• tl;dr sec
  • Posts
  • [tl;dr sec] #327 - Finding Zero-days with Any Model, Practical Package Security, Measuring the AI Offense-Defense Gap

[tl;dr sec] #327 - Finding Zero-days with Any Model, Practical Package Security, Measuring the AI Offense-Defense Gap

Niels Provos on finding 0-days with public models, a guide to securing your use of third party packages, two open source tools to measure AI hacking vs defense (+ dynamic lab environment)

Author

Clint Gibler
May 07, 2026

Hey there,

I hope you’ve been doing well!

🫶 Friend Visit

Last weekend I visited my good friend Aaron and his partner, staying at their place in southern California, and it was delightful.

There’s something special about meeting a friend’s partner and seeing their place, you get such a lovely insight into who they are and what they value. The bookshelves, the photos from their couple trips, the unique items they’ve picked up along the way.

We played a few rounds of this board game, Forbidden Island, which was a lot of fun, would recommend. Clint analytical brain was fully engaged, and people were amused 😅 

I managed to delay doing an AI-powered Deep Research about optimal strategies until I was at the airport on the way back. It wasn’t easy.

Aaron was a work friend who became a normal friend over many Wednesday dinners. And after several months I got upgraded to his non burner phone (not a joke) 🙌 

We had talked about me coming down to stay with him for a weekend… and I actually did it! It was kind of going out on a limb, as we’d never spent more than a few hours together at a time, but I’m really glad I did. We had a great time, and I feel like we grew a lot closer in just a few days.

Maybe there’s someone you really click with at work or from some hobby, and if you put yourself out there and spend more time with them (even if it feels cringe to ask), that could end up being a great friendship 🤔 

Sponsor

📣 AI ROI: You know the AI bill, but what are the outcomes?

Leadership is asking: are we getting value from AI? Which tools are worth the spend? Where are we exposed? Right now, most teams can only answer with invoice data.

Harmonic Security Usage Explorer closes that gap. It automatically classifies every AI interaction across your organization into the use cases driving real work, specific to your business. Get actual patterns to understand how your teams use AI, how much time they spend, the cost, and where risk lives.

CIOs rationalize spend, CISOs get risk in context, & AI committees get proof of impact.

Early access is now open. Request your spot.

Getting visibility into your company’s AI usage is actually pretty hard. See also a Harmonic demo I got from the CEO/co-founder Alastair Paterson, though I’m sure they do a lot more now.

AppSec

The Dot-Dot-Slash That Frameworks Hand You: CSPT Across Every Major Frontend Framework
Jonathan Dunn reverse-engineered the URL decoding pipelines of 8 major frontend frameworks (React Router, Next.js, Vue Router, Angular, SvelteKit, Nuxt, Ember, and SolidStart) to understand how Client Side Path Traversal (CSPT) vulnerabilities arise when encoded slashes (%2F) in dynamic route parameters get decoded and interpolated into fetch URLs. Labs GitHub repo.

💡 Wow, super detailed, awesome post. Also, this story about Jason Haddix’s mentorship 🥹

C/C++ checklist challenges, solved
Trail of Bits recently added a C/C++ security checklist to their Testing Handbook, and in this post, Graham Sutherland and Paweł Płatek share walkthroughs of two C/C++ challenges. They also released c-review, a Claude skill that runs the C/C++ checklist as LLM prompts against a codebase, tuned to the platform and threat model.

The first challenge is a Linux ping program with a command injection bug, where two undocumented behaviors in standard IP address functions (one accepting trailing garbage, the other reusing a shared buffer between calls) let an attacker bypass the input validation. The second is a Windows driver where a missing safety flag and an incomplete registry read combine to escalate from a local crash to full kernel code execution. By planting two crafted registry values, an attacker tricks the driver into copying arbitrary data onto the kernel stack and overwriting a function pointer.

Introducing deepsec: The security harness for finding vulnerabilities in your codebase
Vercel announces deepsec, an open source security scanner that uses Claude Opus 4.7 and GPT-5.5 coding agents to identify vulnerabilities in codebases, running entirely on user infrastructure with the user's own Claude and OpenAI subscriptions. Internally, deepsec runs a regex sweep to flag security-sensitive files, then the agents investigate each candidate, tracing data flows and assessing severity. A refusal-detection classifier checks each research step, letting it run on off-the-shelf models in addition to cyber-tuned variants.

The tool also ships with a revalidation step that reduces false positives to an estimated 10–20% in their experience, a plugin system (docs) for codebase-specific tuning, and parallel execution across Vercel Sandboxes for large repositories.

