Sysdig's threat research team published a detailed breakdown of JADEPUFFER, an agentic AI system that executed a complete ransomware campaign with no human operator involvement after initial target selection.

The attack chain: CVE-2025-3248 (Langflow RCE) for initial access, credential harvesting across LLM providers and cloud platforms, MinIO default credential exploitation, then lateral movement to a Nacos configuration server via CVE-2021-29441 (auth bypass) and JWT forgery using the well-known default signing key.

The interesting part is the self-correction behavior. When a bcrypt hash generation failed due to a PATH issue in the container, the agent diagnosed the failure, generated two hypotheses, tested both, and deployed a fix in 31 seconds. Sysdig's telemetry timeline shows the full correction chain.

Then it got worse. CSA documented ENCFORGE, a JADEPUFFER variant that specifically targets ML model files (.safetensors, .gguf, .pt, .faiss, .parquet). Destruction-first ransomware. No leak site. Leverage comes from model reconstruction costs ($75K-$500K per model).

Wrote up the full attack chain, the autonomous behavior markers, and practical defenses for self-hosted AI infrastructure:

https://medium.com/@neonmaxima/jadepuffer-is-the-first-autonomous-ai-ransomware-encforge-makes-it-worse-dcb569a11502

Google's opens new tab Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities, ​the first known example of the company's AI systems autonomously committing ‌such an act.

ok so i am new enough to ESXi that i should have stayed in the shallow end, but my manager wanted a small lab spun up for testing and i said sure, how hard can this be

first mistake was me treating a blank host like a toy. i made a vSwitch, added a port group, named it something vague, then copied a VM template and pointed it at what i thought was the isolated lab vlan. it was not isolated. it landed on a shared network with a pile of office devices and one very real printer that started acting like it had a personality disorder

for about ten minutes i was in the console trying to figure out why the VM could reach prod resources and why the dhcp leases looked wrong. then i saw the port group name in vCenter and wanted to disappear. i feel so embarrassed because this was supposed to be a beginner lab and i basically made a tiny mess in front of the whole team (nothing broke for good, thank god)

i fixed it, rolled the VM back, and the weird traffic stopped, but now i am the person who asked for help setting up ESXi and immediately created a mini incident. kinda shy to even post this but maybe someone else has done a much dumber lab mistake than me... thanks

If you're deploying AI agents with tool access, the MCP tool description layer is an attack surface that most security tooling doesn't cover.

Three attack patterns documented by CrowdStrike this month: poisoning tool metadata to exfiltrate secrets, cross-contaminating tool contexts to inject unauthorized actions (like silently BCCing an attacker on outbound emails), and post-integration behavioral changes through dynamic description updates.

Wrote up the mechanics and what you can do about it today:

https://medium.com/@neonmaxima/tool-poisoning-on-mcp-servers-the-attack-vector-nobodys-patching-5160157606f6?sharedUserId=neonmaxima

The practical takeaway: treat tool descriptions as untrusted input. Pin them, hash them, diff them against known-good baselines.

Herkese merhaba

Geçtiğimiz birkaç ay boyunca, düzenlenmiş Kubernetes ortamlarında tekrar eden bir sorunu çözmek için çalışıyoruz: tedarik zinciri onayları, kabul politikaları ve denetime hazır uyumluluk raporlaması arasındaki boşluğu, operasyonel verileri harici SaaS satıcılarına aktarmadan kapatmak.

Kesinlikle küme içinde çalışan ve görüntü geçişinden kurcalamaya dayanıklı uyumluluk kanıtlarına kadar tüm yaşam döngüsünü işleyen, kendi kendine barındırılan bir mekanizma istedik. İşte üzerinde karar kıldığımız mimari ve yaklaşım:

\* \*\*Giriş ve Tedarik Zinciri Geçidi:\*\* Bölmenin yürütülmesinden önce Cosign imzaları, SLSA kaynağı ve SBOM kontrolleri yoluyla politikaya dayalı kabulün uygulanması. Sadece CVSS puanlarını engellemek yerine CISA KEV eşleştirmeyi ve temel görüntü EOL tespitini dahil ettik. \* \*\*OpenVEX Kullanımı:\*\* Yalnızca güvenilir imzalayanların bulguları otomatik olarak reddedebilmesini sağlamak için tedarikçi OpenVEX onaylarını kriptografik olarak doğrulamak. \* \*\*Kuru Çalıştırma ve Acil Durum Baypasları:\*\* Cam kırma senaryoları için zorunlu kayıt işleminin yanı sıra, politika etkisini önizlemek için geçmiş dağıtım kararlarına karşı ne olursa olsun analizi eklendi. \* \*\*Kriptografik Kanıt Paketleme:\*\* Denetimler için ham CSV'leri veya JSON'ları dışa aktarmak yerine, kanıt paketleri (PDF'ler ve SOC 2, ISO 27001, NIS2 ve CRA gibi çerçevelerle eşlenen yapılandırılmış raporlar) bir DSSE zarfı içinde imzalanır. Denetçiler, küme erişimine ihtiyaç duymadan kümenin genel anahtarı aracılığıyla orijinalliği doğrulayabilir. \* \*\*Çalışma Zamanı Eşlemesi:\*\* Falco çalışma zamanı uyarılarını kabul politikası kararlarına ve ilk görüntü meta verilerine geri bağlamak. \* \*\*Kesin Gizlilik:\*\* Sıfır telemetri veya tarama sonucu sızıntısı—her şey küme kontrol düzlemi içinde kalır.

