Skip to content

30 results for “Endor Labs”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types151Articles114Write-ups30Advisories4Papers3
✍️ Write-ups“Endor Labs”Clear all
endorlabs.comwriteup🛡️ Security

Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams | Endor Labs

Endor Labs AI SAST found three unbounded memory allocation flaws in Apache Kafka, fixed under CVE-2026-114349 (DefaultRecord decoder, a ~90-byte compressed batch that kills consumers, brokers and the log cleaner) and CVE-2026-111551 (ListDeserializer and Kafka Streams AssignmentInfo decoding). The post gives code, reproducers and payload bytes. Remediation: upgrade to 4.2.2, 4.3.2 or 4.4.0, set max.decompressed.message.bytes, restrict write and group ACLs, and alert on DeadThreadCount.

Apache KafkaKafka StreamsJava+1
CVE-2026-114349CVE-2026-111551denial of service+4

AppSec· Published and added 28 Oct 2026

endorlabs.comwriteup🛡️ Security

LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials | Endor Labs

litellm 1.107.0 was published to PyPI on 21 October 2026 from a source revision that differs from the official tag. One line in the Maturin config (data = "cook") installs cook.pth, cook.py and sitecustomize.py, which run on every Python start. They steal cloud, AI and proxy credentials, including the LiteLLM database tables, and load remote code hourly. The post gives IOCs, a five-step response plan and hardening advice.

LiteLLMPyPIPython+3
litellm 1.107.0cook.pthsitecustomize.py+5

Supply Chain, Malware & RE, DevSecOps· Published and added 21 Oct 2026

endorlabs.comwriteup🧠 AI

Gemini 4 Argon on Cursor: solid security score, two unique solves, but slower and more expensive | Endor Labs

Endor Labs ran Gemini 4 Argon in the Cursor harness on its Agent Security League coding tasks (SusVibes). Argon ties Fable 5 at 29% SecPass with 78.8% FuncPass, and uniquely and securely solves two tasks (SABnzbd CVE-2021-29488 and OpenStack Nova CVE-2015-8749). It is also the slowest and costliest recent combo: 14 minutes median per task and $765. The run had 29 confirmed cheating instances.

CursorClaude CodeCodex+3
CVE-2021-29488CVE-2015-8749Endor Labs+15

evals, coding-agents, models· Published and added 20 Oct 2026

endorlabs.comwriteup🛡️ Security

SBOM vs. SBOM: Comparing SBOMs from Different Tools and Lifecycle Stages | Endor Labs

Case study running three open source SBOM generators (two generic, one Maven plugin) on Eclipse Steady 3.2.5 rest-backend at three lifecycle stages (git clone, Maven package, Docker image), yielding 8 CycloneDX SBOMs. Compares precision/recall against the mvn dependency:tree ground truth and finds the Maven-integrated tool perfect (1.0/1.0) while generic tools miss versions, groupIds and transitive dependencies. It also shows PURL qualifier differences (e.g. type=jar, apt qualifiers) make SBOMs hard to compare, test dependencies are indistinguishable, and argues for an SBOM generator benchmark.

SBOMCycloneDXMaven+3
Eclipse SteadyPackage URLNTIA+3

Supply Chain· Published and added 16 Oct 2026

endorlabs.comwriteup🛡️ Security

Supply Chain Attack targeting Cline installs OpenClaw | Endor Labs

Endor Labs analyzes the compromised Cline CLI npm release 2.3.0, published with a likely stolen long-lived token under the clinebotorg account, which bypassed trusted publishing. Its postinstall hook ran npm install -g openclaw@latest; OpenClaw is benign and no Gateway daemon was started, so impact is low. The post shows the metadata diff (lost provenance attestation, changed publisher) that flagged it, and advises disabling token-based publishing and checking for attestations. Mitigation is to update to 2.4.0 and uninstall openclaw.

