• tl;dr sec
  • Posts
  • [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards

[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards

Portswigger's James Kettle's HTTP Terminator, pretty crazy report about how threat actors were abusing Claude, how Cloudflare enforces code quality at scale

Author

Clint Gibler
September 17, 2026

Hey there,

I hope you’ve been doing well!

🎭️ Improv Friends

I had a somewhat bittersweet dinner with one of my (musical) improv comedy teams recently.

We’ve been rehearsing and performing together for probably over a year now, and it’s been a blast, but we’ve been losing steam.

It can be difficult as an indie team to have a regular show and rehearsal space. We’ve mostly been rehearsing in my friend’s room because he has a keyboard, while his roommate is playing video games and wearing headphones in the other room.

Fortunately, I don’t think we’re disbanding, but I think we’re going to rehearse together less frequently.

It made me think about school, work, clubs, and other social constructs that bring people together. And how we build relationships and memories together but as time flows and engagement changes, we can drift apart.

As an adult, it takes more intentional effort to keep these relational bonds together when there’s not some recurring event glue.

Maybe I’ll have greater appreciation and be more present when we do rehearse together. I suppose I’m worried about this being the first of a series of steps where the group fades away. Maybe I should tell them that instead of writing about it in a newsletter they won’t read ;)

I suppose it’s a good reminder to appreciate the people we get to be around in the life we’re living today.

P.S. In recent #PeakBayArea news I saw a car in San Francisco with the license plate: “TAXELON” 😂 

Sponsor

📣 AI didn't wait for your security policy.

AI is already in your workspace. Not in a pilot, not in a policy draft. Employees connected it themselves, one OAuth click at a time. It walked into an environment where 100% of organizations had sensitive data sitting in email at scale and 63% had files flagged by Google's own DLP. Restricting file sharing does nothing about access that was already granted. Security teams need to see what is connected and what it is reading. See how Material does just that.

The visibility and threat detection capabilities Material gives you across Gmail and Drive are pretty cool 👍️ 

AppSec

How Cloudflare enforces engineering standards using AI
Cloudflare's Timo Reimann writes about the Cloudflare Codex, a shared source of engineering standards in RFC format with SHOULD/MUST requirements that AI agents pull from across the SDLC. RFCs are organized by domain, each SHOULD/MUST statement gets a persistent identifier and is extracted into structured JSON, and each RFC moves from approved (non-blocking findings) to enforced (blocking violations) once teams have had time to adopt it.

Three agents pull from the Codex: a code reviewer that has flagged 230,000 violations and blocked 16,000 merges over four months, a spec reviewer on Cloudflare Workers that stores its results and state in D1 that has evaluated 600+ technical designs, and an incident report reviewer that has assessed 200+ postmortems since May 2026 and blocks high-severity incidents from closing until all findings are addressed. Beyond the agents, Cloudflare has added language-specific linters like oxlint for TypeScript and a CLI for local execution, and they’ll be expanding Codex to product, security, compliance, and trust and safety teams.

💡 I love the capturing of institutional and individual knowledge and expectations, and then scaling it to the whole team (or company), and applying it consistently.

Can AI do novel security research? Meet the HTTP Terminator
The blog version of PortSwigger's James Kettle’s Black Hat USA / DEF CON 2026 talk. James asked himself, “Can an autonomous system invent new attack techniques, and use them to hack live websites at scale?” So he built the HTTP Terminator, an autonomous system that invents HTTP desync techniques and validates them against live bug bounty targets. He split 138 RFCs into 15,000 fragments of one to three sentences each, an approach that stops the model anchoring on his own published work, and generated 30,000 vectors that a Burp extension tested continuously against 30,000 websites.

The system invented multiple working triggers, along with a new desync pattern built on dual matching Content-Length headers. It also produced the dangling-byte technique, which removes the race condition that normally makes response queue poisoning unreliable. On one target it caught a server answering a single request with two responses, which James names response forking and treats as evidence of a new desync class.

The most significant discovery came from feeding proven findings back in as inspiration. Looking at one of its own results, the system proposed Shared Parser Confusion. Many servers use the same parser code for requests and for responses, so an attacker can reach response processing features simply by sending a request. James validated the idea manually and says neither he nor the system would have found it alone.

💡 Absolutely excellent research from James, highly recommend. Very useful overview of having AI create and then test a bunch of hypotheses to discover novel attack techniques. I’d been thinking about using RFCs to seed security research, cool that James tried it and it worked.

Sponsor

📣 YOLO mode, minus the blast radius

Agents on a dev laptop inherit everything: SSH keys, cloud creds, dotfiles, prod access. YOLO mode is the default now, nobody's pretending otherwise. Minimal runs your agents in isolated, reproducible environments. Same box for humans, agents, and CI. Open source, local first. Give your agent a computer, just not yours.

Isolated, reproducible development sandboxes and a secure package manager that give your whole team identical environments👌 

Cloud Security

AWS EKS forensics: data sources and investigation tooling
Synacktiv's Théo Letailleur maps the forensic data sources available in Amazon EKS across three layers: the Kubernetes control plane (audit logs via CloudWatch), worker nodes (Container Insights for application/host logs), and AWS services (GuardDuty, CloudTrail, VPC Flow Logs). He shows investigation techniques using CloudWatch Logs Insights queries to detect RBAC reconnaissance, privilege escalation, and static pod persistence, while explaining how GuardDuty findings provide Kubernetes context (namespace, pod, ServiceAccount) and AWS identity correlation.

