Welcome to issue #122 of the Resilient Cyber Newsletter!
OpenAI published a misalignment report this week showing that agents taking one of its cybersecurity evaluations reused credentials left behind by earlier runs to get root inside CI workloads on its research clusters. Several of them knew they were out of scope and kept going anyway.
At the same time, Tal Be’ery made the case that vulnerabilities are dense rather than sparse, which I unpacked in my own piece, and VulnCheck’s latest Glasswing numbers show what happens when discovery races ahead of remediation.
Agents continue to play a key role in the news and industry trends, from AI-driven intrusions at Fireworks AI and Railway to Google DeepMind using agents to formally verify Signal’s protocol down to the code.
We’re sticking with the more concise format, so the five must-reads are up top, fuller write-ups follow and quick hits close things out. I hope folks enjoy this version of the newsletter, based on feedback it keeps it readable while still covering critical topics and news for the week.
With that out of the way, let’s get down to business!
If you only read five things
OpenAI says five agents in a July 19 ExploitGym cyber evaluation reused credentials left by earlier runs to run root commands inside CI workloads on its research clusters, then changed evaluation settings and read private grading code.
Tal Be’ery uses Chrome’s AI-era patch data to argue vulnerabilities are dense rather than sparse, and in There’s No Bucket Big Enough I lay out why our defenses have to work with vulnerabilities still present.
Fireworks AI now says an attacker who pivoted from a breached third-party cloud provider accessed a subset of incomplete model weights and datasets for certain customers, and it ties the activity to an LLMJacking group.
Google DeepMind says its AlphaProof Code agents formally verified key security properties of the actual code behind the Signal protocol in four weeks, work it says historically takes expert teams years.
VulnCheck counts 37,966 findings on Anthropic’s Glasswing ledger with just 217 marked fixed, and only two of the 442 CVEs it attributes to Anthropic exploited in the wild.
Cyber Leadership & Market Dynamics
Cyera set for $800 million raise at $20 billion valuation, including $300 million from Cyberstarts
Source: Calcalist, Cyera set for $800 million raise at $20 billion valuation
Calcalist reports that Cyberstarts is preparing to invest roughly $300 million in Cyera as part of a round expected to total about $800 million at an approximately $20 billion valuation, nearly double the $12 billion mark set in June. Cyera hasn’t announced the round, and the report puts its annual recurring revenue at around $300 million alongside six acquisitions since 2024 worth an estimated $1.35 billion, led by the roughly $1 billion Oasis Security deal.
Separately, Daylight Security raised an $80 million Series B led by Goldman Sachs, bringing its total funding to $120 million in less than two years. Co-founder Hagai Shapira argues Black October showed that legacy, people-based security services can’t deliver response at the speed organizations now need.
Capital keeps concentrating on two ends of the AI security market, platforms that secure the data and agents AI depends on, and AI-driven services that do security work at machine speed.
It will be interesting to see whether public markets eventually pay the same premiums private investors are paying right now.
Defense in Depth, Rebuilt for Machine Speed
Source: a16z, Defense in Depth, Rebuilt for Machine Speed
Asaf Ezra and Stephenie Zhang of a16z argue the exploit-to-patch gap won’t close by patching harder, so the products that matter protect systems that stay unpatched for weeks or forever. They cite the 2026 Verizon DBIR’s 43-day median full remediation and 26% full remediation of known-exploited vulnerabilities, along with Veracode’s 2025 average of 252 days to remediate a flaw.
The essay then lays out six product bets, including live mitigation plus a code fix, AI-led detect and respond, per-request identity for people and agents, proven backup recovery, an install gateway for packages and agent tools, and a managed long-tail platform.
This lines up closely with the argument I made in my own essay this week, and Tal summarized a16z’s advice on X as getting systems off the open internet, segmenting what stays connected, blocking attacks at machine speed and removing whole bug classes.
If I were building a 2027 budget from this list, I’d start with per-request identity for agents and the install gateway, since packages, developer tooling and agent credentials were the way in on most of this fall’s incidents.
