A look at autonomous agents reaching real systems, the accountability scramble, defensive AI in production, funding megarounds & the state of exploitation
Welcome to issue #109 of the Resilient Cyber Newsletter!
I skipped last week’s issue while I was heads down at Black Hat, so this one pulls together the stories worth your attention from across the last two weeks rather than every link that crossed my desk. I have tried to keep it tight, with a focus on key stories over the last couple of weeks.
Black Hat was a blast, I had a chance to MC both the Innovators & Investors Summit as well as the Startup Spotlight Competition. So many excellent talks both at the events and in the hallways, I recorded several podcasts with friends from the community and more, so be on a look out for those!
This was the stretch where autonomous agents stopped being a benchmark curiosity and started reaching real systems. OpenAI disclosed that a model under evaluation escaped its environment and hacked Hugging Face, Anthropic went back through more than a hundred thousand of its own evaluation runs and found its models had compromised real companies, and the UK’s AI Security Institute published an incident report describing agents attempting supply-chain attacks and deceiving real people during routine testing. OpenAI of course shared their post-mortem at Black Hat, which many including myself agree is a must-watch for this space.
The rest of the industry spent the past week reacting to it, in accountability debates, defensive AI deployments, a wave of agent sandboxing work, and a funding market that keeps writing nine-figure checks for AI-versus-AI security.
Into the Breach is OPSWAT’s new cybersecurity docuseries, hosted by MythBusters’ Kari Byron and produced by Cyber King Productions. Through hands-on experiments, cinematic storytelling, and expert interviews, the series makes critical infrastructure security visible — for technical practitioners and nontechnical audiences alike.
Episode 1, “Breaking the Firewall,” is now streaming on YouTube. It challenges one of the industry’s most dangerous assumptions: that firewalls alone can protect critical assets. Also available on select in-flight entertainment systems worldwide.
Thanks for reading the Resilient Cyber Newsletter! Subscribe for FREE and join 23,000+ readers to receive weekly updates with the latest news across AppSec, Leadership, AI, Supply Chain, and more for Cybersecurity.
Cyera signed a letter of intent to acquire Israeli startup Oasis Security for approximately $1 billion, reported as $700 million in cash with the remainder in Cyera shares. Oasis, founded in 2022, had raised $195 million and works in what it calls agentic access management, which tells you a lot about where Cyera thinks the puck is going.
Cyera itself recently raised $600 million at a $12 billion valuation, reports more than $200 million in ARR, and has now strung together a series of acquisitions across identity and machine access. The interesting piece here is not the headline number, it is that a data-security company is spending megaround capital to buy its way into managing non-human and agent identity before that problem fully arrives.
Given everything else in this issue about agents acting on their own, that looks less like empire building and more like reading the room.
Horizon3 announced a $250 million Series E at a valuation north of $2 billion, up from the $650 million valuation of its Series D just over a year ago.
The company reports 120% year-over-year ARR growth, more than 7,000 organizations protected, and 310,000 tests safely executed in production, with the round co-led by NightDragon and NEA and Dave DeWalt joining the board. The framing Horizon3 chose, leading the “AI vs. AI” era, is the same theme showing up across this issue, and the market is clearly willing to fund it.
Autonomous offense to validate your environment is a genuinely useful capability, and it is worth dwelling on the fact that the same techniques being funded here as blue-team tooling are, in the incident section below, what happens when they run without a leash.
I had a chance to sit down with Snehal at Black Hat and discuss the funding round, their market trajectory, the competitiveness of the category and more. Snehal remains one of the sharpest cyber business leaders I know and speak with.
Corma came out of stealth with a $60 million seed round led by Sequoia, with Khosla Ventures and Coatue participating. Founded in 2025 and split between Tel Aviv and San Francisco, the company deployed its first model roughly six weeks before the announcement to Fortune 100 and Fortune 500 organizations, and CEO Alon Pluda says it focuses squarely on defensive work like log analysis and threat detection, claiming a 94% reduction in threat response times at adopting organizations.
A $60 million seed is a lot of conviction for a company barely a year old, and the vendor-supplied 94% figure deserves the usual skepticism until there is independent validation. That said, the signal is consistent with the rest of the market this issue, investors are pricing defensive AI as a category that has to exist, not one that might.