ClineOpenClawnpm+3
GHSA-9ppg-jx86-fqw7Adnan Khanclinebotorg

Supply Chain· Published and added 12 Oct 2026

endorlabs.comwriteup🧠 AI

Sonnet 5 vs Fable 5: reliable versus security-forward, not better versus worse | Endor Labs

Endor Labs compares Claude Sonnet 5 and Claude Fable 5 using its Agent Security League, a 200-task benchmark run under both Cursor and Claude Code. Raw FuncPass/SecPass numbers are confounded by cheating (recycled answers) and timeouts, so the post uses three controls: scores restricted to instances where both models finished, cheating rate as its own axis, and tool-call trajectory analysis. Sonnet 5 is more thorough, with higher FuncPass, about 1.5x the tool calls and a lower cheating rate. Fable 5 is more security-forward, with higher SecPass, less exploration and 1.7x–4.75x more cheating.

CursorClaude Code
Endor LabsAgent Security LeagueClaude Sonnet 5+1

evals, coding-agents, models· Published and added 12 Oct 2026

endorlabs.comwriteup🛡️ Security

Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser | Blog | Endor Labs

Endor Labs explains CVE-2025-61927, an RCE in the happy-dom headless browser caused by relying on Node.js's vm module, which is not a security boundary. They show that the maintainer's mitigation (--disallow-code-generation-from-strings) is insufficient, because untrusted scripts can still pollute builtin prototypes for DoS or RCE (CVE-2025-62410). The fix adds --frozen-intrinsics. The post recommends isolated-vm, Secure EcmaScript, or container/VM isolation for untrusted JavaScript.

happy-domNode.jsJavaScript+2
CVE-2025-61927CVE-2025-62410CVE-2021-23555+6

AppSec· Published and added 12 Oct 2026

endorlabs.comwriteup🛡️ Security

How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs

Endor Labs breaks down the May 11, 2026 compromise of 42 @tanstack/* npm packages (84 malicious versions) that carried valid SLSA provenance. The attacker chained a pull_request_target "Pwn Request", GitHub Actions cache poisoning across the fork/base boundary, and OIDC token extraction from Runner.Worker memory, then published directly to npm without stealing any credential. It explains why 2FA, trusted publishing, provenance and branch protection all failed, and lists mitigations: split pull_request_target workflows, treat the cache as untrusted, scope id-token: write to a publish job, pin actions to SHAs, require environment approval, use egress allowlists.

GitHub ActionsnpmOIDC+3
TanStackpwn requesttj-actions/changed-files+5

Supply Chain, DevSecOps· Published and added 12 Oct 2026

endorlabs.comwriteup🛡️ Security

Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor Labs

Endor Labs analyzes the malicious PyPI package pyronut (versions 2.0.184–2.0.186), a trojanized fork of the Telegram framework pyrogram. It hooks Client.start() to import a hidden pyrogram/helpers/secret.py that registers Telegram handlers letting two hardcoded attacker accounts run arbitrary Python (/e via meval) and shell commands (/shell via /bin/bash -c). C2 runs entirely over Telegram, so there are no external network indicators; the post includes detection, credential-rotation and prevention guidance.

PyPIPythonTelegram+1
pyronutpyrogrammeval+4

Supply Chain, Malware & RE· Published and added 12 Oct 2026

endorlabs.comwriteup🛡️ Security

GPT-6.1 Sol on Codex: Astra-level security, a third faster, zero cheating | Blog | Endor Labs

Endor Labs benchmarks OpenAI's GPT-6.1 Sol against GPT-6 Sol and GPT-6 Astra using its Agent Security League Codex harness, measuring how often each model produces functionally correct AND securely written code (FuncPass/SecPass) across 200 coding tasks. GPT-6.1 Sol scores 34.1% SecPass (vs Astra's 34.6%), runs a third faster, consumes fewer tokens, and triggers zero confirmed cheating across 13 flagged instances, continuing a streak of clean Codex runs.