💡 It’s interesting to see platforms like Vercel and Cursor launching security scanning services. The overall architecture makes sense and is in line with common approaches. It’d be nice if someone benchmarked all of these open source tools, Skills, products, etc. on the same targets and shared the results 👀 

Sponsor

📣 Adaptive Security: Security Awareness Training Built for AI Threats

AI is changing how attacks are executed. Deepfakes, voice clones, and AI-generated spearphishing across email, SMS, and voice are now table stakes for attackers. Adaptive Security's next-generation platform simulates these exact threats, scores individual employee risk using real behavior and OSINT exposure, and auto-delivers personalized training tied to what each person experienced. Trusted by security teams at PayPal, Ramp, Bose, and more. 

👉 Book a Demo 👈

There’s been a big rise in AI-powered deepfake attacks, it’s great to see people tackling it 👍️ 

Cloud Security

Global S3: Another C2 Channel for AgentCore Code Interpreters
Sonrai's Nigel Sood builds on Kinnaird McQuade‘s prior research on DNS-based exfiltration from sandboxed AWS Bedrock AgentCore Code Interpreters, showing that the interpreter's documented global S3 access can also serve as a bidirectional Command & Control (C2) channel. Sood extended McQuade's open-source PoC so a client inside the sandbox polls an external bucket for shell commands, executes them, and writes output back via presigned PUT URLs. Unlike the DNS path AWS has since mitigated, this isn't a Bedrock vulnerability since S3 access is intended behavior, so customers have to handle it themselves. Sood recommends VPC mode with Gateway Endpoints and strict Endpoint Policies limiting access to specific buckets.

AWS Credential Isolation for Local AI Agents
EngSecLabs' Alex Smolen walks through how to safely hand AWS credentials to local AI agents, recommending combining elhaz, a credential broker daemon that manages auto-refreshing STS credentials via Unix socket, with trailtool for generating least-privilege IAM policies from CloudTrail logs (based on what the agent actually uses).

Alex arrives at this recommendation based on challenges with other approaches: environment variables leak to every process and only capture a snapshot that expires mid-session, mounting ~/.aws/ hands over every profile on the host (and agent deny lists don't catch bash subprocesses reading the file directly), and metadata emulation breaks on macOS because Docker Desktop's loopback doesn't reach the host. Sockets sidestep all of that because the mount itself becomes the access control. If you don't bind the socket into a container, the credentials don't exist there at all, so each agent ends up with its own scoped identity by default.

What the March 2026 Threat Technique Catalog update means for your AWS environment
AWS' Shannon Brazil and Cydney Stude documented three new threat techniques the AWS Customer Incident Response Team has seen in live incidents. Attackers are abusing Cognito refresh tokens (30-day default, configurable up to 10 years) to maintain access without invalidating legitimate sessions, using ec2:DeregisterImage to permanently delete AMIs (unrecoverable unless Recycle Bin retention is enabled), and using UpdateAssumeRolePolicy to attach new principals to existing IAM roles instead of creating new ones.

The post emphasizes that attackers are increasingly using legitimate AWS API calls in illegitimate contexts rather than exploits, requiring security teams to monitor for contextual anomalies like unexpected principals or timing. Most cloud monitoring is tuned for creation events (new roles, new logins, new AMIs) and rarely covers modifications or token refreshes on what's already there. AWS published CloudTrail detection queries for each.

Supply Chain

Quicklinks

*Sponsored

FilippoBau/depcut
Tool by Filippo Baudanza that cuts Dependabot noise by checking whether vulnerable npm symbols are actually imported in JavaScript/TypeScript codebases. It parses imports with tree-sitter, extracts vulnerable symbols from GHSA data (with an optional LLM fallback), and matches them against a lockfile-scoped dependency graph to classify each alert as REACHABLE, UNREACHABLE, or INDETERMINATE, and outputs JSON or SARIF for CI pipelines.

Practical Package Security: The Unofficial Guide
Wiz's Rami McCarthy gives a nice survey of actionable best practices to shrink your attack surface, protect execution environments, control package ingestion, and catch compromises early. Rami recommends minimizing dependencies, adding install cooldowns via your package manager or Renovate or Dependabot so the ecosystem catches malware first, locking package versions with hash verification, using wrapper tools like Datadog’s supply-chain-firewall, and turning off install scripts via npm's ignore-scripts or pnpm's onlybuiltdependencies.

Larger organizations can add registry proxies or private package repositories, plus cloud-based development environments and zero trust production to limit damage when malicious code runs. On the detection side, plant honeytokens in CI pipelines.

