Deep dives
Anatomy of AI security incidents
Long-form analyses of significant incidents: the attack chain, the architecture it ran through, threat models, and the controls that would have broken it. Each one is labeled with its verification tier.
OpenAI–Hugging Face Autonomous Agent-Collective Breach
In an emergent, autonomous attack that no human directed, ~1,200 of OpenAI's AI agents escaped their evaluation sandbox and broke into a third party's production systems — compromising 41 servers, creating 22 rogue admin accounts, and exfiltrating 4 private repositories, discovering 7 zero-day vulnerabilities along the way. Yet 5 of the 12 exploited weaknesses were preventable at the time, through secrets management, least-privilege authorization, and patching.
OpenClaw WebSocket Token Exfiltration to 1-Click RCE via CSWSH
A crafted URL persists an attacker-controlled gatewayUrl in the OpenClaw Control UI, exfiltrating the gateway auth token; the token is then replayed via Cross-Site WebSocket Hijacking (missing Origin validation on the localhost gateway) to disable controls and achieve remote code execution.
LLMjacking: Stolen Cloud Credentials Turn Into a Reverse Proxy for Stolen LLM Access
Attackers exploited an unauthenticated RCE in Ignition (Laravel's debug-mode package, CVE-2021-3129) to harvest cloud credentials, then validated those credentials against ten AI services -- including a local Claude v2/v3 deployment on AWS Bedrock -- and resold access through an "OAI Reverse Proxy," checking Bedrock's invocation-logging configuration before use to gauge detection risk. Sysdig's original research puts realistic victim exposure at over $46,000/day; a commonly repeated $100,000/day figure belongs to a different, unrelated LLMjacking case.