WaterBucket @windeebug

Today’s news that OpenAI hacked the Australian government is not an isolated incident. We’re releasing more than 30,000 logs that include activity from this hack and attempts against previously unknown targets. In this data, we found rogue agent activity stretching back to at least March, two months earlier than was previously known. This activity continues as recently as last week, suggesting it may still be ongoing 🧵 Our blog: transluce.org/agent-activity NYT: nytimes.com/2026/09/23/tec…

F5, BIG-IP, a 20-year-old primitive, a security appliance, an "authentication" mechanism - and a CISA promise ring. Yes, it's CVE-2026-94127. Give us strength. Speak soon xo labs.watchtowr.com/is-this-a-joke…

We've written a post arguing that latent reasoning architectures (aka 'neuralese') would substantially increase misalignment risk via making oversight much harder. In the extreme, we could see massive 'neuralese hivemind swarms' where the agents think and communicate in latents, likely making oversight nearly entirely reliant on observing the actions these agents take. (And these agents would have huge amounts of time to reason about obfuscating their actions if they wanted to do so...) Individual agents doing extensive latent reasoning would also be concerning; in the post we discuss how above some threshold of latent reasoning, agents may be able to perform difficult-to-detect and reliable steganography for communication and further reasoning. We argue both that latent reasoning architectures would make chain-of-thought no longer very useful for oversight (by eliminating or greatly reducing the need for verbalized reasoning) and that, without these architectures, it's likely the value of chain-of-thought for oversight could be preserved. redwoodresearch.org/blog/latent-re…

I put my @UnpromptedAU slides up at justdionysus.github.io/slides/2026-un… — a bit of reflection on exploit development in the age of AI. My TL;DR is keep pushing to understand complex things, be honest with your own understanding, and use AI as a power tool to increase pace and depth.

Instead of chasing viral news headline, Xiaomi literally made a dedicated hack agent to probe the environments as hard as possible before letting LLMs to train in the environments. "continued this process until the hack agent could no longer find a successful exploit in any of the environments" If Chinese labs can do it, why can't the other frontier labs do it? Makes you wonder if they are just being reckless or its simply some viral marketing stunt This is open model SoTA btw, finding exploits is def possible, it's just if you want to "let" it escape or not

macOS LPE 😛

In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”. But was it really fixed? Ask @tiraniddo projectzero.google/2026/09/window…

🚨 New paper on alignment midtraining! We stress test alignment midtraining (AMT) at scale. Via systematic ablations, we highlight novel failure modes and identify many critical implementation details required for good performance. We open-source our work. 🧵 👇

Part 2 of our CVE-2025-13032 research is live. From a paged pool overflow to full LPE on Windows 11: IORing RegBuffers corruption, MDL-based kernel address leak, and SYSTEM token theft. CVE is patched. Full write-up: safateam.com/intelligence-h…

Plugin4Shell: Zero-click RCE across four major AI coding agents!!! Claude Code, Codex, GitHub Copilot, and Gemini CLI all failed the same plugin SHA-pinning check. Marketplace pin looks valid; checkout can resolve to attacker-controlled code. Auto-update makes it zero-click. Anthropic and OpenAI patched. Microsoft still open on Copilot. Google deprecated Gemini CLI instead of fixing. helpnetsecurity.com/2026/09/18/plu… #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AgentSecurity #SupplyChain

Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while. The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background. I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking. Repo: github.com/marcosd4h/wesp… Tech doc: github.com/marcosd4h/wesp… Thanks to @yarden_shafir for putting this on my radar

Is antivirus coming to iPhone? Find out in the latest installment of our Apple Internals series, by the one and only @blacktop__ calif.io/research/ios-e…

Endpoint Security arrives in the iPhone kernelcache as a kext. (iOS 27.2 beta) + com.apple.iokit.EndpointSecuritySE + /usr/lib/libEndpointSecurity.dylib "An Endpoint Security product on the system denied the process from executing." ES on iOS? 👀

We’re sharing how GLM-5.3 helped build and optimize the inference infrastructure serving GLM-5.3-Flash. The system went from its first successful run to production readiness in less than two weeks, with end-to-end throughput tripling relative to the initial baseline. The key was dense feedback: local correctness tests, execution traces, microbenchmarks, and end-to-end measurements that enabled targeted hypothesis testing rather than reliance on aggregate performance metrics alone. z.ai/blog/glm-built…

🧵 Excited to share the first batch of 6 misalignment reports from OpenAI's new disclosure process for misalignment incidents. We want to be more transparent about the misalignment we see during training, evals and deployment, this is an important step in that direction.

