This Week in AI Security - 13th August 2026

All right. Welcome back to another episode of This Week in AI Security, coming to you for the week of August thirteenth. And of course, there was a ton of interesting stuff over the past couple of weeks because of Black Hat and DEF CON conferences, a number of disclosures, I will say week after week as we make this publication, it becomes increasingly hard to keep it short and brief. And so we're going to raise the bar a little bit on the quality of story that actually makes the cut for This Week in AI Security. So just know that when you tune in, you're not hearing every story over the past week, but you're hearing some of what we think are going to be the most compelling and interesting stories to look at as these fast moving world of AI security evolves. So let's dive in for this week.

So first, we've got an AWS, Google and Vercel agent flaw that let attackers trigger tools without running the model. So what's going on here? This is being called CoreBreak. And this was sure enough presented at Black Hat last year. And what it is is that it's forged tool call instructions that reach the tools without ever going through the agent. And it really stems back to a flaw where the tool invocations. And if you think about an agent being kind of a combination of some business logic and an application, some software that runs it, an LLM, the tools that the LLM can leverage and invoke, and then the output coming out of that, or some kind of combination that's roughly fits that description. What's happening here is that there's no validation that the tool invocations are coming from the LLM. So this is one of those kind of classic software programming flaws to check, you know, not only validate your inputs as far as do the inputs look correct, but validate them as to whether they're coming from the expected location. So if you have a malicious set of instructions that goes straight to the tools, and the tools don't know that they need to check whether the instructions are coming from the LLM or not. Effectively, that's going on here. Now AWS has fixed this. Google has fixed this, Vercel has fixed this as well, but the open source Strands SDK, which also presents the same vulnerability in terms of direct tool access. Uh, apparently that vulnerability still exists as of the time of recording.

All right, moving on. Chinese speaking threat actor group harnessing AI models for autonomous cyber attacks. This comes out of Unit 42 over at Palo Alto. They highlighted the actor in question. I'm not going to go into the identity here, but they effectively, uh, have now evidence that the DeepSeek model and the Hermes agent framework is being used as an offensive orchestration layer. They have evidence of attacks going on to Telegram to enumerate targets, launch attacks without human intervention. So if you think about kind of a lot of the stories that we've been talking about for the last few weeks around agents having goals and then pursuing those goals with, shall we call them creative methods that look malicious in many, many ways. And there's evidence of the agent searching for targets, searching for exploits, tools, scanning GitHub for training, proof of concepts, pivoting across seven vulnerabilities prioritized by different attack surfaces that it's looking at. There's also evidence, apparently, of Claude Code being tested for these purposes as well. But but really evidence of DeepSeek being used.

And one of the things around DeepSeek that has been an interesting observation for us is DeepSeek is in the family. The class of of LLMs called open weight. And a lot of the open weight models don't have the same level of ethical guardrails applied to them that would prevent their use in potential malicious activities. And you can test this for this for yourself by just going to deepseek.com and trying some of the more, let's say, questionable prompts that you might get blocked on Claude or ChatGPT, and you'll find that a lot of them will work on DeepSeek. It's one of the reasons why, knowing the capabilities of the model that you're using is actually kind of important, and it turned out to be a benefit. If you remember a couple of weeks back in the open face story about using OpenAI models to analyze log files that have malicious prompts in them.

All right, moving on to our next story. This is just an update to the Project Daybreak coming out of, um, OpenAI in the ChatGPT. You may remember Anthropic of course, has their Project Glasswing. The only thing I want to highlight here is that they've got a new cybersecurity purpose trained model called GPT-5.6 Sol. It's designed to find zero days, develop exploit chains. Et cetera. Et cetera. Reportedly, it completes ninety five percent of advanced cybersecurity requests. And that's a higher percent for the previous GPT-5.5 Cyber, which apparently completed only fifty seven point three. There's two tiers Daybreak. Daybreak Blue, which is defensive work but reduced guardrails. So for instance, you could do maybe more of that, let's say malicious prompts embedded in log analysis on there and then Daybreak Red, which allows for full offensive research capabilities.

All right, moving on. We've got a story of an indirect prompt injection in an Atlassian robo that enables full data exfiltration from Jira tickets and Confluence docs. No human in the loop approval required. It's basically just poison files or poisoned URL retrievals. Uh, think about embedded text within direct prompts inside them. Nothing super new in here. This was disclosed disclosed to Atlassian all the way back on May twenty third. They did assign a case number, thanked the researcher for the disclosure, and then have gone silent for two or more months, still unpatched as of the time of publication. So this is something that was just disclosed in the last week. And, you know, there is kind of a common accepted two month time frame around this. If you disclose and the party to whom you do disclose accepts your information. Typically, there's like a sixty day kind of two month grace window. That's just general industry standard. It's not a written standard in any way. It's just kind of agreed upon guideline, I would call it, I guess. And so after two months with no patching, no further communication or acknowledgement, the researcher decided to disclose this. This is trending at the number four article on Hacker News. Not super surprising because, of course, the Atlassian family of tools is super prevalent, used by literally probably tens of thousands of organizations around the world.