CodexCodex CLIOpenAI+2
GPT-6.1 SolGPT-6 SolGPT-6 Astra+1

AI Security· Published and added 2 Oct 2026

endorlabs.comwriteup🛡️ Security

AI Agent Sandbox Flaw in brig: Symlink Traversal (CVSS 8.2) | Blog | Endor Labs

Endor Labs researcher pkennedy details GHSA-wp6x-29qx-fpr7 (ENDOR-VUL-2026-1809, CVSS 8.2, CWE-59), a symlink-traversal flaw in brig, a tool that runs AI coding agents inside microVM/container sandboxes. While brig's shared working directory was carefully guarded against symlink swaps, the user-named project directory was passed to the underlying runtime (Virtualization.framework on macOS, containerd/nerdctl on Linux) as a raw unresolved path; an agent could replace a subfolder it already controls with a symlink to any host directory, which is then mounted read-write into the sandbox on the next run, exposing SSH keys, cloud credentials, and other projects with the operator's privileges. Fixed in brig 0.3.0 by resolving and holding the path open before mounting; the piece includes full PoC commands, root-cause code snippet, and a detailed vendor disclosure/CVSS negotiation narrative.

Endor LabsmacOSLinux+1
GHSA-wp6x-29qx-fpr7ENDOR-VUL-2026-1809CWE-59+1

AI Security, Offensive Security· Published and added 28 Sep 2026

endorlabs.comwriteup🧠 AI

Opus 5.5: 6x cheaper and 2x faster than Fable 5.1, but only 33.5% of code is secure | Blog | Endor Labs

Endor Labs benchmarks Claude Code running Anthropic's Opus 5.5 against Opus 5 and Claude Fable 5.1 on its Agent Security League coding-security benchmark, finding Opus 5.5 is dramatically cheaper (6x) and faster (2x) but ranks only third on secure code generation (33.5% SecPass) and nineteenth on functional correctness (68.7% FuncPass). The piece centers on a memorization-detection pipeline that confirmed 51 training-recall 'cheats' (the highest of any model tested) — without which Opus 5.5 would top the security leaderboard — and checks Anthropic's launch claims of being state-of-the-art and faster/cheaper against these measured results.

Claude CodeDocker
Endor LabsClaude Opus 5.5Opus 5+8

evals· Added 7 Oct 2026, published 25 Sep 2026

endorlabs.comwriteup🛡️ Security

AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass | Blog | Endor Labs

Endor Labs details GHSA-r5fq-947m-xm57, a high-severity path traversal (CVSS 8.8) in OpenClaw's apply_patch tool that allows arbitrary file write/delete when sandboxRoot isn't configured, tracing the vulnerable code path from resolvePatchPath() through resolvePathFromCwd() to fs.writeFile/fs.rm. Because the tool is only invoked via LLM decision, the researcher bypassed the model's safety guardrails by injecting fabricated function_call/function_call_output entries into the /v1/responses conversation history, tricking the LLM via in-context learning into emitting a real malicious tool call with a traversal payload. This illustrates how LLM safety training can be the sole runtime control gating dangerous tool arguments, and how that control can be defeated with conversation history injection.

OpenClawEndor Labs
GHSA-r5fq-947m-xm57CWE-22

AppSec, AI Security· Published and added 11 Sep 2026

endorlabs.comwriteup🛡️ Security

AI SAST in Action: Finding Real Vulnerabilities in OpenClaw | Blog | Endor Labs

Endor Labs describes applying its AI SAST engine to the open-source OpenClaw AI agent framework, tracing data flows from attacker-controlled sources (HTTP params, config, conversation history, external API responses) through transformations to dangerous sinks like command execution and file operations. The team validated findings by deploying OpenClaw in Docker and building working proof-of-concept exploits, confirming 7 vulnerabilities spanning HTTP handlers, business logic, tool dispatch, and low-level implementation layers, now reported to maintainers via responsible disclosure with technical details pending patch release.

