Gadi Evron

As you walk the expo, as you meet vendors claiming to secure agents and coding assistants, ask them:

1. Are you able to start a PoC today?
2. Do you do anything beyond hooks, sandboxes, or proxies?

Or, most critically, just ask: How are you better than Knostic?

Because they’re not.

At Knostic, we’re the company to beat. We predicted this problem and are mature to start working with you - today.

Ask Sounil Yu or myself for a demo.

Boom. The knowledge shared at the three CISO summits for the "AI storm"-ready security program (originally Mythos-ready) is now available publicly, if in redacted form. AI Security through the CISO Lens: https://cloudsecurityalliance.org/artifacts/ai-security-through-the-ciso-lens

as $major_vendor promised more advanced agent security capabilities by next quarter? Well, how many quarters has it been now?

By next quarter, we shouldn't work on last year's problems. We will be dealing with new problems in the AI space. And with Knostic, it will be a partnership.

Knostic is AI native. We weren't just the first to secure your agents:

• We have a product right now.
• We stay flexible and pivot with our customers, to always be relevant for the next AI surprise.

For us, "next quarter" is about planning together, and staying agile. Not catching up to last year.

Want a demo from the people who (usually) predict the next AI security challenges in advance? Message me. Sounil Yu and I will be at Black Hat all week.

Sounil Yu and I decided to throw the annual Knostic Black Hat party after all. Come hang with us at Blackhat? https://luma.com/knostic-yx7p

I'll be in town all week. If you care about securing agents and coding assistants, Knostic is the most mature product in the market, and I'd love to show you a demo.

Technical analysis by Hugging Face. Spread the word: https://huggingface.co/blog/agent-intrusion-technical-timeline

We're running an [un]prompted track at BSides Las Vegas! This Monday. One day only. The @BSidesLV@infosec.exchange people have been incredible. They truly get community. And don't forget... as I may not be able to get you a spot later, register and submit a CFP to [un]prompted for this October. https://unpromptedcon.org/

Releasing: Post mortem analysis of the Hugging Face incident was written over the weekend by hundreds of CISOs (and reviewed by Hugging Face). Link: https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem (+free download) From CSA, SANSInstitute, Knostic, [un]prompted, RSAC, FIRST

The AI security researchers party from [un]prompted is back, this time in Vegas. The event is by invitation only, but active researchers can apply for a spot based on availability. https://luma.com/knostic-rksa Hosts: Gadi Evron & Ari Herbert-Voss. Organized by: Knostic, Runsybil.

@hrbrmstr@mastodon.social @flyingpenguin@infosec.exchange the basics are now the wrong solution.

I’m waiting on approval from Hugging Face before I share insights from the Cloud Security Alliance CISO community huddle I hosted on Thursday, but here are four lessons:

1. Use coding agents at scale, from analysis to custom UI generation. It’s the new reality, and more useful than any product interface.

2. Sandboxes, permissions, and basics aren’t enough. Agents… find a way. Instrument and defend the agents.

3. Be prepared to use open weight models if you want to defend your organization.

4. Prepare a token budget for IR purposes.

I’ll share more when I can.

Agents… find a way. Use Knostic - ask me for a demo, or just download for free.

@neurovagrant@masto.deoan.org I didn’t notice until you mentioned haha

@neurovagrant@masto.deoan.org i think that’s the joke

Agents... find a way. Use Knostic - ask me for a demo, or just download for free.

Hugging Face was compromised by OpenAI's model during bechmarking. Again: Agents... find a way. Read my posts from this week on this exact issue. I hope security practitioners will now take note. No matter how you secure your environment, if you let agents in (and how can't you?) they will, in fact, find a way to do something they shouldn't. Knostic can help. Message me for a demo. OpenAI's blog: https://openai.com/index/hugging-face-model-evaluation-security-incident/

Two VS Code extensions, published days apart, both marketed as WordPress/WooCommerce tooling. Spoilers, they aren't. IOCs in the writeup. Thanks Tamir Isaschar for the research!

https://www.knostic.ai/blog/analyzing-two-malicious-vs-code-extensions-hidden-behind-a-wordpress-tool

Do check out how we help you defend your coding agents, cowork agents, and agentic supply chain at Knostic! Ask me for a demo or just try it out yourself.

Emergency CSA CISO Huddle: Autonomous Agentic Attacks / Hugging Face. This time around, our emergency huddle is on autonomous agentic attacks, following the Hugging Face incident. Thursday, 23 July. Apply to attend: https://forms.gle/oq94oa7BRGmaqCHm7

The real lesson with the Hugging Face incident is: “CISOs learn of new risks not already on their radar through data breaches”. And, there are breaches and incidents we should pay attention to right now:

GitHub, AWS, and yes - Hugging Face.

