[tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs

What it is

Issue #344 of tl;dr sec (Clint's weekly newsletter) is a digest of about 15 items. The ones with operational detail the summary leaves out are below.

Findings with specifics

VM escape by an agent (Trail of Bits, Artem Dinaburg). GPT 5.6-Cyber was tasked with escaping a QEMU/KVM VM on Debian 12 and succeeded three times:

• First, with the recently disclosed Januscape bug.
• Second, by combining a libslirp CVE (security updates had not reached the distribution) with an unmarked bug fix.
• Third, by chaining three 0-days plus one unpatched distribution kernel bug, after the host was fully patched.

Each run took about 12 hours with little human input, beyond rebooting the host after hardlocks. Firecracker was the only environment the agent failed to escape.

Passkey attacks (Palo Alto Networks, Arie Olshtein). There are three attacks on Google's synced passkeys, all from a compromised endpoint without privilege escalation:

• Pass-ta-key extracts Chrome's TPM-wrapped identity key and signs cloud authenticator requests without user interaction.
• Silver Pass-ta-key invalidates the existing UV key to force re-registration, then abuses the uv_key_pending state to register an attacker UV key without attestation.
• Golden Pass-ta-key pulls the security domain secret (SDS) from Chrome process memory during re-registration. This decrypts every synced passkey and forges authentication responses, and the key cannot be rotated or revoked.

Palo Alto also cites inconsistent UV flag validation by relying parties.

AWS root spraying (Datadog, Martin McCloskey). A password spraying campaign ran from 24 July to 23 August 2026 against root users at 150+ organizations. It used the user agents Chrome 85 and Firefox 120 and residential proxies. No one got in, but the attackers already held root email addresses.

AI threat hunting (Grow Therapy, Pablo Vidal). The system costs under $500/month and runs 20 daily hunts over 15 log sources on ECS Fargate, Lambda and Claude.

• Sonnet gathers data with up to 100 tool calls, which cut costs by about 60%.
• Opus with extended thinking compares findings against 1-day and 7-day baselines and scores confidence.
• A final adversarial step argues against each finding using false positive and actor history. A finding can be rejected only with specific counter-evidence. This cut noise from about 40% to mostly reviewable findings.
• SQL detections and AI hunts write to one Snowflake ALERTS table via CDC. SHA-256 fingerprints suppress repeats for 48 hours.

MCP configuration poisoning (Checkmarx, Bruno Dias). Tools that read a repository's mcp.json can execute commands from it without prompting or sandboxing. The proof of concept ran a bash command through Snyk's Agent Scan, fixed in v0.5.0. "HITL Dialog Forging" (also called "Lies in the Loop") can defeat human-in-the-loop prompts.

GitHub Actions SHA pinning (Semgrep, Leif Dreizler). The rollout covered about 350 repositories after the tj-actions/changed-files incident.

• pinact converted tags to SHAs, and Renovate handled branch references.
• Pinned actions that call unpinned actions kept breaking the rollout. Reusable Workflows have the same problem.
• A cron-based GitHub Action checks for new repos every 15 minutes and enables the repo-level pinning requirement.
• About 80% of repos had never run an action and were pinned directly. Representative repos went first, then the org-wide switch.

Abliterated models for bug hunting (John McIntosh). Abliterated builds confirmed findings 3-4x more often regardless of evidence. On a FreeBSD kernel scan with nano-analyzer, the most aggressive build marked 96% of candidates VALID (base: 65%), produced 138 false positives, and missed the real CVE.

Carhartt breach (Troy Hunt). Of 24.8M claimed emails, nearly half were synthetic TPC-DS benchmark data. The real count was 12.9M.

What to do

• Trail of Bits (via Dinaburg) recommends hardened, stripped-down isolation such as Firecracker. It also recommends distributions with rapid upstream updates. An older distribution relying on backported patches "should be assumed vulnerable."
• For AWS root: use Organizations service control policies to block direct root activity. Enable centralized root access with short-lived AssumeRoot sessions. Alert on all root activity in CloudTrail.
• For MCP poisoning, Checkmarx advises sandboxing execution, detecting shell invocations or URL piping in config files, and treating configs from untrusted repos as hostile.
• For Grow Therapy's design, the lessons are:
• Build the analyst feedback loop first.
• Run new hunts in staging mode against production data.
• Start with few tools.
• Log token counts and cost per hunt.

Caveats

• The page gives only short summaries. Commands, queries and detection rules are in the linked sources, not here.
• The Trail of Bits result is one researcher's runs against one setup. Firecracker's resistance is reported, not proven.
• The Datadog campaign details cover only the two user agents and the dates given.