🎬 The Mandalorian

I don’t have much time to watch TV or movies these days, but I watched The Mandalorian movie over the weekend and it was pretty good!

To parallelize, I also lifted weights while watching, moving my adjustable dumbbells and bench next to the TV 😂 

The movie of course has action scenes and intergalactic space drama, but what stuck out to me was (slight spoilers): Jabba the Hutt’s son trying to break out of his father’s shadow, seeking for crowds to love instead of fear him, and the Mandalorian taking care of Grogu, and vice versa (“the old take care of the young, and then the young take care of the old”).

Probably not something I’d have thought about when I was younger 🤔 

Sponsor

📣 New webinar: The real picture behind shadow AI and what it means for security teams

Shadow AI isn’t just about data loss: it’s a new attack surface that most security teams and tools have pretty much zero visibility of. 

A shadow app integration today is a supply chain attack vector tomorrow. That AI helper browser extension can suddenly become malicious. And the next time your employee searches for an AI tool on Google it could serve them malware instead. 

Join the latest threat briefing from Push Field CTO Mark Orlando for the lowdown on shadow AI and what security teams can do about it. 

👉 Register Now 👈

AppSec

The Defender’s Window
Greg Brockman describes how OpenAI is using AI agents to defend its infrastructure, and urges organizations to act immediately before open-weight models with similar capabilities release. OpenAI's defense strategy includes using Codex with a security plugin for code validation, deploying AI for continuous alert triage and automated response, using frontier models to enumerate attack paths and test security invariants, and maintaining defense-in-depth fundamentals. Greg recommends a 10-step playbook for defenders.

💡 From my vantage point, I would encourage security teams to move with urgency 😅 I know a few companies trying to do like 2-3 years of security hardening in the next… month. I don’t think they’re wrong. As Samuel L. Jackson once wisely said.

A Coming Incident Crisis?
Phil Venables writes about a "perfect storm" of rising incident volume from three sources, attackers using AI to run more attacks in parallel (a ransomware gang going from 10 to 100 attacks a week), AI-driven fakery forcing companies to handle brand and authenticity crises, and misbehaving LLM chatbots landing on security teams' plates. On top of that, regulators worldwide are lowering the bar for what has to be reported and speeding up the deadlines, so more incidents pull in legal, compliance, and privacy work even when they're not significant on their own. Phil wants organizations to move from artisanal handling of a few incidents per quarter to industrial response for dozens per month, deploying Cyber Incident Response Management (CIRM) tools with AI to coordinate across security, legal, privacy, and executive teams.

The OpenAI/Huggingface incident; how we should manage the imminent arrival of autonomous hacking too cheap to meter
Joshua Saxe believes that the Hugging Face incident signals the beginning of AI-enabled cyberattacks that will escalate exponentially through 2027 and beyond. He disagrees with policymakers who want to restrict AI capabilities and suppress open weights models, arguing instead that defenders need broad access to AI cyber capabilities to operate inside attackers' OODA loops, especially since attackers already have access to frontier open weights AI and will use dark inference providers.

Joshua recommends a "light touch around restriction and a heavy hand around adoption" strategy: requiring critical institutions like healthcare providers and defense companies to adopt AI cyber defense on mandated timelines, while labs and inference providers focus on API security and customer vetting rather than capability restrictions.

“In 2027 and beyond, we’ll see substantial damages that start to show up as more and more attacker constituencies adopt frontier AI and defenders, en masse, get jolted out of complacency.”

Sponsor

📣 Threat Intelligence That Analyzes Every Binary

Is your scanner missing threats? Chainguard built one that doesn't: a scanner for the reality of the world we currently code in, where threats are sometimes blatant and sometimes disguised. It evaluates maintainer behavior, package contents, and publishing signals, then runs install scripts in a sandboxed, network-blocked environment to catch callouts to external servers, unauthorized file access, or hidden payloads, all before code ever reaches your build.

Chainguard is scanning 200,000+ packages a day and has already blocked 400,000+ packages detected as malware and greyware.

👉 See How the Scanner Works 👈

Nice, running dependencies in a sandbox to observe potentially malicious behavior 🤘 I like how Chainguard aims to reduce supply chain security risk systematically.

Cloud Security

CosmosEscape: Taking Over Every Database in Azure Cosmos DB
Wiz's Yuval Avrahami and Lior Maman show how a single Gremlin query could have compromised every database in Azure Cosmos DB, including those behind Microsoft's internal services like Entra ID, Teams, and Copilot. The chain starts with a Gremlin sandbox bypass using .NET reflection to achieve arbitrary code execution on the multi-tenant DB Gateway, which exposes the "Cosmos Master Key," a platform-wide signing credential that can fetch the primary key of any Cosmos DB account across all tenants, regions, and API flavors.

That same key also unlocks the Config Store, a Cosmos DB database registry that lets attackers enumerate accounts and filter by target organization before compromising them. Microsoft deployed a hotfix within 48 hours of Wiz's disclosure and completed a full architectural migration that eliminated the Cosmos Master Key entirely.

💡 It feels like it’s been a bit since Wiz published some big tenancy-breaking cloud vulnerabilities. Maybe we’ll see more now that they’re at Google? 🤔 

Hunting malware and malicious MCPs in memory on Kubernetes with FleetDM + Osquery + YARA
Ben Bornholm walks through using osquery's new yara_process table and Fleet's authenticated YARA rule distribution to hunt in-memory malware across two homelab scenarios, detecting a Sliver C2 implant running entirely in memory inside a Kubernetes DVWA container, and identifying credential theft by a malicious local MCP server posing as a code quality scanner for Claude Desktop. He built custom containerd_* tables for osquery, used recursive SQL queries that join on PID namespaces to reconstruct container process trees beyond PID 1, and configured Fleet's GitOps workflow to distribute YARA rules through osquery's existing enrollment identity.

Instead of writing rules to disk where attackers can read them or hosting them on an unauthenticated web server, Fleet uses authenticated retrieval to push rules straight to the agent, so responders can drop in new YARA rules for in-memory shellcode or credential theft while an incident is running.

Blue Team

uber/ADR
Tool by Uber which is a production security system for enterprise AI agents. The system pairs an observability sensor that captures agent telemetry (prompts, MCP activity, reasoning traces, tool calls, execution context) with a two-tier detector that identifies unsafe behavior like credential exposure, prompt injection, data exfiltration, and policy-violating tool use, benchmarked with ADR-Bench across 300+ tasks covering 17 agent attack techniques and 133 MCP servers. See also their arXiv paper and MLSys slides.

💡 Love to see how companies are securely using AI at scale, and awesome that they described it in so much detail and released the code + benchmark 🙏 

How We Secure Figma’s Internal Systems With Agents
Figma's Matthew Sullivan and Brad Girardeau describe an agentic security system built on top of Panther SIEM that investigates alerts, queries audit logs across AWS, Okta, GitHub, GCP, osquery, and over a hundred other sources, and autonomously opens PRs to fix issues, cutting time-to-resolution by roughly 70% on complex alerts and on-call pages by 20% through AI-driven severity downgrading. The architecture uses AWS Bedrock Knowledge Bases and Amazon Kendra for RAG-based retrieval of historical alerts, Tines for workflow automation with explicit tool interfaces, and a Snowflake SQL-writing investigation sub-agent that queries their Panther data warehouse.

Three memory layers (case memory as the RAG corpus of historical alerts, steering memory as behavioral guidance in markdown, procedural memory as self-learned database schemas) let the system refine investigations over time, with procedural memory dramatically reducing schema discovery queries. To keep those autonomous actions bounded, safety controls sit at the tool layer rather than in prompt instructions, with agent-authored PRs defaulting to draft and channel-aware prompt design preventing data exposure in public Slack channels.

💡 I really like the breakdown of the different types of memory and what they’re used for, as well as the “from investigation to code changes” section. Thoughtful security engineering post from Figma, as I’d expect. 👍️ 

AI + Security

inclusionAI/SingGuard-NSFA
By Ant Group: A dual-mode guardrail framework for agentic AI threats, grounded in a CIA-triad taxonomy of 185 risk variants across 7 domains including prompt injection, malicious code, tool abuse, and information leakage. The framework runs lightweight classification heads on top of frozen Qwen3.5 backbones. It operates in two modes, chain-of-thought reasoning for offline auditing and real-time classification at very low latency.

The Agent Access Model
Cloudflare's Matt Silverlock proposes the Agent Access Model (AAM), a framework for securing AI agents that extends BeyondCorp's zero-trust principles by authorizing every action against the task's accumulated state rather than trusting the run. AAM combines six components, an Agent Identity Broker for short-lived sender-constrained credentials, a Task-Scoped Access Engine for per-request least privilege, a Mediation Layer that controls harness tool calls and network egress, a Trust Ratchet that irreversibly removes capabilities when protected events occur, an Agent Activity Log for enforcement evidence, and a Grant Review Loop that proposes template changes from observed behavior.

