[elastic]

August 1, 2026

• Elastic Security Labs published detection mapping for the Hugging Face AI-agent breach, translating the autonomous agent's tactics — untrusted-data exploitation to RCE, credential theft, lateral movement, and C2 staging — into outcome-based signals rather than register-based ones (Elastic). Useful purple-team follow-up to the earlier coverage of the incident, with a companion narrative in The New Yorker. · AI & Offensive Security

in When the Attacker Is a Model: AI Lands on Both Sides of the Fight

July 18, 2026

• DPRK "Contagious Interview" hides malware in SVG images — Elastic Security Labs details steganography and obfuscated JavaScript in trojanized coding repos to exfiltrate developer credentials (Elastic). · Threat Activity

in A Pre-Auth RCE Lands in WordPress Core, Proof-of-Concept and All