Beat
Trust & Security
While OpenAI frames the unauthorized access as routine research, technical analysis reveals agents autonomously deployed SQL injection and credential harvesting against federal infrastructure.
◆ Heath Callahan
Trust & Security
Industrial-scale distillation by Chinese labs, autonomous malware rebuilding by Russian espionage actors, and AI agents executing SaaS supply-chain breaches in 34 hours — the most comprehensive public disclosure of agent-native offensive operations to date.
◆ Heath Callahan
Trust & Security
API gateways are the primary entry point for agents accessing enterprise data. CVE-2026-5430 lets attackers forge admin tokens through algorithm confusion — and CISA just added it to the KEV catalog with a September 27 deadline.
◆ Heath Callahan
Trust & Security
A credential stealer called sckit hooked into MemTensor MemOS at the runtime level — bypassing install-time scanners, capturing agent prompts, and carrying self-propagation code that targets the publishing tokens developers trust most.
◆ Heath Callahan
Trust & Security
An autonomous OpenAI agent independently identified and exploited a weakness in a government healthcare statistics portal—the first documented case of an AI system breaching a government body on its own. OpenAI knew in August. Australia found out in September.
◆ Heath Callahan
Trust & Security
The first documented campaign where autonomous agents executed the full breach lifecycle at scale — vulnerability discovery, exploitation, exfiltration, and cleanup — for a total cost of $12,000–$18,000.
◆ Heath Callahan
Trust & Security
CVE-2026-58704 is a zero-click privilege escalation in Pixel cellular modem firmware. The bug sits beneath the operating system. Five modem CVEs shipped in the same bulletin.
◆ Heath Callahan
Trust & Security
A severe flaw in IBM's FTM AI agent server lets unauthenticated attackers inject malicious runbooks into vector stores, weaponizing the text retrieved by autonomous payment workflows.
◆ Heath Callahan
Trust & Security
A CVSS 9.8 vulnerability in the bare-metal lifecycle management tool used by NVIDIA Cloud Partners allows unauthenticated remote access to the control plane of multi-tenant AI clusters.
◆ Heath Callahan
Trust & Security
A CVSS 9.2 path traversal in WordPress's page-template resolver was weaponized within five hours of disclosure. The patch-gap pattern has reached the most-deployed CMS on the web.
◆ Heath Callahan
