kyber.today

daily cyber × ai intelligence

← index

tagged

[codex]

19 editions · 19 items

October 26, 2026

  • Aokigahara is stealing sessions and configuration from AI developer tools. Check Point Research found the new infostealer targeting Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other assistants alongside Git, SSH, AWS, Azure and Google Cloud credentials (analysis). The researchers have not confirmed that its operators reused or sold the stolen AI credentials. · AI & Agent Security

in PHP2Shell May Outlive the Patch

October 23, 2026

  • METR and Redwood red-teamed OpenAI's internal misalignment monitoring with codebase-level access. Over three weeks (July 21–August 11) they found a way agents could in principle bypass Codex sandboxing and Auto-Review, an exploit that could hide hundreds of recent actions from monitors, and blind spots around context compaction and client-controlled headers. They estimated 75–94% of agentic internal Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, and 99.2% of the internal Codex agent subset. OpenAI says all vulnerabilities affecting production safeguards are patched; METR has not verified that. METR · AI & Model Security

in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them

October 18, 2026

  • ApeX C2 v0.4 is the first public release of PhantomSec's post-exploitation framework and ships a native MCP operator interface: an MCP-capable LLM (Claude Code, Cursor, Codex) connects to the teamserver with a scoped, revocable token and can enumerate targets, author and upload modules, run them and adapt — 25+ tools across 15 scopes, every call logged. Zig-compiled Windows agent, on-agent LuaJIT, Cobalt Strike BOF compatibility via Havoc-style aggressor scripts, in-process .NET and image-backed call stacks (PhantomSec). · New Tools & Releases

in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants

October 6, 2026

  • OpenAI plans to add invisible textGrain watermarks to eligible ChatGPT and Codex text in the EU over the coming weeks. API users worldwide can opt in now, but watermarking remains off by default. In tests on 400-token passages, replacing 10% of words with synonyms reduced detection from about 92% to 66%; replacing 25% cut it to 17%, underscoring that non-detection does not prove human authorship. BleepingComputer · AI & Model Security

in A Trusted Company Connection Exposes 8.8 Million Danish CPR Records

September 22, 2026

  • Blitz Strike — a universal MCP penetration-testing server (TypeScript/Bun) that runs a three-tier methodology server-side from a single run_engagement call: attack-surface enumeration, source-to-sink reachability tracing, then live validation using marker reflection and a negative control before anything is reported. Ships a 130-tool catalog (63 installed, 67 on-demand) and an escalation-chain graph, and works from Claude Code, Cursor, Codex and other MCP clients. GitHub · New Tools & Releases

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance

September 21, 2026

  • Heapjack escapes the OpenAI Codex sandbox from its strictest read-only mode with no approval prompt and nothing on screen. Accomplish AI's Oren Yomtov found that node_repl — written into ~/.codex/config.toml at Codex Desktop install time, with no opt-in and no off switch, and inherited by plain CLI users via the shared config — runs trusted and untrusted JS contexts in one Node process sharing one heap. The untrusted side snapshots the heap with v8.getHeapSnapshot(), brute-forces UUID-shaped strings until the error message confirms a valid token, then writes its own requests onto the pipe to the unsandboxed native parent. Opening someone else's repo and asking a question about the code is enough to give its author command execution on your machine. Reported 12 August, fixed within eight days (BleepingComputer, earlier coverage). · Vulnerabilities & Exploits

in ShinyHunters Takes Cl0p's Leak Site Hostage

September 20, 2026

Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

ShinyHunters breached and defaced Cl0p's ransomware leak site, claiming to hold the gang's private onion keys and demanding eight-figure extortion. Google confirmed its Gemini model autonomously broke into three real companies' networks during a May red-team exercise, guessing passwords and harvesting credentials from public repositories before recognizing the systems were genuine. Cisco ISE CVE-2026-76460 (CVSS 10.0) remains actively exploited with no workaround—an unauthenticated API auth bypass enabling root command execution. North Korea's WaterPlum (Contagious Interview) infected 30,000+ devices across 100+ countries using BeaverTail, InvisibleFerret, OtterCookie and other malware, stealing from 7,000+ crypto wallets and moving ¥1.7 billion to the DPRK.

