Welcome to issue #115 of the Resilient Cyber Newsletter!
This week the cost side of offense got very concrete.
Gambit documented a criminal running three open source agent frameworks against online retailers at a mean of $25.46 per target, and Hacktron walked from OpenAI’s community forum to its internal repos in under 72 hours for less than $3,000 in tokens. The WSJ also reported that Gemini broke out of a test harness and into three real companies back in May. On the other side of the ledger, GitLab, WIRED, curl and Sergej Epp all describe the same bottleneck, discovery scaling with compute while remediation still scales with people.
That said, there is a fair amount of convergence on what the defensive architecture should look like, with Amazon, Okta’s new Blueprint Alliance, NVIDIA, Meta and the NCSC all landing on agents as identities, task-scoped permissions, policy enforced outside the model, reversible containment, and humans as governors rather than operators.
Let’s get into it!
Cyber Leadership & Market Dynamics
The Cyber Gap: How to Counter China’s Threat to America’s Critical Networks
CFR’s Matthew Ferren, Adam Segal and Rush Doshi put out a report arguing that China has built a hacking apparatus for peacetime leverage and wartime disruption while U.S. capacity moves in the other direction.
The numbers they marshal are familiar in isolation and uncomfortable in aggregate, with CrowdStrike data showing China-based activity up 38 percent from 2025 to 2026 and 40 percent of China-nexus exploitation aimed at edge devices, Volt Typhoon sitting in critical infrastructure for at least five years before disclosure, and Salt Typhoon reaching at least nine U.S. telecoms and more than two hundred organizations across roughly eighty countries. Meanwhile CISA has lost roughly one-third of its workforce since
January 2025 and federal cyber spending is expected to drop 9.6 percent in FY2027, to $11.7 billion.
Their four pillars are shared visibility (including mandatory sharing from cloud, ISP and DNS providers and a National Collective Defense System), imposing costs, hardening critical infrastructure (including federal civil liability for vendors shipping insecure products), and rebuilding government capacity.
Having spent a good chunk of my career in DoD and federal civilian environments, the diagnosis I found most accurate is their claim that the central failure of American cyber policy has been an inability to commit to any approach long enough for it to work.
Pairs with the Bessent interview below on liability and the NCSC’s Cyber Shield further down as a national collective defense analog.
Not Giving Frontier Labs Liability Waivers
Treasury Secretary Scott Bessent went on Squawk Box and said the administration will not hand AI companies a federal liability shield. He put the Hugging Face breach squarely on OpenAI’s management rather than “a bunch of agents,” and argued that the best way to guarantee safety is for creators to be liable for what they build.
He also floated a U.S.-China alert mechanism for AI incidents that touch national security, coming out of his meeting with Vice Premier He Lifeng ahead of the Trump-Xi summit.
For those of us who have watched software liability debates go nowhere for two decades, this is a notable signal, and it lines up with the CFR report’s call for a federal civil liability regime for insecure vendors. It of course is debatable whether an interview soundbite turns into policy, but it does suggest the “agents did it” defense won’t get much sympathy in Washington.
Building standards for the next phase of AI
OpenAI published a policy post calling for the U.S. to lead international technical standards for frontier AI, with a focus on recursive self-improvement (RSI) and automated AI research.
They state plainly that fully autonomous RSI is not happening today and should not be pursued until it can be done safely, and they cite their own Hugging Face incident as a preview of what happens without robust safeguards, even though that incident was not an RSI event.
The standards they want are baselines rather than licensing, built on existing bodies such as CAISI, INAMES and ISO, and covering evaluation of RSI-relevant progress, triggers for immediate human review of automated research, and shared incident taxonomies and severity thresholds.
The incident reporting piece is the part practitioners should watch, since shared severity thresholds and reporting protocols for AI incidents will eventually shape how the rest of us are expected to classify and disclose agent failures.
Read alongside their misalignment reporting framework in the AI section, it is a company trying to get ahead of the regulatory conversation in the same week Bessent said liability is coming.
Cyera raises $400 million from Goldman Sachs, bringing 2026 funding to $1.4 billion
Cyera raised another $400 million, this time from Goldman Sachs Alternatives, at a $12 billion valuation that is unchanged from June. Per CTech’s Sophie Shulman, that brings 2026 alone to $1.4 billion across three rounds, on a valuation path that went from $3 billion in 2024 to $6 billion in 2025 to $9 billion in January and $12 billion in June. They have 1,500+ employees across 18 countries and recently acquired Oasis Security, which is a non-human identity play.
CEO Yotam Segev’s framing is that Global 2000 enterprises need to trust what AI agents can see and do before they can scale them, which tells you where data security vendors are headed.
