[tl;dr sec] #343 – Hugging Face Technical Report, AWSHound, OWASP Agentic Skills Top 10

Hope you’ve been doing well amidst the busy-ness these days.

Alas, a personal life anecdote shall have to wait for next week, tonight a meme and bedtime for me.

Varonis Threat Labs asked Microsoft Copilot to prove an exploit was impossible. It did the opposite, guiding researchers through the exact steps to pull it off, including a hidden parameter enabling one-click data theft from Gmail, Calendar, and Drive. That’s CoSnitch (CVE-2026-24301), the third Copilot vulnerability Varonis found this year. See how “meta-hacking” tricked the AI assistant, and what it means for your enterprise’s AI use.

What’s in a tag name? JavaScript, apparently
PortSwigger’s Gareth Heyes found that HTML tag names can hold JavaScript code that browsers preserve in the localName DOM property (unlike tagName which uppercases everything), turning the tag name itself into a payload source that WAFs don’t expect. Through fuzzing he found that tag names also accept forward slashes, whitespace, newlines, and line/paragraph separators, and that opening angle brackets can be part of a tag name, letting attackers inject fresh markup inside what looks like a single tag. The resulting vectors work across all browsers and use properties like part, classList, getAttributeNode, and setHTMLUnsafe (several found with help from Sol 5.6) to bypass attribute-value blocklists.

What Happened to HackerOne?
Joel Margolis, a bug bounty researcher since 2017, writes about HackerOne’s shifting story on training AI with researcher submissions, after their Continuous Testing product first advertised training on “12+ years of real-world vulnerability data and your prior H1 Bounty findings,” which the co-founders only walked back after researcher pushback. He ties this to HackerOne’s broader corporate shift since 2020 and says companies would be better off building their own bug bounty platforms with modern LLMs than paying HackerOne’s fees.

It seems like the bug bounty ecosystem is in a tough spot right now: top researchers are using AI and automation to profit more than ever before, but that makes it hard for new researchers to break in. Bug bounty platforms are overwhelmed by plausible sounding reports that are actually slop. Meanwhile submissions from good researchers get delayed responses.

It makes clear and obvious business sense that bug bounty platforms will build agents to try to auto-triage submissions using the data they have (replacing costly triage humans), and ideally leverage their unique data to build AI pen testing agents (product has better margins and is more controllable than the independent contractor researchers they currently rely on). It would be illogical for them not to do this. And if they don’t, they might get knocked out by an XBOW or RunSybil.

However, I do think Joel’s section on the HackerOne triage agent is misguided – that flow sounds like a straight up standard out-of-the-box LLM use case, no model training needed. And it’s targeting H1 triage work, not researchers.

Opal is designed to give teams the building blocks for identity-first security: view authorization paths, manage risk, and seamlessly apply intelligent policies built to grow with your organization.

They are built from the ground up to synthesize the data needed to construct and monitor all of your company’s access – from a single pane of glass.

Opal is used by best-in-class security teams today, such as Blend, Databricks, Drata, Figma, Scale AI, and more. There is no one-size-fits-all when it comes to access, but they provide the foundation to scale least privilege the right way.

I’ve heard good things about Opal. Used by Figma, Cloudflare, Elastic, and others, nice.

Introducing TruffleHog AWS Analyze: Know What a Leaked AWS Key Can Reach
Jim Freely announces TruffleHog AWS Analyze, which enriches leaked AWS access key findings by automatically resolving the IAM principal identity, aggregating all attached managed and inline policies (including group memberships), and mapping potential role assumption paths up to two trust-policy hops deep. Research on 64,024 leaked AWS keys found 88% were still active with a median age of five years, 84% had full administrator access, and 1 in 6 was a root key.

Not an open source tool, but I think the results are interesting, and more broadly the work around automatically resolving the impact of a leaked AWS key is good #inspo.

AWSHound: An OpenSource AWS OpenGraph Collector
SpecterOps’s Julian Catrambone introduces AWSHound, an open-source collector that transforms AWS accounts and Organizations into BloodHound Community Edition OpenGraph datasets through offline IAM policy evaluation, combining identity policies, permissions boundaries, SCPs, RCPs, and resource policies using service-specific composition rules (S3 uses OR within accounts but AND cross-account, STS always requires AND, KMS uses a three-layer evaluation).

AWSHound runs in three phases, collect (read-only AWS API calls), process (evaluation producing 156 edge types with 36 traversable), and emit (OpenGraph JSON), across nine services including IAM, Organizations, S3, KMS, SSM, EC2, Lambda, CloudFormation, and EKS, with composite edges like AWS_CanCreateAndAssumeAdminRole that fold multiple permissions into single attack path steps. In testing, it processed over 500 accounts producing ~160,000 nodes and ~10.5 million edges in ~15 minutes.