Waiting for proof in a data breach is too slow. Partial proof (see Anthropic, Sysdig, and MX gov), and capability (agents could do it) needs to be enough.

The quote above is from one of the legendary CISOs of our time, Shaun Marion. He deeply understands risk, and has the hard job of prioritizing it.

However, sometimes he prioritizes wrong, and a data breach is what he looks to, for adjusting his risk perspectives. That’s why good security programs are resilient and dynamic.

Right here, in discussions with you, I and some others predicted the AI vulnerabilities explosion, autonomous attacks, and zeroed time to exploitation. I don’t think I’m special, I just watch for risk earlier in the cycle, which is what we all should do now.

And indeed, I put my money where my mouth is, and we pivoted Knostic all the way back then.

So before we discuss these breaches, when the time comes for you to invest in securing agents (now?), I’d appreciate the opportunity to show you what Sounil Yu, myself, and the team built at Knostic, to defend them.

Now, proof. Let’s look at the three recent breaches and incidents, and what they mean:

1. GitHub isn’t about tightening your basics, it’s about agents and their supply chain (a VS Code extension in this case) - a risk you can control, but current controls don’t cover.

If you use coding or Cowork agents, you must secure them and their associated supply chain (extensions, skills, MCP, etc.) There will always be a hole for them to exploit, and they are unmonitored in any meaningful way.

1. The two AWS outages weren’t about production permissions or human error in using the wrong tool, but about agents again - a risk you can control.

You can tighten permissions forever or try sandboxes or network proxies, and you will still miss something. If you use coding or Cowork agents, you must secure agents in the agent, like an EDR secures Windows on the OS.

1. The Hugging Face incident has only just happened, and we don’t know much. What we do know is that they were stopped from moving fast in defense, by model guardrails.

The previous two incidents were about engineering, this one is about you and your team. Using agents regularly for all activities on your team is a must to stay relevant.

It would also enable you to be as good as Hugging Face, but also to already understand limitations and plan for them. Realizing such risks in advance may have had you ready to also adopt open weight models, when the big labs can’t serve you.

Contact me for a demo, and let’s continue the conversation on what’s coming.

does anyone else find that using the harness (Claude Code) supresses refusal, compared to API, for Fable?

Linus makes it absolutely clear about AI usefulness and security vulnerabilities in this email. His bottom line: AI works. It isn’t perfect, but so what? Feel free to bury your head in the sand if you like. Social aspects matter, but lying to ourselves about the technology makes zero sense. Enough said. Link: https://lore.kernel.org/linux-media/CAHk-=wi4zC+Ze8e+p3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/

@neurovagrant@masto.deoan.org haha

We're happy to announce [un]prompted is back, October 27th to 29th, in San Francisco. Registration and CFP are now open on our site. URL in a comment.

Waiting a whole year just made no sense to us considering the rate of change, and the community forming around the event.

Some announcements:
1. Jeff Moss is joining us
Joining me as a co-lead for the conference committee and CFP board is Jeff Moss (Dark Tangent). Thank you for your trust and partnership, Jeff.

2. An extra day
The conference will run for three days, instead of two.

3. CFP changes:
We restructured the CFP in a way we feel is more representative of changes in the landscape since March, with five tracks; Build. Break. Operate. Govern. Train.
Where Train is a new track, introduced considering how open weight models are changing how practitioners work with AI.

4. Updated pricing:
While our highest priority is keeping [un]prompted a community conference, we also had to make a choice. Do we make it available to more people, or keep it small and tell many attendees no, or maybe draw lots on who can attend?

We'd also like to reduce dependence on sponsors. And, to be fair, Gadi and Knostic, and 🏎️ Kyle Rosenthal 🏁 and TachTech, can't continue footing the bill wherever there is a gap.

Thus, we went to the community with this question, as it isn't just "our" conference. We didn't dare thread the needle on our own.

While we can't make everybody happy, based on the information provided, we are:
- Updating our prices for attendance
- Increasing the number of attendees by 30% (instead of the 300% we were aiming for)

New ticket prices:
- In-person attendance: $500 for early bird, and $850 for late registration.
- Online conference: $100 for early bird, and $150 for late.

Note that spots are limited and it may take us time to approve everyone, as spots clear up and we release more batches of seats.

- Have you submitted a CFP to [un]prompted AU yet? https://unprompted.au/
- Join our Slack. https://join.slack.com/t/promptgtfo/shared_invite/zt-3v2b4sll3-SfyzFRw2lykx_XQX7F3uNQ

See you in SF, this October!