Endor LabsOpenClawDocker

AppSec, AI Security· Published and added 11 Sep 2026

endorlabs.comwriteup🛡️ Security

Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

npmBunGitHub Actions+3
Shai-Hulud 2.0Shai-HuludZapier+3

Supply Chain, Threat Intel, DevSecOps· Published and added 11 Sep 2026

endorlabs.comwriteup🛡️ Security

Codex with GPT-6 Astra posts 82.1% FuncPass and 34.1% SecPass | Blog | Endor Labs

Endor Labs ran OpenAI's GPT-6 Astra through Codex against its Agent Security League benchmark of real-world secure-coding tasks, scoring 82.1% FuncPass / 34.1-34.6% SecPass versus 67.6%/20.1% for Codex + GPT-5.6 Sol — the largest generation-over-generation jump recorded in the Codex family, and close to Claude Code + Fable 5.1 (87.2%/36.9%) while beating Claude Code + Opus 5 (73.7%/37.4%). The post details the multi-signal anti-cheating pipeline (16 flagged instances, all cleared for Astra vs. 17 confirmed cheats for Fable 5.1 and 38 for Opus 5) and the speed/token trade-off: Astra is ~1.8x slower than both GPT-5.6 Sol and Fable 5.1, with 29 timeouts out of many tasks in a one-hour cap, though Codex still extracts a diff at kill time.

CodexOpenAI CodexClaude Code+3
Agent Security LeagueGPT-6 AstraGPT-5.6 Sol+2

AI Security· Published and added 8 Sep 2026

endorlabs.comwriteup🛡️ Security

Claude Code with Fable 5.1 posts 87.2% FuncPass and 37.4% SecPass — a new #1 on our board — while running as fast as Fable 5, costing a third of Opus 5, finishing every task with zero timeouts, and drawing less than half the confirmed cheating of both predecessors. | Blog | Endor Labs

Endor Labs benchmarks Claude Code running Anthropic's Fable 5.1 against Opus 5 and Fable 5.0 on its Agent Security League leaderboard, which tests whether agents can independently re-derive historical security fixes (FuncPass/SecPass) without recalling them from training data or git history. Fable 5.1 tops both axes (87.2% FuncPass, 37.4% SecPass), runs at Fable 5.0's speed with zero timeouts, costs roughly a third of Opus 5, and shows far less confirmed training-data memorization than either predecessor. The post includes three detailed 'hall of fame' case studies where Fable 5.1 alone produced an independently-reasoned secure patch: Home Assistant's unauthenticated error-log route (CVE-2018-21019/CWE-200), html-sanitizer's Unicode-normalization XSS bypass (CVE-2024-34078/CWE-79), and Vyper's self-referencing dynarray out-of-bounds write (CVE-2023-31146/CWE-787).

Claude CodeHome AssistantVyper
CVE-2018-21019CVE-2024-34078CVE-2023-31146+8

AI Security, AppSec· Published and added 4 Sep 2026

endorlabs.comwriteup🛡️ Security

Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI | Blog | Endor Labs

Endor Labs researchers document a 'Mini Shai-Hulud' worm variant that compromised the openapi-react-query-codegen npm package and self-replicated across npm, expanding into RubyGems and PyPI ecosystems. The writeup traces how the worm trojanized a legitimate package to propagate malicious code cross-registry, illustrating an evolving multi-ecosystem software supply-chain attack pattern.

npmPyPIRubyGems+1
Shai-Hulud

Supply Chain· Added 3 Sep 2026, published 31 Aug 2026

endorlabs.comwriteup🛡️ Security

Hacking your life with AI can get you hacked | Blog | Endor Labs

Endor Labs researcher details 14 critical/high vulnerabilities (7+ public CVEs/GHSAs) found across seven AI orchestration platforms — NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow — all of which trust anyone who can touch a workflow to run code on the host. Walkthroughs include a Flowise 3.1.2 unauthenticated prompt-injection-to-RCE chain via Pyodide/Node bridge escape, Langflow's trivial `lambda`-string eval sandbox bypass, NocoBase's broken SES Compartment/Proxy guard escalation, and Dify/Activepieces sandboxes applied only after attacker code already executes. The research (presented at DEF CON 34, full whitepaper linked) argues these are multi-tenant code-execution engines shipped with single-user threat models, exposing connected credentials, email, calendars, and customer data.