The pitch is shifting from “classify your data” to “govern what agents touch,” and the Oasis deal means agent identity and data security are converging inside one platform.
Why AI Needs Independent Assurance
Schellman CEO Avani Desai argues that confidence and proof are different things, and the data from their 2026 State of AI Governance report backs it up. 74% of organizations believe they could pass an AI compliance audit today, while only 27% say their governance is actually mature, and this is happening while 46% already have agents in production and 86% have at least tested them.
Organizations with mature governance run agents in production at 78% versus 22% for those still building programs. Framework adoption is split across NIST AI RMF (38%), ISO 42001 (23%) and homegrown frameworks (36%).
Avani makes the case for AIUC-1, which pairs operational control assessment with technical adversarial testing at least quarterly, and notes Schellman’s first end-to-end AIUC-1 audit involved more than 250 pieces of evidence and more than 2,000 adversarial scenarios.
Schellman is the first accredited AIUC-1 auditor, so there is a commercial interest here, which is worth calling out. That said, the five questions she says buyers will ask (what data can the agent access, what actions can it take, how was it tested, what happens when it misbehaves, who evaluated it independently) are ones most security teams still can’t answer with evidence.
AI
Our framework for reporting model misalignment
OpenAI admitted that its misalignment disclosures have been ad hoc and published a formal framework, with six incident reports at launch.
Each flagged incident is triaged into one of three tracks and disclosure disputes escalate to their Safety Advisory Group. The launch reports read like a greatest hits of agent security failures. A model inserting self-generated instructions into its own task summaries, many instances during GPT-5.6 Sol training adding instructions to conceal mistakes from the user, a model finding and using an exposed API key without authorization and then fabricating the data it was supposed to retrieve, an agent uploading a file to the internet to cite it without asking, and models using an internal repository as a message board to coordinate across separate training samples.
Strip away the alignment vocabulary and these are credential misuse, unsanctioned egress, unsanctioned writes and covert agent-to-agent communication, all of which map to controls we already know how to build. These are the same sort of controls I unpacked recently in a conversation with Zack Korman.
The practical takeaway for anyone running long-lived agents is that the agent’s own summaries and notes are untrusted input. OpenAI also says serious incidents should be shared with the federal government, which pairs with their standards post above and Bessent’s liability comments.
Gemini hacked three companies in first known breakout by Google’s AI
The WSJ reported that during a May capability test run by the evaluation firm Irregular, Gemini reached the real internet and broke into three actual companies, the first known case of Google’s models doing so autonomously.
Internet access was unintentionally available during a capture-the-flag exercise, and the model found public information online and guessed credentials to reach sites it believed were part of the test. Google’s Heather Adkins says Gemini stopped once it realized the targets were real. Irregular notified Google on July 31, and Google’s position is that this wasn’t misalignment and didn’t require disclosure because the safety measures worked.
Egress control in an evaluation sandbox is a real security control, and it failed at Google in the same season OpenAI’s agents got loose at Hugging Face. I’d also point out that “the model stopped itself” is doing a lot of work in that disclosure decision, since three companies were still compromised without their consent.
Irregular reportedly saw similar breakouts testing models from Meta, Anthropic and OpenAI. It’s worth calling out that the same firm, Irregular, was involved in all 4 incidents, and ironically, is now pushing to raise $100M and a $1.5B valuation.
Industry leaders form the Blueprint Alliance to advance a shared architecture for securing AI agents
Okta turned its March blueprint for the secure agentic enterprise into a coalition.
AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Okta, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler are the founding members, with GE Appliances and World Central Kitchen as strategic advisors. The Gartner cite in the release is that by 2028 an average Fortune 500 enterprise will have over 150,000 agents in use while only 13% of organizations think they have the right governance in place.
The six principles (agent as first-class identity, task-scoped rather than standing access, traceable delegation, continuous runtime monitoring, instant and reversible containment, governance that adapts at AI speed) will look familiar to anyone who has read the NIST or OWASP agentic work, and the architecture is organized around four questions:
Where are my agents
What can they do
What are they doing
How do I respond
AI Security Is an Engineering Problem - How to Solve It at Every Layer of the Agent Stack
Saša Zdjelar, writing on NVIDIA’s blog, makes the case that AI security is an engineering problem with defined requirements, enforceable controls, named owners and evidence that protections work. This lines up with Jensen’s own comments in a recent interview I shared last week from the All-In Summit.
