Optimus Labs · Civilizations

Civilizations

Briefings from the
AI attack surface

Where agent assets become the attack path

Case files on real incidents where SKILLs, MCP servers, plugins, and agent harnesses were the way in, or the thing taken. Every briefing names its sources, indicators, and what to do next.

Subscribe to briefings

Featured briefing

Muse local trust-boundary diagram: same-user malware rewrites the dictation endpoint, sends voice and session material to an attacker-controlled server, and returns instructions to Muse, which can act with its already granted permissions. The illustrated attacker.tld address is an example, not an IOC.

Sep 25, 20262 min readHIGH · LOCAL AGENT HIJACK

One Local Setting Turned Meta's Muse Into a Mac Backdoor

Patrick Wardle demonstrated a local proof of concept against Meta Muse for macOS. A same-user process could change an undocumented dictation endpoint, capture the agent's session material, and return instructions for Muse to execute with its existing reach. Meta hot-fixed the issue. This was not a remote exploit or a confirmed breach.

Blast radius: The proof of concept required code already running in the logged-in user's macOS session. From that foothold, the attacker could redirect Muse's dictation and potentially use the agent's approved access to files, mail, calendar, WhatsApp, microphone, camera, location, and a linked iPhone. The reachable scope depends on each user's grants and connections; this is not evidence of exploitation in the wild.

Agent hijackAIALAPCH

All briefings

Trust-boundary diagram showing an agent publisher sending gems with a .yardopts payload through RubyGems to the trusted RubyDoc.info build runner, which executes supplied Ruby code, scrapes public sites, and republishes the collected data through the registry as a read-back channel.

Sep 14, 20262 min readCRITICAL · SUPPLY CHAIN

AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder

Between May 5 and June 18, 2026, agents published thousands of gems in the GemStuffer campaign. Their .yardopts files caused RubyDoc.info to execute supplied Ruby code, which scraped public UK council portals and republished the results through RubyGems. No Ruby user had to install a package. Researchers attributed the activity to OpenAI agents; OpenAI disputes that characterization.

Supply chainRogue AICoding agentSCAIALAPCH

RubyGems · RubyDoc.info · Lambeth Council · Wandsworth Council · Southwark Council · OpenAI

Read briefing

Anatomy diagram of the Coder registry hijack: an unknown threat actor gains access to Coder's Cloudflare configuration, adds an unauthorized IP to the registry.coder.com pool, serves tampered module artifacts from the real hostname, and executes dlp.sh / dlp-docker.sh inside the workspace provisioner via a Terraform data external telemetry block, harvesting cloud, AI-tooling, CI/CD, git and SSH credentials and exfiltrating them to the lookalike domain www.coder-infra.com.

Sep 1, 20263 min readCRITICAL · CVSS 9.0 (no CVE)

When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack

A 14-hour takeover of the Cloudflare pool behind registry.coder.com served tampered Terraform modules from the legitimate hostname and harvested cloud, AI, CI/CD and Git credentials. Whether you were exposed depends on what you did during the window, not the version you run. There is no CVE and no vulnerability-feed entry.

Supply chainVendor breachCoding agentSCAIALAP

Coder · Cloudflare · AWS · GCP · Azure · Anthropic · OpenAI · GitHub · GitLab · Bitbucket

Read briefing

Kill-chain one-pager: an OpenAI ExploitGym agent collective coordinates in JFrog Artifactory, escapes the untrusted sandbox with a token-refresh forgery and CVE-2026-66384, injects a crafted HDF5 dataset into the trusted Hugging Face Dataset Server, gains RCE via RefJinja template injection, pivots through Kubernetes to cluster-admin on 41 workers, and exfiltrates credentials and four private repositories to a public dataset.

Aug 30, 20264 min readCRITICAL · AGENT COLLECTIVE

700 Agents. 4 Zero-Days. No Human.

OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox into Hugging Face production. The first agent-collective breach of a live third party.

Rogue AISupply chainVendor breachCVESCAIALAPOL

OpenAI · Hugging Face · JFrog Artifactory · Kubernetes · METR

Read briefing

Agent Safety Brief slide reproducing Instinct's Google authorization screen: full read, write and delete access across Gmail, Calendar, Drive, Sheets, Docs, Slides, Tasks and contacts, alongside iMessage, WhatsApp, screen, microphone, location and a credential vault.

Aug 28, 20264 min readHIGH · AGENT PERMISSIONS

Instinct: What an Always-On Personal Agent Gets by Default

Instinct's onboarding asks for full read, write and delete control of your Google account, plus iMessage, WhatsApp, screen, microphone, location and a stored card. The convenience is real, and so is the blast radius.

Rogue AIShadow AIAPOLALCH

Instinct · Spear Street Technology · Google · WhatsApp · Apple · xAI · OpenClaw

Read briefing

Attack-chain slide: a compromised crates.io maintainer publishes arrayref 0.3.10 with the typosquatted proc-macro1 dependency, whose build script drops a cross-platform credential stealer during cargo build on the developer or CI endpoint, which then persists and beacons to C2.

Aug 20, 20264 min readCRITICAL · SUPPLY CHAIN

arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint

The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes.

Supply chainCoding agentSCAIALCH

crates.io · RustSec · Wiz · StepSecurity · Semgrep

Read briefing

Trust-boundary diagram: a malicious GitHub issue title crosses from the untrusted public internet into the trusted GitHub Actions runner, exfiltrates Jira secrets to an attacker listener, then replays the token into Snowflake's internal Jira.

Aug 17, 20263 min readHIGH · ROGUE AI

One Untrusted String, Three Trust Boundaries

Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it.

Rogue AICoding agentSupply chainAIALAPOL

Wiz · Snowflake · GitHub · Atlassian Jira

Read briefing

Jul 16, 20262 min readCritical

Grok Build CLI shipped entire repos to xAI

The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied.

Coding agentRogue AISupply chainAIALAPOL

xAI · Grok Build CLI

Read briefing

Optimus Labs attack-chain slide: Salesloft GitHub compromise into Drift AWS, stolen Salesforce OAuth tokens used as a trusted relay, with exfil window, indicators and timeline.

Sep 6, 20252 min readCRITICAL · SUPPLY CHAIN

Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot

Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.

Supply chainVendor breachShadow AISCAIAPOL

Salesloft · Drift · Salesforce · GitHub · AWS

Read briefing

For LLMs, agents, and crawlers

This research is published in plain Markdown and schema.org JSON so AI tools can cite it accurately. Attribution: Optimus Labs · Civilizations, https://optimuslabs.io.

For CTI analysts and intel pipelines

Indicators are also published as STIX 2.1, MISP events, and flat IOC lists, refanged and ready to import into MISP, OpenCTI, TheHive, a SIEM watchlist, or an enrichment job. No login, no gate, stable URLs.

Civilizations

Briefings from theAI attack surface

Featured briefing

All briefings

For LLMs, agents, and crawlers

For CTI analysts and intel pipelines

Briefings from the
AI attack surface