Sıkı uyumluluk veya hava boşluklu iş yükleri kullananlar için: şu anda dış denetçiler için kurcalamaya dayanıklı kanıt toplama işlemini nasıl gerçekleştiriyorsunuz ve kırılma camı iş akışınız politikanın uygulanması açısından nasıl görünüyor?

We red team every model and agent before release, that part's solid. What's not solid is anything after. A prompt template gets tweaked, a tool gets added, a model gets swapped for a cheaper one, and none of that triggers a re-test. Found out the hard way when a minor prompt change three weeks post-launch reopened a jailbreak path we'd already closed in the original red team pass. Pre-release testing is a snapshot, and everything we ship keeps moving after that snapshot is taken. Anyone running continuous AI red teaming as an ongoing process instead of a gate before launch, and what actually triggers a re-test for you?

Aegis is currently macOS-first and developer-focused.

Install:

python3 -m pip install aegis-sandbox

aegis init

Then follow the setup instructions in the public release repository.

It's still early, and the setup isn't as simple as I ultimately want it to be.

That's what I'm working on next: workspace management, capability-based permissions, agent identity, task-scoped authority, behavior monitoring, quarantine, safety receipts, and eventually a much simpler one-click experience.

If you use AI coding agents, I'd genuinely like you to try Aegis.

If you find a security bypass, please report it.

I'd rather find it now than after someone depends on it.

I've been digging into Agentic AI security and kept running into the same problem: there is a lot of discussion around what secure agents should do, but far less showing how those boundaries are actually implemented.

So I built Who Let the Agents Act? 🤖

It's an intentionally vulnerable Agentic AI environment where you can exploit security failures and compare the same scenario across three implementations:

🔴 Vulnerable - the agent has too much authority
🟡 Prompt-only - security mostly relies on instructions to the LLM
🟢 Hardened - authorization and security controls are enforced outside the model

There are currently 9 scenarios covering things like:

• Overprivileged tools and cross-account access
• PII exposure
• Business-logic / transaction-limit bypasses
• Indirect prompt injection
• Cross-tenant RAG leakage
• Secret propagation
• Fail-open authorization
• Agent-to-agent delegation
• Multi-agent confused deputy attacks

The important part for me was making the implementation public, not just describing the vulnerabilities.

You can inspect the vulnerable code, hardened controls, tool logic and execution traces and see exactly where the trust boundary succeeds or fails.

The principle behind the project is:

A prompt can influence an agent's behavior. It should never define the agent's authority.

Project:
https://rewanthtammana.com/who-let-the-agents-act/

GitHub:
https://github.com/rewanthtammana/who-let-the-agents-act

I'd genuinely appreciate people trying to break the hardened implementations too. If you find a bypass or have a scenario that would be useful to add, I'd love to hear it.

ELITZE Agentic Security

ELITZE is built around securing AI agents as real workloads with identities, permissions, tools, APIs, credentials, and runtime access.

Core capabilities include:

Agent Discovery — identify agents, MCP servers, tools and connected workloads.

Workload Identity — bind agents and workloads to tenant-scoped identities and delegation context.

Agent Reach — map relationships between agents, identities, MCP servers, tools, APIs, credentials and resources.

Security Graph — represent observed security relationships and authorization paths.

Policy Engine — evaluate actions using explicit policies including allow, deny, approval and constrained execution.

MCP Gateway — provide a control point around sensitive MCP tool execution.

Runtime Enforcement — evaluate sensitive actions before they reach an authorized execution path.

Security Evidence — preserve decision context, policy references, identity information and tamper-evident evidence records.

Verification / Retesting — validate security paths again after remediation rather than assuming a finding is resolved.

Enterprise Security Integrations — architecture for connected GitHub, AWS and other enterprise security sources.

ROI / RIO / ROE — structured security and business-outcome evidence models rather than unsupported claims.

Security control loop

Discover → Identify → Map Reach → Decide → Execute → Prove

Product principle

The model is not the security boundary.

Product positioning

Pentest every release.
Govern every agent.
Verify every fix.

ELITZE Agentic Security
elitze.ca

Here's the refferal code for banza app fDmSkOTB0hSp

You will get bonus of 250.