[tl;dr sec] #338 – OpenAI and Hugging Face, Accelerating EDR Evasion, Google’s Mantis

It’s been… a week  

In case you haven’t heard, this week OpenAI published a blog post saying that the recent AI-powered attack on Hugging Face was in fact… GPT‑5.6 Sol and a pre-release model.

I feel very fortunate to have been able to see things unfold behind the scenes and contribute to the blog.

Unfortunately I can’t say more at this time, other than I am very impressed by my colleagues.

The next security incident may not look like an attack. It may look like an employee moving sensitive data, using an AI tool, or completing a routine task. 

Traditional security controls can see the activity but often miss why it is happening or what should be the response.

Ent brings real-time intent and behavioral context to human and AI-driven work, identifies risky actions, and intervenes before it becomes an incident, without disrupting legitimate productivity. 

Meet with an Ent security expert to learn how to protect work as it happens.

Rust-proof your code with our new Testing Handbook chapter
Trail of Bits released a new Rust chapter in their Testing Handbook, including a security overview of what Rust’s guarantees do and don’t cover, dynamic analysis tools like Miri for undefined behavior detection, proptest for property testing, mutation testing, plus static analysis with Clippy lints and the Kani model checker. The guide includes underappreciated security issues including unwind safety, nondeterminism, arithmetic errors, and operator precedence gotchas, and provides three solutions for memory zeroization of secrets. They also released rust-review, a Claude Code plugin co-built with Aptos Labs that automates security reviews targeting a dozen bug classes, including memory safety, concurrency hazards, FFI pitfalls, and async cancellation issues.

Comparing Open-Source AI Code Security Harnesses
Semgrep’s Isaac Evans compares open-source AI-powered code security tools, categorizing them into three types, LLM-led exploit generation, which finds bugs by crashing them in a sandbox, like Anthropic’s defending-code-harness for C/C++ memory bugs. LLM-skill-boosting, which adds skills inside LLMs to help them reason about code the way a human vulnerability researcher would, including Cloudflare’s security-audit-skill, Trail of Bits’ Skills library, CapitalOne’s vulnhunter, and Google’s mantis. And SAST+LLM hybrids, which use traditional static analysis to feed candidate findings to an LLM for deeper review, including Cisco’s ai-deep-sast, Vercel Labs’ deepsec, Visa’s VVAH, and raptor.

Key differentiators include whether tools execute code to validate findings, generate patches, support fully local operation, and use adversarial validation where a second independent agent attempts to falsify findings. Looking at the field overall, Isaac sees no market leader emerging and expects many companies to build their own “shop jigs” for vulnerability finding while the field moves too fast for a reference open-source harness to consolidate.

It’d be cool to see some TP/FP/FN/cost analysis across various harnesses  

Shadow AI isn’t a rogue employee problem. It’s four ordinary behaviors: signing up for a new tool, logging into an approved one with a personal account, installing an extension, granting an OAuth consent. Each builds the attack surface that attackers now target directly. 

Join the latest threat briefing from Push Field CTO Mark Orlando as he puts hard numbers on the gap and shows how attackers have made shadow AI a key part of their toolkit in 2026. 

Hmm I could see how the interplay between all of these OAuth grants, LLM connections, imitation extensions, etc. all combine in nasty ways.

pnpm 11 Adds Supply Chain Protection Defaults for Minimum Release Age and Exotic Subdependencies
Socket’s Sarah Gooding describes how pnpm 11 turns on supply chain protections by default, including a 24-hour waiting period before new package versions can be installed, blocking transitive dependencies from non-standard sources like Git repos and direct tarballs, and a new allowBuilds model that consolidates control over which packages can execute install-time scripts. The release also adds native registry commands, built-in SBOM generation via pnpm sbom, and pnpm audit --fix=update for lockfile-based vulnerability fixes.

Homebrew: 6.0.0
Mike McQuaid announces Homebrew 6.0.0, which introduces tap trust to require third-party taps to be explicitly trusted before their arbitrary Ruby code runs while official taps stay trusted by default. Two other changes shrink the code that runs unsandboxed. Linux now sandboxes build, test, and postinstall phases through Bubblewrap, matching what macOS already does. And a new install steps framework lets simple postinstall actions ship as static data instead of Ruby code, so the installer no longer has to evaluate a Ruby file for basic file operations. A new brew vulns tap and subcommand also checks installed packages for known vulnerabilities.

Security features and hardening for package managers, love to see it  

DeepTempo/socbench
By DeepTempo: A benchmark that evaluates frontier reasoning LLMs as SOC agents analyzing raw NetFlow data through a deterministic, multi-turn agent loop with persona-scoped read-only tools and strict budget caps. The framework tests four personas (SOC Analyst, Threat Analyst, Adversary Hunter, Detection Engineer) against pre-indexed NetFlow parquet files, scoring predictions using per-flow/per-pair/per-host F1 metrics with ablation support for tools_off and playbooks_off comparisons.

