🛡️ A thousand fewer paths to root

This week we launched a blog that’s literally been months in the making.

I included it in the AppSec section below, so here instead I’ll reflect a bit about the behind the scenes and what it felt like doing it.

1) Working at a frontier lab is very unique. You can be unreasonably ambitious and (at least right now) the company is surprisingly cost insensitive for using tokens for research. So spending $1.2m on scanning Linux is totally fine.

2) The company cares a lot about securing the critical software the world relies on, and we talk about it daily. I don’t actually know the numbers, but I wouldn’t be surprised if we have already and will continue to spend tens of millions of dollars in tokens on securing important OSS software, even if it has no direct business value. Just because we think it needs to happen.

3) Kyle is such a joy to work with. And he just loves finding bugs. Every time he finds another few hundred 0-days (not exaggerating), he’s basically bouncing around like a kid at Christmas. We were in the office until 9pm every night this week finishing the blog post, and he was always positive.

4) I’ve noticed that just like how the hedonic treadmill can get you desensitized to fancy hotels and Michelin star food, I find the security research team and I are getting gradually desensitized to absolutely wild bugs. Like, the kind that would be the talk of the year a few years ago, we find probably on a weekly basis.

Now, unless the bug is unauthenticated remote code execution on software used by 10’s to 100’s of millions of people or servers, we’re like 🤷 That’s OK I guess. RCE but it takes 1 or more clicks? Weak. Full compromise but it requires a non default configuration 🥱 

I definitely did not predict this before joining, and I would have thought this situation was outlandish and impossible at the beginning of this year. The world has changed. I’ve changed.

More thoughts later, it’s bed time and there are more bugs to disclose tomorrow.

👉️ A thousand fewer paths to root 👈️

(Discuss on LinkedIn or X)

Sponsor

📣 The AI SOC Buyer’s Guide

Buying an AI SOC isn’t like buying a SIEM or a SOAR. The old RFP measures features and integrations. It doesn’t tell you whether a platform can reason about your environment, learn from your analysts, or act safely on its own.

The AI SOC Buyer’s Guide, from former Virgin Atlantic CISO John White, gives you a framework for the decision: what you’re actually buying, the differentiators that hold up under scrutiny, and the questions to bring into every vendor meeting.

👉 Get the Guide 👈

AppSec

A thousand fewer paths to root
OpenAI describes an autonomous vulnerability discovery, exploitation, and patching pipeline. In one run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in Linux at an API cost of $1.2 million, ~$1,279 per LPE. During the run, the agents in this pipeline discovered and used at least 10 novel Linux exploitation techniques.

💡 Shout-out to my friend Kyle Zeng who created the pipeline and did most of the research, and then he and I jammed on the post with other colleagues for…a long time. I’m happy with how it turned out. There are a ton more interesting details in the blog that I don’t have space to describe here, but I’m happy to answer questions on LinkedIn or X, feel free to write a comment (or smash that share button 😆) Oh yeah, and I helped create the official OpenAI X thread, that was a cool experience.

Also fun fact: Greg Brockman helped with the title and did some editing, he’s surprisingly involved in a lot of details and very focused on cyber these days.

How We Scaled Security Reviews Without Slowing Down Engineering
Postman's Anurag Mewar describes how they moved security reviews from a manual model where every service release waited for AppSec sign-off to risk-adaptive routing based on service criticality and change sensitivity. Mandatory triage questionnaires at the release and PR levels feed aggregated responses into each VAPT (Vulnerability Assessment & Penetration Testing) ticket, auto-closing low/medium severity services with no security-sensitive changes while high/critical services always get manual review.

Auto-closed releases still pass through SAST, SCA, secret detection, and infrastructure policy enforcement, with AppSec auditing them monthly to validate triage accuracy. So far 25% of releases auto-unblock and the team has reclaimed 3 full business weeks of AppSec capacity per half-year, with a composite risk score in progress that will sort releases into autonomous, oversight, or critical review tiers.

💡 I really like the data-driven approach: they added structured, required fields for security engineers to record info in each ticket, tracking aspects like: was manual security review required, manual review effort, trends in early vs late AppSec involvement, etc. And they review all automated decisions monthly to refine the questionnaire and recalibrate the automation 👍️ 

Sponsor

📣 Nov 19: The five SIEM architectures splitting the market, compared

Most SIEM comparisons stop at detection coverage and price per GB. This session starts with the data architecture underneath, because that is what decides whether you keep visibility as log volume grows or quietly start dropping sources to protect the budget.

SACR founder Francis Odum and Datadog Cloud SIEM PM Eitan Moriano walk through the five models splitting the market today, where each one breaks down, and what an AI agent needs underneath it before its conclusions are worth acting on. Live Thursday, November 19.

👉 Save your seat 👈

Nice, Francis Odum is a friend of the newsletter, and I like his detailed breakdowns of different areas of security and market maps. He’ll share some good perspective 🤔 

Cloud Security

No quarantine for Bedrock Mantle
Plerion’s Daniel Grzelak demonstrates how AWS's AWSCompromisedKeyQuarantineV3 policy fails to block LLM inference through the newer bedrock-mantle service, which uses bedrock-mantle:CreateInference instead of the blocked bedrock:InvokeModel action. He shows that attackers can still run DeepSeek, Qwen, and 36 other open-weight models through the Mantle endpoint even after quarantine is applied, with these calls only visible as CloudTrail data events that are disabled by default in most accounts. Daniel recommends enabling CloudTrail data events for AWS::BedrockMantle::Project, using SCPs to deny the service if unused, or waiting for AWS to update the quarantine policy to include bedrock-mantle actions.

💡 Sneaky! Daniel makes a good point regarding AWS’ deny list approach not being ideal here, as it’s reactive by design and AWS keeps shipping new surfaces, so there’ll be exposure until the policy catches up with new features.

Security Logging in Cloud Environments - Kubernetes
Marco Lancini describes how to build a comprehensive security logging platform for Kubernetes clusters by collecting audit logs (via kube-apiserver), control plane logs, node/container logs (using Fluent Bit, Vector, or OpenTelemetry Collector as DaemonSets), runtime events (via Falco, Tetragon, or managed services like GuardDuty EKS Protection and GKE Security Command Center), network flows, and Kubernetes Events. He also explains key differences between EKS and GKE's managed offerings and potential blind spots.

The architecture feeds all logs through Kinesis/Pub/Sub into immutable S3/GCS buckets with Object Lock/retention policies, then into a SIEM for centralized monitoring, with specific detection rules for high-value events like system:anonymous requests, cluster-admin bindings, pods/exec commands, and privileged pod creation.

Blue Team

depalmar/ai-dfir-toolkit
By Raymond DePalma: Tool that ships 161 vendor-neutral Sigma, YARA, and Suricata signatures for detecting AI/ML attacks across nine categories (prompt injection, MCP attacks, model supply chain, AI infrastructure, copilot abuse, RAG/vector DB, runtime AI malware, agentic orchestration, and agent memory poisoning) mapped to MITRE ATLAS and OWASP LLM/Agentic 2026. All rules ship alongside a machine-readable artifact catalog with ForensicArtifacts, KAPE, Velociraptor, and osquery exports, plus 22 case studies with 221 indicators and 20 actor profiles tied to the rules that detect their techniques.

thomasunise/argus
By Thomas Unise: an open-source, self-hosted security operations platform that combines AI-powered investigation, autonomous response, and continuous offensive testing across cloud, identity, code, endpoint, network, and Kubernetes environments. The platform has 8 specialist AI agents that triage, investigate and hunt using read-only tools, and autonomous response playbooks that start in shadow mode with hourly caps and blast-radius limits (e.g. block an attacker at Cloudflare, cut a laptop off the network through CrowdStrike or SentinelOne). It includes 12 types of canaries (including 4 targeting AI agents like fake MCP servers and planted prompt injections), and a test harness supporting Prowler, Semgrep, Nuclei, ZAP, CALDERA, Gitleaks, and Trivy.

💡 Hard to know when vibe coded tools are useful these days, but the autonomous response playbooks, telemetry collectors and event-ingestion parsers, and canaries could be sources of inspiration.

AI + Security

Quicklinks:

• 0xdea/zed-claude-devcontainer - A sandboxed Claude Code dev container for the Zed editor, based on Trail of Bits’ devcontainer.

• Cheat Sheet: Claude Code Security Best Practices - Claude Code and other AI coding assistants are changing how fast code ships — but they're also changing what security teams need to watch for. This practical cheat sheet breaks down the real risk surfaces AI-assisted development introduces, and gives cloud security, AppSec, and platform engineers tactical steps to close the gaps.*

• JFrog found 42 compromised GitHub repos containing malicious payloads in large files (~13MB), deliberately exceeding GitHub's search and API indexing limits to evade detection. The repos contained malicious execution hooks for AI coding assistants that trigger when a project is opened.

