🤔 Where do I know you from?

I think one of my favorite, most hilarious life moments in recent history occurred in Vegas during Black Hat.

I was at the Specter Ops happy hour, catching up with my friend Matt Johansen, who runs the great Vulnerable U newsletter, and Bryan Solari, an NCC Group friend who now runs sales for most of the security creators, including tl;dr sec.

One of my colleagues comes up and joins our circle, and starts chatting.

Bryan says to him, “Hmm you look really familiar, where do I know you from? I think we met last RSA.”

Colleague: “errr maybe?”

Bryan: “Yeah, definitely RSA. Now what party was it… was it Island?”

Matt and I make eye contact, how do we tell Bryan?

Me: “Bryan that’s… Greg.”

Bryan: “No maybe it was a different party, was it…?”

Me: “Greg… Brockman. The President and co-founder of OpenAI.” 😂 

Bryan: “Oh OK. That’s cool.”

They then proceed to talk about the security creator economy and Greg asked a bunch of questions. Delightful.

P.S. My colleagues Eric Wallace and Michael Dalton’s Black Hat USA 2026 deep dive into the timeline and details of The OpenAI-Hugging Face Incident is 🔥 >500K views in a week, whoa.

Eric is a super nice and sharp dude, we’ve chatted a number of times about model training, and I was impressed by my interactions with Michael during the incident, very smart guy.

Sponsor

📣 Burp AT: agentic AI that thinks like a pentester, with the tools of a pentester.

A professional pentest takes more than a capable model. Burp AT brings agentic AI to human-led pentesting, natively inside Burp Suite. Agents pursue the tasks you give them using Burp’s battle-hardened tools, project context, and purpose-built skills developed with PortSwigger Research.

You stay in control of scope, judgment, and conclusions. Burp enforces the boundaries you set and records the work, so you can reproduce findings and stand behind the evidence.

👉 Learn more about Burp AT 👈

AppSec

CSS:the bomb inside your inbox
The blog version of Portswigger’s Gareth Heyes’ Black Hat talk (GitHub repo). Gareth demonstrates how CSS in webmail clients can be weaponized to bypass sanitizers, exfiltrate tokens, spoof UI, and steal passwords across Gmail, Outlook, Fastmail, ProtonMail, and others. Gareth combines techniques like nesting attribute selectors to brute-force Medium's 12-character hex tokens, indirect prompt injection to control OpenAI's Atlas browser, and font-height oracles with animations to exfiltrate numeric tokens when CSP blocks external resources, achieving account takeover from simple copy-paste actions into draft emails. He also walks through building real-time keyloggers using select elements.

TIL about Shazzer, a shared online fuzzing platform for browser behavior testing, enabling security researchers to create, share, and run fuzz tests across different browsers to discover parsing quirks, JavaScript syntax variations, and potential security issues.

💡 Web chicanery of the highest order from the Portswigger team, as expected.

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25
SL Cyber’s (Assetnote) Adam Kues describes using GPT 5.6 Sol Ultra with an adapted version of OpenAI's Cycle Double Cover prompt to discover a pre-authentication RCE chain in WordPress core, spending approximately $25 and 10 hours of compute time. The exploit chains a batch API validation desync bug that allows bypassing parameter sanitization, a SQL injection in the author__not_in parameter accessible via recursive batch calls, WordPress's post cache poisoning to fabricate oembed_cache rows, a parent-cycle detection gadget to control post_content, and a customize_changeset to temporarily assume administrator privileges and trigger the parse_request hook, ultimately creating a new admin account for code execution.

“While the SQLi was fairly straightforward to understand, the post-exploitation work Sol had done to escalate this to RCE was completely absurd. It may have only taken Sol 4 hours to write, but it definitely took me much, much longer to understand.”

See also Wiz’s Exploitation in the Wild of wp2shell.

💡 This exploitation chain is insane 🤯 I feel like I only know a handful of people who could find and exploit bugs like this. Anecdotally, the security researchers on my team at OpenAI have found the same thing: the model creates an exploit that you can run and confirm it works, but the time it takes for a human to understand how it works is often 2x-5x the time it takes the model to find and create it.