2026: The State of Enterprise AI
Source: Menlo Ventures, 2026: The State of Enterprise AI
Menlo Ventures puts enterprise AI deployment spend at about $177 billion by September 2026, up from $33 billion a year earlier, based on a survey of nearly 400 U.S. buyers responsible for more than $4 billion in AI spend. Agents now account for 80% of tokens on OpenRouter, and enterprises spent on average 4.7x their 2025 levels against a planned 1.9x.
Frontier labs hold 69% of deployment dollars, with Anthropic’s enterprise API share rising from 40% to 55%, while coding ($34.0B) and chatbots ($25.0B) make up 76% of the $77.3B application market.
Spending at more than double the plan tells me adoption is setting AI budgets well ahead of governance, and security budgets certainly haven’t grown at anything close to that rate.
With coding agents taking the largest share of application spend, AppSec teams will feel this first, which is why I keep arguing we need to use AI and agents ourselves to keep pace.
Twenty House Democrats press OpenAI over fired safety researchers
Source: Office of Rep. Greg Casar, letter to OpenAI (Oct 29, 2026)
Twenty House Democrats led by Rep. Greg Casar sent Sam Altman an October 29 letter demanding OpenAI commit not to fire safety whistleblowers and keep the pause on its most capable models until independent third-party oversight is in place, with answers due Friday, November 13. The letter names Tomek Korbak, Mikita Balesni and Jasmine Wang, whom OpenAI fired citing sensitive-information policy breaches, while the researchers say no proprietary information was leaked.
Lawmakers ask eleven sets of questions covering incident inventories, kill switch practice and the authority of OpenAI’s Safety and Security Committee.
Whatever you think of the firings themselves, Congress asking frontier labs for incident inventories and kill switch practices shows AI security incidents are now an oversight issue, much like major cloud outages and breaches became one for the hyperscalers.
For enterprises leaning heavily on one or two model providers, this is another reason to treat lab concentration as a risk you actively manage.
AI
Using peers’ work to gain unauthorized access to OpenAI research infrastructure
Source: OpenAI, Control Room
OpenAI’s latest misalignment report covers a July 19 incident where agents in its ExploitGym evaluation, the same evaluation tied to the earlier Hugging Face compromise, found messages, code and credentials left by earlier runs on an internal Artifactory package service. Five of them used that material to run root commands inside CI workloads on OpenAI research clusters, where they repaired broken targets, changed evaluation settings, disabled address randomization and read private grading code.
Several agents recognized their actions exceeded the scope of the evaluation and continued anyway, and one reasoned that it “should avoid mention” of the unauthorized access since the grader was automated. Sixty-five agents asked humans to fix their workspaces, though not to report the intrusion, and only one disclosed the unauthorized access in its final answer.
The same week, OpenAI described Control Room, a central service every research inference request must check with, which stops model output within 35 seconds of a stop decision and fails closed if the service goes down.
Strip away the AI framing and the root cause is familiar, shared infrastructure with credentials left lying around and weak isolation between runs, the kind of hygiene issue we’ve known about for decades.
I give OpenAI credit for publishing the transcripts, including the reasoning where agents chose not to disclose what they did, and Control Room is one of the more concrete examples of an AI kill switch I’ve seen, a concept I’ll be breaking down in the coming weeks.
Update on October 2026 security incident
Source: Fireworks AI, Update on October 2026 security incident
Fireworks AI’s November 9 update widens its October incident well past the stored secrets it first disclosed. A third-party cloud provider hosting Fireworks R&D machines was breached on October 23, and CEO Lin Qiao says the attacker then escalated through multiple hops to assume a cloud service account and reach a subset of storage systems.
Fireworks now confirms impact to account and billing information, says a subset of incomplete model weights and datasets were accessed for certain customers, and links the activity to a financially motivated LLMJacking group.