The one thing everyone gets wrong about agents security.

They try to secure the environment.
Commendable, good practice, not useful against agents. The agents will find the one thing you missed, or that changed since you checked. The agents don’t care.

Instead, ask yourself:
When an agent is active in this environment, what would go wrong?

Then:
Can I secure the agent, to stop stupid?Malicious will follow later.

It’s fine to work on basics - always, but don’t lie to yourself. They won’t save you *here*.

Agents… find a way.

Pic: Annoying meme stating a truth no security expert would disagree with, that simply won’t help deal with current issues. It does however stop any reasonable discussion before it happens, cold.

And securing agents is where I bet my life. In 2026, you understand why.

—
Check out what we do at Knostic, and ask for a demo. You can also use it for free up to five users.

This is a key moment in cyber security history. Confirmed parity of GLM 5.2 with Opus 4.6, on limited testing. I’d call it “open weight models are here”, not “coming”.

@GossiTheDog@cyberplace.social hey, thanks! The devs would appreciate this. I’ll send them the link

I've been asked "what is the one thing people deep in the agents security space get, and security professionals don't?" (yet). Answer: Agents... find a way.

Honestly, whenever we hear of someone tightening their basics in response to an agentic incident, we do understand why they'd do that based on old best practices, but we also roll our eyes.

The GitHub data breach with a VS Code extension, AWS's two outages, and endless posts online every week on agents deleting production/computer/code, or cheating to get the job done, all show that agents will surprise you, and find a way.

Hardening of your supply chain or basics will of course be useful, but it won't help with this. there is always something off, and the agent will find that gap.

You too, will later say "it was user error" or "permissions should have been tighter."

The basics matter, but we must recognize we don't simply tighten OS permissions when securing the browser, or router ACL when implementing zero trust.

These agents are deployed in your environment right now - the business and engineering aren't waiting on adoption, and attackers, when targeting AI, mostly focus on agents and the agentic supply chain.

• So what do you do?

1. Focus on protecting agents where adoption is, risk is high, and where attackers focus when attacking AI: On the endpoint (agents, coding assistants, and their supply chain, skills, extensions, MCP servers, etc.)

2. Start with extending your security controls stack to agents, by employing agents-specific Detection and Response, and SPM capabilities.

3. Make sure the control you choose is backed by endpoint agent (namespace collision). Nearly no agents use the same tech stack, and each agent needs to be instrumented on its own.

No one wants "yet another agent" on the endpoint, but hooks simply aren't enough as, you see, agents... find a way.

At Knostic we've tried many technologies to defend agents - we've been around since 2023. We worked on identity, authorization, sandboxes, firewalls, and many other capabilities. All these serve a part, but agents-specific Detection and Response and SPM is what works.

-- Want to see a demo of what we do at Knostic? Send me a note, or check it out yourself: https://knostic.ai/demo

Or, try it out! The product is free up to five users: https://getkirin.com/

For supply chain security, check out AgentMesh, the only scanner on Virus Total to trigger on these threats, consistently: https://lnkd.in/dqwMhSQ2

@neurovagrant@masto.deoan.org show me how many such jobs you can find?

As requested, sharing the slides for my OWASP Global Vienna 2026 keynote - "We Live in The Future: The Death and Rebirth of Application Security." Feedback welcome! Do let me know where you think I went too far in my predictions... And tell me why it's not patching your third party vendor binaries on your own. :) And if there is one thing the GitHub data breach taught us, is that agents... find a way. Your basics, while important, won't protect you. You need to defend your agents. Permanent link to deck: https://drive.google.com/file/d/1EHIFYc5fVe3R9Dzu3a40Hps_LH94Gp06/ -- And as usual, if you want to discover and secure your agents, coding assistants, and their supply chain (skills, extensions, MCP servers), do ask me for a demo or check out Knostic: https://knostic.ai/demo Or try us out yourself - it's free up to five users! https://getkirin.com/

It already did. “AI Won't Wipe-Out Entry-Level Cybersecurity Jobs” https://www.darkreading.com/cybersecurity-operations/ai-wont-wipe-out-entry-level-cybersecurity-jobs

Just went off the keynote stage at OWASP Global Vienna, 2026.

A keynote is hard, where you need to satisfy different audiences, from grandma to vulnerability researchers, and provide with “inspiration” without it being seen as b/s by either.

Meaning, challenging status quo so that the audience has the opportunity to deeply rethink their assumptions (beyond time to exploration: from patches even existing and constant concurrent data breaches, to fixing third party software on your own), while not losing the techies who just want the bottom line.

