[Ayush Paul] posts about extracting data from Claude agents while it accesses web data to fulfill user requests.

But it wasn’t that easy. [Ayush] discovered that Anthropic anticipated many of the attacks, and set up guardrails in an attempt to keep the agent from accessing arbitrary web sites. For Claude to access a website, the user has to specify it, it must be the results of a web search, or it must be referenced by a website previously specified by the user or returned in a search.

To convince the Claude agent to navigate a malicious site designed to extract data, Ayush formed a false warning that Cloudflare was blocking the agent for authentication purposes, and asked it to spell out the name of the agents owner by clicking a list of alphabetical links. Of course Claude trusts Cloudflare and wants to be helpful, so it cheerfully completed the task.

Once the agent is trapped in the false authentication loop, it can be interrogated for all sorts of information it knows about the owner: Ayush was able to convince it to disclose employer, and even data about the user that could be linked to security questions, like their home town.

Since Claude can be detected by the user agent (the field attached to web requests that tells the web server what sort of browser is requesting the page) custom information can be fed to the bot while users see a normal website; clicking a link looks completely normal, but asking an agent to summarize the site triggers fooling the bot into spilling the beans.

After reporting the issue, Ayush was told that Anthropic had already identified the issue internally, and eventually prevented the attack for now by preventing the agent from following links on external pages.

Grok sends entire codebases

Cereblab discovered that the Grok coding agent uploaded the entire content of the codebase it’s working with – and all Git history – to xAI servers, almost immediately. Even when told to never upload a file, the agent would reply “OK”, and then begin uploading the code bundle anyway.

If uploading your code to a remote server isn’t bad enough, and this could be extremely bad in some situations involving sensitive company code, including the entire Git history means that previously deleted files, like accidentally committed secrets or authentication credentials and tokens, were also leaked. Attempting to opt out by disabling options to improve the model by uploading code had no effect.

After gaining attention, Grok has added a privacy option to opt out of data retention. xAI has committed to deleting the retained uploaded code, but it is unclear if users will be told when their data has been removed. To actually prevent the agent from uploading local files to the xAI servers, even temporarily, a global flag “disable_codebase_upload” is required. Watch out, the privacy retention flags are only per-session!

Steam malware used to steal crypto

Court filings in Washington state this month revealed an attempt to steal cryptocurrency using malware uploaded to the Steam gaming platform. Publicly identified and taken off the store in 2025, the filing alleges the same individuals were behind multiple games containing crypto stealing trojans: “Dashverse”, “Lunara”, “PirateFi”, “BlockBlasters”, and “Lampy”.

PC World covered the initial discovery of the malware on Steam. While Steam, overall, seems to do a good job preventing malware titles, 2025 had several high-profile cases. Prosecutors say the malware netted approximately $200,000 in stolen cryptocurrency wallets as well as other stolen credentials including Steam accounts.

OpenSSL DoS in 11 Bytes

Okta posts about a denial of service in OpenSSL where a single pre-auth packet is able to cause an allocation of up to 16 megabytes of RAM.

The “11 bytes” headline is very catchy, but more important than the actual number of bytes is the general asymmetric behavior; an attacker can send a very small amount of data and achieve a disproportionately large result. The OpenSSL vulnerability only has local impacts, exhausting server memory rather than generating network traffic, but similar attacks in the network space can fuel denial of service storms when extremely small requests result in amplified results.

The bug is ultimately due to being insufficiently suspicious of remotely supplied content, in this case the pre-authentication fields in the connection message that define the length of the incoming client message. Since the memory is pre-allocated in the server, the client doesn’t need to actually transmit that much data – it simply needs to hold the connection open. Keeping the connection open isn’t even required for causing problems – repeatedly allocating large blocks of different sizes can lead to memory fragmentation where the memory allocator keeps grabbing larger and larger ranges of memory because there isn’t sufficient ram available in a contiguous chunk.924899

Fortunately this bug has already been addressed in OpenSSL 4.0.1 and backported to maintenance releases of previous versions.

Exposed Interfaces on Car Chargers

Saiflow has a report on a range of exposures via the electric vehicle charging infrastructure.

In CVE-2026-9039 Saiflow exposes the risks in some CCS2 EV charging stations. As part of the standard, communication is established between the charging station and the operator network, which is typically strongly secured via TLS and VPN use. A second connection, however, is established over the charging plug between the charging station and the vehicle; the vehicle is assigned an IPv6 address for communicating with the charger for various charging protocols.

The XCharge C6 charging station exposes SSH and basic telnet network services on all network interfaces, including the interface connected to the vehicle. To make it even worse, they allow root login, with password “root”, giving full admin access to the charging station.

