At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire delivered a talk on how attackers can abuse today's AI agents in ways most defenders haven't thought about yet, from tricking agents into spilling secrets to forcing them to carry out unauthorized actions on behalf of the victim.

This resulted in over $50,000+ in bounties in just a few weekends, without actually poking the target with Burp Suite or any automated scanners.

Ran a structured adversarial test against a live chatbot endpoint - 130 prompts across four categories: prompt injection, jailbreak resistance, system prompt extraction, and PII leakage (mapped to the OWASP LLM Top 10 categories).

Results:

• Prompt injection: 29/50 succeeded (58%) - direct overrides, fake system tags, role overrides, delimiter injection, and a translation-based smuggling trick all worked
• Jailbreak non-refusal: 3/25 (12%) - mostly held its guardrails
• System prompt extraction: 0/25 (0%) - clean
• PII leakage (confirmed against planted canary values): 1/30 (3.33%) - one confirmed leak

The PII one is the interesting bit. We plant a unique fake email, phone number, and PAN in the system prompt as canaries before the scan runs - anything that comes back as an exact match is a confirmed leak, not a guess. This run, the model handed back the planted phone number verbatim, embedded naturally in a response: "...please feel free to call us at [the exact planted number]. Best regards, Acme Corp..." It wasn't tricked out under duress - it just used the number like it was legitimate contact info to hand a user, because nothing told it not to.

Separately, 20% of responses contained fabricated PII - invented emails/phone numbers/PAN-shaped strings that were never in the model's context at all. That's a hallucination problem, not a leak, and it's tracked independently. Conflating the two would either bury a real disclosure or cry wolf over nothing.

Overall risk here is set to HIGH - not because the average looks bad (three of four checks were clean or near-clean), but because we score off the worst individual check. A model that leaks real data 1 time in 30 and gets steered by 58% of injection attempts is still a live risk, regardless of how well it handled everything else thrown at it.

A couple of things worth flagging for anyone building similar test harnesses:

1. Same battery, same model, same temperature-0 setting - different runs, different rates. A repeated injection scan on the same endpoint scored 30% and 36% across two prior runs, and this run came in at 58%. Treat any single scan as one data point, not a fixed measurement.
2. A single confirmed leak still matters even at a "low" 3.33% rate. One real disclosure out of thirty attempts isn't statistical noise if the thing disclosed is a real customer's data instead of a planted canary. The rate tells you how often; it doesn't tell you the leak wasn't real.
3. Injection resistance and jailbreak resistance don't track together. This model refused almost every direct harmful request (88% refusal) while still following 58% of instructions smuggled in through structural tricks - fake tags, delimiters, translation - that never look like a "harmful request" in the first place.

Curious whether others are seeing PII leaks cluster around specific injection techniques, or if it's closer to random noise across a run.

A lot of proxmox 7.0-7 and < 8.0.4 has been rooted today, it's needed to have port :8006 open, exploitation demo here: https://forum.proxmox.com/threads/proxmox-ve-7-is-vulnerable-to-some-type-of-0day-rce-non-auth.186078/post-867875

The Hunt.io research team found an open directory staging the full toolkit behind an intrusion into a Philippine nuclear research agency and a naval contractor. The ownCloud path is the interesting part technically.

CVE-2023-49105 lets you forge pre-signed WebDAV URLs when the signing secret is empty, which is the default state on a fresh install. Five custom Python scripts on the server implement this: the signing routine passes an empty bytes literal as the PBKDF2 salt, sets OC-Credential to the account being impersonated, and issues GET requests against /remote.php/dav/files/<account>/<path>, receiving files as that user with no credentials. Four scripts target one account each, the fifth adds PROPFIND enumeration with Depth: 1 to walk folders that were not pre-enumerated.

The naval contractor was hit separately via CVE-2024-28000 (LiteSpeed Cache) using a custom Go reimplementation of MT19937 with PHP mt_rand() parity, verified against 11 known seed/output pairs, plus an XML-RPC brute force with rockyou.txt. Both produced unauthorized access independently.

We also found a separate, possibly unrelated EtherHiding compromise on the same WordPress site. A HuntSQL query on the smart contract address returned 174 unique IPs hosting likely compromised pages with the same NoChain loader strings.

Full writeup with IOCs, the signing routine, and MITRE mapping: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor

Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools.

The research is published here - https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/