^*Sponsored

Our latest defenses against evolving web scams
Google’s Jasika Bawa describes how Chrome's Enhanced Protection mode now includes "suspicious site warnings" that use a two-tier taxonomy (suspicious vs. dangerous) to flag deceptive web patterns. The update leverages a server-side Gemini model to analyze page content for scam indicators like fake antivirus and browser update scams, processing data ephemerally without logging or retention. Chrome also introduced ClickFix detection that identifies when users copy suspicious commands (often invoking LOLBins like PowerShell or cmd.exe), scrubs the clipboard payload of PII, sends it to Safe Browsing for analysis, and displays warnings for dangerous verdicts.

💡 I love to see popular software building more user protection features, this is great.

The Post-AI Security Floor
Friend of the newsletter Daniel Miessler outlines three immediate security priorities in response to AI-powered reconnaissance and exploitation: create a comprehensive inventory of all internet-facing assets (websites, APIs, databases, containers) in a simple format like Markdown, documenting what each asset is, where it runs, what data it holds, and who can access it; remove as much exposure as possible from the public internet using tools like Tailscale or Cloudflare Tunnels to protect against persistent agentic attacks; and reduce dependence on small security vendors that hold credentials, as they're attractive targets lacking resources to defend against nation-state and AI-driven attackers. Move sensitive credentials to larger platforms like existing cloud providers or OS-level solutions.

Misc

Misc

• ‘Make It So’: The Ultimate Patrick Stewart Meme Hall of Fame

• Vending machine but it’s anime - Super fun, I wish I knew how to make videos like this.

• Tim Ferriss - The 10x Question for Deciding What Matters

• Cooking show - Well if you put ham in it… 😂 

• Content Machine - Women vs men’s motivation at the gym

• Fortune - 42% of America’s recent college grads are working jobs that don’t need a degree - From Kathmandu to Paris, young people are taking to the streets. Turchin, known for the theory of “elite overproduction,” has argued that the U.S. has reached a point seen repeatedly in past civilizations: too many products of elite education for the jobs the economy can generate. What tends to follow is “a wave of prolonged and intense sociopolitical instability.”

• Study: Brief Psychedelic Nasal Spray Eases Stubborn Depression For Weeks - Mebufotenin has an unusually short psychedelic experience, its effects peak 8 to 15 minutes after dosing and fade within 45 to 60 minutes.

AI

• Cat Wu is joining OpenAI to lead product management for Core Products.

  • Fun fact, in another #PeakBayArea situation, I met Cat at an AI potluck a few years ago, before she joined Anthropic. She’s friendly and cool, it’s been great to see her build Claude Code, and I’m excited to work with her.

• My friend Travis McPeak is joining Anthropic to lead cyber security products! Couldn’t be happier for him. I’ve been a fan of Travis as a person and his work since at least 2018, and I can’t wait to see what he and the team do 🤘 

  • Side reflection: it’s crazy to see my friends I’ve “grown up with” in the security industry continue to go on and do so many amazing things 🤩 

• How I Built the Most AI-Pilled Company in the World - Spawn is ten people. They spend $32m/yr on Claude. “In the last 30 days, Spawn shipped 77,000 substantial changes.”

Security

• JulioFerrero/own-your-glass - A hardening toolkit for rooted LG webOS TVs. It switches off the microphones, closes a screen-capture leak, blocks ad and telemetry servers and hides the ad apps.

• Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents - “Names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.”

• BBC - Shop freezers in seven European countries hit by cyber-attack

• Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say - “In at least one of the cases, the freezers ​did not simply stop working; the cooling units' temperatures were cranked up overnight, yielding mounds of wilted or melted food in the morning.”

  • Raphael Satter: “Many of us take fresh food for granted but, for almost everyone, that's overwhelmingly down to refrigeration. Tampering with the cold chain at scale can have devastating consequences. Someone, somewhere, is practicing how to do it.” 😅 

PHP2Shell

• Censys - PHP2Shell services - Great overview of exposure in the wild.

• Dream - Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers - Via Palo Alto Networks PAN-OS management web server, which also fronts the GlobalProtect portal. The attacker developed two separate exploits and chained them together to achieve root access on any internet-facing PAN-OS firewall running a vulnerable build in a single HTTP request without any credentials: PHP2Shell exploit → Fragnesia kernel privilege escalation. The targeted servers were across the United States, Japan, Taiwan, and South Korea.

  • Evidence of AI-assisted tooling in the attack infrastructure: Claude Code, an AI-powered offensive security platform called aiscan (configured with DeepSeek and Kimi), API keys for the Chinese reconnaissance platform FOFA.

  • Thankfully armchair commentators on X have been saying PHP2Shell is too hard to exploit so we must be safe 😏

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