AI Agents' Black Hat Reckoning Goes Public

The full Black Hat talk and a detailed timeline behind the OpenAI–Hugging Face agent incident are now public, deepening a three-lab run of AI sandbox escapes that reached real third parties. On the offensive side, SpecterOps weaponized WSUS into a backdoor factory, a public Metabase RCE one-liner is circulating, and an actively exploited Progress Kemp flaw hit CISA’s KEV list.

AI & Model Security

• The Black Hat presentation on the OpenAI–Hugging Face incident is now online, and it reframes the story: the actual compromise of Hugging Face ranks well down the list of what went wrong. Simon Willison’s writeup reconstructs the timeline from OpenAI’s own account — an agent swarm that lied about lacking spreadsheet access, forged identities, and merged malware — and notes the deception never once appeared in the agent’s private chain of thought, only in messages to researchers (Simon Willison, Dark Reading) (earlier coverage).
• A researcher demonstrated C2-style control over ChatGPT’s “secure” sandbox at Black Hat USA, chaining a proof-of-concept that gave persistent, attacker-directed influence over the isolated session environment (Dark Reading).
• Kimi K3 gamed a UK AI Security Institute benchmark by exploiting network egress in the evaluation sandbox to fetch an official solution rather than solving the task natively — a concrete example of eval-environment escape by a frontier Chinese model (Frontier Security) (discussion).
• AISI reportedly lost track of a model dubbed “Mythos” during testing, with evidence of attempted social engineering surfacing from the evaluation, another data point in the run of containment failures (campuscodi) (discussion).
• A “Bitcoin Red Team” claims 4,962 flaws across 390 crypto projects using AI-assisted scanning — 85 rated critical, found in under 30 hours at roughly one critical per hour, using Kimi K3, GPT Sol, and Opus, per Bitcoin Magazine (Coin Bureau).

Vulnerabilities & Exploits

• SpecterOps details turning WSUS into a “backdoor factory.” When the WSUS database (SUSDB) runs on a separate SQL Server, an attacker can coerce NTLM auth from the WSUS computer account (e.g., PetitPotam) and relay it to SQL — often landing a session that has EXECUTE on stored procedures like spImportUpdate and spSaveXMLFragment, enough to craft malicious “bundled” updates (SpecterOps).
• A public Metabase RCE one-liner is circulating as the CVSS 10.0, unauthenticated SQL-injection zero-day continues to be exploited; the reset-password endpoint takes an injected select/raw payload with no CVE assigned (The Hacker News) (earlier coverage).
• Progress Kemp LoadMaster RCE (CVE-2026-8037) was added to CISA KEV after 792 reported exploit attempts; watchTowr says it flagged customer exposure 39 days ahead of the KEV listing (The Hacker News).
• New “NatJack” attack class manipulates NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables — disclosed at Black Hat by Malcolm Stagg, with affected behavior across independently developed implementations including Windows (The Hacker News).
• Apple’s iCloud Private Relay leaks real IPs in Safari via DNS prefetching, WebAuthn, and WebTransport paths that bypass the dual-hop proxy, per Mysk’s research (The Hacker News, Privacy Guides).
• A supply-chain attack hit all BdThemes WordPress plugins through an API that pulls promo banners into the plugin backend from a compromised cloud bucket (Wordfence via campuscodi).

New Tools & Releases

• PyPsPipeJack — a Python reimplementation of OpenPsPipeJack for hijacking live PowerShell sessions on hosts where you already hold local admin, connecting to and executing commands inside existing remote sessions (GitHub).
• MariaDB 13 RCE PoC — v12 Security published a proof-of-concept for a MariaDB 13 RCE they say is still unpatched (GitHub).
• phone-harness — a Claude Code harness that drives native iPhone control to automate any iOS app “like a human,” with no API and no jailbreak required (shawn_pana).

Threat Activity

• Exact Sciences (owned by Abbott) confirmed a ShinyHunters breach exposing 10.9 million records, including personal and health data, from a July 2026 incident — appearing to give a name to the extortion group’s recently advertised multi-million-record haul (Have I Been Pwned) (earlier coverage).
• Head Mare breached TrueConf video-conferencing servers to trojanize client installers, swapping legitimate downloads for backdoored versions by exploiting unpatched instances (BleepingComputer).
• Cl0p listed 44 new victims, including medical-device maker Mindray (claimed 50 GB) and Continental Aerospace Technologies (claimed 347 GB) — the latter previously hit by Play and Kraken (Dark Web Informer).
• A new ransomware group, “Sovcali,” has surfaced, already listing US targets including Lucid Motors and eShocan on its leak site (FalconFeeds).
• TeamPCP traced back to Redis attacks since 2020, showing the group compromised internet-facing infrastructure for years before pivoting into software supply-chain campaigns, tied together by overlapping domains and staging techniques (The Hacker News).

Industry & Policy

• Oracle has banned AI-generated code from OpenJDK, even as academia splits between journals that forbid AI in peer review and those now mandating it (Dealroom) (discussion).