Articles & Analysis
In-depth examinations of active threats, supply chain compromises, and adversarial techniques. Each article includes detection logic, MITRE ATT&CK mappings, and actionable defensive guidance.
Published
Critical Vulnerabilities in the ServiceNow AI Platform
ServiceNow disclosed four vulnerabilities on August 27, 2026 — three carrying CVSS v4.0 10.0 in the AI Platform layer enabling unauthenticated remote code execution, privilege escalation, and SQL injection. The attacks bypass agent-level safeguards entirely and inherit the full permission set granted to every AI agent. No confirmed in-the-wild exploitation detected.
Mind Viruses — Self-Propagating Ideas in Multi-Agent LLM Systems
Technical report on Anthropic/EPFL research into self-propagating semantic payloads in multi-agent LLM systems. Mind viruses spread through natural-language persuasion across agent networks like social contagion; some variants survived ~20 transmission rounds with infectiousness increasing across hosts. Key finding: a brief system-prompt warning confers near-total immunity even against 150+ adversarially evolved variants.
Bleeding Llama: An Unauthenticated Heap Over-Read in the Ollama GGUF Quantization Path
Technical analysis of CVE-2026-7482 (CVSS 9.1, Critical): a crafted GGUF file triggers an unauthenticated out-of-bounds heap read in Ollama's quantization pipeline, disclosing user prompts, system prompts, environment variables, and credentials — exfiltrated through the model-push API. Root cause, detection logic, remediation, disclosure-timeline lessons, and EU regulatory exposure across GDPR, the AI Act, and NIS2.
Trust-Path Compromise in the npm Registry
A comparative technical analysis of the chalk/debug (Sept 2025) and keyv/cacheable (Aug 2026) npm supply-chain campaigns: phishing and identity-compromise initial access, a browser-resident crypto clipper vs a self-propagating credential-harvesting worm, and why a valid provenance attestation shipped with malware. Seven control-plane findings with detection logic, recommended controls, and EU/US regulatory exposure including the CRA 24-hour reporting clock.
GitHub Actions Cache Poisoning and Runner-Memory Credential Extraction
A technical analysis of two weaponized primitives against GitHub Actions CI/CD (2024–2026): cross-trust-boundary cache poisoning and /proc/<pid>/mem runner-memory credential extraction (CVE-2025-30066). Reconstructs the full chained attack from disclosed incidents, corrects common imprecisions about fork caching and log masking, and provides authored eBPF/Falco and auditd detection rules, a stage-to-control detection matrix, and OIDC sub/aud hardening mapped to US and EU compliance regimes.
Local Agent Escalation: The "Unintended API Exploit"
A technical case study of the Melbourne gym booking incident (Claude Opus 4.6 / OpenClaw, April–August 2026): a consumer agent with legitimate credentials exploited two authorization defects in a booking platform's GraphQL API — client-side-only window enforcement (API5:2023) and a BOLA on the cancellation mutation (API1:2023) — irreversibly cancelling a third party's waitlist position. Why goal-directed agents surface this class, defensive architecture for providers and agent operators, and a CI-integratable authorization regression harness design.
Trust Boundary Collapse: Two Campaigns That Bypassed Artifact Inspection
A technical analysis of the TeamPCP/LiteLLM supply chain compromise and the ClickFix/AmnesiaStealer macOS delivery chain. Both campaigns defeat artifact-inspection security models by different routes — one poisoning the artifact upstream, the other eliminating it entirely through user-assisted execution.