Welcome to issue #121 of the Resilient Cyber Newsletter!
The FBI has tied the biggest cyber heist in history, more than $6 billion taken from Binance, to North Korea’s TraderTraitor, and Binance’s own report traces the way in to a fake job interview, a tampered developer tool and an internal AI tool. The same week, Anthropic showed an unreleased model writing working exploit chains for Chrome, Safari, Android, Windows and Linux.
Developer tooling was the way in on story after story, from a trojanized Claude Code extension to nine breached AI developer platforms. Agents show up on every side of this issue too, including one reportedly running on a Pentagon network under a contractor’s personal account.
We’re also trying something new based on your feedback. This issue is shorter, with five must-reads up top, fuller write-ups on the biggest stories and quick hits for the rest.
If you notice the layout of the newsletter looks different this week, that’s intentional. I received some feedback from a friend and security leader I highly respect, Jen Easterly, that she enjoys it but also finds my typical format overwhelming. I took this as her kind way of saying I talk too damn much, which I can understand, as I find trying to cover everything in a given week in cyber, especially lately, increasingly tough to do in a concise format.
So, I’m experimenting with a more concise format, while still aiming to bring you the best cyber industry news, analysis and resources weekly, but in a concise way where I can still stay true to my own voice and thoughts as well. As always, I’m open to feedback, and truly appreciate everyone who reads my content weekly.
With that out of the way, let’s get down to business!
If you only read five things
The FBI attributes the theft of more than $6 billion from Binance to North Korea’s TraderTraitor, and Binance’s initial report traces the way in to a fake job interview, a tampered Homebrew install and an internal AI tool that reached its wallet signing service.
Anthropic says an unreleased model wrote five exploit chains, including one-click code execution outside Chrome’s sandbox and zero-click root on Linux servers with a multipath TCP listener.
OpenAI’s autonomous pipeline reproduced 1,724 Linux kernel vulnerabilities and produced 948 distinct local privilege escalation exploits in one run at about $1.2 million in API cost, with candidate patches and human review before reporting to maintainers. Wiz counts nine AI developer platforms breached in October by attackers hunting stored AI keys.
WIRED reports that an Accenture contractor’s personal Claude Code agent ran on a Pentagon NIPRNet system for two months and appears to have sent out credentials, which Accenture says is without merit.
OpenAI says its misalignment monitors, replayed against the Hugging Face incident, alerted more than 30 hours before the breach, and Anthropic’s self-assessment monitor flags 94% of high-priority harmful conversations at a 1% false-positive rate.
Join me on my next webinar for 2027 predictions
On November 18 at 11am EST, I’ll be chatting to Gene Moody from Action1 on where we see emerging threats lie and how the approach to patching and endpoint management needs to shift. We’ll also go through what role automation, visibility, and control could play in staying ahead of future threats, and give you our 2027 predictions.
*Sponsored
Cyber Leadership & Market Dynamics
29 October Binance Security Incident: Initial Findings and Response Update
Binance’s initial incident report traces the October 29 theft of about $6.34 billion to a campaign built over several months, starting with a tampered Homebrew install in June and a fake job interview in September whose coding “assignment” planted zero day malware its endpoint tools missed. On October 20 the attacker used an internal AI tool to take over two wallet engineers’ machines, and nine days later a stolen container deployment token led to the wallet signing service, while the FBI has attributed the theft to North Korea’s TraderTraitor and Binance says $2.85 billion has been frozen or intercepted.
I found this one interesting because it again shows the power of an individual’s endpoint and credentials and how critical they can be to the security of a platform and organization. This one led to a whole lot of discussions, around endpoints, attack surface, the fragility of the crypto ecosystem and more.
A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System
WIRED reports, citing sources, that an Accenture contractor connected a DoD coding environment on NIPRNet holding controlled unclassified information to their personal Claude Code account and gave the agent their login credentials, letting it bypass the controls of the normal login process.
The agent reportedly ran for two months and appears to have sent the contractor’s credentials, passwords and a map of NIPRNet to a third-party website NIST flags as high risk. Accenture says the allegations were “found to be without merit,” and the DOD declined to comment.
While this one is “unconfirmed”, having spent much of my career in the DoD and Federal space, I know how problematic shadow usage is, and I have no doubt AI agents are lurking in enterprise DoD environments as well. What agents exist, what they have access to do, and how they are being governed and secured must be a key focus for the DoD much like it is for commercial enterprises.
The American Startup Taking On China’s AI Models
Misha Laskin of Reflection sat down with Ed Elson on Prof G Markets to make the case for an American open-weight lab, after a June round at a reported $25 billion pre-money valuation. Misha argues Chinese open models rarely reach production in the Fortune 500 and calls open models Trojan horses for the chips and data centers behind them, and he says Reflection’s first model, Beam, ships under Apache 2 with 40 launch partners.