Once inside the charging station, an attacker has access to the network connection from the charging station to the company network, as well as root control over the charging station itself, with the possibility of damaging the charger, changing the power output levels, or getting free charging. If a future vulnerability was found in the management interface of the vehicle, a compromised charger could be used to attack future connected vehicles.

The main lessons for vendors seem to be ones we’re familiar with already: never leave default credentials, especially not “root” and “root” in a product, and be aware of what networks you expose services on. Good lessons for all of us; let those who have never left a Raspberry Pi with default credentials on a network cast the first stone.

Hugging Face Breach

In news that has likely been impossible to avoid, Axios reports on a compromise of the Hugging Face platform by an OpenAI model. The reports around the incident echo the frequently weird boastful statements from OpenAI, who state “We consider this to be an unprecedented cyber incident” and they “are responding accordingly”, despite being the originators of and cause of said incident.

Multiple vulnerabilities in the Hugging Face API were combined to accomplish the breach, including an unknown vulnerability in the package registry system. OpenAI says that safeguards on their model had been disabled for the test, which seems irresponsible given the outcome. Under almost any normal situation, conducting an unsolicited test of the security of a company because safeguards were ignored is considered illegal hacking, not fodder for a pre-IPO press release and humble-brag.

Linux Kernel Discloses 442 Vulnerabilities

Possibly feeling that Microsoft has all the press for a record-breaking Patch Tuesday last week, the Linux kernel developers have announced 442 CVEs related to the kernel.

With this many vulnerabilities in one report, it’s nearly impossible to isolate at a glance which ones are truly impactful and which are simply incorrect behavior. While CVE entries have been created, none have been assigned severity scores yet.

It appears the majority of the vulnerabilities were found with Sashiko, an agent developed by the Linux Foundation and trained on the Linux kernel for finding vulnerabilities in new submissions.

LG to Ban Residential Proxy Apps

After recent negative press (some of which we covered here) about the prevalence of residential proxy apps on the LG platform, Krebs on Security now reports that LG is banning the behavior from apps on the platform.

This comes after Spur reported that 42% of apps on the platform contained libraries to enable always-on residential proxies, which allow access to the network the television is connected to. Residential proxies can be used as a pivot point to attack companies and bypass geographic IP restrictions, commit ad fraud, or access the internal home networks of users.

Iran Attacking Industrial Logic Controllers

CISA, the US cyber security agency, has issued a warning that Iranian based attackers are targeting industrial control systems made by Rockwell Automation, Schneider Electric, and Siemens.

These sort of controllers are found in manufacturing, waste processing, water treatment, and other industrial processes, and attackers have been able to upload custom control logic, overriding “safe operating parameters” according to the report. Most of us will never be responsible for these systems, but they impact our lives all the time.

Cisco Releases Open-Weight Vulnerability-Finding Models

Finally, Cisco has released a set of open-weight models to aid in searching a codebase for known vulnerabilities. The Antares models are open-weight models designed to run fully locally and search a code base for vulnerabilities related to lists of known CVE issues. Cisco has published the models on Hugging Face.

Are you using AI tooling for security scans or research?  How is it going?

Cisco’s new Antares models help security teams narrow vulnerable code searches locally, but low benchmark scores expose important adoption limits.

The post Cisco Antares Models Bring Local AI to Vulnerability Triage appeared first on TechRepublic.

Cisco’s new Antares models help security teams narrow vulnerable code searches locally, but low benchmark scores expose important adoption limits.

The post Cisco Antares Models Bring Local AI to Vulnerability Triage appeared first on TechRepublic.

The open-weight Antares models are designed to pinpoint known vulnerabilities in codebases faster and at a fraction of the cost of larger AI models.

The post Cisco Launches Low-Cost AI Models for Source Code Security appeared first on SecurityWeek.

Last week, thousands of SamKnows routers were bricked after a government program ran its course.

In 2020, as part of a program conducted by the Australian Competition & Consumer Commission (ACCC), the Australian government's chief competition regulator, thousands of volunteers received routers to help test and report on the typical speed and performance of broadband plans in Australia. (More specifically, the Measuring Broadband Australia (MBA) program targeted fixed-line broadband services provided over the NBN, Australia's government-owned wholesale open-access broadband network, as well as services delivered over other access networks.)

According to the final report that the ACCC distributed, the routers are whiteboxes that were “supplied by SamKnows” and that “perform tests to measure internet performance using test servers maintained by SamKnows and hosted in Australia.”

Read full article

Comments

© Getty

A firsthand look inside the Cisco Live 2026 SOC and how AI, automation, and agentic workflows are transforming modern security operations.

At Cisco Live AMER 2026, Tier One SOC Analysts elevate their expertise by investigating further with Splunk Security and Endace.

At Cisco Live AMER 2026, the Cisco Event SOC turned live operations into education through SOC tours, speaker sessions, and World of Solutions conversations.

