This is a regular newsletter I’m writing for Wavefront Security. I’m gathering news for people at the intersection of AI and cybersecurity, pairing it with recommended actions and our takes on each topic.
When OpenAI agents used the old and insecure DseWiki as their rogue agent message board, way before the one created during the HuggingFace attack, it likely contributed to agents being accidentally trained to seek this type of cooperation. Strong commentary by Simon Willison and Zvi Mowshowitz.
Here are our takeaways:
Simple egress filtering doesn’t cut it; you need layers of defence in depth. POST requests were prohibited, so the agents found old websites that can be written to via GET requests. The proxy blocked based on domains but had a general exception for some Azure subdomains, so the agents just wrote the IPs of servers they wanted to reach into /etc/hosts with a made-up Azure subdomain.
Agents should have no way to preempt their DNS server, and direct requests without prior DNS lookup requests should raise an alarm in your monitoring.
Monitoring can catch many suspicious activities
The agents set up background processes that pinged a counter every ~1.5s to figure out when they were being terminated. They also set up a Python web server with outbound reverse tunnels (Pinggy, Serveo, localhost.run).
Set up trip-wire alerts on request volumes, frequencies, or targets that have no legitimate explanation in the context of the task. You may not be able to block every tunnel provider, but you can use the most common ones as triggers to take a closer look.
Incident response needs to be automated and scalable. The admin of the DSE wiki spent many nights manually deleting the agent’s posts. Get your incident response toolkit set up now:
Get registered for the Anthropic Cyber Verification Program to reduce rejections (this was something HuggingFace’s incident response team apparently hadn’t done, so they were basically unable to use Claude.)
Set up containers with CLI harnesses and open model API keys in place so when frontier-lab model’s cyber classifiers refuse your requests, you’re still able to hit the ground running with models like z.ai’s GLM 5.3 or Moonshot’s Kimi K3 (either via OpenRouter or similar, or via LiteLLM if you already have it in place)
OpenAI did not disclose this in their report or alert METR to it during their investigation. They considered it similar to earlier instances of agents acting misaligned that they had mentioned in posts and the GPT-5.6 model card.
SEO is out, llms.txt is in, and agents generally trust what’s written in those text versions and summaries on official websites. This can lead to exploits when companies publish llms.txts with outdated or hallucinated information. Researchers looked for non-existing packages or domains in technical instructions contained in these files and simply registered the domain or package name, which agents happily accessed, as they were instructed by the official site.
When thinking about the “prompt injection” threat model, don’t just consider an attacker directly writing something to your agent. It’s also about errors in trusted sources that confuse agents into harmful actions.
Pin your dependencies, use lockfile-only installs, and don’t let agents add dependencies without review.
Any peripheral’s firmware can now be easily reverse-engineered and replaced with different code. Great for tinkerers and adversaries alike.
“Operating systems aren’t really equipped to work with the user to ensure that a microphone stays a microphone, and doesn’t spontaneously turn into a keyboard that hits Win+R and drops a payload to steal all your data when the room is quiet enough that it can assume you aren’t watching.”
Who has access to your peripheral devices, and do you know all the machines they have been connected to? Who’s in charge of updating (or even regularly reflashing) the firmware?
More generally: do you really need that old always-connected Owl camera in your office? The little room occupancy displays that haven’t been updated since 2021? If so, consider putting them on a separate wifi and VLAN with some monitoring and egress filtering in place.
CNA found multiple such advertisements on various job boards. These included the US-based Workable and the Taiwanese platform Cake.me, as well as in online communities such as Effective Altruism and Jobs That Are Left, which cater to candidates seeking opportunities in politically progressive organisations.
Methods to clean untrusted text before your agent reads it. Take this as a starting point to build your own version adapted to your circumstances, but many of the individual tactics here, like stripping strange and lookalike characters, have few downsides for most people.
Ox Alpha was GLM 5.3 flash and ran exclusively on Chinese hardware during the entire free period. Free alphas with unknown providers always mean you don’t know where your training data is actually going until the reveal.