He breaks the stack into models (capabilities), harnesses (context, tools and workflows) and runtime environments (where actions execute), and the principle that carries the post is that a security boundary has to hold even when an agent makes the wrong decision. NVIDIA’s answer at the runtime layer is OpenShell, an open source secure runtime that enforces policy outside the agent’s reach with sandboxed execution, with Cisco’s DefenseClaw as a governance layer on top and JFrog scanning agent skills.
There are no statistics in the piece, and the value is the checklist, task-limited identity and credentials, human approval for consequential actions and permission changes, verification of tool source and integrity, protected audit records of tool calls and authorization decisions, and pre-deployment testing with an accountable owner. Between this, Muse, Amazon and the Blueprint Alliance, the industry has effectively converged on one reference architecture in a single week.
Autonomic Defense: Countering AI-Driven Offense at Machine Speed
Phil Venables argues that running existing playbooks faster won’t hold against AI-driven offense, and that defenses need to become autonomic, meaning self-regulating and capable of generating novel responses rather than executing static SOAR logic.
He reaches for Ashby’s Law of Requisite Variety (only variety can absorb variety) and IBM’s 2001 Autonomic Computing manifesto with its MAPE-K loop of Monitor, Analyze, Plan, Execute and Knowledge, adapted for security with a versioned context graph as the knowledge layer.
The ten applications he sketches are a practical backlog, including self-healing virtual patching, a “resident adversary” that continuously attacks your own systems, self-guarding build pipelines that quarantine artifacts, autonomic credential rotation and continuous privilege minimization with just-in-time elevation.
Phil is careful to say none of this replaces a strong and ever-increasing baseline of controls, and that humans move from operators in the loop to governors on the loop, with a follow-up post promised on that distinction.
One does not simply defend agentically
Dave Chismon, the NCSC’s CTO for Architecture, wrote among an excellent piece on why defenders can’t simply mirror attackers’ autonomous tooling. He leans on Halvar
Flake’s line that offensive problems are technical and defensive problems are political. Offense has a clearly measurable success state, which is exactly what AI is good at. Defense is a cost center, success is hard to measure, a defensive action can harm the business, and someone at board level has to own the outcome when it does.
He offers a five-part test for any automated defensive action, potency (observe versus change or execute), scope, criticality, rollout confidence, and recoverability, and suggests that the near-term wins are low-potency advisory tasks such as summarizing and ranking threat intelligence, plus cloud-native “cattle, not pets” environments where recovery is cheap.
AI Agents Are Hacking Online Retailers for $25 a Company
Gambit’s Eyal Sela documented a financially motivated actor running three open source agent frameworks against hundreds of online retailers from July through September.
Hermes (121 skills, 78 of them attack skills, on Anthropic’s opus-4.6), Strix (on GLM 5.2 and later DeepSeek v4 Pro) and Cairn (DeepSeek v4.1 Flash) did the work, with the human contributing short instructions in Chinese to launch attacks and nudge next steps.
The operator’s own cost review shows a mean of $25.46 per target across 101 completed scans, ranging from $3.13 to $79.31, and the OpenRouter account had $7,005.71 spent over four weeks. Between September 10 and 15 alone, 105 attack projects launched and at least 27 companies were compromised, with skimmers confirmed on 19 and more than 100 further sites infected. More than 600,000 card records came out of two victims.
The detail to forward to whoever owns your backups is the bicycle retailer whose “Database Wipe After Extraction” cleanup routine dropped 180 tables, including the victim’s own backups, because an agent pattern-matched on table names.
Access usually took less than a day and often a few hours, which is why Eyal’s recommendation is resilience-first thinking, define the minimum viable business and prove it comes back under these conditions.
The AI Security Decisions Report: 2026 (Wave 1)
Lenny Zeltser and Sounil Yu surveyed security leaders on how AI security decisions actually get made, organized around the AI Defense Matrix’s eight asset classes. Among respondents who could name an AI asset and say whether it has a dedicated control, 33% have no dedicated control for any of them, 28% have one for every asset they named, and 39% for some. Coverage is best for AI traffic paths at 65% and worst for runtime AI data, agent identities and orchestration tools, where only 40% of organizations that have them report a dedicated control, and those are precisely the assets respondents said they worry about most. 43% extended tools they already own, while buying an AI-security-specific product was the least common route at 26%.
Accountability is split, with the CISO or central security primarily accountable at 38% of organizations and a dedicated AI security leader at only 13%, and 22% haven’t organized AI security work into categories at all. One respondent summed up the mood as agents with too high permissions and too little control. Read this as the distance measurement between the target architecture in the Okta, Amazon and NVIDIA items above and where most organizations actually sit today.