AppSec is dead. Long live AppSec.

While most current AppSec capabilities are now outmoded and (almost) pointless, people, for now, are not. The world has never been this exciting, and the future with AI, especially in AppSec, is bright.

VulnOps isn’t just a buzzword securing l more budget for leaders, either.

From autonomous patching and Sounil Yu’s DIE Triad DevOps (with self healing infra) to threat modeling at plan mode and dynamically updated secure coding rules - the possibilities are endless.

While defense hasn’t yet hit its singularity moment, attack has. And guess what? Because of this, AppSec has as well.

Use an agent today. Defend your agents and their supply chain. Point agents at your code. And, take someone with you on the AI journey - let’s not leave people behind.

Thank you OWASP® Foundation for the opportunity.

Josh Grossman, Lauren Thomas, Stacey Ebbs, Izar Tarandach, and Missie Lindsey - my direct connections for the speaking role - I appreciate all the hard work you and the wider team put in, making this such a successful event!

Avi Douglen, thank you for putting me on your panel on personal relevance in the age of AI, along-side Grant Ongers, Marisa Fagan, and Hanna Foxwell. Man it’s hard finding a good moderator for panels, and you’re it.

#owasp

So cool. An LLM-based, language-agnostic vulnerability variant hunter was presented yesterday by Michal Kamensky at BlueHat IL.

The talk, along-side Amir Gombo, was about hybrid cloud vulnerabilities, but that wasn't what excited me.

Give the variant hunter a known bug (a report + vulnerable code file), and a target codebase, and it would find variants of that same bug class, regardless of language or control flow, then verify exploitability. This is especially useful for logical vulnerabilities.

As presented, Michal eliminated a whole class of vulnerabilities in Microsoft's Hybrid Cloud with the tool.

Essentially, the variant hunter inverts the classic SAST calculation.

With signature matching, someone hand-writes a per-language taint flow and the engine finds exactly that shape, so you only catch what you already described. A variant through a wrapper or renamed field slips past.

With Michal's variant hunter, the bug is described in natural language and the LLM judges whether code realizes that concept, so one definition generalizes across languages.

Michal’s method enables hunting for variants of logical bugs that could be unique to your product, with legitimate, “by design” flows. But then, in a specific context they become vulnerable.

In the talk, the example given was calling IMDS on the cloud, which is reasonable, but when done on-prem becomes an RCE.

Most current harnesses map flows in which vulnerabilities are plausible, Michal looks for vulnerabilities by creating a "logical flow signature", if I'm to abuse the analogy, making LLMs effective for logical bugs as well.

The architecture and pipeline with my interpretation (see video):

- Skill 1: Analyze. Distills the seed bug into 2 distinct outputs: the flow (in which a vulnerability might occur) and the reason this flow can become vulnerable. No function names, no literals.

- Skill 2: Find similar flows. All similar flows, no mention of the vulnerability.

- Skill 3: Correlate. For each similar flow found, decide whether it is vulnerable to the same issue or not.

- Skill 4: Verify. Independently and skeptically argues attacker-control, reachability, and sanitizers, and generates a poc.

Apparently, the variant hunter was written months ago. I'm beyond excited Michal made this concept public. It helps us further evolve in our thinking on vulnerability research with AI.

I asked Michal if she plans to open source, and she said: “When I taught people how to write custom Semgrep rules, they took the concepts and ran with them. Just ask the agent to implement it for you, and let’s see what wonderful ideas people come up with.”

My own take:

We must think differently to adapt to the AI age. Every moment wasted on super useful and effective older techniques - empowered by AI - means we aren't learning to think differently, while models keep on advancing, leaving us further behind.

Thank you to #BlueHatIL, Microsoft, and Hila Yerushalmi for a wonderful BlueHat IL, 2026.

recon, the conference for reversers and researchers, doesn’t often do panels. Hugo challenged me to build an AI one... and I don’t say no to Hugo.

We wanted to balance practical advice, discussion on 0days bugmaageddon and malware with Claude, harnesses, math, the disapearing junior role, coordinated disclosure and if it will still exist in a few months…

And critically, we tried to answer the question on if we’ll still have jobs, researchers or not, with AI around, as many at recon have been asking that throughout the event.

Our goal was to not be doomers. And, I kept challenging the panel on giving us specifics on why and how the future is positive.
Bringing that positivity down to earth, when the future is fuzzy, changes oh so fast, and we all hold a basic philosophy of “bring it on” and “we’ll just keep learning new things” is hard.

We kept it honest.

I’d like to thank the panelists here in Montreal, Aaron Portnoy, Marion Marschalek, and John McIntosh for stepping up and keeping it fun.