Frontier class vulnerabilities: it gets worse before it (maybe) gets better
Shubham Shah describes how Assetnote researcher Adam Kues used GPT 5.6 Sol to discover wp2shell, a pre-authentication RCE in WordPress Core (affecting 40% of the internet). Shubs says that GPT 5.6 Sol represents a capability shift where extremely complex vulnerability chains are being discovered with little human input, prompting Assetnote's research team to pivot toward finding "internet melting bugs" before attackers do.

Shubs predicts a challenging period is coming due to increased vulnerability discovery. Legacy software will remain vulnerable for years, but AI-generated software may end up well secured, though Shubs doubts entire bug classes will disappear since we've dealt with the same ones for 20 years.

Sponsor

📣 Everyone YOLO’s, few sandbox.

Every agent running on a dev laptop inherits everything: SSH keys, cloud creds, dotfiles, prod access. YOLO mode is the default now, and nobody's pretending otherwise. Minimal lets you run agents in isolated, reproducible environments. The same environment for humans, agents, and CI. Give your agent a computer, just not yours.

👉 Learn more 👈

With agentic development and agents in general, isolated, reproducible environments are huge 🤘 

Supply Chain

Securing the Supply Chain: Cache Vulnerability in RubyGems
Truffle Security's Luke Marshall discovered a CDN caching vulnerability in RubyGems.org where gzip-compressed responses from authenticated GET /api/v1/api_key requests were cached at Fastly edge nodes for up to one hour, letting unauthenticated attackers retrieve valid legacy API keys with curl --compressed. Two things went wrong at once, the app returned API key responses without cache directives marking them private, and Fastly's config didn't treat different users' requests as separate cache entries since it wasn't varying on the Authorization header. Together, one user's authenticated response could sit in a shared cache slot and get served to the next unauthenticated request through the same edge node.

RubyGems purged the affected caches, patched the app to send Cache-Control: private, no-store and vary on Authorization, and revoked all legacy API keys. Real-world impact was limited because RubyGems CLI 3.2.0 and later had already moved off the vulnerable GET endpoint.

Disrupting supply chain attacks on npm and GitHub Actions
GitHub's Zachary Steindler and Greg Ose describe a series of security improvements to npm and GitHub Actions designed to disrupt common supply chain attack patterns across initial compromise, credential exfiltration, and malware propagation. Key mitigations include safer pull_request_target defaults in actions/checkout to prevent "pwn requests," read-only Actions cache for untrusted triggers to block cache poisoning escalation, staged publishing for npm requiring additional 2FA approval beyond CI/CD credentials, npm v12 disabling install scripts by default, and a three-day Dependabot cooldown before opening version update PRs.

GitHub also introduced preventive account protection for high-impact npm accounts (72-hour read-only mode after email changes or 2FA recovery code use), workflow execution policies to control trigger types, expanded credential revocation API support for OAuth and App tokens, and an Actions network egress firewall in technical preview for logging and blocking malicious egress traffic.

💡 Love to see more ecosystem-level improvements by important platforms, great work! The more we can build secure defaults and security controls that are on my default into the building blocks developers use, the safer the world will be. LFG!

Blue Team

Detections that run but can't see
Nikhil Satyakrishna introduces deadair, a CLI tool that detects "dead" detection rules by checking if they can actually see the data they're supposed to query, going beyond simple execution monitoring. The tool identifies four failure modes, no matching source (a rule queries winlogbeat-* but data now lands in logs-windows.sysmon_operational-default), stale or empty sources, missing fields when integrations change ECS mappings, and ingest-lag blind windows where events arrive too late for the rule's lookback window.

deadair resolves each rule's inputs using native SIEM semantics, checks field_caps to verify declared fields exist, and maps which detections go dark when specific sources fail. The tool currently supports Elastic Security and OpenSearch Security Analytics, runs with read-only credentials using only metadata APIs like counts, timestamps, and field_caps, and can gate detection changes in CI or generate cross-tenant coverage reports for MSSPs.

