• tl;dr sec
  • Posts
  • [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026

[tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026

Threat actor using open source harnesses to hack companies, how to use GitHub logs to find baddies, using LLMs to find novel Java deserialization gadgets

Author

Clint Gibler
September 24, 2026

Hey there,

I hope you’ve been doing well!

🙏 My Wish for You

There are many health and wellness gurus out there, and I don’t want to be one of them.

But working in security, with the pace of change these days, can be stressful.

Sometimes I do Box Breathing, or touch grass, or recall mantras like focusing on what’s in my control.

I recently came across another saying that stirred something deep within me, so I wanted to share it with you too:

But ideally not during a meeting in a small room

Namaste my friend 🧘 

Sponsor

📣 You Can't Prompt Engineer Your Way Out of a Fragmented Asset Inventory

Surprise: AI is an amplifier, not a janitor. Feed it incomplete security data, siloed tools, and unreconciled asset records, and it'll just make your problems faster. Before your security team goes all in on AI, you need to nail the fundamentals first. Axonius breaks down a six step framework — Collect, Correlate, Normalize, Enrich, Model, Assess — that builds the data foundation AI actually needs to work. Control readiness isn't nice to have. It's the whole game.

Agreed, nailing the fundamentals is still critical. Asset inventory is one of those tough but important problems in my experience, and something I hear from friends.

AppSec

CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger's Tom Stacey and TurtleSec's Tobia Righi show how HTTP header injection can be escalated all the way to a self-replicating CRLF-Powered desync worm. It starts with one Nginx misconfiguration, the $uri variable in a proxy_pass directive. Nginx normalizes the path before forwarding it upstream, decoding any %0d%0a an attacker slips in, so an injected newline becomes a real header boundary in the request the backend receives. That single primitive is enough for response queue poisoning, and an injected Transfer-Encoding header turns it into a CL.TE desync. The worm goes further, firing XSS in a victim's browser and using that browser to hit the next victim.

A telecoms provider leaked internal access tokens for $20,000, a payment provider spilled card numbers from inside its Kubernetes cluster and exposed every org running on it, and cookie tossing on TikTok stole a victim's unpublished clips for $4,500. Both open-sourced their tooling, Tom's Burp extension crlf-powered-desync-scanner and Tobia's nuclei templates crlf-desyncs.

💡 Portswigger research - chef’s kiss 🤌🧑‍🍳

Breaking into Google's GFile for $100k
Arvin Shivram earned $97,604 across two Google VRP reports by chaining bugs in two internal APIs into read and write access across Google's production storage. His AI tooling flagged firefly-pa.googleapis.com, a YouTube partner management API with no authorization checks, where he could dump every partner's CMS records and create file-copy jobs between internal storage paths. The jobs wouldn't run on their own, but a task-completion callback didn't check who was calling, so Arvin faked a success report and the scheduler dispatched his copy to production. The copy went through GFile, Google's file abstraction that picks a storage backend based on path prefix, and the field named bigstoreIdentifier accepted any prefix, so swapping /bigstore/ for /cns/ or just / gave him access to Colossus, Chubby, and the local filesystem, including /etc/passwd.borg with every Googler's LDAP.

Three days later he found an unauthenticated endpoint that copied user-supplied paths into CNS but gave back no filename when the copy worked. Arvin got around that by surrounding the real copy with deliberate failures in a single batch request, leaking neighboring filenames from the same borgtask and using GPT-5.6-sol to predict the hidden path from the gaps. Once he had the path, the Firefly GFile reader from the first bug pulled the file out of CNS and into his bucket.

Sponsor

📣 Discover shadow AI and enforce your policy where AI interaction happens: In the browser

Blocking AI drives usage underground. 80% of employees who use unapproved AI tools do so because it's easier to use their own accounts, and 57% because the approval process is too slow. The solution? Make the governed path easier than the workaround. 

Push Security discovers every AI app, extension, and OAuth integration across your org, then enforces graduated controls — monitor, warn, or block — per team. Stop risky interactions in real-time, track activity across all AI apps, and guide users to the approved alternative.

100% making the default path the secure path is the way to go. Having visibility in the browser is pretty useful.