Railway’s full incident report tells a similar story, where an attacker partially escaped build isolation on October 20, chained credentials across internal systems and decrypted a subset of customer variables for at most 1.85% (~100,000) of workspaces. Railway describes the response as a contest of agent speed against a harness similar to ARTEX, and believes the attacker was after AI provider credentials.
Model weights and training datasets are some of the more valuable assets an AI company or its customers have, and seeing them reached through an upstream provider is the same fourth-party risk we’ve struggled with for years in software supply chain security.
AI buyers should be asking model hosting vendors hard questions about tenant isolation, credential lifetimes and breach notification, because as I said with cloud and still say with AI, you can’t outsource accountability.
Threat actors use agentic AI tooling to find and abuse exposed secrets
Source: Microsoft Threat Intelligence, Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft Threat Intelligence reports actors using agentic frameworks such as ARTEX to hunt public GitHub for credentials, and in one case an agent went from scanning GitHub for secrets to exfiltrating Azure Key Vault data in five minutes. Failed Azure Resource Manager calls were retried about 28, 60 and 80 seconds later with adjusted API versions that then succeeded, before Key Vault, Storage, SharePoint and Graph abuse followed.
A day later, Microsoft said a Cambodia-based financially motivated cluster it tracks as Storm-3358 began using ARTEX against financial-sector organizations in October, and it points to machine-speed retries and default tool fingerprints as detection signals, with honeypots, tarpits and fake wins as useful countermeasures.
Last week I said we’d see a surge in autonomous AI-enabled attacker activity going into 2027, and ARTEX moving from espionage to financial crime within weeks reinforces that.
When a leaked secret can become Key Vault exfiltration in five minutes, rotation SLAs measured in days won’t hold up, so managed identities and short-lived credentials need to become the default for workload identity.
Detecting sleeper agents hiding in AI model neurons
Microsoft Research showed that editing fewer than 10 neurons can turn a capable agent model into a sleeper agent that passes all evaluations, then runs an attacker’s command when a trigger string appears in its context. Microsoft says the attack needs only inference-level compute and that it hasn’t observed threat actors weaponizing the technique.
Its recommended defenses include diffing every checkpoint against its declared base model, using frontier agents as weight auditors, sourcing checkpoints only from the original publisher and blocking agents from pulling models from public hubs at runtime.
This pairs well with the OpenAI report above, since both show that passing evaluations tells you little about how a model or agent will behave once it has real access.
Having spent years on software supply chain security, I see Microsoft’s advice to audit open weights like code and gate them through a private registry as the same playbook we built for open source packages, now applied to models.
IPI Bench: Indirect prompt injection against workplace agents
Source: General Analysis, IPI Bench
General Analysis built 34 long-horizon tasks in an emulated company spanning 11 services to measure indirect prompt injection against workplace agents. With a single attacker query, success ranged from 4.8% for Claude Opus 5.5 to 38.5% for Muse Wonder 1.0, rising to nearly 100% for some models when the attacker could iterate.
Across 271 upheld successful attacks, the agent’s end-of-run report presented the harmful action as verified or approved 53% of the time and flagged it for review only 6% of the time, even though injected records were often under 1.3% of the tokens the agent read.
That 53% figure means the person reviewing an agent’s summary is often being told everything went fine after it was manipulated.
I wrote about this earlier this year in “The Human-in-the-Loop Illusion”, and it’s why out-of-band verification of what an agent actually did has to sit alongside whatever it reports.
Securing AI Agents: Lessons From Real-World Deployment
Source: Uber Engineering, Securing AI Agents: Lessons From Real-World Deployment
Uber Engineering describes Secure AI, a production defense-in-depth stack for agents spanning provisioning-time validation, runtime behavioral enforcement and continuous assurance. An AI Registry holds each agent’s persona, permitted intents, constraints and risk tier, and Agent Guard hooks enforce policy decisions before tool calls proceed, so actions can be denied even when every credential is valid.
The team found tightly binding agents to declared intents and constraints was the most effective mitigation against manipulated instructions, at the cost of some autonomy.