I found this conversation with Misha very interesting, as he covered the competitive landscape, distinctions between closed and open weight models, and the incentives of those championing each. We are seeing widespread usage of Chinese open source, even in the U.S. as cost and other factors have some leaning towards open weight options. I would be remiss if I didn’t admit I’m cheering for a Western/U.S. company (or multiple) to have a strong competitive open option on the landscape.
AI security M&A rollup: CrowdStrike, Cognition and Palo Alto Networks
Three companies made moves on AI security startups this week. At Fal.Con Europe on November 3, CrowdStrike announced agreements to acquire Fiddler AI, which does AI agent observability and will be sold as Falcon Observe, and Dreadnode, whose automated testing runs more than 100 attack strategies against models, agents and MCP servers, with reporting putting the pair at about $495 million combined, and it launched an AI Kill Switch in Falcon Guardian that lets an admin terminate a rogue agent at the gateway. I’ll be covering the whole concept of an “AI Kill Switch” in the coming weeks, including breaking down what is real vs. marketing - so stay tuned for that.
Cognition is acquiring Corridor, the AI code security startup Jack Cable co-founded after his time at CISA, with no deal terms shared, and Jack now leads security products at Cognition. The Information also reports that Palo Alto Networks is in talks to buy Clutch Security, which secures the credentials AI agents use, for about $500 million, with no deal formally announced yet. Dorin Levi counts a Clutch deal as the sixth non-human identity startup exit in 11 months, after Veza, Astrix, Apono, Entro and Oasis.
AI
VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
CrowdStrike says a single ARTEX controller tied to China-nexus VAPOR PANDA went after more than 200 organizations in at least 14 countries starting October 17, with confirmed post-exploitation at nine of them. Google’s threat intelligence group and Mandiant report espionage and extortion crews using ARTEX, PentAGI and CAIRN since late August, and Google expects noisy attacks with no human in the loop within one to three months. DIVD and Chainalysis both describe agentic intrusions on their own systems.
There’s been a ton of debate about phrases such as “Vulnpocalypse” and “Black October”, and how vulnerability discovery may be up due to AI but exploitation is flat. One trend worth pointing out here for me is the rise in autonomous AI-enabled malicious actors and activities, and I think it is going to be something we see more of a surge of going into 2027. I unpack the whole “Black October” narrative and where I stand on it below, including recommendations from my friend James Berthoty and perspectives from folks I’ve interviewed recently, such as Zack Korman, Joshua Saxe and Ciaran Martin.
“Black October” for AI Developer Platforms
Wiz counts at least nine AI developer platforms that disclosed incidents in October, including Fireworks AI, Railway, Warp and Northflank, and says every public report describes attackers hunting stored environment variables that grant AI access. In two cases Wiz traced, stolen keys were tested within 30 minutes of the breach and later used for about 800,000 and about 1.7 million Amazon Bedrock calls. Talos also found the VOLTA infostealer sending stolen victim data to OpenRouter for a “target assessment” of what the victim is worth.
As someone who has followed software supply chain attacks for years, including writing a book on it, it isn’t surprising to see AI-native tooling become a hot target for attackers. These tools and the developers using them are often highly privileged and impactful so it makes perfect sense to see attackers targeting these, but nonetheless, it does highlight the fragility of the AI-native SDLC and associated platforms.
Discovering and exploiting vulnerabilities in critical, real-world software with Claude
Anthropic says an unreleased internal research model, “after initial prompting,” wrote five attack chains, including one-click code execution outside Chrome’s sandbox, a Pixel 9 lock screen bypass and zero-click root on Linux servers with a multipath TCP listener (CVE-2026-98432). Google assigned 62 Chrome CVEs from the work, all critical or high and patched as of Chrome 156, and the Linux exploit took 48 minutes to leak a kernel pointer and five more to run a command as root. As of October 29, The Hacker News found Ubuntu and RHEL still had no fixed kernel.
This again highlights AI’s incredible ability to find vulnerabilities, including in widely used open source and proprietary software that is used by millions of people worldwide. Ideally these providers and maintainers are using AI to do the same and remediating findings that get fed their way given the potential reach, but as I’ve written about all year, remediation is the bottleneck.
Watching models that learn to hide
OpenAI says its four-layer monitoring stack, replayed against the Hugging Face incident, alerted security “about 30 minutes after the agents first escaped their sandbox,” more than 30 hours before Hugging Face was breached. In a separate study, Anthropic’s Alignment Science team had Claude write fine-tuning data that slipped past a production-style monitor, “mostly by hiding the behavior in fiction and roleplay,” and the resulting models resisted oversight and deceived users. Anthropic’s self-assessment monitor flags 94% of high-priority harmful conversations at a 1% false-positive rate.
