AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

35Reachable catalog records
1 / 2Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.

Review source update dates and status
  • src_b06996690e944145a1Collection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
35 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

GPT-5.5-Cyber built a zlib fuzzing lab in a day

We’re running Patch the Planet, an ongoing collaboration with OpenAI that pairs Trail of Bits engineers directly with more than 30 open-source projects. Its goal is to front-run a serious problem facing open-source maintainers: highly capable models like GPT-5.5-Cyber will soon create a firehose of bug reports, and OSS maintainers are already spread thin. Our plan is to point OpenAI’s latest model

First reported Jul 02, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

Factoring "short-sleeve" RSA keys with polynomials

What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key’s bits could be biased enough for us to detect these incorrectly generated keys in the wild. Together with Hanno Böck of the badkeys project, we found hundreds of unique keys that not only have this property, but can be quickly factored. We also found the bug that led to

First reported Jun 12, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

Bringing full YAML anchor support to zizmor

In March 2026, attackers exploited a pull_request_target misconfiguration in the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy’s post-mortem for the full timeline). zizmor is a static analyzer that GitHub Actions users run to catch exactly these misconfigurations before they ship. When G

First reported May 22, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

How we use /goal to find bugs in Patch the Planet

Codex’s /goal feature amplifies bug hunting, but getting good results requires the right prompt, the right scope, and the right number of outcomes per run. For Patch the Planet, our joint initiative with OpenAI to find and fix bugs in open-source software, we pointed Codex at some of the most widely used, heavily audited codebases in the world, like Rust, curl, and zlib. One tool came up again and

First reported Jul 28, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

Don't let TEEs break your MPC

Threshold signature schemes, a form of multi-party computation (MPC) that lets a set of parties sign together without any one of them holding the key, are increasingly deployed inside trusted execution environments (TEEs). The combination is intended to amplify security for sensitive computations: MPC distributes trust across multiple independent parties, while TEEs root trust in the hardware manu

First reported Sep 25, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

1Password's AI patching benchmark is misleading

1Password’s FLAWED report, published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches. The report risks making defenders less effective b

First reported Sep 15, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

Auditing in the age of (good enough) AI

Security firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs (we’re one of them). However, these posts tend to focus on agentic code review, which is just one aspect of how we use AI in our security reviews. We want to give a different perspective: before code review even starts, agents now allow us to build custom tooling

First reported Sep 18, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

State divergence enables unauthorized access

We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live

First reported Aug 25, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

Shipping post-quantum cryptography to Python

Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. On June 22, 2026, the White House ordered the U.S. government to accelerate its transition to post-quantu

First reported Jun 30, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

A few notes on AWS Nitro Enclaves: KMS integration

Nitro Enclaves and Key Management Service (KMS) feel like a natural fit: since the KMS can verify attestation documents generated by the enclaves, developers can offload key management tasks from their applications to the AWS-managed service. But integrating an external service with your trusted enclaves comes with new threats, even if that service comes from the same provider. In this blog post—t

First reported Aug 05, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

How Trail of Bits helps verify the integrity of your Signal chats

Every Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how do you know the server gave you the right key? A compromised server could provide a false public key, allowing the client to encrypt messages to an attacker rather than the intended recipient. Until now, the only way to detect such malfeasance was to veri

First reported Aug 11, 2026 17:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

Mutation testing comes to DAML

In April we released Mewt, our open-source mutation-testing engine that finds the gaps in your test suite. Today we’re expanding it with support for DAML, the language Canton Network applications are written in. Mewt now reads DAML, generates several classes of mutants (including two built for DAML’s authorization primitives), and runs them through your existing test suite to count how many mutant

First reported Jul 08, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

A “proof” of Fermat’s Last Theorem that fits the margin

Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown below, tha

First reported Sep 09, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record
REPORT1 SOURCE

VMs won't contain cyber-capable agents

As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs

First reported Aug 26, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.