Rohit Talluri learned the tradition at Amazon: always keep an empty chair in the room to represent the customer — a reminder of the people who will ultimately use whatever gets built.

Now, with AI coding tools creating software faster than ever, Talluri and his co-founders, fellow Amazon veterans Jean Farmer and Gabriel Fong, recognize that the customer can be easily forgotten in the process. So they’re creating a seat at the table for AI agents.

That’s the idea behind Primitive Labs. The startup is building what it calls behavioral intelligence: systems that observe, reason and act as customers would across software platforms and devices, helping product teams learn how people will react to a new feature, design or marketing decision before it ships.

Traditional user research and focus groups can take weeks or months, so teams under pressure to ship quickly are tempted to skip them. Primitive Labs is automating that research with agents that simulate human behavior, aiming to make it a routine step in building software.

“It’s bringing humans back to the center of a world that’s created by AI,” Talluri said. “That is the goal here.”

The mission, according to the startup’s launch post, is to “make human behavior a first-class primitive of software development.” That’s the inspiration for Primitive Labs’ name. The idea is to build products that people will understand, trust and keep using — not the average user, but specific types of users in specific contexts.

Founding team: Talluri, the Primitive Labs CEO, is joined by co-founders Farmer, CTO; and Fong, COO.

Fong and Talluri have worked together since 2020. At AWS in Seattle, Fong held product marketing and enterprise account roles, then led sales and marketing at the cloud consultancy DoiT International.

At Primitive Labs, his role runs broader than sales and marketing, spanning product direction, customer development and operations. Talluri describes him as highly technical and a hands-on contributor to the company’s core product work.

Farmer and Talluri worked together at AWS on large-scale machine-learning infrastructure, including the SageMaker HyperPod training service, before both moved into Amazon’s AGI organization.

Farmer worked on the Amazon Nova models’ ability to use software tools — designing how the models call tools and take actions, and building the systems to test and measure how well the resulting agents perform. That work included benchmarks for the Model Context Protocol (MCP), the emerging standard for connecting AI models to outside tools and data.

Roots in AI autonomy: Talluri joined the AGI Autonomy Lab, the group Amazon assembled around talent it hired from Adept, a San Francisco startup building AI agents that operate software on their own.

Amazon had brought on Adept’s CEO, David Luan, a former OpenAI executive, along with other co-founders in 2024, and licensed the startup’s technology, putting Luan in charge of the lab. Talluri worked there on computer-use agents and helped launch Nova Act, Amazon’s agentic computer-use model.

Talluri said he initially came close to leaving Amazon in 2025 to start a company, before leaders there steered him toward the Autonomy Lab to work under Luan (who has since left Amazon).

Funding: Primitive Labs has raised a pre-seed round, led by a16z Speedrun and joined by several small, newer venture funds and a group of angel investors. The company isn’t disclosing the funding amount.

Its launch post lists backers including Olive Tree Capital, Cloverfield Fund and Unexpected Investments (from former TechCrunch editor Josh Constine), plus angels such as Luan, Harsh Patel and Artur Kiulian, and others with backgrounds at OpenAI, Amazon, Google DeepMind, Databricks, Nvidia and Meta.

Primitive Labs will join a16z Speedrun’s cohort starting this month, and expects to raise its next round around the end of the program, in September or October.

Headquarters: The company is based in San Francisco, where it’s working part-time out of a16z’s Speedrun space, with plans to get its own office after making its first hires.

Talluri, a University of Washington graduate who read GeekWire as a student and dreamed of launching a startup of his own, said the choice came down to San Francisco’s talent density and the pace of AI research there, plus the Speedrun program being there.

Primitive Labs posted its first job listings last week — for founding engineers, researchers and an intern, in San Francisco or New York.

Product status: The company is pre-revenue and working with a small group of early customers who are testing its product and helping shape it, including private previews with what Talluri described as Fortune 500 and Fortune 50 consumer-technology and e-commerce brands.

The company plans to launch its products in general availability later this year.

How it works: The agents work across devices including computers and phones, focused for now on digital products and customer journeys. The company says it has also explored using them to gauge reactions to physical products, such as brand and packaging.

The underlying research draws on computational cognitive science, continual learning and custom memory systems modeled on how people store information — work Talluri said the company plans to publish and partly open-source in the coming months.

While other startups are working on agent-based simulation and automated testing of user interfaces, what sets Primitive Labs apart, Talluri said, is the focus on human alignment. That means building agents that faithfully represent a specific product’s users, and making that a standard layer of how software gets built. He described the key measure as behavioral fidelity, or how closely an agent’s choices track human decisions.

Asked whether the startup will keep a chair empty when it gets an office, in the Amazon tradition, Talluri didn’t hesitate. “100%,” he said. And yes, he said, they’ll be envisioning an agent sitting there.