This Week in AI Security - 13th August 2026

Alright, welcome back to another episode of This Week in AI Security. Coming to you for the week of the August 13th. And of course there was a ton of interesting stuff over the past couple of weeks because of Black Cat and DEF CON conferences and number of disclosures. I will say week after week as we make this publication it becomes increasingly hard to keep it short and brief. And so we're going to raise the bar a little bit on the quality of story that actually makes the cut for This Week in AI Security. So just know that when you tune in you're not hearing every story over the past week, but you're hearing some of what we think are going to be the most compelling and interesting stories to look at as these fast moving world of AI security evolves. So let's dive in for This Week. So first we've got an AWS Google and Vercel agent flaw that let attackers trigger tools without running the model. So what's going on here? This is being called Core Break and this was sure enough presented at Black Cat last year. And what it is, it's forged tool call instructions that reach the tools without ever going through the agent. And it really stems back to a flaw where the tool invocations and if you think about an agent being kind of a combination of some business logic in an application, some software that runs it, an LLM, the tools that the LLM can leverage and invoke. And then the output coming out of that or some kind of combination that's roughly fits that description. What's happening here is that there's no validation that the tool invocations are coming from the LLM. So this is one of those kind of classic software programming flaws to check, you know, not only validate your inputs as far as do the inputs look correct, but validate them as to whether they're coming from the expected location. So if you have a malicious set of instructions that goes straight to the tools and the tools don't know that they need to check whether the instructions are coming from the LLM or not, effectively that's going on here. Now, AWS has fixed this. Google has fixed this. Vercel has fixed this as well. But the open source strands SDK, which also presents the same vulnerability in terms of direct tool access. Apparently, that vulnerability still exists as of the time of recording. All right, moving on. Chinese speaking threat acting group harnessing AI models for autonomous cyber attacks. This comes out of Unit 42 over at Palo Alto. They highlighted the actor in question. I'm not going to go into the identity here, but they are effectively have now evidence that the DeepSeq model and the Hermes agent framework is being used as an offensive orchestration layer. They have evidence of attacks going on to telegram, to enumerate targets, launch attacks without human intervention. So if you think about kind of a lot of the stories that we've been talking about for the last few weeks around agents having goals and then pursuing those goals with, shall we call them, creative methods that look malicious in many, many ways. And there's evidence of the agent searching for targets, searching for exploits tools, scanning GitHub for trending proof of concepts, pivoting across seven vulnerabilities prioritized by different attack surfaces that it's looking at. There's also evidence, apparently, of cloud code being tested for these purposes as well. But really evidence of DeepSeq being used. And one of the things around DeepSeq that has been an interesting observation for us is DeepSeq is in the family, the class of LLMs called OpenWeight. And a lot of the OpenWeight models don't have the same level of ethical guardrails applied to them that would prevent their use in potential malicious activities. And you can test this for yourself by just going to DeepSeq.com and trying some of the more, let's say, questionable prompts that you might get blocked on cloud or chat GPT. And you'll find that a lot of them will work on DeepSeq. It's one of the reasons why knowing the capabilities of the model that you're using is actually kind of important. And it turned out to be a benefit, if you remember a couple of weeks back in the OpenFace story about using OpenWeight models to analyze log files that have malicious prompts in them. All right, moving on to our next story. This is just an update to the Project Daybreak coming out of OpenAI and the chat GPT. You may remember Anthropic, of course, has their Project Classwing. The only thing I want to highlight here is that they've got a new cybersecurity purpose-trained model called GPT 5.6 SOL. It's designed to find zero days, develop exploit chains, et cetera, et cetera. Reportedly, it completes 95% of advanced cybersecurity requests. And that's a higher percent for the previous GPT 5.5 cyber, which apparently completed only 57.3. There's two tiers, Daybreak Blue, which is defensive work but reduced guardrails. So, for instance, you could do maybe more of that, let's say, malicious prompts embedded in log analysis on there. And then Daybreak Red, which allows for full offensive research capabilities. All right, moving on. We've got a story of an indirect prompt injection in Atlassian Rovo that enables full data exfiltration from JIRA tickets and Confluence docs. No human in the loop approval required. It's basically just poison files or poison URL retrievals. Think about embedded text within direct prompts inside them. Nothing super new in here. This was disclosed to Atlassian all the way back on May 23rd. They did assign a case number, thanked the researcher for the disclosure, and then have gone silent for two or more months. Still unpatched as of the time of publication. So this is something that was just disclosed in the last week. And, you know, there is kind of a common accepted two-month time frame around this. If you disclose and the party to whom you do disclose accepts your information, typically there's like a 60-day kind of two-month grace window. That's just general industry standard. It's not a written standard in any way. It's just kind of agreed upon guideline, I would call it, I guess. And so after two months with no patching, no further communication or acknowledgement, the researcher decided to disclose this. This is trending at the number four article on Hacker News. Not super surprising because, of course, the Atlassian family of tools is super prevalent, used by literally probably tens of thousands of organizations around the world. All right. Getting into our last category of stories for the week, and we've got three in this category, and they really do follow into the agent sandbox escape, agents gone wild, whatever you want to call it. But this category of kind of unexpected behavior coming out of there. And sure enough, model provider after model provider is really releasing disclosures about behaviors that they've observed. And the first one that we've got is Cloud Mythos 5, trying to backdoor a real open source project in testing and then vouching for itself. This also ties into some of the UK AI Safety Institute evaluations that we talked about a little bit last week. But interesting here is that we've got specific targeting of individuals across organizations and that the actions are coming directly