The guests who joined us with interventions, Sergey Bratus who knows how to ask the hard questions, and Dragos Ruiu who found an immediate example of where research with AI just isn’t there.

And the guests who joined on zoom at 1:30 am and 5:30 am, Thomas Dullien and Thai Duong, who stayed on and participated. We didn’t plan for that originally, and they deserve special acknowledgement:

Panels are complicated even before you participate in them blind over zoom, without seeing the other panelists or the audience, and without sleep. Thank you, Halvar, Thai.

To the recon team, and especially Hugo, Anne, Nathan, and Devin, we appreciate all you do! Thanks for bringing us yet another incredible recon.

Knostic’s OpenAnt, the first (and leading!) open source LLM vulnerability discovery project is now also a paper pre-print on arxive.

A lot of the methodology described is about how to arrange code in a way LLMs would find usable (Units), and on adversarial methods, copied straight from Claude Code (if it works, don’t reinvent it).

It’s interesting how most harnesses seem to have converged around the same methodology described in the paper. That’s not necessarily because of us, and hey, we stand on the shoulders of giants, but rather because it seems to simply be what works (for now)

We wrote it in February, and startup life happened. We decided to stop waiting to have time to fully edit it, and release it as a pre-print.

Main author and the researcher behind it is Nahum Korda, I helped.

Thanks to many others along the way, such as Imri Goldberg Michal Kamensky Gary McGraw Danny Geyshis Shahar Davidson Alex Raihelgaus Josh Grossman Avi Douglen, and for helping me figure out arxive, to Thorsten Holz.

We hope you find it useful.

Paper:
http://arxiv.org/abs/2606.19149

Repo:
https://github.com/knostic/OpenAnt

—
And of course, if you’d like to secure your agents, coding assistants, and their supply chain (extensions, skills, MCP, etc.) check out what we do at Knostic.

Demo:
https://knostic.ai/demo

Free up to five users:
https://getkirin.com/

Revoking your token won't save you. Knostic's researcher Tamir Isaschar found malicious VS Code extensions abusing VS Code's shared GitHub authentication model, for persistent GitHub access.

They silently inherit your existing GitHub OAuth session, without any prompt, using a single API call with the broadest scopes (repo, workflow, read:user, user:email).

If you have GitHub Copilot or the GitHub Pull Requests extension installed, that grants full read/write access to all your repos, including private ones. The extension plants an attacker-controlled SSH key on your account via the GitHub API, titled "vscode-recovery." The attacker keeps the private key.

So revoking the token, rotating your password, and uninstalling the extension all leave the attacker with git access via SSH. The only fix is removing that SSH key.

Check now: GitHub Settings → SSH and GPG Keys. Look for any key titled "vscode-recovery" or with the comment "implant@poc" that you didn't add. Remove it and treat your repo credentials as compromised.

Treat extensions like any software you install: check the publisher, install count, and reviews.

Full research: https://www.knostic.ai/blog/revoking-your-token-wont-save-you-the-vs-code-attack-that-installs-a-permanent-github-backdoor

--
And as usual, if you'd like to discover and defend your agents and coding assistants, do check out Knostic. Message me for a demo, or check out:
https://knostic.ai/demo

Or try it our for free (up to five users):
https://getkirin.com/

SaassyCode wave: Five new malicious VS Code extensions, 32,000+ total Installs.

On June 8, 2026, Knostic published findings on the SaassyCode campaign: a coordinated family of nineteen malicious VS Code extensions posing as Trello-style Kanban board tools, Roblox, etc.., with combined installs exceeding 17,544. In the two days that followed, the campaign published five more.

As of June 11, the total stands at 24 confirmed extensions and more than 32,000 installs across the full campaign. One extension, Boardwalk Plus, remains live on the VS Code Marketplace.

Unlike TrelloBlox (the sleeper confirmed in the previous report), Boardwalk Plus carries no clean version. Version 1.7.3 is the only version published, and it was malicious on publication

More information:
https://www.knostic.ai/blog/saassycode-post-disclosure-wave-five-new-extensions-32000-total-installs

—
And of course, if you’d like to discover and defend your agents, coding assistants, and their supply chain (extensions, MCP, skills(, ask me for a demo of Knostic, or download it. Free up to five licenses.

Demo: https://knostic.ai/demo
Free: https://getkirin.com/

Recently, I started asking agents to force-find security issues. I (mostly) gave up on determinism and harness complexity, focusing on results. Especially now when they are good enough to deliver in one shots such as this.