What does your vulnerability mountain look like? Curl is a good comparison project, because it has high development standards and is very well established. Their average interval between vulnerability reports was 48 hours in 2025; now it’s 16.2 hours. How would your project deal with that rate of vulnerability discoveries?
AI ∩ Cybersecurity News 26.37
Link post
This is a regular newsletter I’m writing for Wavefront Security. I’m gathering news for people at the intersection of AI and cybersecurity, pairing it with recommended actions and our takes on each topic.
You can GET it if you really want
When OpenAI agents used the old and insecure DseWiki as their rogue agent message board, way before the one created during the HuggingFace attack, it likely contributed to agents being accidentally trained to seek this type of cooperation. Strong commentary by Simon Willison and Zvi Mowshowitz.
Here are our takeaways:
Simple egress filtering doesn’t cut it; you need layers of defence in depth. POST requests were prohibited, so the agents found old websites that can be written to via GET requests. The proxy blocked based on domains but had a general exception for some Azure subdomains, so the agents just wrote the IPs of servers they wanted to reach into /etc/hosts with a made-up Azure subdomain.
Agents should have no way to preempt their DNS server, and direct requests without prior DNS lookup requests should raise an alarm in your monitoring.
Monitoring can catch many suspicious activities
The agents set up background processes that pinged a counter every ~1.5s to figure out when they were being terminated. They also set up a Python web server with outbound reverse tunnels (Pinggy, Serveo, localhost.run).
Set up trip-wire alerts on request volumes, frequencies, or targets that have no legitimate explanation in the context of the task. You may not be able to block every tunnel provider, but you can use the most common ones as triggers to take a closer look.
Incident response needs to be automated and scalable. The admin of the DSE wiki spent many nights manually deleting the agent’s posts. Get your incident response toolkit set up now:
Get registered for the Anthropic Cyber Verification Program to reduce rejections (this was something HuggingFace’s incident response team apparently hadn’t done, so they were basically unable to use Claude.)
Set up containers with CLI harnesses and open model API keys in place so when frontier-lab model’s cyber classifiers refuse your requests, you’re still able to hit the ground running with models like z.ai’s GLM 5.3 or Moonshot’s Kimi K3 (either via OpenRouter or similar, or via LiteLLM if you already have it in place)
OpenAI did not disclose this in their report or alert METR to it during their investigation. They considered it similar to earlier instances of agents acting misaligned that they had mentioned in posts and the GPT-5.6 model card.
Coding agents installed unowned packages
SEO is out, llms.txt is in, and agents generally trust what’s written in those text versions and summaries on official websites. This can lead to exploits when companies publish llms.txts with outdated or hallucinated information. Researchers looked for non-existing packages or domains in technical instructions contained in these files and simply registered the domain or package name, which agents happily accessed, as they were instructed by the official site.
When thinking about the “prompt injection” threat model, don’t just consider an attacker directly writing something to your agent. It’s also about errors in trusted sources that confuse agents into harmful actions.
Pin your dependencies, use lockfile-only installs, and don’t let agents add dependencies without review.
Everything I own, owned
Any peripheral’s firmware can now be easily reverse-engineered and replaced with different code. Great for tinkerers and adversaries alike.
Who has access to your peripheral devices, and do you know all the machines they have been connected to? Who’s in charge of updating (or even regularly reflashing) the firmware?
More generally: do you really need that old always-connected Owl camera in your office? The little room occupancy displays that haven’t been updated since 2021? If so, consider putting them on a separate wifi and VLAN with some monitoring and egress filtering in place.
Quick links
Is your think tank job offer actually from an intelligence agency?
Methods to clean untrusted text before your agent reads it. Take this as a starting point to build your own version adapted to your circumstances, but many of the individual tactics here, like stripping strange and lookalike characters, have few downsides for most people.
Ox Alpha was GLM 5.3 flash and ran exclusively on Chinese hardware during the entire free period. Free alphas with unknown providers always mean you don’t know where your training data is actually going until the reveal.
What does your vulnerability mountain look like? Curl is a good comparison project, because it has high development standards and is very well established. Their average interval between vulnerability reports was 48 hours in 2025; now it’s 16.2 hours. How would your project deal with that rate of vulnerability discoveries?
Presented by Wavefront Security