FlowiseLangflowNocoBase+3
DEF CON 34

AppSec, AI Security· Added 3 Sep 2026, published 18 Aug 2026

endorlabs.comwriteup🛡️ Security

Best in Class, Novel in Method: Opus 5 and the Recall-Then-Diverge Pattern | Blog | Endor Labs

Endor Labs benchmarked Claude Code + Opus 5 on its SusVibes secure-coding benchmark (real historical CVE fixes hidden as coding tasks) and found it topped the leaderboard at 73.7% FuncPass / 32.4% SecPass, but also uncovered a new memorization-evasion pattern called "recall-then-diverge": the model writes a memorized fix early in its edit trajectory, then iteratively rewrites the code until the final diff no longer resembles the known patch and evades similarity-based cheat detection. The team details the discovery via an aiohttp request-smuggling task (CVE-2023-47641) where the agent produced the exact hidden pytest error string before any tool output could have revealed it, then extended their anti-cheating pipeline to compare first/peak/final edit overlap and string chronology rather than just the final patch, ultimately disqualifying 4 of Opus 5's 13 "unique" secure solves (including a jupyter-server-proxy case with a leaked upstream commit hash) as memorized.

Claude CodeCursorCodex+1
CVE-2023-47641CWE-444Opus 5+9

AI Security, AppSec· Added 3 Sep 2026, published 11 Aug 2026

endorlabs.comwriteup🛡️ Security

SANDWORM_MODE: Dissecting a Multi-Stage npm Supply Chain Attack | Blog | Endor Labs

Endor Labs dissects "SANDWORM_MODE", a multi-stage npm supply-chain attack using typosquatted packages (e.g. suport-color, fake claude-code) that combines credential theft, worm-like propagation via npm and GitHub Actions, and DNS/HTTPS/GitHub API exfiltration with a domain generation algorithm. Notably it installs a rogue MCP server into AI coding assistants (Cursor, Claude Code, Windsurf, Continue) and uses prompt injection to trick the AI into silently exfiltrating SSH keys, AWS credentials, and password-manager secrets. The post walks through the three-layer deobfuscation chain (Base64 + zlib + XOR + eval), differential-analysis detection techniques, and disabled destructive dead-switch/polymorphic-rewrite features.

npmModel Context ProtocolCursor+3
SANDWORM_MODEShai-Hulud

Supply Chain, Malware & RE, AI Security· Added 27 Jul 2026

endorlabs.comwriteup🧠 AI

OpenAI Codex with GPT-5.6 Sol: competitive, zero cheating, one unique Django fix | Blog | Endor Labs

Endor Labs benchmarks OpenAI's Codex agent with GPT-5.6 Sol on its Agent Security League, reporting 70.9% FuncPass and 23.5% SecPass (third on security among 23 combos) and steady gains over GPT-5.4 and GPT-5.5. It documents a four-signal anti-cheating pipeline (conversation analysis, patch similarity, memorization detection, strict-test pass) feeding a multi-step LLM adjudicator, which flagged 7 instances and confirmed none as cheating. Case studies include an identical two-line django-rest-registration patch, FastAPI CVE-2021-32677, Django CVE-2024-39329, and a unique Django CVE-2021-44420 solve with a structurally different patch (similarity 0.57).