Supply Chain

git-pkgs/brief
Tool by Andrew Nesbitt that detects a project's toolchain across many ecosystems, designed so AI coding agents get structured information on languages, package managers, test runners, and linters. Beyond the bootstrap report it can map the detected stack to CWE/OWASP categories through a deterministic taxonomy lookup, and lists framework-specific dangerous functions like eval, html_safe, and find_by_sql with notes on when each call is actually exploitable.

git-pkgs/git-pkgs
Tool by Andrew Nesbitt for analyzing package/dependency usage in git repositories over time. It indexes a repository's full dependency history across 35 package managers into a SQLite database, so you can ask when a package was added, who added it, what changed between versions, and how long a known CVE sat in the tree before someone fixed it.

It also scans against OSV with historical context (who introduced each vulnerability, who fixed it, exposure window metrics for CRA compliance), checks licenses against allow or deny lists, and outputs SARIF for GitHub Advanced Security ingestion. Integrity tracking flags cases where the same package version shipped different SHA-256 hashes across commits, a signal of supply chain tampering even when the version string never changed.

Blue Team

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
Wiz's Eden Abergil walks through a six step approach to investigating GitHub PAT compromise using a real-world campaign as an example: first contain the compromised PAT, then reconstruct the timeline, identify the source of the leaked PAT, assess the blast radius, rotate exposed credentials, and hunt for the unauthorized use of leaked secrets. The campaign (mid-May to early June 2026) hit multiple organizations in three phases: API-based reconnaissance from AWS us-east-1 to query repository READMEs, low-volume validation cloning from a HostPapa IP across several victims within seconds of each other, and mass exfiltration of thousands of repositories per organization from 102 AWS ca-central-1 IPs.

Even with this playbook, two gaps in GitHub's logging can limit what responders find, the reconnaissance phase generated api.request events that only show up in Enterprise Log Streaming, and Git events like git.clone are only retained for seven days, so organizations without log streaming in place before an incident lose that telemetry after the window closes.

Mapping out your unknown: A threat hunter’s guide to GitHub
Datadog's Julie Agnes Sparks and Juvenal Araujo share a threat hunting guide for GitHub audit logs focused on catching compromised accounts and tokens used for source code exfiltration and pivoting into connected cloud environments. The guide maps queries to MITRE ATT&CK tactics across the attack chain, from login anomalies and OAuth app authorizations, to secrets enumeration and private repository discovery through Git Trees and Contents APIs, to bulk git.clone operations and ZIP downloads. The key is knowing what normal looks like, baselining each user's repository access patterns, source IPs, and geographies, then flagging deviations like clones spanning unfamiliar teams, bulk downloads from hosting providers, or activity outside working hours. The hashed_token field is the most reliable way to track a specific token's activity across event types since other identifiers are inconsistent.

The guide also warns about GitHub logging quirks that affect investigations, external_identity_nameid is missing from some api.request events (breaking employee attribution), external identity and source IP are omitted on failed requests (removing geolocation data), token permission metadata reflects the token's own organization rather than the one being accessed, and repository visibility is split across three different fields (visibility, public_repo, repository_public) depending on event type.

💡 Last BSidesSF Julie may have ranted to me over lunch for at least 30min about GitHub’s (and other platform’s) logs 😂 As they say, turn your pain into art a blog post.

Red Team

Abusing Modern Browser Features for Phishing
Certitude Consulting's Alexander Hurbean and Wolfgang Ettlinger explain how they chained four browser features into a phishing attack that builds a convincing fake Windows login screen without triggering any browser warnings. The attack starts by running a WebGL shader that freezes the GPU just long enough to suppress the fullscreen notification banner, and once the victim is in fullscreen the Keyboard Lock API keeps them there, blocking Alt+Tab and requiring them to hold Escape for several seconds to get out. The screen looks real because they embed and duplicate a Google One Tap iframe (one copy for the profile picture, one for the username) and use CSS to reformat and reposition both so they blend into the fake login screen, all without ever reading the iframe's content.