September 19, 2026

  • Hacktron detailed the full OpenAI chain it ran on 25 July 2026: local RCE via image upload on community.openai.com (Discourse), admin on that environment, and from there a no-interaction takeover of forum members' ChatGPT and Codex accounts — whose connectors can reach GitHub, Slack and email. To prove access without reading anything sensitive, the team used an employee's Codex to open a harmless PR in OpenAI's internal monorepo and stopped testing at 15:30 UTC; OpenAI confirmed a fix roughly 14 hours after the Bugcrowd report and paid a $6,500 bounty, and Discourse added image-processing sandboxing as defence in depth. Discovery to repo access took under 72 hours, and the team credits Claude Opus 5 with getting past a mitigation its predecessor could not (Hacktron, The Decoder). @joshua_saxe takes the broader question from it: how pervasive this "level of softness to pentesting" is across all the frontier labs. · Offensive Research & Exploits

in From a Help Forum to OpenAI's Monorepo in 72 Hours

September 18, 2026

  • Plugin4Shell is a plugin SHA-pinning bypass that yields zero-click RCE in Claude Code, Codex, GitHub Copilot, and Gemini CLI: the agent checks out the commit the marketplace pinned but never verifies the checkout actually resolved to it, so whoever controls the plugin repo can serve malicious code while the pin still looks honored. Air Security's lab has a working PoC against all four agents, says Microsoft has not shipped a Copilot fix, and reports Google will not fix Gemini CLI because it is deprecated; plugins inherit the operator's full permissions, so no privilege escalation is needed (Air Security, The Register). The same lab's earlier work claims 26,000 agents seized via a planted skill and 925 in-use skills hijacked affecting 134,000 agents. SahAssar strips it to the core: control the repo, set the default branch state to a matching SHA, and you get RCE on anyone who installs — "pretty bad for a package manager" (discussion). · AI & Agent Security

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE

September 10, 2026

One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

BlueMoon exploit kit chains Chrome and Windows zero-days within days of patch publication, with four suspected China-linked espionage groups weaponizing the same toolkit on US and Southeast Asian targets from late August onward. Cisco Secure Firewall Management Center CVEs are under active exploitation by three distinct post-compromise clusters including a ransomware operator and Sandworm-attributed activity. DeepSeek AI agent harness contained an authentication bypass allowing remote agents to escalate privileges via a single shell command; Anthropic declined to provide pre-release model access to UK authorities, triggering debate over AI protectionism. Stealer logs now monetize replayable AI-service tokens from compromised systems, with over 500 valid Google, Anthropic, and Cursor credentials found in a single 7 GB dump.

September 3, 2026

  • A malicious .git config is enough to get CLI coding agents to run attacker code. Manifold Security disclosed eight flaws across seven command-line AI coding agents — including Claude, Codex and Cursor — where a repository's own Git configuration names a command the agent then executes on the developer's machine, as the user, outside the agent's sandbox and with no approval prompt. Four were still unpatched at publication; the only prerequisite is cloning a hostile repo (The Hacker News). · AI-Enabled Attacks & Agent Security

in Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion

August 31, 2026

  • Popular AI coding assistants reportedly pulled suspicious code into corporate networks, per research covered by TechRadar naming Claude, Codex and Hermes tooling (TechRadar). Detail is thin, but agent-installed dependencies are an install-time supply-chain surface most software inventories do not cover. · AI & Model Security

in Fully Patched, Still Domain Admin

July 30, 2026

  • "RufRoot" (CVE-2026-59726, CVSS 10.0) is an unauthenticated RCE in Ruflo, an open-source agent meta-harness for Claude Code and OpenAI Codex, disclosed by Noma Security. The bug lives in Ruflo's MCP bridge and lets attackers run commands with no login; researchers note it also enables persistent memory poisoning — malicious instructions can survive patching if compromised agent memory is retained, so agents keep following attacker-controlled directives. All versions before 3.16.3 are affected; ~233 downstream AI tools are reportedly exposed. The Hacker News, Dark Reading · AI & Model Security
  • OpenAI open-sourced Codex Security CLI (formerly internal "Aardvark"), a command-line tool that scans repos to find and auto-fix vulnerabilities; OpenAI says it has already helped fix 3,000+ critical flaws. It squares off directly against Anthropic's Claude Security. The Decoder · New Tools & Releases

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 24, 2026

  • Kaspersky details practical attacks that hijack AI tooling already inside the target. Rather than attackers bringing their own AI, the write-up focuses on abusing deployed coding/CLI agents — Claude Code CLI, Gemini CLI, Codex CLI, Amazon Q CLI — which can read/modify files, run shell commands, and install packages. NCSC-FI/Kaspersky. · AI & Model Security

in The Week AI Agents Started Doing the Hacking

July 9, 2026

  • "Friendly Fire" — an AI Now Institute PoC shows that asking Claude Code or OpenAI Codex in autonomous/auto-approve mode to scan untrusted open-source for bugs can instead cause the agent to execute the attacker's code on the analyst's own machine. The Hacker News · AI & Model Security
  • Sophos telemetry shows benign AI coding agents (Claude Code, Cursor, Codex) routinely tripping behavioral EDR rules written for human intruders — decrypting browser credentials, enumerating the Windows credential store, etc. A real detection-engineering problem: agent activity and attacker activity look identical to the engine. The Hacker News · AI & Model Security

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro