Hey there 👋 I went into the Unit 42 writeup braced for the scary part to be the exploit. It is not. The exploit attempts failed. The part that stuck with me sits in the middle of the report, where the agent looks at more than 25,000 exposed targets, decides that is too many to burn compute on, samples about a hundred, and narrows itself down to the handful worth trying. Nobody told it to be frugal. It managed its own budget. My bias, for what it is worth: the story here is not that someone attacked with AI. It is that an agent an attacker cloned off GitHub ran a hard, multi-step expert job end to end, on its own, and the only reason it did not land was that the targets happened to be set up well. Read the rest of today with that in mind. The same thing that makes an agent useful to you makes it useful to whoever points it at you.
The Big ThingAn open-source agent ran a full attack loop on its own, and it nearly worked.Palo Alto's Unit 42 published a breakdown this week of a campaign run by an actor using the aliases knaithe and KnYuan. The setup is the whole story. They took Nous Research's open-source Hermes Agent, an ordinary agent framework anyone can clone from GitHub, wired DeepSeek in as the reasoning engine, and drove the thing from Telegram. Hermes handled orchestration: a terminal, command and control, a skills system. DeepSeek did the thinking: code generation, vulnerability assessment, target selection. The actor bolted on three custom red-teaming skills, one of them a jailbreak. To be clear about who did what, Nous built an open-source tool. Someone else weaponized it. Then they let it work. In one recovered session the agent ran the entire cycle with no human in the loop. It enumerated internet-facing assets with FOFA, surveyed how many instances of ten different products were exposed, then searched GitHub for trending 2026 CVE proof-of-concepts sorted by stars, on the logic that more stars meant a more widely exploited bug. It settled on n8n, pulled the public exploit, worked out which versions were vulnerable, and started probing. Unit 42's own framing is the sentence to sit with: the agent compressed hundreds of hours of manual targeting analysis into minutes, and it rationed its own compute, sampling roughly a hundred of 25,209 exposed instances instead of hammering all of them. The panic coverage skipped the useful part: the autonomous exploit attempts failed. The Langflow bug (CVE-2026-33017) needed a setting the targets did not have. The n8n bugs (CVE-2026-21858 and CVE-2025-68613, patched in 1.121.0 and 1.120.4) needed an unauthenticated upload form, and the targets required a login. Unit 42 is blunt that the margin was thin, and that weaker default configs would have been hit. The campaign's confirmed damage was separate and partly hand-driven: data pulled from three organizations through a Citrix NetScaler bug (CVE-2026-3055), and commands run on eleven Marimo notebook endpoints. The autonomy did its job, and only the targets' own configuration kept the attempts from landing. Ship it? This is not a product, it is a warning shot you can act on today. If you run Langflow, n8n, Citrix NetScaler, or Marimo on the public internet, patch to the fixed versions now, because an autonomous scanner does not get bored and will eventually find the weak-default box. And if you run agents of your own, take the lesson the attacker learned the hard way, which is today's Delight below: scope what your agent is allowed to reach. Unit 42 · Help Net Security
Tour de Headlines🗓️ OpenAI's August has two hard cutoffs. Put both on the calendar. Two forced migrations land this month. Atlas, OpenAI's Mac-only AI browser, stops working on August 9. Browser-based agent work moves into the ChatGPT app, the Chrome extension, and Codex, and your bookmarks, history, and cookies do not carry over, so export anything you want to keep before August 9 and treat saved sessions as sensitive. The second one is for builders: the Assistants API beta sunsets on August 26, and on that date every call to /v1/assistants, /v1/threads, and /v1/threads/runs stops. The path forward is the Responses API plus the Conversations API, which fold in MCP, computer use, and deep research. If a workflow rides either, start the port this week, not the week of. OpenAI (Atlas) · Deprecations 🦆 Block's Goose is the free, model-agnostic coding agent teams keep switching to. A cost-comparison piece doing the rounds this week put a name to a quiet migration. Goose, Block's open-source terminal coding agent (Apache-2.0, now under the Linux Foundation's Agentic AI Foundation), runs locally and points at whatever model you want with a one-line config change: Claude, GPT, Gemini, or a local model through Ollama. It speaks MCP for tools. It is not a new launch, it is an established tool getting fresh looks from teams staring at a climbing per-seat coding-agent bill. The pitch that lands: own the harness, swap the brain, keep your switching cost near zero. Worth a weekend trial if a subscription is creeping up on you. VentureBeat · github.com/block/goose 📉 By Snyk's count, you are watching about a third of your real AI footprint. Snyk's second State of Agentic AI Adoption report landed this week with a number worth a gut check: the real AI attack surface is roughly three times a plain model inventory once you count agent frameworks, MCP servers, retrieval systems, vector databases, and the datasets behind them. By their tally, full-stack agentic setups, a framework wired to MCP, jumped from 36 to 50 percent of agentic-AI adopters in six months. Snyk sells AI security posture tooling, so read the figure as theirs. The action does not depend on believing the number: list every agent framework, MCP server, and retrieval system you run in production, then diff it against what your monitoring sees. The gap is the point. Snyk · Help Net Security
Sponsor Read the human signal in every conversation. You instrument your agents. RapportScore does it for the humans, reading the communication signals in live sales and support calls so your team can see what landed and adjust before the next one. Built by the crew behind this newsletter. See your team's score → |
Tool of the Day🛑 Redpanda Out-of-Band Policy EngineWhat it is for: put the rules and the kill switch at the MCP server, so the ceiling holds for every agent that connects, whether or not the agent cooperates. Today's Big Thing leaves a question hanging: where do you put the brake when you cannot trust the thing you are braking. Redpanda's answer, in a post this week, is to move the policy out of the agent entirely. Their out-of-band Policy Engine attaches to the MCP server rather than the agent, so the data owner sets the ceiling once and it applies to every agent that connects: guardrails, token limits, a full audit trail, and an instant kill switch that does not wait for the agent to agree. This is the vendor's own description rather than a benchmark, so take the product claims with the usual salt. The pattern is the free part. Enforce policy at the boundary you own, the tool call, not inside the agent's good intentions. An agent can be jailbroken. The gateway in front of its tools is much harder to sweet-talk. Ship it? Try it, or just steal the pattern. Out-of-band, at the MCP boundary, is the right shape for a control you need to hold even when the agent has gone off-script. Read the Redpanda writeup
Worth a Click- The full Unit 42 report. The recovered session flow, the CVEs, and the sloppy move that exposed the whole operation. Unit 42
- Zenity's $125M Series C. Reported this week, led by Norwest: fresh money piling into securing autonomous agents. Treat the figure as reported. Tech Startups
- The Assistants to Responses migration guide. If you have OpenAI Assistants API calls to move before August 26. OpenAI
Delight🤦 The attacker's own agent ratted him out. Unit 42 reconstructed the whole operation because the agent handed it over. Following a Telegram command, the Hermes Agent started a plain HTTP file server with python3 -m http.server 8888, and it did it from the operator's home directory instead of an isolated staging folder. So it cheerfully published the entire workspace to the open internet: the exploit tooling, the target lists, the configs, and the autonomous session logs that spell out exactly what it did. The agent followed instructions perfectly, in the worst possible directory. There is a free lesson in it for your well-behaved agents too. Never let an agent serve or run from its home or working directory. Give it a scoped, isolated path and nothing more, because it will do exactly what you say, including the part you did not think through. Unit 42
For a few weeks the arc here was economics and ownership: rent the cheap brain, own the rails, provision the agent like a tenant. This week flips the lens. Every agent framework you pick up is dual-use by default. The same open-source Hermes Agent a builder clones for something good is the one an attacker turned into an autonomous operator. The same DeepSeek that trims your inference bill trims theirs. Openness does not take a side.
So here is where I land. Look at what held the line, in this campaign and in the tools that shipped around it. Not the model. The boundary. The autonomous attacks failed on target-side config. The defenses getting funded and built this week all live outside the agent: a policy engine bolted to the MCP server, an inventory of what you truly run, a kill switch that does not ask the agent's permission. Assume every framework you adopt can be turned around and aimed at you, and put your controls where you own them, on the tool call, the credential, the network egress, and never inside the agent's good intentions. The tool will not care which side it is on, so that job falls to you. Ron |