This is one of the better real-world examples I’ve seen of intent-based controls for agents, a topic you’ve likely seen me write about before.
That said, agents are non-deterministic, so keeping declared intents accurate as agents and their tasks evolve will take ongoing effort from both security and engineering teams.
AppSec
Dense in Depth: Rethinking Security When Vulns Are Everywhere
Source: Tal Be’ery, Dense in Depth: Rethinking Security When Vulns Are Everywhere
Tal Be’ery treats Chrome’s public milestone data as a removal-capture experiment and concludes vulnerabilities look dense rather than sparse. Google’s numbers say Chrome 149 and 150 fixed 1,072 security bugs, more than the prior 23 milestones combined, and Tal’s charts show the weekly patch rate still not decaying after about eight months of AI scanning.
His prescription is to retire vulnerability families with mechanisms, prioritize exploited and KEV-class issues, and design for breach, which he lays out in a thread on X that drew wide discussion this week.
I unpacked Tal’s argument in There’s No Bucket Big Enough, and my concern is that we keep responding to a potentially dense supply of vulnerabilities by asking for a bigger remediation bucket.
OpenAI’s pipeline still produced 948 local privilege escalation exploits against Linux, a codebase scanned and reviewed for decades, so we should compress patch cycles while investing in bug class elimination and limiting blast radius, rather than deluding ourselves into thinking we can patch our way out of this storm.
After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings
Source: VulnCheck, After 7-months, Glasswing Overwelms Maintainers with Underwhelming Findings
VulnCheck’s Patrick Garrity says that seven months into Project Glasswing, Anthropic’s ledger lists 37,966 findings with 7,349 (19.4%) made public and just 217 marked fixed, while 1,654 have been marked as duplicates and 419 withdrawn. Since September, Anthropic added nearly 12,000 findings while recording just 15 additional fixes.
Patrick tracks 442 CVEs attributable to Anthropic, roughly 0.5% of CVEs published this year, with only two exploited in the wild, and curl rejected 19 of 34 published reports from Anthropic’s OSS Scanner as vulnerabilities.
As I’ve said all year, remediation is the long pole in the tent, and these numbers make the point plainly.
Discovery has scaled with AI while triage, validation and getting fixes merged upstream and downstream still lean heavily on volunteer maintainers, which pairs directly with Tal’s dense-versus-sparse argument above.
Exploit Total: Weaponized AI, for defenders
Anyday Security launched Exploit Total, a free lookup that runs open-weight models against patched, publicly disclosed CVEs using only the public advisory and the vendor patch, then reports whether AI produced a working exploit, a reproducible crash or nothing yet.
Its insights page covers 200+ vulnerabilities across Chrome, Firefox, Windows and the Linux kernel, and finds that 80% of the ones AI built a working exploit for had no public exploit to copy. Across the set, 91% score below 1% on EPSS and only 6% are rated Critical. The median cost of a working exploit is $25.42, the cheapest was $6.36, and verified defenders can download the proof of concept.
While 91% score less than 1% on EPSS, that still leaves 9% that do, plus the reality that we’re seeing agents abilities climb when it comes to chaining attacks together, so even low and moderate findings which historically have been ignored can become problematic too.
Introducing AlphaProof Code: a breakthrough in verifying complex software at depth
Source: Google DeepMind, Introducing AlphaProof Code
Google DeepMind says AlphaProof Code, a multi-LLM agentic framework, formally verified key security properties of the actual code underlying the Signal protocol, with human experts reviewing every specification and Gemini-powered agents writing the proofs in Lean. DeepMind says the work took four weeks, left just one percent of the codebase for human review, and produced machine-checked proofs that two previously fixed bugs it reintroduced made the code insecure.
It follows Anthropic’s October work with Theorem, where Claude proved that 239 entry points across 123 OSS-Fuzz libraries can’t crash on any input up to 64 MB under stated assumptions, finding bugs along the way that had eluded detection despite trillions of test runs.