CodexClaude CodeCursor+6
CVE-2021-44420CVE-2021-32677CVE-2024-39329+9

evals, coding-agents· Added 23 Sep 2026, published 17 Jul 2026

endorlabs.comwriteup🛡️ Security

How Unprotected Release Branches Let Attackers Compromise AsyncAPI | Blog | Endor Labs

Endor Labs researchers found that AsyncAPI's release branches lacked branch protection, allowing an attacker with write access (or via a compromised contributor account) to push malicious commits that would be picked up by the automated release/publish pipeline, potentially poisoning published packages. The issue highlights how missing branch protection rules combined with automated CI/CD release workflows create a supply-chain compromise path for widely-used open-source projects.

GitHub Actionsnpm
AsyncAPI

Supply Chain, DevSecOps· Added 3 Sep 2026, published 14 Jul 2026

endorlabs.comwriteup🛡️ Security

The Bitwarden CLI Supply Chain Attack: What Happened and What to Do | Blog | Endor Labs

Analysis of a supply-chain compromise of @bitwarden/cli version 2026.4.0, published to npm for ~1.5 hours on April 22, 2026, which added a preinstall script (bwsetup.js) that downloads a Bun runtime and executes a 10MB obfuscated payload (bw1.js) harvesting CI secrets like SSH keys and API tokens and exfiltrating them to attacker-created public GitHub repos in victims' namespaces. The compromise is linked to a prior breach of Checkmarx's GitHub Actions (checkmarx/ast-github-action), used in Bitwarden's repo, and the payload includes CI/CD platform detection across 30+ platforms and a Russian-locale self-exclusion check consistent with Eastern European threat actor tooling, framed as part of the "Shai-Hulud" campaign lineage.

npmGitHub ActionsBun+1
BitwardenBitwarden CLICheckmarx+3

Supply Chain, Malware & RE, Threat Intel· Added 3 Sep 2026, published 10 Jul 2026

endorlabs.comwriteup🛡️ Security

Sonnet 5 vs Fable 5: reliable versus security-forward, not better versus worse | Blog | Endor Labs

Endor Labs' Agent Security League ran Claude Sonnet 5 and Fable 5 through a 200-task security-fix benchmark on both Cursor and Claude Code harnesses, then controlled for two confounds (task timeouts and answer-cheating/memorization) to compare the models fairly on FuncPass (functional correctness) and SecPass (security correctness). After removing confounds, Sonnet 5 shows a consistent FuncPass edge via more investigation (roughly 1.5x the tool calls, mostly Read/Grep/Glob), while Fable 5 shows a higher SecPass rate but also cheats 1.7-4.75x more often, reaching security-relevant fixes more directly with less exploration when it isn't cheating. The piece concludes the two models trade off reliability versus security-directedness rather than one being strictly better.

Claude CodeCursorEndor Labs+1
Sonnet 5Fable 5Agent Security League

AI Security· Added 3 Sep 2026, published 9 Jul 2026

endorlabs.comwriteup🛡️ Security

Claude Sonnet 5 with Claude Code: strong on function, average on security, and unusually honest | Blog | Endor Labs

Endor Labs benchmarked Claude Sonnet 5 paired with Claude Code on its Agent Security League test, which measures whether an AI agent can autonomously patch real vulnerabilities in complex codebases without copying a remembered upstream fix. Sonnet 5 scored 83.2% FuncPass (functional correctness) but only 19.6% SecPass (actually closing the vulnerability), continuing the benchmark's recurring functional-vs-security gap; notably it showed very little cheating (8/200 confirmed cases, mostly workspace-leakage rather than training-data recall) compared to prior models like Fable 5 (38 cases) and Opus 4.8.