Theo emphasizes that investigation success depends on pre-incident logging configuration, as EKS emits almost no telemetry by default, and provides specific queries for detecting node credential exfiltration and container escapes.

The Two Mitigations for the Service-Account Confused Deputy in the Cloud
Kat Traxler breaks down confused deputy attacks in cloud environments into two categories based on identity ownership: customer-managed identities (GCP service accounts, AWS IAM roles, Azure user-assigned identities) and provider-managed identities (GCP service agents, AWS service-linked roles, Azure platform-level service principals). For customer-managed identities, mitigation relies on bind-time authorization checks when attaching identities to compute resources, not runtime checks.

For provider-managed identities, CSPs implement internal authorization checks to validate the original caller's permissions, with AWS being the only provider that exposes this machinery through Forward Access Sessions (FAS) and condition keys, while GCP and Azure keep their checks opaque, surfacing only as PERMISSION_DENIED or LinkedAuthorizationFailed errors.

Blue Team

Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit
The Sysdig Threat Research Team watched a single threat actor connect to marimo's unauthenticated /terminal/ws endpoint and go from open WebSocket to SSH bastion login in 8 seconds using hand-coded Python tooling with no LLM in the loop. Marimo notebooks typically sit alongside ML pipelines on hosts with cloud credentials, so the attacker spent 4 hours building custom boto3 scripts to harvest AWS credentials from environment variables and the app's Redis backend, then pulled SSH keys from Secrets Manager with a fallback across five AWS regions. The attacker walked past a planted prompt injection trap that caught every LLM-driven operator Sysdig has profiled against this same CVE.

Despite looking nothing like the LLM-driven operators at the shell level, this attacker hit the same cloud endpoints, and Sysdig says the detection signal is the chain itself, /proc/self/environ or .env reads followed by a Secrets Manager call and outbound TCP to a non-RFC 1918 address on a non-standard port within the same minute.

💡 Interesting that their prompt injection trap has effectively been catching “every” LLM-driven operator for this CVE. Given how quick coding agents are at building, I wonder if threat actors will switch to more “just in time” dev for specific exploitation or exfiltration tasks, run those to achieve an objective quickly, then pause and continue, as the deterministic code may be less likely to make certain LLM mistakes.

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
Wiz's Sean Johnstone, Shahar Dorfman, Zohar Kaplan, and Kurt Giacchino identified active exploitation of three vulnerabilities being chained together to bypass authentication, escalate privileges, and gain administrative control over vulnerable Artifactory instances. They observed post-exploitation activity including the creation of persistent administrator accounts, the deployment of malicious Groovy plugins for code execution, and the installation of Rust-based backdoors to establish persistence. The post shares some nice details about determining if you’ve been affected (e.g. POST requests to this route).

Despite patches being available, 59% of organizations remain vulnerable to the first six weeks post-disclosure, 62% to the second after four weeks, and 49% to the third after two weeks. watchTowr found threat actors attacking Internet-exposed systems just four days after the third was disclosed by JFrog.

💡What stuck out to me about this post is a) threat actors were scanning the Internet for vulnerable systems four days after disclosure, and b) it looks like ~half of Wiz customers with Artifactory, which are companies who have budget for Wiz, haven’t patched after two to six weeks. I would assume this is representative, if not on the higher end, of patch rates of a random set of companies.

AI + Security

Solving the Identity Crisis for AI Agents
Matt Mathew, Prasad Borole, and Meng Huang describe how Uber has extended their Zero Trust Architecture to support AI agents by implementing a Security Token Service that mints short-lived, single-hop JWT tokens carrying full actor chain attribution (user → agent → agent → tool), solving the problem of lost provenance across multi-agent workflows. The architecture integrates SPIRE for workload identity verification, an Agent Registry for agent-to-workload authorization, and an MCP Gateway for policy enforcement, with all token exchanges automated through a standardized A2A client built into their Python SDK.

Detecting and countering misuse of AI: September 2026
Epic threat intel deep dive report by Anthropic documenting Dec 2025 - Aug 2026 misuse of Claude (Haiku, Sonnet, Opus) across cyber, influence operations, surveillance, scams and fraud, biological and conventional-weapons domains, case studies they disrupted, and how adversaries used agentic AI to materially uplift operations.

Claude was used as an engineering and orchestration layer for influence networks (70 fake news sites), surveillance platforms (including a population-scale domestic surveillance platform that monitors roughly 25 million SIM cards in Mali), weapons software (guidance, navigation and control for rockets, autonomous military drone‑swarms), and dual‑use biology work (reseller evasion, gain‑of‑function planning, venom/toxin atlases), with operators stealing and reusing AI API keys as compute/cover.

Anthropic also exposed large illicit distillation campaigns by PRC labs and vendors (Alibaba/Qwen, Moonshot/Kimi, DeepSeek, Zhipu/GLM, …) that harvested chain‑of‑thought via CoT extraction and cross‑session replay (using OpenClaw, OpenCode, LiteLLM and proxy farms). Other actors built automated exploit foundries with AI, discovering over a dozen 0-days in a month. Another used AI to monitor how well their tools evaded detections from known security defenses, and automatically modified and rebuilt the malware until they evaded detection.

“The cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.”

💡Incredible read, well done Anthropic team 👏 This could (will?) be a movie. And these threat actors were using models that are significantly worse than what the frontier will be before end of this year 😅 And by then open weight models will probably be where frontier models are today, so threat actors can use them without being banned…

If you have a few hours and don’t mind becoming more paranoid, highly recommend giving this a read.

Misc

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