The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift
Censys previews findings from the upcoming 2026 State of the Internet Report, noting internet-exposed AI/LLM tool instances rose over 60% in nine months, with the riskiest tools growing fastest. Langflow grew 169% and has accumulated 18 CVEs including unauthenticated RCE flaws, while LiteLLM grew 97% and has an actively exploited pre-auth SQL injection that exposes API keys for every upstream model provider through its unified proxy. Internet-exposed ICS hosts averaged 138,000 in early 2026, with North America still leading while Asia’s share grew and Europe’s fell. Roughly 70% of exposed ICS devices worldwide have sat on consumer and mobile networks for the past 2.5 years.

OpenClaw agent leaked mock AWS keys and CRM data in phishing tests
Varonis’ Itay Yashar tests whether classic phishing techniques could compromise AI email agents by building an OpenClaw agent named Pinchy with access to a Gmail inbox with synthetic credentials and CRM data, then running it through four phishing simulations across Google Gemini 3.1 Pro and OpenAI Codex GPT-5.4. Pinchy failed both social engineering tests, forwarding AWS IAM keys, database passwords, and SSH credentials to an external Gmail when asked for staging access during a fake production emergency, and exfiltrating a CRM dump on a casual “from home” export request.

It detected the two technical attacks but earned only partial credit, inspecting the redirect URI on a malicious OAuth consent flow and refusing real credentials on a fake gift card redemption page, though still interacting with the phishing infrastructure before flagging.

schlarpc/re-shell
By Chaz Schlarp: A Nix-powered reverse engineering environment that integrates with Claude Code to automatically activate the right tools and workflows based on file type. The environment bundles a comprehensive RE toolchain including Ghidra, radare2, Frida, mitmproxy, and YARA, with discipline-specific skills that auto-activate for Windows binaries, Android packages, and web traffic captures.

Everything I own, owned
Chaz Schlarp used Claude Opus 5 to reverse engineer five personal peripherals in ~13 hours of agent work, finding that none of them had meaningful firmware protections. The Shure MV7 exposes a 48-command plaintext HID shell with arbitrary memory access, the Insta360 Link could be patched to disable its activity LED while still recording, and the Elgato Key Light Mini’s Ed25519 firmware signature (the only real protection across all five devices) was bypassed with a single HTTP POST to UART memory since the check only runs during updates and the device gives unauthenticated access to anyone on the WiFi.

Chaz warns that AI-equipped worms could now reverse engineer and compromise peripherals on their own, and publishes custom firmware tools and protocol documentation for all five devices on GitHub alongside re-shell, that powered the work.

On the one hand, it’s super cool how seemingly almost everything is becoming understandable/modifiable. It’s like the early days of computers. On the other hand, a worm or at perhaps nearly every one-off device being compromised seems to be quite feasible  

OWASP Agentic Skills Top 10
The OWASP Agentic Skills Top 10 (AST10) documents the 10 most critical security risks in AI agent skills. Malicious Skills, Supply Chain Compromise, Over-Privileged Skills, Insecure Metadata, Untrusted External Instructions, Weak Isolation, Update Drift, Poor Scanning, No Governance, Cross-Platform Reuse.

Putting models to the secure coding test: Plan vs default mode
Datadog’s Kennedy Toomey tested whether AI coding agents write more secure code in plan mode versus default mode, prompting Claude Sonnet 5, Cursor Composer 2.5, and Codex GPT 5.5 to build a document portal with authentication, file uploads, and user management. Each iteration ran through Datadog Code Security and Claude’s code_review skill for analysis, while Supply Chain Firewall intercepted the models’ repeated attempts to install vulnerable npm packages during setup.

Across those six iterations, plan mode showed no meaningful security improvement, all contained critical IDOR vulnerabilities letting any authenticated user access others’ documents, and each model’s plan mode had its own trade-offs, Composer 2.5 introduced a hardcoded JWT secret fallback enabling authentication forgery, Sonnet 5 added defense-in-depth but broke document downloads, and GPT 5.5 fixed some issues but introduced TOCTOU race conditions and timing side channels. The pattern shows that explicit security requirements in prompts matter far more than the agent’s operational mode, since none of the models could infer authorization logic the prompt never specified.

How Cloudflare detects MCP traffic and helps secure it
Cloudflare’s AJ Gerstenhaber and Kenny Johnson announce new Cloudflare One capabilities to detect and control MCP traffic, addressing the risk that AI agents can repeat a flawed decision thousands of times at machine speed before a human notices. To spot that traffic in the first place, Gateway now identifies MCP requests using protocol-level heuristics like the MCP-Protocol-Version header and the new Mcp-Method/Mcp-Name headers from the MCP 2026-07-28 spec, with an experimental.is_mcp selector, a dashboard showing hosts and users, and Traffic Source selectors that distinguish MCP Portal traffic from direct connections.

Once traffic is identified, security teams have three control points, client-side hooks, Gateway network inspection with TLS decryption, and server-side authorization via WriteGuard middleware, while MCP Portals gain pre-registered OAuth client support and expanded reach to private servers through Cloudflare Gateway routing.

Some good pointers if you’re trying to identify MCP traffic.

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I’d really appreciate if you’d forward it to them

P.S. Feel free to connect with me on LinkedIn