• tl;dr sec
  • Posts
  • [tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev

[tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev

OSS tool to reverse binaries, apps, etc. with natural language, new hunting toolkit by Cisco Talos, testing Jev on identity resolution

Author

Clint Gibler
October 15, 2026

Hey there,

I hope you’ve been doing well!

🤔 Advice

One of the biggest emotional intelligence unlocks I’ve had is learning to differentiate when a partner or friend is wanting to a) vent or b) problem solve.

It’s kind of embarrassing, but I think I was late 20’s to early 30’s when that really sunk in.

I also noticed that (most) therapists seem to not want to tell you what to do.

When I first started therapy, I went in thinking, “OK, you’re an expert in this space and have spent years studying it. I am going to give you my full context and then you can give me an educated, weighted advice and plan based on your knowledge + my specific context.”

But it was difficult to get them to give a “this is the answer” or “you should do X” type judgement.

After some reflection and further discussion, it makes sense why, though I still kind of find it annoying to be honest.

Maybe they’re worried about this:

I’ve found long discussions with friends who’ve known me for years really helpful for stuff like this (shout-out my bud Daniel Miessler).

I hope you too have friends with whom you’re filling up your relational context window 😂 

Sponsor

📣 Personal AI agents are crossing the corporate trust boundary

An employee connects their personal AI agent to Slack. Now it can read internal conversations, access files, and act through authenticated sessions. 

Computer-use agents introduce a new class of unmanaged access that traditional SaaS discovery, EDR and DLP weren't built to address.

Harmonic gives security teams visibility into employee AI usage and the sensitive data flowing into AI tools, so you can identify risky behavior without blocking adoption.

Great to get visibility into AI usage while supporting the business, as people will likely work around bans.

AppSec

Zero to Calc in Six Days: Inside XBOW’s Chrome Full Chain
Brendan Dolan-Gavitt describes how XBOW researchers built a Chrome full-chain exploit in six days for $40k in API costs using GPT-5.6 Sol, which received a $250,000 Chrome full-chain reward. The exploit combined a V8 compiler bug, an animated-WebP decoder bug, and a memory-safety bug in Crashpad, which together turned JavaScript execution in an ordinary Chrome tab into code execution outside the renderer sandbox.

💡 $40K (not including human costs) to make $250K, not too shabby. Hopefully the required token cost to achieve similar exploit capability will rapidly rise for important targets like Chrome, Linux, etc.

Grounded or Gamed? We Audited Our Own Cyber Benchmark
Semgrep's Brenden Noblitt introduces four metrics (beyond true/false positives and negatives) to evaluate whether LLMs reason about vulnerabilities or just pattern-match. Counterfactual checks whether findings disappear when the vulnerability is patched, metamorphic whether findings persist after renaming identifiers, selectivity whether models avoid flagging safe code with similar structure, and stability whether findings hold across scans.

Testing IDOR detection across GLM-5.2, Kimi K2.7, MiniMax M3, Claude Opus 4.8, GPT-5.5, and Semgrep Multimodal on a repository with 27 known IDORs, all six models were well-grounded, but every one missed 70% of the real IDORs, and pooling all five LLMs raised union recall to only 29.6%. Models catch textbook IDORs in file-download handlers but miss the same shape on document, prompt, and tool endpoints.

💡 This is cool, I like breaking down and measuring model performance across a number of dimensions, not just TP/FP/FN, etc. I will say 27 IDORs is a bit of a small sample set, and if it’s just one repo, does that mean it’s the same programming language and web framework for each vuln? I also wonder if you add in some repo-specific SECURITY.md or AUTHZ.md context, if the same models would perform significantly better. My intuition says yes but would be neat to test 🤔 

Sponsor

📣 CodeAF: open-source software factory with vulnerability hunting built in

CodeAF is a new open-source software factory built for open models like DeepSeek and Qwen, with vulnerability hunting built in. Every candidate must survive a challenge before you see it: a source-to-sink trace, a sanitization check, a concrete exploit path. Findings land as SARIF with CWE IDs and a suggested patch. On one open model it tops DeepSource's published OpenSSF CVE Benchmark table on F1. On DeepSWE, same model, it solved nearly 4× as many real GitHub issues as Claude Code, at 3.4× less per solved issue.

Hm, looks like they’re making some interesting workflow decisions and have a cool design. Looking forward to playing around with it.

Cloud Security

What Is EntraGoat? A Deliberately Vulnerable Entra ID Simulation Environment
Semperis' Jonathan Elkabas and Tomer Nahum released EntraGoat, an open-source deliberately vulnerable Entra ID environment that simulates real-world misconfigurations. The tool uses PowerShell scripts and Microsoft Graph to deploy scenarios including service principal misuse with Graph API permissions, privileged role escalation via application ownership, PIM activation chains and eligible role abuse, dynamic administrative unit poisoning, and certificate authority forgery for Global Admin impersonation. Each challenge starts from an already-compromised identity rather than requiring reconnaissance.

AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
Zenity Labs' Tamir Ishay Sharbat and Lana Salameh discovered that AWS Bedrock AgentCore agents could access their instance's IMDS endpoints via SSRF, since the Firecracker microVMs they run in don't isolate network access, allowing an attacker with chat access to extract credentials with a single prompt and compromise all AgentCore agents in the same AWS account and region. The overprivileged default IAM role granted permissions to read all private conversations, pull ECR images, plant persistent memories that hijack agent behavior across future sessions, and extract tool credentials.

AWS initially closed the IMDS access report as "informative" after implementing IMDSv2 and left the default role unchanged through two follow-up reviews, only restricting its permissions shortly before publication. Their public statement still calls the behavior documented and expected.