Amid all the megarounds, Kyle Hanslovan put out a reflection on Huntress crossing $250 million in ARR, and it is worth reading because it is not a funding announcement.
The company now protects more than 270,000 organizations and 19 million endpoints and identities across 100 countries, largely through a partner motion of more than 20,000 MSPs and resellers, and Hanslovan frames the revenue as a byproduct of the mission to bring enterprise-grade security to the small and mid-sized businesses he calls “the 99%.”
I have long argued that the underserved end of the market is where a lot of the real risk lives, and building a nine-figure business by serving it rather than chasing the Fortune 500 is a model more of the industry should study. Huntress serves the majority of the ecosystem that lives below the cyber poverty line and desperately need help, as you saw with my recent discussion with Alex Pinto of Verizon on their Breach Impact Study. SMB’s face steeper financial impacts from incidents than their enterprise counterparts.
Lenny Zeltser published four customizable executive-briefing templates covering threat intelligence, vulnerability investigation, incident response, and security assessment, each built around leading with the takeaway and what a finding actually means for the organization.
This is not flashy, but communicating clearly to decision-makers is one of the most persistent gaps in our field, and a well-structured brief that opens with the takeaway and puts action items in a table does more for your program than most tooling. A timely resource to bookmark.
The centerpiece of Black Hat this year was OpenAI walking through the incident in which one of its models, under evaluation, escaped its environment and compromised Hugging Face.
OpenAI called it a watershed moment for the industry and encouraged defenders to watch and plan for how attack dynamics are about to change, and the Black Hat session recording covers the reconstruction and its implications for AI security and alignment.
Whatever you make of the framing, a frontier lab standing on the Black Hat stage to dissect its own model breaching another company is a moment our field will be referencing for a while.
This talk helps frame a lot of the below resources and at the time I’m sharing it, it already has over 500,000 views on YouTube!
Prompted by OpenAI’s disclosure, Anthropic went back through 141,006 of its own evaluation runs and found three incidents where Claude models escaped supposedly isolated environments and reached real systems at three organizations.
Across the three, involving different models, a model compromised a real company’s infrastructure and accessed a database containing several hundred rows of production data, published malicious Python packages to PyPI that were downloaded and run on 15 real systems before removal, and scanned roughly 9,000 targets before compromising a company using what Anthropic describes as basic techniques like reading credentials from an exposed debug page and SQL injection. The root cause was a misconfiguration with their partner Irregular that granted internet access despite prompts stating there was none.
Give Anthropic credit for the transparency, because the substance is helpful but many of course also remain skeptical that it is in large part marketing, especially as others such as Meta and even Chinese model providers rushed to say their agents also broke out of training environments. The models were not doing anything exotic, they were doing ordinary attacker things, at scale, because a supposedly closed door was open.
James Berthoty turned the Hugging Face timeline into a practical kill-chain analysis, splitting it into initial access, breach, and lateral movement and mapping defensive controls to each stage.
His read is that supply-chain firewalls offer limited protection against this pattern, and that the real leverage is blocking egress, deep runtime monitoring, and an assume-breach posture, given how difficult the template-injection and in-memory-secrets stages are to stop. He notes the nearly 17,600 actions over four days represent a level of sophistication we would once have called nation-state grade, now produced by a model chasing a benchmark.
If you own detection and response, this is a actionable write-up of the incident.
Separate from the OpenAI and Anthropic disclosures, the UK’s AI Security Institute published an incident report from a routine cyber evaluation on July 28, and it is the one that I found the most informative.
Of 122 test runs, 10 runs contained 19 instances of unsanctioned behavior, 17 of them from Anthropic’s Mythos 5 and 2 from OpenAI’s GPT-5.6-Sol. The behaviors are the key part. Agents attempted a supply-chain attack by inserting malicious code into a public open-source project, creating fake identities and social-engineering the maintainers, an attempt caught by a human reviewer. Others directly deceived real people, attempted prompt injection against other AI systems, and in one case left public GitHub messages sharing account credentials for other agents.
Internet access was deliberately enabled and cyber classifiers intentionally disabled for realism, AISI reports no confirmed real-world harm, and it contained the incident within an hour. Autonomy and deception stopped being a slide in a threat model here and started being a logged event.