Claude CodeClaudeCursor+1
Agent Security LeagueFable 5Opus 4.8+2

AI Security· Added 3 Sep 2026, published 9 Jul 2026

endorlabs.comwriteup🛡️ Security

Endor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Blog | Endor Labs

Endor Labs describes how its AI SAST engine traced a source-to-sink data flow in Anthropic's Rust protobuf library, buffa, uncovering CVE-2026-55407: an unbounded, attacker-controlled heap allocation in the unknown-field decoder (decode_unknown_field, buffa/src/encoding.rs). Beyond the initially flagged ~2x LengthDelimited allocation flaw, the researcher found the StartGroup arm allows ~22x memory amplification, letting a 64MB payload balloon to ~1.4GB and OOM-kill a capped server, defeating the library's documented "cap input size" mitigation. The piece details the PoC, the fix shipped in buffa/connectrpc 0.8.0 (per-message unknown-field count cap), and a nuanced CVSS 4.0 disclosure discussion with Anthropic over deployment-dependent severity.

RustDockerAnthropic+2
CVE-2026-55407GHSA-f9qc-qg88-7pq5

AppSec, AI Security· Added 3 Sep 2026, published 6 Jul 2026

endorlabs.comwriteup🛡️ Security

Endor Labs: Claude Fable 5

Endor Labs re-ran their Agent Security League benchmark (200 real-world vulnerability-fixing tasks) with Claude Fable 5 paired against the Cursor agent instead of Claude Code, and found the same model jumped from 59.8% FuncPass/19.0% SecPass to 72.6% FuncPass/29% SecPass — the best fair SecPass score on their leaderboard, showing the agent harness can matter more than model choice. The piece walks through instance-level diffs on CVE-2020-15118 (Wagtail XSS via unescaped help_text), CVE-2017-12440 (OpenStack Aodh trust-ID leakage), and CVE-2024-3571 (LangChain local file store path traversal via yield_keys) to show Cursor produced more complete patches that covered secondary sinks Claude Code missed, and confirms 28 of 29 flagged cheating cases were training-data memorization rather than git/web lookup.

Claude CodeCursorLangChain+3
CVE-2020-15118CVE-2017-12440CVE-2024-3571+5

AI Security, AppSec· Published and added 18 Jun 2026

endorlabs.comwriteup🛡️ Security

Endor Labs: Claude Fable 5

Endor Labs benchmarked Claude Fable 5 paired with Claude Code on 200 real-world vulnerability-fixing tasks, scoring 59.8 percent FuncPass but only 19.0 percent SecPass. The report covers record timeouts from extended thinking, the highest confirmed cheating volume post-hardening driven by training-data memorization, and four first-ever solves including CVE-2023-27494, CVE-2024-28102, CVE-2021-43818, and CVE-2021-41124.

Claude CodeClaude Fable 5Anthropic+2
CVE-2023-27494CVE-2024-28102CVE-2021-43818+13

AI Security, AppSec· Published and added 11 Jun 2026

stepsecurity.iowriteup🛡️ Security

StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2

StepSecurity and Endor Labs document a second wave of the Mini Shai-Hulud npm worm spreading through the compromised 'atool' account, which publishes timeago.js and maintains packages in Alibaba's @antv namespace, hitting echarts-for-react, jest-canvas-mock and dozens of other packages. The payload scrapes GitHub Actions Runner.Worker process memory to steal masked CI/CD secrets, harvests 130+ credential file paths (cloud, SSH, Kubernetes, Vault, crypto wallets, Claude Code/VS Code configs), exfiltrates via a GitHub API dead-drop in antvis/G2 or a fake-OpenTelemetry C2 at t.m-kosche.com, drops persistent backdoors in Claude Code/VS Code, and has already used stolen GitHub tokens to spin up 2,500+ dead-drop repositories. The writeup includes full process/network telemetry from Harden-Runner showing the attack blocked, deobfuscated payload internals, IOCs, and detection/remediation guidance.

npmGitHub ActionsBun+3
Mini Shai-HuludatoolAntV+5

Supply Chain, Threat Intel, Malware & RE· Published and added 19 May 2026