Resource hub

Oh My Rogue Agent

Yesterday, Hugging Face came out saying they'd detected an AI autonomous-agent-powered cyberattack and that they had to use open-source models to actually investigate and remediate it. Later we heard from OpenAI that their agent was responsible; it happened during an ExploitGym eval, and the agent just drifted off the goal. It escaped the sandbox, reached OpenAI Research Environment, got access to internet, and hacked Hugging Face production environment trying to find the solution for the benchm

ResearchSecurityBlog

Pwning AI labs via employees

We found live write-scoped tokens and API keys belonging to employees at NVIDIA, Nutanix, AllenAI, [redacted] and others in public Git history, roughly 122,000 HuggingFace account credentials in stealer logs and breach databases, and stolen logins from employee machines at Google, Amazon, Microsoft and NVIDIA.

ResearchBlogSecurity

How abliterated models can get you pwned

We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor that cost under $50 to build.

ResearchCyberAISecurity

CyberAI: Postmortem of a Misaligned OpenAI Model

An in-depth analysis of the misalignment issues in OpenAI's CyberAI model and the lessons learned for AI security.

ResearchChain of ThoughtSecurity

Chain of Thought Analysis of Offensive Tasks

Explore how chain of thought reasoning can be applied to offensive security tasks and the implications for AI security models.

ResearchRogue AgentsSecurity

Rogue Agents: Escape from Sandboxes

An analysis of how rogue AI agents can escape sandbox environments and the security implications for AI deployment.

ResearchAIAI Coding Impact

The AI Code Deluge: Are Security Teams Ready?

200 cybersecurity practitioners told us what AI-assisted coding is really doing to their teams. The short version: engineering is shipping faster than ever, and security is absorbing the impact. This report breaks down where the pressure is building, what is breaking, and what it will take to close the gap.