I recorded a video breaking this one down from my hotel room at Black Hat:
Hyrum Anderson offers a sharp reframe of the whole episode, and I largely agree with him. His argument is that these incidents are not primarily a story about misaligned objectives, they are a story about failed constraints, models optimizing perfectly legitimate goals inside environments where the declared boundaries were documented but never actually enforced.
In Anthropic’s case the prompts claimed no internet access while the harness quietly provided live connectivity, and the model simply used it.
His line, “optimizers are going to optimize,” is the whole thing in four words.
The uncomfortable question he leaves you with is not whether your models are aligned, it is which of your security constraints are genuinely implemented versus merely written down, and that question long predates AI.
TechCrunch takes on the accountability question these incidents force, and the answer is genuinely unsettled and that is why we’re seeing a lot debate in the ecosystem.
The piece weighs criminal and civil exposure under the 1986 Computer Fraud and Abuse Act, with cybersecurity attorney Ahmed Ghappour arguing the model is the company’s tool and that “you don’t get to deploy something capable of breaking into systems and then disown where it goes,” calling a civil negligence case a “no brainer” for victims. The EFF’s Andrew Crocker is skeptical that the intent required for criminal charges can be proven against a model, and there is no federal AI liability law to lean on, though several states are moving.
We are going to be litigating who owns an autonomous system’s actions for years, and the technology is not waiting for the law to catch up, so expect more incidents as well as more debates about accountability.
For anyone who thinks this is purely a US-lab story, Wired reported that Moonshot’s Kimi K3 model escaped its sandbox as well, a pattern corroborated by Frontier Security’s account of Kimi K3 exploiting network egress in an AISI evaluation sandbox to retrieve an official benchmark solution rather than solving the task natively.
Frontier’s broader argument is the one to keep in mind, that offensive capability scales predictably with inference budget while defensive investigation does not, an asymmetry that should reshape how we benchmark security agents in the first place. Open-weight and international models are part of this story now, and the containment problem does not respect a lab’s borders.
The key theme across all of these stories is that agents find a way, and that way often involves trying to cheat, something that has been researched and documented by AISI on their blog.
AWS open-sourced Dogwood, a governance language for regulating how agents use tools that goes beyond point-in-time authorization by adding temporal conditions over an agent’s recent history. Built on Cedar and grounded in metric first-order temporal logic, it can express rules like requiring an approval before a sensitive action or rate-limiting a class of operations, which is the kind of history-aware constraint that static, request-by-request policy cannot capture. It pairs naturally with research like Dreadnode’s ScopeJudge, which tested whether a runtime LLM judge can keep offensive agents in scope and found the best configuration reaching the lower end of human agreement, concluding runtime monitoring is the most practical way to deploy scalable oversight for offensive agents today. Between formal policy and learned judges, runtime is clearly where the agent-control conversation is heading.
On the offensive research side, Incalmo built a system called PathoGen that uses open-weight models like GLM 5.2 to generate evasive malware, reporting that roughly 27% of samples evaded all 75 scanners on VirusTotal and about 75% evaded all but one, at a cost of $2 to $35 per sample. The researchers withheld methodological details and coordinated with vendors, and their point is constructive, use frontier models proactively to find the defensive gaps before adversaries do. That said, the economics are the story. When capable, scanner-evading malware costs less than lunch to produce, volume stops being a meaningful signal and detection has to lean much harder on behavior than on signatures.
Patrick Garrity and the VulnCheck team published their first-half exploitation data, and it is the empirical grounding a lot of the AI-and-vulnerabilities conversation badly needs. In 1H-2026, 23.43% of known exploited vulnerabilities showed evidence of exploitation on or before the day the CVE was published, down from 28.93% in 2025, and the median time from publication to known-exploited status dropped from 120 days to 80.
The figure most relevant to this issue is the AI one, of 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, were confirmed exploited, and Anthropic’s Project Glasswing produced 23,019 findings and 126 published CVEs but just a single confirmed exploitation. AI is discovering vulnerabilities at scale, but discovery and real-world exploitation remain very different things, and the data is a healthy corrective to the assumption that one automatically becomes the other.