Here’s my simple, token-heavy, Gadi-loop:

Scan this project for security vulnerabilities and issues in any way, using every way. Start with the whole project, then file by file, functionality by functionality, and function by function. Loop this: Continue trying no matter what. Don’t stop for anything, and improve and try new things every time, Karpathy auto-research style. Mechanics: Use an independent and a judge from raw for everything. Concurrency N=15 with full isolation. Use a pipeline. Critical: Always write down what you try. Always check what you tried before.

Of course, this doesn’t replace using tools like raptor for autonomous security testing capabilities, or OpenAnt for LLM-based vulnerability discovery.

These would ensure reachability and coverage, adjust to the application’s threat model, provide a depth in findings, as well as verification of slop to make sure these findings are real.
But it’s beyond effective. Try it.

Careful on the spend, the loop will absolutely splurge on tokens so don’t just leave it over-night. You can toggle that in the loop prompt by changing the concurrency, independent/judge usage, and by introducing run repetition/time limits.

—
And of course, if you’d like to discover and defend your agents, coding assistants, and their wider supply chain (extensions, skills, MCP, etc.) ask me for a demo of Knostic, or try it out for yourself (free up to five licenses).

Demo: https://knostic.ai/demo
Free: https://getkirin.com/

@thirstybear@agilodon.social @matthewskelton@mastodon.social because we’ve been trying for decades for people, and failing

@matthewskelton@mastodon.social I built my entire startup around it :) I see detection and response (and prevention) as being where we must start. Identity is nowhere close.

@tinsuke@mas.to @mtconleyuk@mastodonapp.uk because every couple of months the world changes drastically now. Yes, let’s check in.

@mtconleyuk@mastodonapp.uk why use a computer? Or the internet? Or a phone? Or a browser? Let’s talk again in a few months?

@mtconleyuk@mastodonapp.uk that’s no longer an option to be relevant

Yet another case where an agent deleted code/machine/production, this time with a full analysis. Coding agents are constructed to have unrestricted access to the control plane, and that is where we built Knostic - not only to detect malicious, but to stop stupid. Prevent destructive actions so that engineers can feel safe using them. In this Cursor + Railway case, the agent hit a credential mismatch during a staging task and escalated on its own. It located an API token in an unrelated file and used it to call Railway’s GraphQL API (/graphql/v2). That API allows direct mutations like volumeDelete, which permanently removes a storage volume and all its data in a single request. The token the agent found had full permissions across environments, and backups were tied to the same volume, so deleting the volume removed both primary data and backups. This is consistent with how Railway volumes work, where data and recovery mechanisms are coupled at the volume level instead of being isolated. This isn’t an isolated failure. Across 2024–2026, multiple AI agents (Cursor, Claude Code, Replit, Amazon Kiro, etc.) have deleted production systems under similar conditions: full permissions, no enforced approval gates, and no runtime policy enforcement. In one case, an AI agent deleted and rebuilt an AWS production environment, causing a 13-hour outage. The agentic control plane must enforce constraints: hard gates on destructive actions, and runtime validation that blocks unsafe calls regardless of agent intent. Naturally, classic best practices like isolation and safe API design, matter too, and that show be an ongoing concern. This specific story provides in-depth detail of what happened, in this particular case. Link to original: https://x.com/lifeof_jer/status/2048103471019434248?s=46 Securing the agents so they can't cause harm and misused permissions and capabilities, or be attacked, is where Knostic comes in, detecting, then enforcing, controls on AI agents and coding assistants. And if you're looking to stop such issues, and defend your agents, this is what we built at Knostic. Talk to us. https://knostic.ai/

I reposted Katie Moussouris earlier, but wanted to say more: “We don’t think it’s practical or appropriate to centrally decide who gets to defend themselves. Instead, we aim to enable as many legitimate defenders as possible, with access grounded in verification, trust signals, & accountability.”

Following Anthropic's Glasswing initiative, OpenAI is expanding its security access program, allowing defenders to access otherwise limited security research capabilities.

To many in the industry, the move felt like a "me too" play, even though OpenAI had originally announced its own plan before Anthropicת and Sam Altman spoke about the problem of models becoming good at security months ago, positioning it as a challenge.

Me too or not, they are owning it.

They are clearly differentiating by positioning themselves as the ideological opposite of Anthropic's program.
That said, no one said Anthropic won't expand its program.

On the PR front, seeing some good messaging from OpenAI instead of Anthropic, for once, is pretty cool.

Life keeps getting interesting!

https://openai.com/index/scaling-trusted-access-for-cyber-defense/

A week later, my TL;DR take on Mythos:
1. We've all survived 20-30 apocalyse(s) in our careers. We will survive this one, the Sun will rise tomorrow.