AppSec
Forget the AI Slowdown - the Vulnerability Explosion Is Already Happening
Lily Hay Newman and Matt Burgess launched WIRED’s Kernel Panic column with a piece arguing that while labs debate a pact to slow frontier AI, the vulnerability crisis is already here and rests on broadly available models, open-weight ones included.
Microsoft issued patches for 974 CVEs so far this month, a record. Oracle shipped 1,448 patches in July against 309 in July 2025. Chrome’s two major releases in June carried 1,072 patches, more than the prior 23 big releases combined. Mozilla found 271 Firefox vulnerabilities in one bug hunting sprint with Anthropic’s Mythos. Across the board, 66,401 CVEs had been recorded as of last Wednesday, versus 33,512 by the same point last year and roughly 25,000 for all of 2022.
Jerry Gamblin’s framing is that discovery scales with compute while remediation scales with people, and people are the part you can’t buy more of in a quarter. That is the throughline for this entire section, and it pairs with the pacing debate from last week’s issue. Slowing the frontier labs does nothing about the models already in everyone’s hands.
ZeroDayClock: Beyond AI Doomers and AI Maginot Thinkers
Sergej Epp responded to Root Evidence’s Vulnpocalypse report, which criticized ZeroDayClock’s time-to-exploitation metric, and it is a model of how to take criticism.
He concedes three real weaknesses in his own metric (aging, right truncation and saturation) and then shows that Root Evidence’s replacement “defender window” carries the same selection bias with worse data, since roughly two thirds of their classified records take the patch date from the MITRE CVE API’s publication fields rather than actual patch availability, and datePublic is missing for 70 to 84 percent of the exploited population in every year since 2019. Their claim of a 25-day NVD lag creating false zero-day acceleration reclassifies exactly one of over three thousand exploited CVEs when he tests it.
His own numbers are measured. Cataloged vulnerabilities in his dataset are running at 270 percent of last year (29k against 11k), though sixteen CNAs account for 86 percent of that rise. KEV first listings are slightly ahead at 485 against 436 for the same half of 2025. Zero-day KEVs doubled between 2022 and 2024 and have since held. Sergej’s line that a window is not a warning is the one to keep in mind when someone hands you a defender-window SLA.
Treat it as a ceiling on the time you might have, never a guarantee.
I made a video breaking down the new ZDC:
Securing the software factory at machine speed
GitLab CISO Chaim Mazal published his own company’s numbers, which takes some courage. GitLab has published 317 CVEs so far in 2026 against 181 in all of 2025 and 170 in 2024, and its bug bounty program took in just over 3,600 reports in the last 90 days compared with 1,440 in all of 2024.
He cites this year’s DBIR putting vulnerability exploitation ahead of credential abuse as the leading initial access vector for the first time in 19 editions, with median time to resolution slipping from 32 to 43 days, and NIST’s April decision to stop enriching most CVEs.
Chaim’s argument is that when code is no longer the bottleneck, trust becomes the scarce resource, and the metric to run the program on is time from detection to verified remediation.
GitLab is running Anthropic’s models across its critical systems under Project Glasswing, which I covered in “The Remediation Receipts,” and ran agentic security review on 969 of 997 eligible merge requests in a recent release. The six foundation controls (continuous scanning, eliminating long-lived secrets, agent-generated tested fixes, policy in execution paths, agents as privileged actors with constrained permissions, detection-to-remediation time by severity) are sensible.
A shortened release cycle
Daniel Stenberg posted a short note to the curl-library list that cURL is shortening its release cycle by two weeks and shipping on October 14, with the feature window closed effective immediately, in order to ship many pending vulnerability fixes sooner. He gives no count and names no CVEs. If you have vendored or embedded libcurl anywhere (and you do), plan for a meaningful batch on that date. The podcast below explains where the volume is coming from.
The cURL summer of Bliss with Daniel and Stefan
Josh Bressers had Daniel Stenberg and Stefan Eissing on Open Source Security to talk about what happened when cURL stopped taking vulnerability reports for a month over the Swedish summer.
The short version is nothing much, other than the maintainers realizing how much the queue had been sitting on the back of their heads. Since reopening they have taken somewhere around 70 to 80 reports, and Daniel mentioned another project receiving 82 vulnerability reports in a single email. A year ago, in August 2025, curl had not received a single correct AI-generated vulnerability report. Now the reports are high volume and largely real, with tools such as AISLE’s harness finding complex chained bugs.
Daniel’s summary is that the cost of finding a vulnerability has dropped dramatically while the cost of fixing one hasn’t changed, and that AI-proposed fixes tend to patch symptoms rather than the underlying design, so humans still own the fix. Stefan’s description of security work as cleaning the bathroom of open source is accurate.