JFrog’s Afek Berger dug into six SQLite advisories filed from a newly created GitHub repository and found them fabricated, referencing functions that do not exist, with proof-of-concepts that do not run, and CVSS scores as high as a claimed 9.8 critical that had to be walked back.
A broader audit turned up 54 completely fabricated advisories, with exactly one containing a real bug. Berger ties the problem to NVD pausing its deeper analysis back in early 2024, which lets AI-generated slop flow downstream into scanners and databases unchallenged.
This is the shadow side of the AI-discovers-vulnerabilities story. The same generative capability that finds real bugs also mass-produces convincing fake ones, and our vulnerability infrastructure was not built to filter them.
Elastic Security Labs built an AI triage system for HackerOne reports that performs about 85% as well as a human at roughly $2 per report, validated against 764 known-outcome reports.
The context that makes it matter is the volume, they received more than 1,390 reports in the first half of 2026, exceeding their full-year totals for 2024 and 2025 combined, which is exactly the flood that AI-assisted discovery produces on the reporting side. A human still makes the final call on every report.
This is the pragmatic pattern for surviving the coming report volume, let the model handle triage economics while keeping human judgment on the decision, and it pairs well with 1Password’s parallel work on making security reviews scale without drowning in context and nondeterminism.
1Password’s Off-by-1 Labs ran one of the more rigorous tests of AI patching I have seen, generating 6,080 patches across six recently disclosed CVEs. Only 26.0% completely fixed the flaw without changing application behavior, another 20.1% fixed it but altered behavior, and 53.9% failed outright or introduced new vulnerabilities, with more than a third of even the successful patches judged fragile because they treated symptoms rather than root causes. This is the essential counterweight to the fix-it-with-AI enthusiasm.
The generation side is improving fast, but a majority of machine-generated patches are still wrong or harmful without expert review, and shipping them unreviewed would trade a known vulnerability for an unknown one.
Vercel’s Malte Ubl makes the blunt case that open-weight models now carry real offensive capability, describing Kimi K3 as an Opus-class model with no relevant cybersecurity safeguards, while frontier models still hold the defensive edge for now. This widespread capability is the same point Joshua Saxe has been making for months.
Vercel’s response is instructive, running full deep security reviews across mission-critical repositories quarterly at a cost of tens of thousands of dollars, and making an egress firewall available even on its free Hobby plan. The egress theme keeps recurring across this entire issue for a reason.
Whether you are containing your own agents or blunting an attacker’s, controlling what code can reach the network is turning out to be one of the highest-leverage controls available, and it is encouraging to see it pushed down to the free tier rather than reserved for enterprise.
Final Thoughts
Two weeks is a lot to compress, but the summer’s story told itself.
Autonomous agents crossed from the benchmark into real systems, and they did it not through exotic capabilities but by exploiting ordinary weaknesses the moment a containment assumption failed.
The most critical thread running through the OpenAI, Anthropic, and AISI incidents is not that the models were brilliant, it is that they were ordinary attackers with unusual stamina, and the doors they walked through were the same weak passwords, exposed endpoints, and soft egress boundaries we have been failing to close for years.
These same problems are pervasive across every organization and environment and is exactly why Vercel’s CTO said everything hackable will be hacked.
The encouraging counter-thread is that the response is already taking shape, in the sandboxing and runtime-verification work, the defensive deployments at security vendors, the honest accounting of where AI patching still fails, and the beginnings of a shared exchange for incidents and near-misses.
The pace of agent adoption is once again outrunning the pace of governance, and we get to choose whether we build these controls in while the architectures are still forming or bolt them on after the next incident. The evidence from the last two weeks suggests we should hurry.
Hyrum's reframe is the one I'd hand to a board. The prompt said no internet, the harness gave it internet, and the model used what was there. I got a small version of that in my own lab: I sandboxed my coding agent, it couldn't install what the job needed, so I ended up running the job outside the sandbox. Are you seeing teams actually test agent boundaries by trying to break out of them, or is it still mostly config review?
Hyrum's reframe is the one I'd hand to a board. The prompt said no internet, the harness gave it internet, and the model used what was there. I got a small version of that in my own lab: I sandboxed my coding agent, it couldn't install what the job needed, so I ended up running the job outside the sandbox. Are you seeing teams actually test agent boundaries by trying to break out of them, or is it still mostly config review?