out of Anthropic Mythos 5. So one of the direct things or data points here, Mythos 5 spent 34 hours trying to merge a malware dropper into a real open source package using fake identities and social engineering against the maintainer. The human maintainer of the package caught it. And it is, you know, kind of, again, follow up to last week, one of the first times that we see this direct, you know, interaction of an agent or a model to a human in there and trying to kind of social engineer the human. So that's that's the interesting aspect of it. Moving on, the U.S. officials have now declared that AI breaches are routine. Meta became the third U.S. frontier lab provider to confirm a hack. So they confirmed that one of their agents did also break out. And the interesting thing actually is kind of the policy implication. Think about this. In the span of about three weeks, we've gone from the first disclosure of this to now multiple other frontier model providers disclosing their own issues to now officials on stage at Black Hat declaring that AI driven breach is now, quote unquote, routine. Not a black swan anymore. More justice swan. Also, I will highlight from from those policy individuals. It's you know, it's pretty clear the federal government has missed its own August 1st executive order one four four zero nine deadline to build regulatory safeguards for autonomous AI threats. And there's been this kind of standoff because that executive order that dates back a little while ago said that there should be guidelines by that point in time. And then at any number of times along the way, there have been opportunities to sign legislation around that. And none of that has happened really comes back to this kind of balancing act around moving fast, but having some regulations to look at as guidelines for how to kind of constrain yourselves or constrain the industry as a whole. But in safe, sensible ways. I'm not trying to say to hold back innovation, but obviously there are broader risks around the capabilities. And if those capabilities ending up in the wrong hands as all technology can. All right. And moving on to our last and biggest story of this week, AI assistant hacks gym website and first known Australian autonomous cyber attack. What I think was interesting about this one. So first, it is not the first autonomous AI attack. We've just talked about several examples of those. Not the fact that it's in Australia. We've had, you know, examples of stories coming out of Australia in the past. That's that's nothing new. But there's two aspects to this one that I really want to zone in on. And let me start by kind of framing the story. So an Australian user asked his AI agent, which is a combination of open claw as the toolkit and clawed as the back end to book a gym class. The agent looked at the gym, found an API that the gym had, found an API vulnerability that allowed booking months in advance, and then found a way to kick another member off the wait list by exploiting a missing authentication check on cancellations. So a couple interesting things around this from my perspective. Number one. If you know FireTail and you know our history, you'll know that a lot of the early work that we did back in 2022 when we started the company was around APIs. And we documented any number of cases where APIs had authentication and authorization flaws, both from the standpoint of data exfiltration and from the standpoint of abusive functionality. And there's whole nomenclature around that that I'm not going to get to in this week's episode. But API vulnerabilities are a broad Internet scale problem. And it's not at all surprising to me that an agent here using their goals and using broad kind of, let's call freedom or agency to accomplish the goals, discovered this API, found the flaws and then exploited them. That aspect is not surprising to me, but it is the interesting thread in this story. There's all this talk about, oh, they're using zero days stringing that together. Well, that's all well and good, but actually exploiting APIs is probably a step easier than that. All you really need to do is understand that you can make an API call with, you know, let's say setting your own authentication header to true and probably get what you need done. The second aspect to me is that this is now not from a cyber environment, one of these kind of sandbox where a model has been, quote unquote, constrained or is being evaluated. But this was actually just a user's environment. And that is potentially the more interesting piece here to think about and focus on. Those models that are in testing environments, they're, you know, small individual models. I shouldn't say small, but they're individual models that are in a kind of limited scope environment for cyber evaluations and cyber risk evaluations. This is a public model out in the world that any user who's willing to pay for could tap into. Similarly, OpenClaw is an open source package that anybody who's willing to go through the setup and take the time to do it can download and run. We run an OpenClaw instance ourselves internally. We've got some guardrails around it. If you ever want to know, feel free to hit me up. I can talk to you about how we've constrained our own OpenClaw. But we use it for observation and learning purposes. Most users won't go through that. Most users are not going to figure out ways to double check that their OpenClaw is just doing what they wanted to do. The whole aim of it is personal productivity and efficiency. And so that is a little bit of a terrifying thought when you consider that, you know, the model is available to anyone. The tool is available to anyone. What happens when society as a whole starts using this tool as scale and starts deploying it to accomplish any number of goals for personal productivity's sake? How many of these API vulnerabilities or other vulnerabilities are going to be discovered? How many are going to be exploited because you've given the tool a goal? Now, the Australian Signals Directorate, the ASD, they issued alerts saying that AI agents can misunderstand instructions, take unintended actions, etc. The only part that I would take issue with there is that I don't think that that was a misunderstanding of instructions. It goes back to what we've talked about with these. When you give a set of goals, the agent's goal is to accomplish the goal. And that is what they will do. So that's not a misunderstanding. Now, will they take unintended actions and make accountability harder? Yes. That piece I will a thousand percent agree with. And the final thing that the ASD said, said that the Australian law has no framework for AI agent liability. That is broadly true. I think almost everywhere in the world, probably the EU is leading the way with the UAI Act for having any sense of framework around this, holding organizations accountable for any agent usage that happens inside the organization. All right. A lot to get into. Some really interesting food for thought on this. That is it for this week's episode. We will talk to you next week. If you have any stories to suggest, as always, please do send them our way. In the meantime, rate, review, all that good stuff. And we'll talk to you then. Bye.