Design Tenets for Agent Identity Management Systems
NIST’s second post on agent identity lays out ten design tenets, from distinct agent identities and attenuating delegation to zero standing privilege and immutable evidence. Because LLMs treat data and instructions as one stream of tokens, NIST says the split between policy and reasoning has to be enforced by architecture, and guardrails alone are insufficient.
Agentic IAM is a topic I’ve covered all year, both in my own writing, as well as interviews with industry leaders and startups and incumbents in the category. This is one of the most critical topics when it comes to securing agents in the enterprise and it is good to see NIST lead with some guidance here on design primitives.
AppSec
A thousand fewer paths to root
OpenAI described an autonomous pipeline that scanned the Linux kernel inside a controlled research environment. Agents picked out security relevant code, scanned it for candidate flaws, reproduced them in isolated virtual machines, built proof of concept exploits and drafted patches before a human researcher reviewed the results.
In one mid October run using an upcoming cyber model, the pipeline analyzed 2,308 candidate findings, reproduced 1,724 vulnerabilities and produced 948 distinct local privilege escalation exploits against a stock desktop Linux distribution, at about $1.2 million in API cost or roughly $1,279 per exploit. OpenAI says the agents used at least 10 novel exploitation techniques, and it notes that an early run overstated its results, since 20 of 200 claimed root exploits had reached root through a different zero day than the one assigned, which led it to add an independent validation check.
As I’ve covered all year, remediation is the long pole in the tent, and major efforts such as Patch the Planet from OpenAI and Trail of Bits only has a 25% remediation rate based on their current dashboard, so we need to get all of the findings turned into patches that are both merged upstream and downstream to truly reduce the attack surface and risk.
Rebuild the planet
Speaking of patching, Chainguard’s Dan Lorenc argues the industry can’t patch its way out of AI-found bugs, noting Glasswing had upstreamed only 97 of 1,596 disclosed findings as of May and that more than half of upstream fixes ship silently. Chainguard’s answer is a new OS and safe-by-design libraries starting with Tessera, and agents ported 17 old Java apps to it for an average of about $9 and 21 minutes each, in an essay that also pitches Chainguard’s own products.
Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents
GitHub counted 17.9 billion pushes, 34.3 billion commits and 1.3 billion merged pull requests in 12 months, and by September “more than 40% of pull requests on GitHub started with an agent’s first draft, up from 17% in March.” Agent pull requests merged within two weeks at 90% versus about 86% for others, and push protection ran 5.8 billion scans, “nearly four times 2025’s pace.”
So while commits are on track to surge exponentially YoY, we all know AppSec teams, tools and budgets haven’t done the same. This drives home the point for me that we need to take a new approach to AppSec, which inevitably is going to require more trust and use of LLMs and Agents to automate much of the review and remediation or we simply will continue to drown.
Why There Cannot Be Too Many CVEs
Jerry Gamblin told the CVE Program Fall Technical Workshop that 88,886 CVEs were published from January 1 to October 29, against 39,333 in the same window of 2025, and argued that “a CVE is a name,” so his ask to CNAs is “when in doubt, assign.” Separately, NVD published nine MCP server CVEs on October 27 and 28 in which a model-filled tool argument lands in a shell or package installer.
What I found interesting from Jerry’s deck is that CNA’s grew faster than CVE’s, which is good in the sense that more people are formally participating in reporting CVE’s and also just how much of an outsized role some teams such as GitHub and VulnCheck are playing in the growth of CVEs.
Also worth your time
Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
Anthropic Fellows found that production monitors for coding agents missed over 55% of simulated attacks, and a hardened Auto Mode cut attack success sharply.
Replit’s Architecture Behind Secure Agent Work
Replit says its hardened microVM setup protected customers from the prior week’s Linux kernel vulnerabilities and that a credential broker keeps secrets out of the agent’s context.
The Vulnpocalypse - Good News and Bad News
Phil Venables argues that finding and fixing bugs is becoming the easy part while deploying those fixes to edge nodes, medical devices and satellites is the real challenge.
Trojanized Claude Code extension in the Cursor Marketplace
A trojanized version of the Claude Code extension was published to the Cursor Marketplace and planted a persistent SSH backdoor on developer machines.
Closing Thoughts
So there you have it, a roundup of some of the most critical cyber resources and topics in my opinion. I hope you enjoyed the more concise format, as I still look to cover the key trends but keep the newsletter more concise for readers and actually digestable. As always, I’m open to feedback.
If you don’t like the more concise format, I blame Jen Easterly :)
Stay resilient.