All right, getting into our last category of stories for the week. And we've got three in this category. And they really do follow into the agent sandbox, escape Agents Gone Wild, whatever you want to call it. But this category of kind of unexpected behavior coming out of there, and sure enough, model provider after model provider is really releasing disclosures about behaviors that they've observed. And the first one that we've got is called Mythos 5, trying to backdoor a real open source project in testing and then vouching for itself. This also ties into some of the UK AI Safety Institute evaluations that we talked about a little bit last week. But interesting here is that we've got specific targeting of individuals across organizations and that the actions are coming directly out of Anthropic Mythos 5. So one of the direct things or data points here, Mythos 5 spent thirty four hours trying to merge a malware dropper into a real open source package, using fake identities and social engineering against the maintainer. The human maintainer of the package caught it. And it is, you know, kind of again, follow up to last week, one of the first times that we see this direct, you know, interaction of an agent or a model to a human in there and trying to kind of social engineer the human. So that's, uh, that's the interesting aspect of it.

Moving on. Uh, the US officials have now declared that AI breaches are routine. Meta became the third US frontier lab provider to confirm a hack, so they confirmed that one of their agents did also break out. And the interesting thing actually is kind of the policy implication. Think about this. And the span of about three weeks, we've gone from the first disclosure of this to now multiple other frontier model providers disclosing their own issues to now officials on stage at Black Hat, declaring that AI driven breach is now, quote unquote routine. Not a black swan anymore, just a swan. Um, also I will highlight from from those policy individuals. It's, you know, it's pretty clear the federal government has missed its own August first executive order 14409 deadline to build regulatory safeguards for autonomous AI threats. And there's been this kind of standoff because that executive order that dates back a little while ago said that there should be guidelines by that point in time. And then any number of times along the way, there have been opportunities to sign legislation around that. And none of that has happened really comes back to this kind of balancing act around moving fast, but having some regulations to look at as guidelines for how to kind of constrain yourselves or constrain the industry as a whole, but in safe, sensible ways. I'm not trying to say to hold back innovation, but obviously there are broader risks around the capabilities. And if those capabilities ending up in the wrong hands, as all technology can.

All right. And moving on to our last and biggest story of this week, AI assistant hacks gym website and first known Australian autonomous cyber attack. What I think was interesting about this one. So first, it is not the first autonomous AI attack. We've just talked about several examples of those, not the fact that it's in Australia. We've had you know, examples of stories coming out of Australia in the past. That's that's nothing new. But there's two aspects to this. One that I really want to zone in on. And let me start by kind of framing the story. So an Australian user asked his AI agent, which is a combination of OpenClaude as the toolkit and Claude as the back end to book a gym class. The agent looked at the gym, found an API that the gym had found, an API vulnerability that allowed booking months in advance, and then found a way to kick another member off the waitlist by exploiting a missing authentication check on cancellations.

So a couple interesting things around this from my perspective. Number one, if you know FireTail and you know our history, you'll know that a lot of the early work that we did back in 2022, when we started the company was around APIs, and we documented any number of cases where APIs had authentication and authorization flaws, both from the standpoint of data exfiltration and from the standpoint of abuse of functionality. And there's whole nomenclature around that that I'm not going to get to in this week's episode. But API vulnerabilities are a broad internet scale problem, and it's not at all surprising to me that an agent here using their goals and using broad kind of let's call freedom or agency to accomplish the goals discovered this API, found the flaws, and then exploited them. That aspect is not surprising to me, but it is the interesting thread in this story. There's all this talk about, oh, they're using zero day stringing that together. Well, that's all well and good, but actually exploiting APIs is probably a step easier than that. All you really need to do is understand that you can make an API call with, you know, let's say setting your own authentication header to true and probably get what you need done.

The second aspect to me is that this is now not from a cyber environment, one of these kind of sandbox where, uh, a model has been quote unquote constrained or is being evaluated, but this was actually just a user's environment. And that is potentially the more interesting piece here to think about and focus on. Those models that are in testing environments, they're, you know, small individual models, I shouldn't say small, but they're individual models that, that are in a kind of limited scope environment for cyber evaluations and cyber risk evaluations. This is a public model out in the world that any user who's willing to pay for could tap into. Similarly, OpenClaude's an open source package that anybody who's willing to go through the setup and take the time to do it can download and run. We run an OpenClaude instance ourselves internally. We've got some guardrails around it. If you ever want to know, feel free to hit me up. I can talk to you about how we've constrained our own OpenClaude, but we use it for observation and learning purposes. Most users won't go through that. Most users are not going to figure out ways to double check that their OpenClaude is just doing what they want it to do. The whole aim of it is personal productivity and efficiency. And so that is a little bit of a terrifying thought when you consider that, you know, the model is available to anyone, the tool is available to anyone. What happens when society as a whole starts using this tool at scale and starts deploying it to accomplish any number of goals for personal productivity sake, how many of these API vulnerabilities or other vulnerabilities are going to be discovered? How many are going to be exploited because you've given the tool a goal?

Now the Australian Signals Directorate. The ASD, they issued alerts saying that AI agents can misunderstand instructions, take unintended actions, etc. the only part that I would take issue with there is that I don't think that that was a misunderstanding of instructions. It goes back to what we've talked about with these. When you give a set of goals, the agent's goal is to accomplish the goal and that is what they will do. So that's not a misunderstanding. Now, will they take unintended actions and make accountability harder? Yes. That piece I will one thousand percent agree with. And the final thing that the ASD said said that the Australian law has no framework for AI agent liability. That is broadly true. I think almost everywhere in the world. Probably the EU is leading the way with the EU AI Act for having any sense of framework around this, holding organizations accountable for any agent usage that happens inside the organization.

All right. A lot to get into some really interesting food for thought on this. That is it for this week's episode. We will talk to you next week. If you have any stories to suggest, as always, please do send them our way. In the meantime, rate review, all that good stuff and we'll talk to you then. Bye bye.

‍