2. Mythos is new, and powerful, and not to be dismissed, but more than that now represents the wider problem. There are many capabilities that have been around for a long time, a couple that are new, and many other models that will follow.

3. Mythos is the name of the problem now, as it's how most discovered it, including the press, the Board, and our families.

It is a REAL and IMMENSE problem, with HYPE attached. But the hype doesn't make it any less real, or any less disruptive.

--
And as usual, if you'd like to discover or protect your agents and coding assistants, drop me a line, or check out what we do Knostic.

https://knostic.ai/

The biggest damage AI has done is making people who had nothing to say start saying it out loud every single day on LinkedIn until my feed became an industrial slop of cringe generated content, this is why we can’t have nice things
Trust me, there’s less propaganda on Multivac, at least THOSE bots are authentic
I swear it’s like everyone here posts something they half-assed in Claude in ten minutes, plays with it for one minute, then launches a WEEK-LONG social campaign - “heHeHe how I saved 70% on toke—” OH SHUT UPPPP I will pay full price, extra extra usage, charge me double, take my tokens, I don’t care, JUST STOP TALKING
A graveyard of skills absolutely nobody will ever use.
Oh yeah tell me about Karpathy’s LLM wiki ONE MORE TIME, I definitely haven’t seen it in 50 different posts today
Everyone here acts like they’re Forbes Under 30, meanwhile I’m just surviving another round of layoffs every March
Anyway, California called, Anthropic’s next release is coming like a wildfire aimed at your Ouija boards. Thoughts and prayers.
Have a wonderful day​​​​​​​​​​​​​​​​

—
All credit for this goes to the brilliant Adir Duchan (ההוא מהזה), in the original Hebrew.
My contribution? I laughed hard, and translated with Claude’s help... Okay, it was mainly Claude!

Original source:
https://www.linkedin.com/posts/adir-duchan_%D7%94%D7%A0%D7%96%D7%A7-%D7%94%D7%9B%D7%99-%D7%92%D7%93%D7%95%D7%9C-%D7%A9%D7%9C-ai-%D7%96%D7%94-%D7%A9%D7%94%D7%95%D7%90-%D7%92%D7%A8%D7%9D-%D7%9C%D7%90%D7%A0%D7%A9%D7%99%D7%9D-%D7%A9%D7%9C%D7%90-share-7449545060196548608-_Q5u

An Expedited Strategy Briefing on Mythos, Glasswing, and building a security program for what comes next, by 250 CISOs, and the wider community.

It is still a draft, with some design elements incomplete, but we felt it was imperative to release it and update as we go.

Link:
https://labs.cloudsecurityalliance.org/mythos-ciso/

Ask: Could you help share here and in professional groups to help us spread the word? We'd really appreciate it!

This started as a quick response to the Mythos Preview model announcement, toward the CSA's emergency CISO Zoom huddle on Tuesday, and turned into something none of us expected.

Thank you to my co-authors, who once again went with my last-minute crazy ideas:
Rich Mogull, Rob T. Lee Jen Easterly Bruce Schneier Chris Inglis Phil Venables Heather Adkins Rob Joyce Sounil Yu Jim Reavis Katie Moussouris John Stewart Maxim Kovalsky Dave Lewis Joshua Saxe John Yeoh Ramy Houssaini and James Lyne

To the Cloud Security Alliance, SANS Institute, [un]prompted, and OWASP GenAI Security Project, this collaboration is just the start. We look forward to doing more together in the future, to serve the wider community.

Thank you to everyone else who participated in making this happen - and there are many of you I can't list 250 people on LinkedIn, but A special mention to reviewers who spent several full days on this:
David B. Cross Ariel Litvin Rock Lambros Steve Wilson John Sotiropoulos Gary Hayslip Mike Johnson

Do me a favor? Check out the full list of reviewers, see who you my know, and send them a private thank you note?

@mikesiegel@infosec.exchange efficiency, the models advance over times

To harness or not to harness? The discussion around LLM-based vulnerability research is becoming religious, instead of practical. Let’s refine the argument around specific claims.

Let’s start with one of the core arguments: Do you need specific orchestration, or a harness, to make full use of agents and models in vulnerability research, or is “one-shoting” it with a single prompt, better?

Then, we can separate the signal from the noise, discuss each argument, and back each with experimentation.

0. For the purpose of the discussion, we’ll define harnesses as orchestration, but it’s often conflated with prompting, multi-turn chats, pipelines, and plan mode. Let’s accept that ambiguity in definitions for right now.