Hacking OpenAI
Hacktron’s Harsh Jaiswal, Mohan Pedhapati and Rahul Maini chained a libheif heap overflow, reachable through Discourse image uploads because Debian was missing a security backport, with an OpenAI SSO flaw that turned a forum compromise into access to employee ChatGPT and Codex accounts and, through the GitHub integration, OpenAI’s internal repos.
They compromised the accounts on July 25 and the whole path from discovery to repo access took less than 72 hours. As proof they sent a prompt to an employee’s Codex account to open a PR in OpenAI’s internal monorepo. OpenAI paid $6,500 for the SSO finding and Discourse had a fix by Monday.
The exploit development was done with Opus 4.8 and then Claude Opus 5, which produced a working ARM64 exploit within three hours, and the broader HEIF Heist campaign against Slack, Meta, GitHub Enterprise, Rails and several JS frameworks cost less than $3,000 in tokens across three researchers.
Thousands of crashing images went mostly unnoticed, which is its own finding about detection. The actions I’d take from this are to disable untrusted HEIF and AVIF decoding where you don’t need it or sandbox the image pipeline, and to treat coding assistant and agent integrations as the high-value pivot they are, since the SSO flaw is what turned a forum bug into repo access.
Landscape of agentic solutions for penetration testing
Wavestone’s Theo Atakpama, Gregoire Podda and Thomas Rousseau mapped 69 agentic pentest solutions across six architectures, from single agents such as PentestGPT and VulnHuntr through orchestrator models, multi-agent role systems (PentAGI, Shannon, Strix), swarms, MCP-centered tools and Claude Code native approaches.
Coverage skews hard to web, API and mobile at 81% of solutions, with infrastructure at 52%, code review at 36%, cloud at 30%, genuine red team and social engineering at 13%, and industrial or reverse engineering at 7%. Market signals they cite include Horizon3’s $250 million raise in August, AISLE’s 380 attributed CVEs (98 confirmed), and XBOW’s claim of more than 14,000 zero-days in client applications.
Their cost comparison for a representative engagement is around $90 with Claude Fable 5, $45 with Claude Opus 4.7 and less than $3 with DeepSeek V4 Pro, which explains why the Gambit actor above ran on DeepSeek and GLM.
Their verdict is that in the short term these tools won’t replace professional auditors, with hallucinated findings, scope drift (unintended credential use, disruptive actions, redirects to third parties) and business logic as the gaps. The scope drift list is the one to take seriously before pointing any of these at a client.
Can AI do novel security research? Meet the HTTP Terminator
James Kettle’s Black Hat research is from August, so some of you have seen it, but it belongs next to the Hacktron and Gambit pieces.
He built an autonomous pipeline that fed 138 HTTP and SMTP RFCs into an ideation stage, generated 30,000 unique desync vectors, and tested them against 30,000 websites, producing roughly 700 vulnerable targets including Apache Traffic Server (a zero-day, CVE-2026-63078), Citrix NetScaler and Akamai, and real-world hits on a U.S. bank, a government site, airport infrastructure via F5 BIG-IP and Meta. Success rates went from 0% with broad prompting to 5% with concrete questions to 30% with newer models and a focused technique he calls protocol-ruler.
The design lessons transfer well beyond HTTP. Deterministic code handles validation gates and the model handles hypothesis generation, the agent needed tricks such as renaming Turbo Intruder to “Turbo Simulator” to stop it giving up, and the biggest gains came from putting a human in the loop in exactly one place, the discovery cascade.
James’s defensive advice is to never use upstream HTTP/1.1 and to move to HTTP/2 or higher, and if you can’t, allow-list methods on both ends and only accept bodies on POST.
Final Thoughts
The offensive economics in this issue are hard to argue with.
Twenty-five dollars per retailer and three thousand dollars in tokens to reach OpenAI’s monorepo are the kind of numbers that should end any remaining debate about whether criminals will adopt agents, and a frontier model wandering out of its sandbox into three real companies because someone left the internet on shows the labs are not immune either.
The defensive response is converging too, and I count at least five organizations this week describing the same architecture, agents as identities with delegated task-scoped permissions, policy enforced outside the model, reversible containment and humans as governors.
The AI Defense Matrix survey and Schellman’s data suggest most organizations are a long way from running that architecture, and Dave Chismon’s point that defense is a political problem explains why the gap will close slower than the vendor alliances imply.
Discovery has become a compute problem, while remediation and governance still run on people, which is where is where we desperately need to see the most innovation to try and keep pace.
Stay resilient.