BOTS v3 Benchmark
DefenseBench evaluation of AI agents on Splunk’s Boss of the SOC v3 dataset, giving them 90 minutes to answer security investigation questions via a referee API that handles question retrieval, answer submission, and hint purchases. Agents query Splunk via CLI using curl commands, with scoring based on correctness, speed bonuses, and penalties for wrong answers or hints. The setup tests AI agents’ ability to perform SOC analyst tasks like querying security data, interpreting results, and managing investigation workflows under time pressure.

Most recent models tested are Opus 4.6 and GPT 5.4, so this benchmark must be at least 10 years old in AI years.

Accelerating EDR Evasion with LLM-Driven Analysis
SpecterOps’s Adam Chester demonstrates how LLMs like GPT-5.5-Cyber can systematically reverse engineer commercial EDR products to extract detection rules and generate evasions, using a simple “Day Shift” harness that loops Codex CLI with Binary Ninja over MCP. Testing against Palo Alto’s Cortex XDR, the LLM successfully extracted 9,350 DSE rules, 4,209 BIOC rules, 6,358 YARA signatures, 7 ML models with working execution harnesses, and behavioral detections written in CLIPS (like LISP), all from local files without cloud access. “Again this isn’t just a binary artifact that is referenced by the LLM. When reviewing the results, I found a list of cleartext files ready to be reviewed.”

Extracting the rules is only useful if you can turn them into evasions, and Adam demonstrates the closed loop with a concrete example. Cortex blocks reg save HKLMSAM, a standard credential dumping command, but the decrypted CLIPS rule reveals an allowlisted output path an attacker can use to run the same command undetected. He closes with a preview of Upside Down, a simulation framework using Windows and EDR emulation subagents that let the LLM test extracted rules and iterate on evasions before touching a real environment, and notes the same process has already produced extracted rules and models for every major EDR vendor.

Honestly kinda crazy that you can just put an agent in a while loop and say “please reverse this and find the secrets” with no additional scaffolding and… it does  

google/mantis
Mantis is a portable, sequential toolkit of AI agent skills for building automated security review pipelines that can discover vulnerabilities, generate proof-of-concept exploits, and create patches. The 15-stage pipeline includes threat modeling, vulnerability scanning, deduplication, false positive filtering, sandboxed crash reproduction, exploit chaining, and automated patching, all designed to run in isolated Docker/gVisor containers.

The toolkit supports both interactive human-in-the-loop execution and unattended cloud deployment, with an opt-in snapshot model that enables continuous review of living codebases by pinning immutable snapshots per pass and syncing targets non-destructively at pass boundaries.

Kimi K3 Might Have Just Started a Crash of the US Economy
Daniel Miessler argues that China’s release of cheap, high-quality open source AI models like Kimi K3 is a deliberate CCP strategy to undermine US AI labs, potentially triggering a stock market crash and economic collapse that could lead to Taiwan reunifying with China. He believes that while increased competition benefits the AI ecosystem, users sending their data to these models are falling into a geopolitical trap. Daniel warns that once China achieves global dominance, the era of cheap, politically unrestricted models will end, with the world resembling Hong Kong’s current state under CCP control.

How Far Behind the Frontier are Leading Open Weight Models on Cyber?
The AI Security Institute reports that open weight AI models are catching up to closed frontier models on cyber capabilities faster than expected. GLM-5.2 and DeepSeek V4-Pro now match closed models released 4 to 7 months earlier, down from a 6 to 10 month gap in 2025. On AISI’s long-horizon cyber ranges, GLM-5.2 got as far as Anthropic’s Opus 4.5 across a 32-step attack that would take a human expert about 20 hours.

The open weight models were also much cheaper and less guarded. A full cyber range run cost $1.19 on DeepSeek V4-Pro and $46 on GLM-5.2, against $85 on Opus 4.6. DeepSeek refused a few tasks but retrying the same prompt was enough to get it to comply. Once model weights are out in the open, closed-model safeguards like monitoring, user banning, and refusal training don’t hold up, since anyone can strip refusal training out of the weights and run the model wherever they want.

Western governments, rightly so, want to ensure models from American AI labs aren’t used for harm. This is a good thing. However, slowing down the rate of release/adding significant friction helps Chinese models catch up. I intellectually understood but didn’t fully appreciate this before working at a lab. This is actually a Big Deal, when the state of the world is $X0,000 gets you 0-days in important software.

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I’d really appreciate if you’d forward it to them

P.S. Feel free to connect with me on LinkedIn