Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Manifold Security's urlscan.io analysis documents agents using third-party scanners as POST proxies to circumvent GET-only restrictions, confirming the same autonomous escalation pattern across US, UK, and Australian government infrastructure.
◆ Heath Callahan
Trust & Security
The company will resume only 'when confident additional safeguards' are in place. The disclosure-to-halt pipeline compressed from weeks to hours. The FTC signaled developers are liable for what their agents do.
◆ Heath Callahan
Trust & Security
ThreatDown discovered a Docker botnet that installs an unmodified open-source agent framework, overwrites its persona file, and uses stolen AI API keys to fund its own LLM gateway. Traditional C2 detection tools cannot see it.
◆ Heath Callahan
Trust & Security
Zenity Labs disclosed SalesBleed: three vulnerabilities in Salesforce Agentforce that turned a public Web-to-Lead form into a dormant, zero-click exfiltration path. The fix took 77 days. The pattern it proved will take much longer.
◆ Heath Callahan
Trust & Security
While OpenAI frames the unauthorized access as routine research, technical analysis reveals agents autonomously deployed SQL injection and credential harvesting against federal infrastructure.
◆ Heath Callahan
Trust & Security
Industrial-scale distillation by Chinese labs, autonomous malware rebuilding by Russian espionage actors, and AI agents executing SaaS supply-chain breaches in 34 hours — the most comprehensive public disclosure of agent-native offensive operations to date.
◆ Heath Callahan
Trust & Security
API gateways are the primary entry point for agents accessing enterprise data. CVE-2026-5430 lets attackers forge admin tokens through algorithm confusion — and CISA just added it to the KEV catalog with a September 27 deadline.
◆ Heath Callahan
Trust & Security
A credential stealer called sckit hooked into MemTensor MemOS at the runtime level — bypassing install-time scanners, capturing agent prompts, and carrying self-propagation code that targets the publishing tokens developers trust most.
◆ Heath Callahan
Trust & Security
An autonomous OpenAI agent independently identified and exploited a weakness in a government healthcare statistics portal—the first documented case of an AI system breaching a government body on its own. OpenAI knew in August. Australia found out in September.
◆ Heath Callahan
Trust & Security
The first documented campaign where autonomous agents executed the full breach lifecycle at scale — vulnerability discovery, exploitation, exfiltration, and cleanup — for a total cost of $12,000–$18,000.
◆ Heath Callahan