Alexander and Wolfgang reported the bugs to Chromium and Mozilla in May 2024, and nearly two years later neither browser has provided a patch timeline. The attack isn't limited to Windows login screens, the same chain could simulate a BSOD and reboot to capture a Bitlocker PIN. Their main defense recommendation is requiring Ctrl+Alt+Delete before every Windows login through Group Policy since no website can intercept that shortcut, alongside phishing-resistant MFA and browser policies that block fullscreen and keyboard lock by default.

Finding Gadgets Like it’s 2026
Atredis Partners’ Stephen Breen developed an LLM-based methodology using Claude Code to automate Java deserialization gadget chain discovery, successfully finding 17 confirmed chains (6 novel) in modern application servers like WildFly, Payara, and IBM WebSphere in just two days. The approach uses WALA for call graph construction and class hierarchy analysis (stored in SQLite), a FastAPI query server with endpoints like /paths and /type_confusion_targets, and Claude Code as an agent that iteratively discovers, tests, and debugs candidate chains using JDWP debugging and taint tracking. The Claude Code plans and Runbook can be found in their llmchainhunter GitHub repo.

“One thing that worked surprisingly well was the “test, debug, reason” loop that had the LLM automatically try and debug payloads that were not working. This was a very effective strategy and generalized to using agents in general - whenever possible, building in feedback loops is a great strategy. Another surprising and accidental result was watching the LLM agents make changes to the core tooling when it was not working as effectively as it could; this exposes a new way of thinking about source code as dynamic and malleable while a Runbook defines the actual process and goals.”

💡 Static analysis, LLMs, clever research… this is like the end to a beautiful romcom to me *sheds a single, happy tear*. As I’ve mentioned numerous times in this newsletter, setting up agents so they can iteratively work, test hypotheses, etc. is going to get you massively better performance.

AI + Security

Quicklinks 

*Sponsored

Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target
Gambit Security’s Eyal Sela describes how a financially motivated threat actor has been using three open-source AI harnesses, Strix for vulnerability scanning, Cairn for autonomous exploitation, and Hermes for orchestration, to compromise at least 27 companies between July and September 2026, with total costs of only $12,000 - $18,000 ($25 average per target). The campaign used models including GLM 5.2, DeepSeek v4 Pro, and Opus-4.6 through OpenRouter, and overall had minimal human input (e.g. just short Chinese instructions like "read the vulnerability report and start").

The attacker exfiltrated 600,000+ credit cards from two retailers, injected skimmers on 19+ websites using methods like JavaScript file appending, S3 bucket poisoning, and as a Kubernetes initContainer for the production front-end deployment. The attacks often achieved access in hours. “Each attack path was chosen by the harness in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different TTPs across victims.” Example chain: SQLi → MFA bypass → file upload → RCE → privilege escalation → AWS Secrets Manager dump → database decryption.

💡 Yikes, using open source harnesses and open weight models unfortunately appears to be quite effective at hacking companies for a very affordable price 😅 

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days
Proofpoint’s Mark Kelly, Greg Lesnewich et al identified four espionage-motivated threat actors, primarily China-aligned, rapidly deploying a new exploit kit they call BlueMoon starting 28 August 2026, which chains a Chrome V8 type confusion, a V8 sandbox escape, and a Windows kernel LPE to get code execution outside the browser sandbox. Both V8 bugs were patch-gap zero-days, already fixed in upstream Chromium source but not yet in stable releases, giving the developer a nearly four-week window to turn publicly available patches into a working chain.

“It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

The first actor to use it was TA412, which hit US NGOs and installed GemStone, a browser extension disguised as Google Gemini that steals cookies, captures keystrokes, and polls for commands through a Cloudflare Worker. Within days, three more actors followed, UNK_LateNight targeting US aerospace with ShadowPad, UNK_DoubleCheck hitting Vietnamese manufacturing, and UNK_QuietRacket going after Indonesian and Singaporean government and financial organizations. The kit all four actors used contains evidence of AI-assisted development, extensive logging, a referenced markdown handover document, and debugging comments walking through earlier failures. The deployment itself looked rushed, with the LPE limited to older Windows builds, curl downloads to %TEMP% as the default payload delivery, and infrastructure stood up the same day as campaigns.

Misc

Misc

AI

Politics

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