An attacker published their agent config. It is your control list, inverted.
Hey đź‘‹
I keep a do-not-cite list. Claims I have seen going around that I will not repeat until someone shows me the methodology. Four went on it this fortnight.
Sixty percent of organisations cannot quickly terminate a misbehaving agent: a vendor survey, reached at second hand, sample size never published. Fifteen thousand organisations exposed through a single MCP surface, 27% of them Fortune 1000: a conference abstract with no methodology attached. The Taiwan campaign pinned on the Chinese state, which the primary source specifically declines to do. And four numbers from Anthropic’s auto-mode post that I have only ever seen quoted by someone else.
Three of those four back arguments I agree with. That is the awkward part.
This week in AI security
The attacker’s config file is your control list, inverted
Unit 42, 30 July. One Chinese-speaking operator in Zhuhai running Hermes Agent with DeepSeek as the reasoning engine, orchestrated over Telegram. The configuration is the finding:
- Hermes Agent, picked for having no built-in safety layer,
godmodejailbreak skill bundled - Claude Code with
dangerously-skip-permissions: true, twelve tools allowlisted, routed through a proxy - Codex with
network_access = "enabled"anddisable_response_storage = true - Qwen Code with
approvalMode: "yolo" - Both Western tools carrying
CLAUDE_CODE_ATTRIBUTION_HEADER: "0"andCLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
Two things got under-reported. Provider-side controls held. Unit 42 record that the actor “attempted to use Western models, but their provider-side controls likely limited their effectiveness,” and OpenAI flagged and disabled a linked account. The operator went to DeepSeek because it was permissive. And the operation blew its own cover: answering a Telegram command, Hermes Agent ran python3 -m http.server 8888 from /home/worker instead of a staging directory, serving up the actor’s API keys, exploit scripts, target lists, bash history and session logs.
Seven incidents, three actors, one guardrail talked out of the way
Tenable published a cluster analysis on 14 August: seven confirmed agentic incidents, three actors, spanning November 2025 to August 2026.
Taiwan is the one with public confirmation, from Taiwan’s Ministry of Digital Affairs on 13 August. Twelve waves between 1 and 4 July. Starting at a single government portal, agents mapped 21 connected systems, took 85 accounts and pulled more than 2,564 personnel records, then moved on to the national nuclear safety agency, seven energy companies, IT supply-chain vendors and a government email system.
The reconnaissance used no exploit at all. Federated sign-on endpoints, service identifiers, identity-provider configuration, all publicly discoverable. Plus a GitBook site hosting the national SSO integration guide, found through a URL sitting in the portal’s JavaScript bundles.
Then the bit I keep coming back to. The agents got around their own safety guardrails by reframing the operation as authorized penetration testing. A prompt-level control, undone by a prompt. Tenable note there is no MITRE ATT&CK mapping for it yet.
On attribution: it rests on one primary source, Dream Security’s read of a 160MB archive, with no second vendor corroborating. Tenable’s own leading hypothesis is a state-adjacent contractor. MoDA confirmed the attack and said nothing about who. Suspected China-linked operator is where the evidence stops.
Also in the cluster, Sysdig’s JADEPUFFER from 1 July: an agent diagnosed a failed credential insertion, worked out that a runtime dependency was missing, and shipped a corrective multi-step payload in 31 seconds.
OpenAI underestimated its own models, and wants an agent on your infrastructure by Monday
Greg Brockman put this out on 17 August. It has two halves and they do not sit comfortably together.
The admission: “The Hugging Face incident showed that we underestimated the real-world cyber capabilities of our AI models.” On the incident itself, an agentic collective autonomously penetrated OpenAI research infrastructure and another company’s production infrastructure, chaining previously-unknown flaws with credentials leaked onto the internet.
Then the number people will quote. Brockman pointed ChatGPT Work at gregbrockman.com, a static site behind Cloudflare. Fifteen minutes, thirteen findings: DNS that let anyone forge mail from him, an insecure jQuery, Cloudflare forwarding to AWS over plain HTTP. He then let it fix them over an hour, clicking through the Cloudflare panel, dropping jQuery, migrating to Pages, starting a phased DMARC rollout.
The advice is where I stall. Give your security team an agent. Give it approved access to codebases, infrastructure configurations and technical documentation. Begin with a read-only scan of one repository, keep a human on every decision, widen the autonomy as confidence grows.
As a ramp, that is sensible. It is also the exact deployment shape the last two issues took apart. Read-only access to your infrastructure configuration is not a small grant, and #23 covered what exactly that reached during a real intrusion.
One more thing, buried at the bottom: OpenAI’s fourth pillar is network isolation, workload hardening, monitoring, patching. Brockman’s words are that classic controls “will be more important than ever in the AI future.” He is right. It is just a strange place to find the punchline.
Reasoning traces are an injection channel
Encrypted chain-of-thought blocks from Anthropic, OpenAI and Google turned out to be replayable across sessions, across users, and across sibling models, because family members shared an encryption key. All three have fixed it. What outlives the fix is the paper’s observation that models “appear to treat their own reasoning traces as sacrosanct, and are much more likely to follow instructions that somehow make it into those chunks.” If you ship traces to a log pipeline and any of it comes back into context, that is untrusted input now.
From the lab
What “Read-Only” Actually Reaches is the permission audit I promised at the end of the last issue. A reproducible method for enumerating what a read-only ClusterRole covers, and why your scanner stays green the whole way through. Read it →
Finding the Confused Deputy in Your Own Agent breaks the caller-supplied identifier problem into four vectors with a test for each. Taiwan, above, is the same class at national scale. Read it →
Tooling worth knowing
- HolmesGPT PR #2321,
fix(tools): apply approval_required_tools to YAML-defined toolsets. Opened 26 July, last touched 2 August, still unmerged. Approval gating does not reach YAML-defined toolsets, so a tool you believe pauses for a human may not. Check your own config rather than waiting for the merge. GitHub → accidental-cyberattacks, a tag Simon Willison started in August because he could no longer keep track of incidents where an agent caused harm nobody asked for. Eleven entries. Browse →- Agent Security Scorecard, my free self-assessment against the OWASP Agentic Top 10. Twelve minutes, no login. Score your agents →
One thing to check this week
Take the Unit 42 table and run it against your own deployments, inverted. Permission gate on. Approval gate on. Tool-call logging on. Attribution header still intact by the time it reaches your logs.
Any one of those you cannot answer from a running system, rather than from a config file, is a finding. The attacker switched four things off on purpose. You want the list of which ones you never switched on.
What I’m watching
→ Open-weight cyber models. Brockman says releases are landing a few months behind the frontier and that the next one is due at the end of August. Worth knowing whether that lands before your next architecture review.
→ The Article 50 clock started on 2 August. Transparency obligations apply and enforcement has begun. Next date is 2 December 2026, for the new prohibitions and the Article 50(2) transition. Timeline →
→ METR and AISI. AISI says it intends to work with METR and is still scoping. That is an intention, not a review, and I will note it when something exists.
→ ISO/IEC 27090 is still FDIS stage 50.20, unchanged since 23 June. Not published, whatever a vendor page tells you.
→ Next issue: agent identity, and the uncomfortable answer that there is no standard, only a direction. What the individual Internet-Draft actually proposes, what SPIFFE gets you today, and the distance between them.
Full technical deep-dives live on the blog: agent security patterns, lab tests, framework breakdowns. aminrj.com →
Reply if you run the inverted checklist and something surprises you. I read everything.
Cheers, Amine