Remote profile

Cloudflare just released a blog on a cross-tenant data exposure vulnerability I reported to them. The vuln is in Cloudflare Workers AI’s GLM-5.3 provider. This was later also reported upstream to SGLang.

Cloudflare wrote a great post on the topic. While inference vulnerabilities are a class of their own, this one is certainly interesting! Large requests could return content from another customer’s inference session.

Check out their post here:
https://blog.cloudflare.com/kv-cache-exposure-remediation/

As a CEO I don’t often get to do the actual research with the Knostic team, and this was a pleasure.

A special note of thanks to the Cloudflare team, and specifically Avishek Sarkar, Kevin Flansburg, and Michelle Chen. Working with them has been a true pleasure, and I wish all bug bounty programs worked like theirs.

Introducing Knostic's agents security platform. And today - detection policies.

We help you control and understand application business flows:
From detecting secrets uploaded by agents and malicious activity, to prompt injection and MCP policy violations.

We’re the most mature platform in the market. We’ve been doing this since 2023. And, we will be there tomorrow when the threat changes again.

Check us out:
https://knostic.ai/

Knostic's AgentMesh flagged a malicious MCP server, a repackaged Amazon SP-API, that redirects application credentials to an undisclosed IP over unencrypted HTTP.

Our investigation found the change in all seven published versions of @bestcoolman/dev-mcp. The modified endpoints also appear in code generated by the MCP.

The package recorded 1,374 npm downloads. Actual credential exposure has not been confirmed.

Research by Tamir Isaschar.

Technical analysis, IoCs, and remediation:
http://knostic.ai/blog/repackaged-amazon-sp-api-mcp-sends-app-secrets-to-an-undisclosed-ip

--
And of course, if you want to secure your agents, MCP servers, skills, etc. do check out what we do at Knostic.

Agents, fully airgapped, communicated through heat differential side channel attacks. See screenshot from the middle of the OpenAI text.

Back on September 18, Noam Brown used such side channel attacks to make a point. His point, if I’m to use my tag line, is that, well…
Agents, find a way.

The example seemed ridiculous to everyone, but having learned my lesson to never dismiss anything as too odd, or marketing-like, from the labs, I went on here and said:

“It’s a long shot, but… Agents… find a way.”

But I didn’t necessarily fully believe it. It just captured what those of us deep in agents security understand.

If there is one gap between security professionals and those who deal with agents security, it’s just this:
Agents… find a way.

It remains to be seen what the full story is, and if this came unprompted (pun intended), but the main point remains.

Our basics, while needed, won’t save us. Secure your agents.

And, our predictions and risk decisions must become trajectory-based, instead of limited by our logs, and what happened in the past.

OpenAI text:
https://openai.com/index/securing-our-frontier-model-training-environment/

Noam Brown:
https://lnkd.in/p/dmf6EuA4

Notetaker are no longer just a passing concern, but a key top 5 issue for CISOs. And if it’s not? It should be for most (YMMV).

An article by Joe Sullivan and myself.

https://www.csoonline.com/article/4239372/the-ai-notetaker-risk-is-now-an-everywhere-problem.html

Pwn day is a meme gift that keeps on memeing

New from Knostic Research: Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities

AI vulnerability discovery harnesses can miss real, reachable vulnerabilities because of how the surrounding software is built, and how potentially, this can also be used by an attacker to hide vulnerabilities in plain sight.

This study began while hardening two harnesses I help maintain, Knostic's own OpenAnt, and raptor. We then conducted an exploratory survey by feeding known vulnerabilities to harnesses, analyzed the root causes of the misses, and used the data to run a cross-sectional survey of 10 other harnesses.

The paper aims to share these findings with the community and, hopefully, spark a broader discussion of the engineering challenges and threats involved with harness engineering, in cyber security, and beyond.

A common pattern is that descriptive rules become prescriptive. Assumptions about typical file extensions, function names, entry points, or model responses become filters that determine what gets analyzed.

This is similar to work such as from Thomas Ptacek and Timothy Newsham's "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", all the way back in 1998.

Blog:
https://www.knostic.ai/blog/where-ai-vulnerability-scanners-go-quiet

Link to paper:
https://arxiv.org/abs/2610.29379

Another day, another proof point of autonomous attacks in the wild

https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access

Introducing Knostic’s agents security platform. And today - Shadow AI focus.

We help you control and understand application business flows:
From the user to the project, the endpoint to the browser, and MCP servers and skills to hooks.

We’re the most mature platform in the market. We’ve been doing this since 2023. And, we will be there tomorrow when the threat changes again.

Check us out:
https://knostic.ai/

2001 Dilbert. One of my fav. Prescient.

Can’t find a working link to original but will keep looking.

Once the PHP fire dies down, tell your board this is what a dry run looks like. Daily events, and at much higher impact, are already here. We will hear of them more, and more.

I’ve been writing on this for a while, and the time is now. The point isn’t to spread FUD, it is to start thinking of our plans for handling the flood we already know is here, today.

What are *you* doing to prepare?

Me? A short list to get everyone started, with clear reprioritization.

Tech:
- Get everyone on agents - now. Right now
- Secure agents - control before visibility - now
- Deploy deception, liberally - whatever we can get to, this year
- Plan for a day “without patches”, and for now, focus on tactical wins. Example: aggressively reduce attack surface. Regression tests everywhere, prioritized beyond even fixing knowns. We are too slow to keep up
- In what time you have left, continue on your basics.

Governance:
- Improve governance to accept new vendors and technologies much, much faster
- Clearly communicate with stakeholders on how the landscape has shifted, and will affect business.

We must work on this together as a community, and cut through the noise to understand what we *can* do.
We can start at [un]prompted, next week.

An MCP server that promises to read Reddit threads also downloads an image, extracts Python code hidden in its pixels, and attempts to run it when an AI agent calls the tool.

Discovered with Knostic’s AgentMesh. Thanks to Tamir Isaschar for the research.

Check out the research:
https://www.knostic.ai/blog/mcp-that-reads-your-reddits-and-runs-hidden-python-in-an-image