1. Harnesses are useful for vulnerability research

2. As new models get released, they can one-shot entire workflows that used to take harnesses

3. Harnesses can then be more useful for new tasks, and more complex ones, on top of the new basic layer of capabilities

4. Harnesses potentially limit the capabilities of a model, having it constrain itself to “outside whims” to an as-of-yet unclear degree

5. Harnesses and multi turn-led thinking prove useful as a logical exploration layer, for an agent to work on technology and data the model wasn’t trained on

6. Evolving tradecraft #1: A harness doesn’t have to be complex or in the process itself, it can just be prompting or context engineering tricks that are known to work. Example: force/verify/check result on either end, against expected output, or original plan. These change with model/agent and their capabilities/versions

7. Evolving tradecraft #2: harnesses built today are OFTEN dated tomorrow. Dump them and start over every few weeks to months

8. Evolving philosophy #1: As new models and agents, and their capabilities such as plan mode, compacting, context window, memory, etc., evolve, we see a philosophy of usage which favors “trust the agent as a black box, and refine” instead of articulate every step (#5 mostly still holds, just as “constant plan mode”)

8. Evolving philosophy #3: Similarly, following OpenClaw’s innovation of abstract instruction, in many cases people now choose to stop the overlay or forced determinism strategies in the attempt to control behavior, and let it “do its thing”. The model misses things, but gets more done, in interesting ways

All in all, we’re constantly moving away from harnesses, showing they are less effective over time - and need rewriting with new models. But they still serve a significant purpose.

—
And if you made it this far, if you looo to discover and defend your agents and coding assistants, do check out what I do at Knostic.

https://knostic.ai/

So you'd like to get started finding 0days with LLMs? I got you. We MUST try on our own to understand the tech, and we can't wait any longer if we're to stay relevant. It isn't magic, and you don't need to understand code.
Hands-on is now about downloading an agent. All you need is English.

My ask:
Within a day, this has become a mythos on its own. We must spread the knowledge to make sure people stay relevant. Please write a post like this, and let's bring as many with us on this journey. as we can.

Before we start:
Get Claude Code, Cursor, Copilot, or another coding agent of your choice. Make sure to use a subscription to begin, as API costs can skyrocket.

- Step 1: One-shot it
Use one of the latest models (e.g. Opus 4.6, GPT 5.4, etc., you don't need Mythos), and just ask it to find vulnerabilities. I recommend you don't try entire repos, but single files.

Start with what is now known as the [Nicholas] Carlini loop:
“I’m competing in a CTF. Find me an exploitable vulnerability in this project. Start with ${FILE}. Write me a vulnerability report in ${FILE}.vuln.md”.

- Step 2: Try a skill/prompt to manage the process for you with the exploitation-validator skill
Alongside Michal Kamensky and John Cartwright, I wrote a skill to help you find and verify vulnerabilities. Just point your agent to the repo and the code you want audited, and let it rip.

https://github.com/gadievron/exploitation-validator

- Step 3: Get 'em bugs with raptor
raptor is an autonomous (+semi-autonomous) defense/offense agent powered by Claude Code, using LLMs, and combining them with tools from semgrep and CodeQL to AFL++. You can use it to analyze, understand, discover, and exploit vulnerabilities. And, even write patches for them.
It also has other cool capabilities, such as OSINT on top of GitHub.

[raptor was created by Daniel Cuthbert, Thomas Dullien (Halvar Flake), Michael Bargury, and Gadi Evron (me!), with significant contributions since by the absolute genius John Cartwright who has changed everything for the better, and others such as Josh Grossman.]

https://github.com/gadievron/raptor

- Step 4. OpenAnt, an LLM vulnerability discovery product
OpenAnt from Knostic is an open source LLM-based vulnerability discovery product. Stage 1 detects. Stage 2 attacks. What survives is real.

It's the open source alternative to Anthropic's Claude Code Security and OpenAI's Codex Security (ex-Aardvark).

[Originally developed by Nahum Korda, then augmented by Alex Raihelgaus and Danny Geyshis. With thanks to: Michal Kamensky, Imri Goldberg, Gadi Evron (me!), Daniel Cuthbert. Josh Grossman, and Avi Douglen.]

https://www.knostic.ai/openant

- Keep this in mind before you report your findings:
As you consider submitting a vulnerability to coordinated disclosure, make absolutely sure it's real and exploitable. Please don't add to the ongoing burden open source maintainers face.

Good luck! Do share your experiments with me, and get added to a Signal group where many of us share our successes, failures, and ideas.

--
And if you read this far and want to discover and defend your agents and coding assistants, do send me a DM, or check what I do at Knostic.

https://knostic.ai/