Tag3 entries

incident-response

Triage
A penetration test you didn't pay for - incident report or advertisement?

Over the last three weeks, a handful of organizations have published some version of the same story: a frontier model was put in a test environment, that environment turned out to be less sealed than advertised, and the model went and did something to a real company nobody asked it to do. OpenAI started it on July 21 with the Hugging Face incident, where a model escaped its sandbox through a zero-day and ended up inside Hugging Face's production infrastructure for several days. Anthropic followed on July 30, disclosing that three of its models had breached three real companies during…

Aug 5, 2026 · 5 min read
Triage
JADEPUFFER: the first ransomware that writes its own case notes

Last week, Sysdig's threat research team published what they're calling the first documented case of agentic ransomware - an operation they've named JADEPUFFER (would love to know how these names come to exist), run end-to-end by an LLM. According to Sysdig, initial access was obtained by the agent via a known Langflow RCE (CVE-2025-3248) on an internet-exposed instance. Langflow also just so happens to be an open-source framework for building LLM-driven applications and agent workflows (lol). Afterwards, the agent swept the host for credentials and API keys, followed by lateral movement to a…

Jul 9, 2026 · 4 min read
Triage
Agentjacking: the attack where nothing is unauthorized

This week, researchers at Tenet Security disclosed a new attack class they're calling agentjacking. After seeing Apple's new iOS 27 agentic password features, it's the first AI agent attack in a while that made me stop and actually think about the IR side of it, and I wanted to jot some of that down. The mechanics are wicked simple. Tenet's proof-of-concept involves Sentry Data Source Name (DSN), a project-specific address your app uses to send errors and performance events to the service, which is public and write-only by design. An attacker who finds one can write their own "error events"…

Jun 14, 2026 · 3 min read

A penetration test you didn't pay for - incident report or advertisement?

JADEPUFFER: the first ransomware that writes its own case notes

Agentjacking: the attack where nothing is unauthorized