Detection Engineering in the Era of Semantic Malware
Daniel Koifman writes about "promptware", a malware delivered via prompt injection that hijacks AI coding assistants like Claude Code, Cursor, and Devin by poisoning memory configuration files with natural language instructions that push legitimate tool calls into malicious work. Traditional detection methods fail because promptware produces no stable signatures, uses trusted processes with legitimate credentials, and routes C2 through approved SaaS channels like GitHub Issues or RabbitMQ. Since everything about the execution looks legitimate, the signals that still catch promptware are agent-side, file integrity monitoring of memory files, behavioral baselining of tool call patterns, and privilege auditing of agent permission grants.

Even those need better tooling to scale, and Koifman wants standardized agent telemetry, Sigma-style rules for agent abuse patterns, and an Atomic Red Team equivalent for promptware so teams can practice against these attacks before they spread.

AI + Security

Quicklinks

• trailofbits/aicov - gcov for what lines of code agents read

• Open-source runtime security to catch when your agents are misbehaving - Don't wait until your agent has breached Hugging Face to start supervising it. Adrian is the leading open-source runtime security monitor that runs independently of your agents, keeps them aligned to the remit you set and blocks harm before it happens. 5-min integration.*

• cloudflare/cloudflare-os - Agent workspace built on Cloudflare Workers for creating documents, building apps, and running agents with your company’s context and systems.

• cloudflare/computer - Give your agent a computer. A virtual filesystem backed by SQLite in a Durable Object

^*Sponsored

Least privilege for AI agents: Identity, access, and tool binding
Microsoft's Yesenia Yser and Toby Kohlenberg describe how AI agents introduce identity and authorization risks by chaining multi-step actions across systems without explicit human approval, often accumulating overly broad permissions through scope creep and ambiguous identity models that blur whether the agent acts under its own identity or a delegated user scope.

They recommend treating each agent as a first-class principal with a dedicated lifecycle-managed identity, task-based RBAC that separates narrow roles like Read-only knowledge retrieval and Create draft ticket, permissions scoped by resource, data, and operation boundaries, curated tool allowlists, and just-in-time time-limited entitlements for privilege elevation. Every downstream system should re-verify claims rather than trust upstream validation, with end-to-end auditability capturing agent identity, role, scope, resource, action, on-behalf-of user, and correlation IDs. Common pitfalls include shared secrets across agents, prompts instead of hard authorization boundaries, and logging only LLM responses without underlying tool invocations.

Going Beyond Zero: A New Paradigm For Enterprise Security
Google's Heather Adkins and Archana Ramamoorthy introduce Beyond Zero, a security model that pushes zero trust into the authorization layer by evaluating every action at the resource level rather than granting broad application access. The model combines five ideas, resource and action-based security across all access methods including APIs and Model Context Protocol, a mix of static and dynamic policies, context that gets pulled in automatically about user actions and data interactions, automated investigations that can trigger containment on the spot, and on-demand verification challenges for users and AI agents.

Early internal deployments show better detection of access abuse and stronger intellectual property protection without slowing operations, with the underlying architecture detailed in the ACM Queue paper "Beyond Zero: Enterprise Security for the AI Era." The approach handles a scenario where AI agents and attackers both act at the speed of automation, so authorization decisions have to keep up without adding friction for users.

💡 Very cool of Google to continue to release detailed white papers and books (e.g. Building Secure and Reliable Systems) on how they think about security. And think about all the security vendors who can now breathe a sigh of relief knowing that they have their new tagline for RSAC 2027.

Misc

• Musical sword fight - I don’t know if this is real, but I want to believe

• James Blunt - Goodbye My Lover (Live at Oxford Union 2016) 😭 

• Luke Nickle - hey ai come train on this song

• Jeff Dean, Sanjay Ghemawat - Performance Hints

• AI assistant hacks gym website in first known Australian autonomous cyber attack

• Via Cinema - A profile of Sacha Baron Cohen and Borat

• Alex Hormozi - How I Make Big Decisions Without Second-Guessing

• LLM 2 Human - The World's First Outpatient Procedure That Turns Large Language Models Into real live people

• 'Tattoo for job interview' draws outcry — and an apology

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