Blue Team

runZeroInc/sshamble
Tool by runZero that finds insecure, unusual, or unique exposures on SSH servers. It inventories authentication capabilities, looks for username-enumeration timing behavior, tests public-key handling, checks the badkeys blocklist, and probes for implementation-specific auth bypasses, pre-auth state transition flaws, or post-session weaknesses. The output is JSONL, which makes it easy to feed into SIEMs or inventory databases for broader asset analysis workflows.

Introducing CAIRN: Frontier tracking for AI-integrated malware
Cisco Talos' Ryan Fetterman released CAIRN (Cognitive Artifact Intelligence Research Network), a metadata-first hunting toolkit that identifies AI-integrated malware by extracting "cognitive artifacts" like prompt templates, API endpoints, jailbreak strings, and AI provider domains from VirusTotal metadata without downloading binaries. The tool uses 24 acquisition filters to discover samples, a three-tier YARA ontology (T1 for AI artifacts, T2 for behavioral context, T3 for family attribution), semantic clustering with HDBSCAN and UMAP for discovering unknown variants, and relationship graphing to map infrastructure and campaign connections.

CAIRN's initial findings reveal an "autonomy escalation arc" from optional LLM features to fully autonomous multi-model orchestrators within a single year, and an AI-analysis evasion technique traced to a red team instructor that reached unrelated actors within 12 months. See also: The Closed Quorum: Inside the first reported autonomous AI C2 implant.

Context Collapse, Part 3 - AI Worming through Word
Continuing the Context Collapse series, Håkon Måløy shows how a document-borne AI worm works in Microsoft Copilot for Word, where malicious instructions hidden in an external document (as white text on white background) cause Copilot to alter financial figures in generated reports and copy the full attack payload into each downstream document it produces. The hidden text works because Copilot strips all formatting before passing content to the LLM, so text a human can't see is fully readable to the model. Once the payload reaches a second document the original is no longer needed, and the attack spreads through normal workflows across SharePoint, Teams, and OneDrive as each affected document becomes a new carrier.

Over 144 days Microsoft deployed two mitigations including a GPT-5.5 model upgrade, but Håkon reproduced the attack class on GPT-5.6 because the problem is architectural, not implementation-specific.

💡 I’ve seen a number of people mention self-propagating AI worms. Hasn’t seen to have been a huge thing yet, but seems feasible 😅 

Red Team

REA - Reverse Engineer Anything
One MCP for reverse engineering across binaries, applications, and runtime behavior. See a feature you like. Understand how it works, down to the binary level. It leverages a number of existing tools like Hopper, Ghidra, or IDA.

💡 A week or two ago one of my colleagues said, “reverse engineering is basically saturated/solved by current models.” Super cool project. Being able to build so much so quickly, and understand how arbitrary software works is such a cool time for all of us to be in tech. Feeling #blessed.

AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps's Russel Van Tuyl examines how AI is currently being used across their consultants’ offensive security work, covering eight use cases from research and analysis, tool development (LLM-generated Mythic agents and Beacon Object Files), and reconnaissance through BloodHound MCP and DeepPass2 (secret scanner), to social engineering, vulnerability discovery, long-running automation, stealth adaptation, and evidence organization. The team has found roughly 40 previously unknown bugs this way, including LPE, RCE, and a container escape, with work that once took months now taking hours or days.

Russel believes web application assessments and external network tests are the best current fits, where results are observable and repeatable enough to validate independently. One common failure mode is that models can satisfy a weak success metric without performing the intended action. Russel's advice is to start with bounded problems and measure workflows where they'll actually run.

💡 Great overview article that also links to other cool research SpectreOps has done 👍️

AI + Security

Quicklinks:

*Sponsored

How DigitalOcean Manages Credentials for Autonomous Agents
DigitalOcean's Tyler Healy describes their Managed Agents architecture that prevents autonomous agents from ever holding credentials directly, instead brokering access through their Action Gateway at execution time and running agents in isolated microVM sandboxes with zero-egress network policies and non-root execution. For workloads the gateway doesn't broker, three credential tiers decide who can read the value back:

  1. env for non-sensitive config, scanned for credential-shaped prefixes like sk- and AKIA.

  2. secrets for encrypted storage that still injects the real credential into the sandbox where anything the agent spawns can read it.

  3. Scoped secrets that bind a credential to one HTTPS destination so the sandbox only receives a short-lived handle redeemed by an egress proxy.

Sub-agents each get their own microVM and resolve their own handle, so a fan-out of fifty sessions carries the same exposure as one, with the whole thing designed to fit NVIDIA's OpenShell policy schema and leave the boundaries in a spec security teams can version.

Test-driving Jev on a security task: identity resolution
Vincenzo Iozzo evaluates Jev, TypeSafe's “type one thinking” decision model, on identity resolution, the problem of working out which of a company's scattered accounts belong to the same person, comparing it against Claude Opus 5.5, Sonnet 5 and Haiku 4.5, a prompted gpt-oss-20b baseline, and traditional entity resolution methods. Jev came out ahead on the large environments at a fraction of the Claude models' cost and roughly ten times their speed, which matters at the scale of a 100,000-account directory.

Jev connects JDOE to [email protected] through the company's naming convention and refuses msmith and msmith1 because the second account exists precisely because a second M. Smith joined. The older methods can't do that, with classic record linkage getting close on tidy directories but falling apart on messy ones, and a supervised classifier trained on four environments collapsing on the fifth. Jev isn't flawless either, since duplicate guest invitations and secondary accounts land in a maybe zone just under its cut-off, though sending those to Sonnet 5 for a second opinion recovers most of them.

Misc

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