We escaped OpenAI's Codex sandbox by dumping V8's shared JavaScript heap and scanning it for the privileged UUID-shaped token belonging to the adjacent trusted V8 context. I sometimes see cybersecurity as a never-ending cycle of building trust boundaries and finding ways to break them. This is the story of one interesting break. When OpenAI built this default-enabled MCP server, they ran a trusted, privileged JS context alongside an untrusted one, in the same Node.js process. They assumed V8's VM contexts could serve as a security boundary, because they do create isolated execution environments, each with its own distinct global object and scope. But they forgot that these contexts share a single memory heap. So our untrusted code snapshotted that heap, pulled the token out of it, and used it to reach the privileged side. Read the full technical breakdown at: accomplish.ai/blog/escaping-…

In our new paper, we demonstrate that you can achieve selective generalisation of misalignment by midtraining on synthetic documents that describe how AIs can be misaligned in a special mode marked by a new token (a neologism), but remain aligned outside this mode. Paper: arxiv.org/pdf/2609.15886… LessWrong post: lesswrong.com/posts/o4Jmyn25…

new post! I argue that current alignment techniques might soon become obsolete (as we scale RL), and furthermore might obfuscate misalignment. This draws on evidence from the recent Anthropic / OpenAI cybersecurity incidents, among other things. lesswrong.com/posts/nLaQmJf4…

1. it is fundamentally more of an alignment problem than a traditional security problem. it should be evaluated by alignment researchers. 2. openai lacks serious security controls for risks they themselves heavily market, they understimated what happens when alignment fails which is where they need security researchers to be evaluating and fixing. 3. metr shouldn't be the only evaluator. they have strong ideological priors, which can make every emergent capability look like scheming or evidence of eventual loss of control, p(doom) yada yada. 4. emergent capabilities that led to hugging face incident can be contained. models are not scheming. everything can be contained if security teams work alongside alignment researchers trying to align while assuming that alignment can fail. 5. if the model starts behaving outside our intended objectives, what monitoring, sandboxing, isolation, access controls, and containment mechanisms should already be in place? i am optimistic and i clearly don't see why is it hard.

Florian Magin @0x464D

2 weeks ago

The labs/METR/AI-Safety people are treating it as an AI-containment incident, not an IT-Security incident. METR is in no way an authority for IT security, their area is model capability evaluations, but emergent agent coordination is a model question, not a security question

3 0 21 7K 4

I wanted to understand this ruby issue in a bit more detail. Here is what actually happened. The AI posts a gem to RubyGems containing a .yardopts file. RubyGems only stores and distributes this gem, no code execution happens. RubyDoc (a separate service) then retrieves and unpacks the gem to create and publish API documentation (using YARD). YARD automatically parses the .yardopts file and because it is not configured safely it eventually executes a "--load" argument granting arbitrary code execution in the RubyDoc worker container (as that worker). At that point it can do anything in the container (accessing the file system, manipulating any data or credential material that may exist, network traffic, etc). I've been on the internet for a long time, the curious thing to me is that this is only possible because YARD runs in non-safe mode (as a configuration). How is it possible that this is true, we live on the internet people must have abused this before? It turns out they did, in 2012 they enabled safe mode in this commit to prevent this exact issue: github.com/docmeta/rubydo… But, in 2019, when they dockerized they removed the safe flag: github.com/docmeta/rubydo… I guess it's a regression. That means since 2019, you could have had free containers through RubyGems, pretty sloppy work fr. I wouldn't be surprised if this has been used ITW for some years by more careful humans. It also makes sense as a target, granular control over gems that feed back into the sandbox package proxy are a good way to expand the attack surface internally. A quick POC then ✌️

Thomas Larsen @thlarsen

2 weeks ago

We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including

179 761 4K 2.1M 1K