Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
11 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_c25d91fa3ad9ae9ac7Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Recently I read this excellent post by Evan Sultanik about exploiting pickle files on Trail of Bits. There was also a DefCon30 talk about backdooring pickle files by ColdwaterQ. This got me curious to try out backdooring a pickle file myself. Pickle files - the surprises Surprisingly Python pickle files are compiled programs running in a VM called the Pickle Machine (PM). Opcodes control the flow, and when there are opcodes there is often fun to be had.
First reported Aug 29, 2022 03:10 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
In this second post about Windsurf Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration. SpAIware is an attack we first successfully demonstrated with ChatGPT last year and OpenAI mitigated. While inspecting the system prompt of Windsurf Cascade I noticed that it has a create_memory tool. Creating Memories The question that immediately popped into my head was if this tool will require human approval when Cascade creates a long-term memory, or if it is added automatically.
First reported Aug 22, 2025 22:21 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
The idea for Lyrebird came from observing that sometimes when someone forgets lock their workstation, someone else might mess with their computer. Since I wanted to learn more on how to program a webcam and take pictures - I figured why not create a little tool that takes a screenshot and uses the webcam to take pictures of anyone that interacts with the computer while I’m gone. The way this work is simple, start Lyrebird. It will take a screenshot of the current desktop and then enter its observation mode.
First reported May 22, 2019 04:48 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This week I learned about a design flaw with pip download, which allows an adversary to run arbitrary code. I assumed that running pip install means anything could happen, but pip download seems a bit surprising. Both seem useful for red teaming though. Background This post from Yehuda Gelb named Automatic Execution of Code Upon Package Download on Python Package Manager which the Security Now! podcast pointed me towards. The post highlights that just running pip download can compromise your computer.
First reported Sep 09, 2022 23:30 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This post is part of a series about Offensive BPF to learn how BPFs use will impact offensive security, malware, and detection engineering. Click the “ebpf” tag to see all relevant posts. Building advanced BPF programs So far in this Offensive BPF series the focus was on bpftrace to build and run BPF programs. The next thing I wanted to investigate is what options are available to modify data structures during BPF execution. This is where I hit limitations with bpftrace.
First reported Oct 20, 2021 07:04 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
Last week Google released an IDE called Antigravity. It’s basically the outcome of the Windsurf licensing deal from a few months ago, where Google paid some $2.4 billion for a non-exclusive license to the code. Because it’s based on Windsurf, I was curious if vulnerabilities that I reported to Windsurf back in May 2025, long before the deal, would have been addressed in the Antigravity IDE. See Month of AI Bugs for some detailed write-ups.
First reported Nov 25, 2025 13:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
In the previous post, we explored two data exfiltration vectors that Jules is vulnerable to and that can be exploited via prompt injection. This post takes it further by demonstrating how Jules can be convinced to download malware and join a remote command & control server. This research was performed in May 2025 and findings were shared with Google. Remote Command & Control - Proof Of Concept The basic attack chain follows the classic AI Kill Chain:
First reported Aug 14, 2025 11:20 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
Finally I got to writing some basic tooling for invoking the Firefox debugging API to send commands to the browser and read the responses. This can be useful for grabbing cookies in the post-exploitation phase. It works for Windows and macOS, should also work on Linux. This technique is probably most useful when we don’t have root or the user’s credentials to decrypt cookies or can’t attach a regular debugger to the browser process.
First reported Jul 21, 2020 18:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
In this post I will discuss some testing techniques for internal red teams to identify privacy issues in services and infrastructure, most importantly a simple three step approach that might uncover interesting results. Background story First, let me share a story from the past. When I did my master’s I built an app that performs end to end encryption of Facebook posts. This means that only the intended audience for which your posts were encrypted for can decipher the posts.
First reported Jul 24, 2020 17:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
Last year, Jun Kokatsu disclosed an interesting vulnerability with ChatGPT Operator by exploiting a race condition. I was wondering if I could reproduce this attack chain, and this post describes the results of that research. I had this post drafted for months, and yesterday at the Real-world AI security conference I included a video demo of this attack in my talk and that reminded me that I should finally publish this.
First reported Jun 25, 2026 12:20 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
The other day I read this blog post about “The Death of Manual Red Teams” and I thought I’d take a moment to comment on it to provide an alternative perspective. In my opinion the premise of the blog post is backwards, highlighting a lack of understanding of what red teaming is about. For instance the following sentence in the post seems quite incorrect: “Red teaming is the process of using existing, already known security bugs and vulnerabilities to hack a system.”.
First reported Feb 08, 2021 19:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
In this post, we’ll look how an adversary can mint authentication cookies for Next.js (next-auth/Auth.js) applications to maintain persistent access to the application as any user. The reason this is important is because of React2Shell, which is a deserialization vulnerability that allows an adversary to run arbitrary code. Much has been discussed about this vulnerability, and you can read up the original details from the finder here.