Matt demonstrates this with an example nightly reconciliation agent where the Trust Ratchet blocks data exfiltration by closing processor and support paths before protected ledger data reaches the model, but acknowledges that multiplayer access control (where one agent serves multiple principals with different permissions) remains an unsolved problem.

Beyond Zero: For The Rest Of Us
Kane Narraway writes about Google's Beyond Zero paper, which shrinks the trust boundary from applications to individual actions on resources, asking "can this identity export these fifty thousand records right now" instead of just "can they access the finance system." Google can do this because it controls its full stack, but most enterprises face fragmented auth systems, SaaS vendors that don't expose external policy decision points, and industry-wide specs that aren't there yet. Kane suggests enterprises focus on what already works today, finishing data classification (using AI for labeling), enriching identity providers with HR and work context, deploying SSF and CAEP for real-time risk signals, MCP or API gateways for agentic access, and async policy evaluation to measure false positive rates before turning on enforcement.

The key difference from BeyondCorp is that Beyond Zero needs SaaS and AI vendors to adopt new external authorization hooks and specs like MCP authorization and CAEP, rather than the proxy-based enforcement enterprises could roll out on their own, making vendor adoption the real bottleneck.

Delegated authority, running locally: Give an agent on your machine an identity you can trust
1Password's Horia Culea presents a reference architecture for giving local AI agents like IDE coding assistants and browser copilots a trustworthy, auditable identity without long-lived credentials on disk. A trusted local app acts as a "trust anchor," verifying the agent's OS code-signing identity and minting short-lived SPIFFE JWT-SVIDs backed by a device key in the Secure Enclave or TPM. The architecture combines OAuth 2.0 Token Exchange for delegated tokens carrying sub (human) and act (agent) claims, emerging OAuth Transaction Tokens for per-call intent binding as a structural defense against prompt injection, WebAuthn/FIDO2 for phishing-resistant human authentication, and CAEP for near-real-time revocation.

💡 Great detailed discussion of delegated authority (agent acting on behalf of a human), and nice example at the end of having Claude use 1Password where: sensitive values are never directly handed to the agent, the agent works through a short-lived grant scoped to the moment (not a standing key on disk), and each grant is logged so each agent action is visible to the admin. I like it 👍️ 

Misc

Misc

• Jason Haddix - DEF CON Is Dead and Security Is Cooked… Or Is It?

• Seth Godin - The Amazon tax

• Kyle Gordon - White Guys When They Go to Africa - Full version

• fosrl/pangolin - An open-source, identity-based remote access platform built on WireGuard that combines reverse-proxy and VPN capabilities, enabling browser-based access to web apps (HTTPS, VNC, RDP, SSH) and client-based access to private resources through NAT traversal without public IPs or open ports.

• Guy doing impressive pole tricks while giving life and relationship advice

• After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

Politics

• Private security firms will soon be allowed to hack overseas cybercriminals

• China’s Military Is Now Using AI to Plan Strike Operations

• Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia - Dream Research Labs describes a multi-agent AI attack framework that compromised Asian government entities over four days in July 2026, using the Hermes and OpenClaw agent platforms to deploy up to 8 parallel sub-agents per wave across 12 attack waves. China → Taiwan.

• Sticky Wage Norms and the Real Wage Cost of Unexpected Inflation - Even accounting for job-changers, 37 percent of all U.S. workers saw real wages decline from 2021-2024.

AI

• xxyyue/llm-observer-proxy-go - A Go-based LLM observability proxy that embeds Bifrost Core (enterprise AI gateway) to create run-scoped proxies for observing LLM traffic without requiring Python, LiteLLM, or Docker.

• Y Combinator open-sourced QM, a multi-agent harness they use internally

• Influencer copying another’s videos for an ad using AI

• tigerless-labs/autoharness - A self-learning skill layer for Claude Code that automatically captures techniques from real coding sessions, consolidates similar skills instead of accumulating duplicates, and prunes unused ones based on real usage rather than benchmarks.

• Oh Lord, AI Reporters Are Actually Breaking Big News - RuntimeWire, an AI-powered newsroom has published nearly 2,000 tech news stories since May using autonomous AI agents that find stories by crawling court databases, web forums, company filings, and social feeds, then draft, edit, fact-check, generate images, and publish articles, sometimes without human review if deemed low legal risk.

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