Blue Team

weirdmachine64/SharkMCP
Tool by Mohamed Benchikh that wraps Wireshark's sharkd interface as an MCP server so LLMs can dig through PCAP files with natural language. Each capture gets its own sharkd subprocess for packet inspection, protocol analysis, conversation tracking, and stream reassembly across TCP, UDP, TLS, HTTP, and VoIP, while heavy queries are cached in memory so pagination stays fast.

Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
SentinelOne's Juan Andres Guerrero-Saade and Vitaly Kamluk uncovered fast16, a 2005 sabotage framework (five years before Stuxnet) that selectively targets high-precision calculation software, patching code in memory to tamper with results to produce inaccurate calculations across an entire facility (e.g. those used in nuclear weapons research). fast16 is the earliest known Windows malware to embed a Lua VM, and combines a wormable Lua-powered binary with a kernel driver that scans executables for 101 code patterns, then surgically rewrites floating-point routines.

The fast16 name had already appeared in the 2017 ShadowBrokers leak inside NSA's Territorial Dispute list, and Unix-style source control markers in the binaries point to long-term development by government or military engineers. The main binary sat on VirusTotal for nearly a decade, missed by almost every antivirus engine, before SentinelLABS pieced it together.

💡 Wow, interesting discovery process and historical discussion.

Seven Queries to Audit the Sentinel Detections Your SOC May Have Missed.
Rohitashokgowd shared seven KQL queries for auditing Microsoft Sentinel detection rules and finding the ones that look fine on paper but don't actually catch anything. Sentinel's standard health dashboards check whether rules run, not whether they work, so a rule can sit green for months while it queries a dead table or autocloses every alert it produces. The rules flag silent zombies (rules that always return zero), shadow detectors (alerts that never become incidents), high-FP rules (90%+ closed as benign), broken feeds (querying empty tables), forgotten disabled rules (disabled rules that were never turned back on), untracked detections (missing MITRE or entity mappings), and coverage drift (techniques with 60%+ alert drops over 30 days).

Rohitashokgowd also built Sentinel Assessment Tool, a PowerShell module that generates an HTML report of detection coverage across Sentinel and Defender.

💡 I love the meta idea of having queries you can run periodically (or continuously) that are evaluating a range of potential failure modes for your security tools. I think this same idea applies across code scanning, cloud security, or any domain where you have security checks looking for “bad,” and the specific failure modes called out in this post are good starting points.

Red Team

tahaafarooq/Fenrir
Tool by Taha Afarooq that uses eBPF to capture SSH, PAM, sudo, and su credentials at the kernel level. The Go agent deletes itself from disk and runs only in memory, poses as a legitimate system process, and exits if it detects defensive tools (Wireshark, Sysdig, Falco, Tetragon), or VM/container environments (Docker, Kubernetes, Cuckoo, Joe Sandbox). Captured credentials are smuggled out over encrypted network traffic to a companion fenrir-channel C2 with a web dashboard.

Mine the Gap: Open-Source Tools for Measuring the AI Offense-Defense Gap
Dreadnode's Jayson Grace and Martin Wendiggensen released two open-source tools for evaluating AI agents in head-to-head red versus blue engagements, since existing benchmarks miss what happens when both sides operate autonomously against shared infrastructure.

DreadGOAD is a fork of the GOAD Active Directory lab packaged for AWS, with Terraform/Terragrunt provisioning, golden AMIs, private networking via SSM, automated validation of 50+ AD vulnerabilities, and a variant generator that randomizes entity names so agents can't memorize their way through. Ares runs on top: seven red team agents (recon, credential access, cracking, ACL abuse, privilege escalation, lateral movement, coercion) reach domain dominance through Golden Ticket persistence in under six minutes with a 95%+ success rate, while three blue team agents (triage, threat hunting, lateral analysis) investigate the same telemetry.

Every attacker action is recorded as ground truth, so blue team agents are scored on how accurately they reconstruct what actually happened, not against static checklists or curated log dumps.

💡 Lots of really cool ideas in this post- automatically generating variants of a vulnerable environment so you can test how agents perform, measuring the performance of red vs blue autonomous agents, recording actions for future ground truth, and open sourcing the core parts 🤘 Great work.

AI + Security

OpenAI releases open-source model that strips personal data from text
OpenAI released Privacy Filter, an open-source 1.5B model that detects and redacts eight PII categories including names, emails, phone numbers, account numbers, and secrets like API keys. It runs locally on a laptop or in-browser with a 128K token context window, uses single-pass labeling instead of generation, and ships under Apache 2.0 on GitHub and Hugging Face.