First reported Jan 15, 2026 06:58 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
After reading this post about ChatGPT imitating Linux, I wanted it to be a database server. Let’s try it out! Imagine you are a Microsoft SQL Server. I type commands, and you reply with the result, and no other information or descriptions. Just the result. Start with exec xp_cmdshell ‘whoami’; Wow, this looks like a promising start. And, it “thinks” that it is running as LOCAL SYSTEM - quite funny actually.
First reported Dec 02, 2022 16:41 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
About a year ago we talked about how developers can’t intrinsically trust LLM responses and common threats that AI Chatbots face and how attackers can exploit them, including ways to exfiltrate data. One of the threats is unfurling of hyperlinks, which can lead to data exfiltration and is something often seen in Chatbots. So, let’s shine more light on it, including practical guidance on how to mitigate it with the example of Slack Apps.
First reported Apr 03, 2024 04:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
On a network and need credentials? Try password spraying the domain controller directly. A few years ago, I wrote this password spray tool called gospray that was used succesfully in a couple of engagements since. It does an LDAP bind directly against the domain controller to validate credentials. This doesn’t require an SMB server (or other servers) as target. So, it’s pretty quiet and number of concurrent Go routines is configurable. :)
First reported Sep 18, 2022 15:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio. This post is a write up about the talk, which covered CVE-2026-65669, a SQL Server Elevation of Privilege Vulnerability rated critical by Microsoft. So, make sure your installations are up-to-date. The slides of the presentation can be found here. BlueHat Asia 2026 in Singapore First, a few words about the conference. I have spoken at BlueHat before, sometime back in 2017, and also two years ago. Both times at Microsoft’s Redmond Campus.
First reported Sep 30, 2026 21:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
The other day Microsoft published a great deep dive around the second stage payloads and hands-on hacking activities of the Solarwinds/Sunburst incidents that where uncovered late 2020. One thing that is so interesting is the use of off the shelve Cobalt Strike tooling and templates for command & control. After doing all the hard work and customization to seamlessly backdoor binaries the adversaries sem to use Cobalt Strike. Intel for Red Teamers Although, they did add customizations with some interesting features, which are interesting for red teamers to be aware of. For instance each instance of the zombie would be unique in name, folder locations, etc. to make it more difficult to identify in environments.
First reported Feb 02, 2021 18:35 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This post describes how I found a Prompt Injection attack angle in Bing Chat that allowed malicious text on a webpage (like a user comment or an advertisement) to exfiltrate data. The Vulnerability - Image Markdown Injection When Bing Chat returns text it can return markdown elements, which the client will render as HTML. This includes the feature to include images. Imagine the LLM returns the following text:  This will be rendered as an HTML image tag with a src attribute pointing to the attacker server.
First reported Jun 18, 2023 07:01 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This post is part of the machine learning attack series. It’s been a while that I did a Husky AI and offensive machine learning related post. This weekend I had some time to try out Counterfit. My goal was to understand what Counterfit is, how it works, and use it to turn Shadowbunny into a husky. Let’s get started. What is Counterfit? With Counterfit you can test your machine learning models and endpoints for specific adversarial attacks.
First reported Aug 16, 2021 17:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
To help raise awareness of Indirect Prompt Injections and other related attacks, I put together a little fun mini app that you can invoke with ChatGPT. Visit this link with GPT-4 and Browsing enabled (see Appendix, if you don’t know what that means): https://wuzzi.net/matrix The website will hijack ChatGPT via an indirect prompt injection and then allow you to enter the matrix, if you decide to do so. Note: You can’t browse to the URL, it will only respond to ChatGPT. :)
First reported Jun 11, 2023 15:49 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts. The previous four posts explained the architecture and how Husky AI was built, threat modeled and deployed. Now it’s time to start the attacks and build mitigations. The appendix in this post shows all the attacks I want to research and perform in this series over the next few weeks/months.
First reported Sep 09, 2020 18:18 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This week was HackSpaceCon 2024. It was the first time I attended and it was fantastic. The conference was at the Kennedy Space Center! Yes, right there and the swag and talks matched the world class location. The keynote “Buckle up! Let’s make the world a safer place” was by Dave Kennedy, who provided great insights on attacker strategies of the past and present, the importance of active threat hunting and challenges ahead. A great specific example he gave was how simple modifications to off-the-shelf malware (still) go entirely under the radar.
First reported Apr 14, 2024 01:30 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This post is part of a series about machine learning and artificial intelligence. In the previous post I talked about good resources for learning more about artificial intelligence and machine learning in general, and how I started my journey in this space. The next few posts will be about Husky AI. What is Husky AI? Husky AI allows a user to upload an image, and get an answer back if the image contains a husky or not. Below is a screenshot of the application:
First reported Sep 02, 2020 19:04 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
This post walks through a sandbox escape from a Flatpak application via PipeWire. The vulnerability was discovered using my automated research pipeline with Claude Code and Opus 4.6 back in April 2026. It was an exciting find, as this was the first bug I submitted to Red Hat. Claude Code was also excited finding this: Once discovered, I repro’d it manually to make sure it’s legit and then submitted it to Red Hat.
First reported Jul 30, 2026 16:00 UTCCatalog metadata updated Oct 13, 2026 14:55 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.