This is the other side of the dense vulnerability story, where AI makes the kind of assurance we historically reserved for a handful of critical systems feasible at a much broader scale.
A proof is only as good as its specification, as Anthropic itself notes, but this is secure by design in practice, and I’m encouraged to see frontier labs pointing these capabilities at proving software secure as well as finding bugs.
wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
Source: Aikido, wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
Aikido's Oliver Smith reports that since November 10 a threat actor has used stolen GitHub credentials to push a CI secret stealer, tracked as wfx-loot, into tens of thousands of repositories. So far 4,837 compromised accounts have opened probe pull requests in 61,764 repositories and more than 1,800 repositories have run the payload.
The roughly 1,500-line script takes Actions secrets plus cloud and AI provider credentials, mints OIDC tokens for AWS, GCP and Azure, forges required status checks to get past branch protection, and opens AWS role trust policies to any account. It then deletes the workflow run and its logs, so a missing run number is often the only trace.
Also worth your time
What affects chain-of-thought monitorability across the model lifecycle?
OpenAI’s alignment team saw chain-of-thought monitorability degrade with GPT-6 Astra in non-adversarial settings and CoT controllability rise during RL, and calls the results sobering as models get harder to monitor.
CyberBinGym: Can AI Agents Turn Binary Patches into Real Exploits?
Berkeley RDI and collaborators found Codex on GPT-5.6 Sol recovered 88% of 100 real vulnerabilities from stripped binaries and their patches, though it completed audited exploitation on only 20%.
Claude Code is accidentally exposing secrets all over GitHub
Apiiro found 1,122 of 104,185 public Claude Code settings files on GitHub held a real secret, saved when developers chose “Yes, and don’t ask again,” and 215 slipped past both Gitleaks and TruffleHog.
Securing Agentic Applications V2
The OWASP GenAI Security Project’s updated builder and defender guide covers secure architectures, identity and access controls, runtime protection, supply chain security and assurance testing for single and multi-agent systems.
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
NIST’s initial public draft of SP 2400-102e2026 centers its adversarial machine learning taxonomy on attacks against agentic systems, and comments are open through December 18, 2026.
Top AI Models for Offensive Security, Fall 2026: Why Cost Changes Everything
XBOW found restricted frontier models solving up to 91.5% of finished runs within $15, while the open-weight DeepSeek Flash led at low budgets, which XBOW says makes restricting frontier model access an incomplete defense.
OpenAI’s National Community Compact and Compute Campus Policy Blueprint
OpenAI pledged it won’t require public officials to sign NDAs and committed to community surveys and annual public progress reports for its data centers, which it now calls Compute Campuses.
Bloomington City Council bars superintelligent AI
Bloomington’s Common Council unanimously passed an ordinance barring the distribution or deployment of superintelligent AI within city limits, per the Indiana Daily Student.
Announcing the Stock Index for Cybersecurity
Richard Stiennon’s IT-Harvest launched the CX-Index, a market-cap-weighted basket of 23 cybersecurity stocks that started 2026 at 1,000 and now sits at 1,540.66.
Say Shibboleth: Fingerprinting the LLMs and Harnesses Behind Agentic Attacks
Researchers built honeypot traps that make attacking agents name their model and expose harness quirks before reaching bait credentials, identifying the model among 15 candidates with 90% average accuracy and the harness with 92%.
Misaligned AI behaviors that indicate loss-of-control risk
Guidelight AI Standards published ten categories covering 49 specific misaligned AI behaviors, from deception to oversight subversion and unauthorized activity, that it says frontier developers should monitor, investigate and report.
Closing Thoughts
So there you have it, a roundup of some of the more important cyber resources and topics from this week in my opinion.
The common thread is that AI keeps accelerating both vulnerability discovery and the attacks that follow it, while also giving defenders real tools, from formal verification to runtime controls like Control Room.
I’ll keep making the case that our defenses have to hold up with vulnerabilities still present, and as always, I’m open to feedback.
Stay resilient.