[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards

What it claims

tl;dr sec #346 (late 2026) is a link newsletter. Its AI substance sits in four items: Cloudflare's Codex standards system, James Kettle's HTTP Terminator, Uber's agent identity architecture, and Anthropic's "Detecting and countering misuse of AI: September 2026" report. Meta's Muse appears as a one-line link. Each item is a few sentences summarising an external post. The newsletter has no original results.

How it works

Cloudflare Codex (Timo Reimann). Standards are written as RFCs grouped by domain. Each SHOULD/MUST statement gets a persistent identifier and is extracted into structured JSON for agents to consume. An RFC starts as "approved", where findings are non-blocking. It becomes "enforced", where violations block, once teams have had time to adopt it. Three agents read the Codex:

• a code reviewer;
• a spec reviewer on Cloudflare Workers that keeps results and state in D1;
• an incident report reviewer that stops high-severity incidents from closing until all findings are addressed.

Language linters (oxlint for TypeScript) and a local CLI support the agents. Cloudflare plans to extend Codex to product, security, compliance, and trust and safety teams.

HTTP Terminator (James Kettle, PortSwigger, Black Hat USA / DEF CON 2026). Kettle split 138 RFCs into 15,000 fragments of one to three sentences each. He did this so the model would not anchor on his own published desync research. The fragments seeded 30,000 attack vectors. A Burp extension tested these continuously against 30,000 live bug bounty websites. Proven findings were then fed back as inspiration for new hypotheses.

flowchart LR
  A[138 RFCs] --> B[15,000 fragments]
  B --> C[LLM generates vectors]
  C --> D[Burp extension tests live sites]
  D -->|works| E[Proven findings]
  D -->|fails| C
  E -->|fed back as seed| C
  E --> F[Manual validation]

Uber agent identity (Matt Mathew, Prasad Borole, Meng Huang). A Security Token Service mints short-lived, single-hop JWTs. Each token carries the full actor chain (user → agent → agent → tool), so provenance survives multi-agent calls. The other components are:

• SPIRE, which verifies workload identity;
• an Agent Registry, which authorizes agent-to-workload pairs;
• an MCP Gateway, which enforces policy.

Token exchange is automated through a standard A2A client in Uber's Python SDK.

Meta Muse. Muse runs in a per-user cloud VM with its own browser. A separate, isolated agent called Sentinel must approve every outbound request. Muse uses passwords and card numbers from secure storage without seeing them.

Evidence

• Cloudflare: the code reviewer flagged 230,000 violations and blocked 16,000 merges in four months. The spec reviewer has evaluated over 600 designs. The incident reviewer has assessed over 200 postmortems since May 2026.
• HTTP Terminator, techniques found:
• several working desync triggers;
• a desync pattern built on dual matching Content-Length headers;
• a "dangling-byte" technique that removes the race condition behind unreliable response queue poisoning.
• HTTP Terminator, response forking: one target answered a single request with two responses. Kettle names this "response forking" and treats it as a new desync class.
• HTTP Terminator, feedback loop: the loop produced "Shared Parser Confusion". Many servers parse requests and responses with the same code, so a request can reach response-processing features. Kettle validated this manually and says neither he nor the system would have found it alone.
• Anthropic report: it covers Claude Haiku, Sonnet and Opus misuse from December 2025 to August 2026. Documented cases include:
• a network of 70 fake news sites;
• a surveillance platform monitoring about 25 million SIM cards in Mali;
• rocket guidance and drone-swarm software;
• dual-use biology work;
• stolen API keys used for compute and cover.
• Anthropic report, distillation and exploits: the report names distillation campaigns by Alibaba/Qwen, Moonshot/Kimi, DeepSeek and Zhipu/GLM. These used CoT extraction and cross-session replay through OpenClaw, OpenCode, LiteLLM and proxy farms. One actor's AI exploit foundry found over a dozen 0-days in a month. Another rebuilt malware automatically until it evaded detection.
• Related non-AI item: in Sysdig's marimo CVE-2026-39987 report, a prompt injection trap caught every LLM-driven operator Sysdig profiled against that CVE. A hand-coded attacker with no LLM in the loop walked past it.

Limits

Every item is a short secondhand summary. The Cloudflare figures carry no false-positive rate. The HTTP Terminator summary gives no count of confirmed vulnerable sites and no model name. Readers need the linked originals before adopting any of these designs. Editor Clint's forecast, that open-weight models will reach today's frontier and let threat actors avoid bans, is his opinion.