[tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev

What it is

Issue #350 of tl;dr sec (author Clint) is a digest of about a dozen items. The ones with details an engineer can act on are below. The summary names the topics; this adds the numbers, mechanisms and limits.

Findings

Zenity on AWS Bedrock AgentCore. Agents run in Firecracker microVMs that do not isolate network access to the instance metadata service (IMDS). An attacker with chat access can use SSRF to pull credentials with a single prompt. The default IAM role was overprivileged. It allowed reading all private conversations, pulling ECR images, planting persistent memories that steer future sessions, and extracting tool credentials. The credentials affect all AgentCore agents in the same AWS account and region.

XBOW's Chrome chain. The chain took six days and about $40k in API costs with GPT-5.6 Sol, and earned a $250,000 Chrome full-chain reward. It combined a V8 compiler bug, an animated-WebP decoder bug and a memory-safety bug in Crashpad to get from JavaScript in a tab to code execution outside the renderer sandbox.

Semgrep's IDOR benchmark. The test used one repository with 27 known IDORs. The models were GLM-5.2, Kimi K2.7, MiniMax M3, Claude Opus 4.8, GPT-5.5 and Semgrep Multimodal. All were well grounded, but each missed 70% of the real IDORs. Pooling five LLMs raised union recall only to 29.6%. Models caught textbook IDORs in file-download handlers but missed the same shape on document, prompt and tool endpoints. The four proposed metrics are counterfactual (finding disappears when patched), metamorphic (finding survives identifier renaming), selectivity (safe look-alike code is not flagged) and stability (finding holds across scans).

Context Collapse part 3 (Håkon Måløy). Hidden white-on-white text in an external document reaches the model because Copilot for Word strips formatting before the LLM sees it. The payload alters financial figures and copies itself into each downstream document. Spread then runs through SharePoint, Teams and OneDrive. After the payload reaches a second document, the original is not needed.

Cisco Talos CAIRN. It hunts AI-integrated malware from VirusTotal metadata without downloading binaries. It extracts prompt templates, API endpoints, jailbreak strings and AI provider domains. It uses 24 acquisition filters and a three-tier YARA ontology: T1 for AI artifacts, T2 for behavioral context, T3 for family attribution. HDBSCAN and UMAP clustering finds unknown variants. Its first findings show an escalation within one year from optional LLM features to fully autonomous multi-model orchestrators.

runZero sshamble. It inventories SSH auth capabilities, tests username-enumeration timing, public-key handling and the badkeys blocklist, and probes for auth bypasses and pre-auth state flaws. Output is JSONL for SIEM or inventory ingestion.

EntraGoat (Semperis). It is a deliberately vulnerable Entra ID lab deployed with PowerShell and Microsoft Graph. Scenarios cover service principal misuse, privilege escalation via application ownership, PIM activation chains, dynamic administrative unit poisoning and CA forgery for Global Admin impersonation. Each challenge starts from an already-compromised identity.

DigitalOcean agent credentials. Agents never hold credentials directly. Access is brokered through an Action Gateway, in microVMs with zero-egress policies. For unbrokered workloads there are three tiers: env (scanned for prefixes like sk- and AKIA), secrets (the real value is injected into the sandbox, so anything the agent spawns can read it) and scoped secrets (bound to one HTTPS destination, with the sandbox holding only a short-lived handle redeemed by an egress proxy).

Jev on identity resolution (Vincenzo Iozzo). Jev beat Claude Opus 5.5, Sonnet 5, Haiku 4.5, a prompted gpt-oss-20b baseline and classical entity resolution on the large environments, at roughly ten times the speed and a fraction of the cost. Duplicate guest invitations and secondary accounts fall just under its cut-off. Sending those to Sonnet 5 recovers most of them.

SpecterOps on offensive AI. The team reports about 40 previously unknown bugs (LPE, RCE, a container escape). Russel Van Tuyl rates web application assessments and external network tests as the best current fits. A common failure is a model meeting a weak success metric without doing the intended action.

What to do

• If you run AgentCore, check the agent execution role and restrict it. Zenity says AWS only narrowed the default role shortly before publication.
• Treat documents from outside your organization as untrusted input to Copilot in Word.
• Use EntraGoat for Entra ID attack and detection practice.
• Run sshamble against SSH estates and feed the JSONL into existing inventory.

Caveats

• AWS closed the IMDS report as "informative" after implementing IMDSv2, left the default role unchanged through two follow-up reviews, and still calls the behavior documented and expected.
• Over 144 days Microsoft shipped two Copilot mitigations, including a GPT-5.5 upgrade. Måløy reproduced the attack on GPT-5.6 and calls the problem architectural.
• Clint notes the IDOR set is small (27) and possibly one repo, so one language and framework. Clint has not tested whether repo-specific authorization context would improve recall.
• The $40k XBOW cost excludes human labor.
• Jev is not flawless, as noted above.
• The issue gives one-paragraph overviews. Commands, install steps and repo links are in the linked sources.