[tl;dr sec] #343 - Hugging Face Technical Report, AWSHound, OWASP Agentic Skills Top 10

What it is

Issue #343 of the tl;dr sec newsletter, written by Clint Gibler. It links to a dozen items. The ones with findings an engineer can act on are below. The issue also notes that OpenAI released a full 38-page technical report on the Hugging Face incident, but gives no details of it.

Cloud and AWS

TruffleHog AWS Analyze (Jim Freely) resolves the IAM principal behind a leaked AWS key. It aggregates attached managed and inline policies, including group memberships. It also maps role assumption paths up to two trust-policy hops deep. The accompanying research covered 64,024 leaked keys:

• 88% were still active, with a median age of five years.
• 84% had full administrator access.
• One in six was a root key.

The newsletter notes the tool is not open source.

AWSHound (SpecterOps, Julian Catrambone) is an open-source collector that turns AWS accounts and Organizations into BloodHound Community Edition OpenGraph data. It evaluates IAM policy offline, combining identity policies, permissions boundaries, SCPs, RCPs and resource policies. Composition rules differ by service:

• S3 uses OR within an account and AND across accounts.
• STS always requires AND.
• KMS uses a three-layer evaluation.

It runs in three phases: collect (read-only API calls), process (156 edge types, 36 traversable) and emit (OpenGraph JSON). It covers IAM, Organizations, S3, KMS, SSM, EC2, Lambda, CloudFormation and EKS. Composite edges such as AWS_CanCreateAndAssumeAdminRole fold several permissions into one attack-path step. In testing it processed over 500 accounts, producing about 160,000 nodes and 10.5 million edges in about 15 minutes.

AI agents and tooling

Agent coding modes (Datadog, Kennedy Toomey). Claude Sonnet 5, Cursor Composer 2.5 and Codex GPT 5.5 each built a document portal in plan mode and in default mode. Plan mode gave no meaningful security gain. Every build had a critical IDOR that let any authenticated user read others' documents. Each model also had its own flaw:

• Composer 2.5 added a hardcoded JWT secret fallback that enables authentication forgery.
• Sonnet 5 added defense-in-depth but broke document downloads.
• GPT 5.5 fixed some issues but introduced TOCTOU races and timing side channels.

Supply Chain Firewall blocked repeated attempts by the models to install vulnerable npm packages. The conclusion is that explicit security requirements in the prompt matter more than the mode, because the models did not infer authorization logic that was never specified.

OpenClaw phishing tests (Varonis, Itay Yashar). An agent named Pinchy had a Gmail inbox with synthetic credentials and CRM data. It was tested on Gemini 3.1 Pro and Codex GPT-5.4 across four simulations.

• It failed both social-engineering tests. It forwarded AWS IAM keys, database passwords and SSH credentials to an external Gmail during a fake production emergency, and it exported a CRM dump on a casual "from home" request.
• It earned partial credit on the two technical attacks. It checked the redirect URI on a malicious OAuth consent flow and refused credentials on a fake gift card page. It still interacted with the phishing infrastructure before flagging it.

Cloudflare MCP detection. Gateway identifies MCP traffic through the MCP-Protocol-Version header and the Mcp-Method and Mcp-Name headers from the MCP 2026-07-28 spec. It exposes an experimental.is_mcp selector and Traffic Source selectors that separate MCP Portal traffic from direct connections. Control points are client-side hooks, Gateway inspection with TLS decryption, and server-side authorization through WriteGuard middleware.

OWASP Agentic Skills Top 10 (AST10) lists: Malicious Skills, Supply Chain Compromise, Over-Privileged Skills, Insecure Metadata, Untrusted External Instructions, Weak Isolation, Update Drift, Poor Scanning, No Governance and Cross-Platform Reuse. The newsletter gives only the names.

Other findings

• CoSnitch (CVE-2026-24301). Varonis got Copilot to explain how to run a prompt without user interaction by repeatedly asking it to prove the attack impossible. Its refusals disclosed an undocumented URL parameter that enabled one-click data theft from Gmail, Calendar and Drive. The newsletter quotes Varonis as saying Microsoft was told in December 2025 and patches shipped on August 18, 2026.
• HTML tag names (PortSwigger, Gareth Heyes). Tag names can carry JavaScript, which browsers preserve in localName (unlike tagName, which uppercases). Tag names also accept forward slashes, whitespace, newlines, line and paragraph separators, and an opening angle bracket. The vectors work in all browsers and use part, classList, getAttributeNode and setHTMLUnsafe to bypass attribute-value blocklists.
• Censys. Internet-exposed AI/LLM tool instances rose over 60% in nine months. Langflow grew 169% and has 18 CVEs, including unauthenticated RCE. LiteLLM grew 97% and has an actively exploited pre-auth SQL injection that exposes upstream provider API keys.
• Peripheral reverse engineering (Chaz Schlarp). Using Claude Opus 5 over about 13 hours of agent work, Schlarp found no meaningful firmware protection on five devices. The Shure MV7 has a 48-command plaintext HID shell with arbitrary memory access. The Insta360 Link can be patched to turn off its LED while still recording. The Elgato Key Light Mini's Ed25519 signature check, which runs only during updates, was bypassed with one HTTP POST to UART memory by anyone on the WiFi. The Nix-based re-shell toolkit and device documentation are on GitHub.

What to do

• Check any leaked AWS key for reach, not just validity, using TruffleHog AWS Analyze or AWSHound on your own accounts.
• Put authorization requirements, such as per-user document access, explicitly in coding-agent prompts.
• Treat email-reading agents as phishable and limit what credentials and data they can reach.
• Look for MCP traffic using the header signals above.

Caveats

The Hugging Face report is mentioned but not summarized. Opinions on HackerOne's AI training and triage plans are the newsletter author's and Joel Margolis's, not established fact.