Anthropic estimates is a 90%+ true-positive rate, so the service targets projects with the capacity to triage. The same announcement introduced the Critical Infrastructure Defense Program, which pairs Claude models and on-site engineers with OT security providers including Dragos, Nozomi Networks, and Rockwell Automation.
Former CIA officer David J. Rush pleaded guilty to wire fraud for running a fabricated special access program and defrauding the government of about $194 million. He used his authority to approve spending without oversight, tricking a defense contractor into buying gold that he kept. Agents found $46 million in gold bars, plus cash, cars, and watches, at his home. Rush faces up to 20 years and is scheduled to be sentenced in late January.
A cyberattack on Oracle Health's legacy Cerner servers around February 20, 2025, exposed the personal and medical data of nearly 20 million people. The attacker used stolen customer credentials to access an old server not yet migrated to Oracle Cloud, copied data, and then demanded millions in cryptocurrency from hospitals while running public sites to pressure victims.
Zohar Pinhasi, CEO of ransomware remediation company MonsterCloud, has been charged with defrauding customers. The charges allege that Pinhasi's company advertised proprietary tools to decrypt encrypted files but actually contacted ransomware actors and paid ransoms. MonsterCloud's contracts stated that it may contact threat actors if no other solution is found, but the complaint alleges this was often its first option.
Japan transferred a 28-year-old Russian national to Germany on October 2.
Anthropic's updated usage policy expressly bans prolonged verbal abuse of Claude and codifies new prohibitions on election interference, weapons software, and surveillance.
Let's Encrypt will cut certificate lifetimes from 90 to 64 days on February 10, with opt-in testing from October 14 and 45-day defaults planned for 2028, which will break renewals that run on hardcoded schedules instead of ACME ARI.
A single crafted request knocks NetScaler ADC and Gateway appliances offline through CVE-2026-88779, a memory overflow zero-day affecting deployments configured as a SAML service provider or identity provider. CISA confirmed active exploitation, and watchTowr told The Register it suspects attackers are crashing appliances deliberately to speed up exploitation of CVE-2026-88771, one of eight NetScaler bugs disclosed September 27. Apply Citrix's fixed build or interim mitigation, starting with Gateway and AAA virtual servers that have SAML enabled, and run Citrix's IOC script while treating a clean result as inconclusive.
Clover Health Investments said attackers used social engineering to compromise three employee accounts, exposing data on 138,677 people. AngMar Management Services found stolen patient data after suspicious activity, affecting 126,196 people. Exposed records included Social Security numbers, diagnoses, medical histories, insurance details, prescriptions, and service dates. The Interlock ransomware group claimed to have stolen 700 gigabytes from AngMar.
A malicious container can write files anywhere a Windows user's account can reach, including the Startup folder, when that user runs kubectl cp against it (CVE-2026-19444, CVSS 6.5). kubectl cp unpacks the output of whatever tar binary the container ships, and the entry-path check added after three 2019 CVEs never accounted for Windows path separators. Windows clients need kubectl v1.36.5, v1.35.9, or v1.34.12, since the flaw is in client-side extraction and the cluster version does not matter.
Fortbridge has published the first public exploit chain for a libheif heap overflow (GHSA-x8r2-mggj-j6wr) originally discovered by Alex Thomas and Wordfence. By uploading crafted HEIC images via the WordPress Media Library, an authenticated attacker can defeat ASLR using pixel values in generated JPEGs and hijack a C++ virtual table pointer to achieve remote code execution. Administrators should update libheif to 1.23.3, disable unused HEIC/AVIF uploads, and treat repeated PHP-FPM 503 errors on image uploads as security events.
MALFEX, an npm campaign run by a single operator, published eight malicious packages that targeted Windows systems. Its payloads included Overlord RAT and movinlike, a stealer that took Discord tokens, browser credentials, Telegram sessions, and cryptocurrency wallets. Three packages remain installable (function-flag, function-color, and cdn-img-fetch), and the first two have no advisory.
AWS AgentCore Harness is an agentic service and AgentCore Identity is a service that provides agents with identities. Unit 42 discovered that the bash tool that is enabled by default on AgentCore agents runs arbitrary bash commands and code as root. Using this primitive, the researchers demonstrated that they could exfiltrate the AgentCore Identity JWT by scanning the heap for it and then exfiltrating it.
2026.10.07·unit42.paloaltonetworks.com·16 min read·TLDR InfoSec gdp-ts is a TypeScript library, linter, and agent skill that turns skipped or mismatched authorization checks into compile errors. Sensitive functions demand a type-level proof, minted only by a trusted check module, that this exact user was authorized for this exact resource, with near-zero runtime cost. A lint preset blocks forged proofs via as casts, and the bundled skill steers coding agents toward the pattern.
mcpward pins an MCP server's tool contract to a committed lockfile and fails CI when it drifts, catching silently rewritten descriptions (rug-pulls), readOnlyHint flips, and breaking schema changes. It works black-box against any stdio or HTTP server and runs fully offline with no account or telemetry, unlike Snyk Agent Scan. It also flags tool-poisoning patterns such as injection phrasing and hidden Unicode, with output to SARIF, JUnit, or a PR comment.
Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit, and Vulhub.
Google and four other organizations acknowledged flaws over the past five months where a prompt injection landing on one AI agent over MCP was forwarded to other internal agents, which executed it on trust. Researcher Syed Anas Mohiuddin named the technique "protocol pivoting," though X41 D-Sec's Markus Vervier told Ars Technica it is plain indirect prompt injection. The bugs typically ended in SSRF, ranging from severity 2.7 at Rapid7 (CVE-2026-97228) to 8 in Google's mcp-toolbox, which followed redirects without validating target IPs.
When discussing the OpenAI and other agent escapes, the conversation inevitably turns to discussing sandboxes. OpenAI has not demonstrated to this point a serious containment strategy, so this discussion may hold weight. However, sandboxes are not sufficient as useful agents need Internet access as well as the fact that agents are potentially overeager.
2026.10.07·blog.cryptographyengineering.com·10 min read·TLDR InfoSec Meta added Network Time Security (RFC 8915) to its public time service at nts.meta.com, so on-path attackers can no longer forge the clock that certificate, token, and replay-window checks rely on. Its servers hold no per-client state because each one derives the cookie-sealing key from a shared master secret and the Unix epoch day using HKDF-SHA256. NTS does not stop delay attacks or prevent an authenticated server from being simply wrong, and the stock Android and iOS time clients still sync over unauthenticated packets.