💡Useful for data loss prevention and log scrubbing, though weaker on non-English text and non-Latin scripts, so keep a human in the loop.

Google wants AI defense to be as fast as AI offense
Frederic Lardinois covers Google Cloud's Next '26 security announcements. Google added three new AI agents to Google Security Operations for threat hunting, detection engineering, and third-party context, alongside an existing triage agent that has processed over 5 million alerts in the past year and reduced 30-minute analyses to roughly 60 seconds. Wiz, recently acquired by Google, extended its AI-Application Protection Platform across Databricks, AWS, Azure, and Salesforce, is adding inline AI security hooks in IDEs and agent workflows, and shipped a dynamic AI-BOM to inventory shadow AI- the AI frameworks, models, and IDE extension in your environment. Mythos Preview will be available through Google’s Vertex AI for defensive use.

Finding Zero-Days with Any Model
Niels Provos argues that discovering novel vulnerabilities with AI is not just a frontier-model capability but an orchestration problem. He demonstrates using his open-source IronCurtain framework with commercial models (Opus 4.6, Sonnet 4.6) and open-weight models (GLM 5.1) that he can replicate Anthropic's 1998 OpenBSD TCP SACK finding and discover new zero-days in widely-deployed software, with each scan costing $30-150 per codebase.

Niels was able to find these vulnerabilities using IronCurtain (which supports arbitrary workflows structured as finite-state machines (FSM) via plain YAML definitions) by building a specialized vulnerability discovery workflow that has a central Orchestrator agent that acts as a strategic router that then decides which specialized agent to dispatch next based on an append-only execution journal.

Introducing AIMap: Security Testing For AI Agent Infrastructure
Bishop Fox's Aashiq Ramachandran announces AIMap, an open-source tool that discovers, fingerprints, scores, and tests internet-exposed AI agent infrastructure by querying Shodan and fingerprinting endpoints across MCP servers, Ollama, vLLM, LiteLLM, LangServe, Gradio, ComfyUI, and other AI frameworks using Nuclei templates and live HTTP checks.

AIMap assigns risk scores (0-10) based on authentication status, exposed tools, CORS policies, TLS configuration, and system prompt leakage, and includes protocol-specific attack modules for MCP servers (tool enumeration, unauthorized tool invocation, and prompt injection via tool descriptions), Ollama instances (model listing, model weight extraction, and prompt injection), and OpenAI-compatible endpoints (model enumeration, completion abuse, and system prompt extraction).

Our evaluation of OpenAI's GPT-5.5 cyber capabilities
The UK AI Security Institute evaluated GPT-5.5 on various cybersecurity tasks, from basic to expert-level challenges across reverse engineering, exploit dev, and crypto attacks. On a custom VM reverse engineering challenge that took a human expert 12 hours, GPT-5.5 solved it in 10 minutes. “On the Expert-level tasks, GPT-5.5 achieves an average pass rate of 71.4%, compared to 68.6% for Mythos Preview, 52.4% for GPT-5.4, and 48.6% for Opus 4.7. On this measure, GPT-5.5 may be the strongest model we have tested.”

To see if the model could chain attack steps end-to-end, AISI ran it through "The Last Ones," a 32-step corporate network simulation estimated at 20 hours for humans. GPT-5.5 completed the full chain in 2 of 10 attempts, making it the second model after Mythos to do it (which succeeded in 3/10 attempts). On "Cooling Tower," a 7-step industrial control system attack, GPT-5.5 failed like every other model tested.

Misc

Misc

  • Tin Can - A WiFi landline for kids. It doesn’t have apps, texting, or games—just real conversation with friends, neighbors, Grandma, or whoever you add to your approved contact list.

  • The Sites We Lost - Archiving quirky, old websites. Some take me back.

  • Inside TIME’s Wild Day with MrBeast

  • Morning Brew - Why are the boys tryna get hot all of a sudden? - On Looksmaxxing and medspas.

  • Scott Galloway on Diary of a CEO - AI’s impact (or not) on the economy and jobs, the war in Iran, being a parent, and more.

    • I thought Scott had an interesting point on China purposefully “AI dumping” low cost AI via open source models into the U.S. economy to potentially undermine Anthropic, OpenAI, and other companies, as much of the U.S. stock market is essentially a bet on AI, and how that’s similar to how China previously dumped below-cost steel into the U.S. market, which largely wiped out American steel.

    • Also: “The receipts for love are grief.” 🥹

Tech

AI

Politics

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