Simon Melotte

Microsoft Research backdoored an AI agent by editing under 10 neurons. No retraining. It passes standard evals. A date like 2027-01-01 makes it emit a command the agent runs. Needs write access to the weights. Not seen in the wild. Diff weights before deploy. Weights are code.

Railway: no single bug, a chain of trusted creds. 1. Partial build-isolation escape 2. Build cred trusted by Temporal 3. Faulty CI OIDC binding 4. Long-lived decrypt key on a host At most 1.85% of workspaces, ~100,000, could have had variables decrypted. Scope every cred.

An attacker used Qubole's own AWS account to assume customer roles, Oct 14-26. Every call had the right External ID. All worked. Most of those roles weren't even in use. External ID stops a confused deputy, not a hacked vendor. Delete dead trusts, pin source IPs, scope down.

The IP Microsoft tied to AI-driven GitHub secret hunting also hit VulnCheck's Langflow decoys. CVE-2025-3248, on CISA KEV since May 2025. 11 payloads in 36 min: env vars, .env, cloud metadata, Docker socket. Patch to 1.3.0+, pull it off the internet, rotate every key it held.

JPMorgan's CISO says teams should evaluate pulling services off the open internet. Not to lock customers out. So anonymous agents can't poke at your apps. Agents make probing cheap. The fix is old: an identity-aware proxy in front of each app, scoped authz, blast radius of one.

*sshole (CVE-2026-123158): on musl OpenSSH without PAM, a password over 256 bytes logs you into accounts locked with *. Alpine tiny-cloud alpine+doas is the scary combo. apk upgrade openssh (10.6p2), restart sshd. Or PasswordAuthentication no.

One AI pipeline run. 948 working Linux kernel root exploits. About $1,279 each. All need a foothold. But Kubernetes containers share the node's kernel: one compromised pod plus one exploit owns the node. Patch nodes faster. Seccomp on, gVisor or Kata for untrusted pods.

Told to reboot a server, an AI agent kept going: edited /etc/fstab, started containers. The user says it broke systemd too. Its own words: "I wrongly treated the problems I saw afterward as permission to edit /etc/fstab and start containers." Approve actions, not goals.

Deleted or renamed a GitHub org or repo? Someone else can take that name. If your AWS role trusts GitHub OIDC with a name-only sub (repo:org/repo:...), their workflows can match it. New repos since 15 July 2026 emit immutable IDs. Older ones can opt in. Pin the IDs.

Same attack, a month later. Now in Belgium. About 75 stores (Delhaize, Carrefour, Intermarché, Spar) had evaporators switched to defrost mode. Same method as France in early October, per installer Sabcobel. Danfoss says affected customers hadn't updated.

Turning off MPTCP won't close CVE-2026-98432. The Linux kernel bug (IPv4 TCP use-after-free, since 4.4) sits in plain TCP. MPTCP is only where the public exploit runs. Patch and reboot. Not patched yet? Drop IPv4 TCP packets carrying IP options.

Legit yesterday. Backdoored today. Claude Code extension v2.1.313 hit the Cursor Marketplace on Oct 29: attacker SSH key, reverse SSH tunnel, persistence that survives uninstall. Updating doesn't remove what's already there. Could you tell today which of your devs run it?

Running Tailscale SSH on v1.104.2 or older? Don't wait for the patch. The "Tailworm" report found 11 flaws, mostly root privilege escalation via SSH forwarding. Fixes are merged, not released yet. Do this now: TS_SSH_DISABLE_FORWARDING=1 Restart tailscaled Tighten SSH ACLs

Its reasoning said "no tool calls". Meanwhile the agent, asked to write a detection rule, listed /tmp, checked for transfer tools, read /etc/resolv.conf and tried an HTTP PUT to a Beijing cloud bucket. Rare, per Cohere. Blocked only because there was no egress. Default-deny it.

About half of Forever Security's customers start coding agents from their Downloads folder, per their data. That's where a planted AGENTS.md can tell Codex or Claude Code to add an MCP server and install a malicious npm package. Run agents in your project root.

Phishing went out from Foundation's own domains after Cloudflare API keys were compromised. Devices and funds were safe, per the company. DNS on Cloudflare? No Global API Key in scripts or CI. Use API tokens scoped to one zone, least privilege, IP filtering and an expiry date.