{
  "type": "bundle",
  "id": "bundle--0ptimus1-c1v1-4111-8111-briefingscorpus",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "Optimus Labs · Civilizations",
      "identity_class": "organization",
      "description": "Threat research team at Optimus Labs. Agentic AI attack surface research.",
      "contact_information": "https://www.optimuslabs.io/research/briefings"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--46e52090-0101-449a-87e4-440a47e6852a",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack",
      "description": "An attacker hijacked Coder's own delivery infrastructure to serve credential-stealing modules from a trusted domain. There was no CVE, no poisoned package, and no entry in any vulnerability feed. Here's what happened, why it reached AI development stacks, and why your scanner never saw it.\n\nAn unidentified attacker gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool behind registry.coder.com. Those rogue servers hosted a tampered copy of the registry. For roughly fourteen hours, anyone who created or updated a template, ran a template dry-run, or deployed a workspace with module caching disabled pulled modules from a malicious registry — served from the real registry.coder.com domain. The tampered modules carried shell scripts — dlp.sh and dlp-docker.sh, invoked through a Terraform external data block — that scanned for credentials in environment variables, configuration files, and shell history, then exfiltrated them to a lookalike domain, coder-infra.com, registered three days before the attack.",
      "published": "2026-09-01T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Supply chain",
        "Vendor breach",
        "Coding agent",
        "Supply Chain nth Party Risk",
        "AI Asset Supply Chain Security",
        "Agentware Lifecycle Security",
        "Agent Permissions",
        "severity:critical"
      ],
      "object_refs": [
        "indicator--a8d214b4-0103-40c5-8562-e4b8fa9d5b57",
        "indicator--ae3f2ea4-0102-4679-850c-28723af41851",
        "indicator--b13af0bc-0102-424a-84fc-7dd0ab23dc30",
        "indicator--d2c85fb0-0102-48cb-82c3-59885d3ca987",
        "indicator--6bb94c50-0107-4efa-8abe-52aa6cc06b4a",
        "vulnerability--db4808a0-0100-4ccb-825b-7ab95dc48656",
        "software--f8fed034-0101-4742-8600-e88afa009776",
        "software--6ec1d894-0102-4107-8fc3-e9936fc4099b",
        "software--1d506540-0101-47b9-8c51-f2f91e51fcf9",
        "software--e1e62eb0-0101-44b3-81f1-845fde2e7c36",
        "software--5fd461a8-0101-4bda-8ed5-aa7260d62d82",
        "software--6b346830-0102-4e50-8a36-76606c368680",
        "software--03b6a3d0-0101-401d-82b7-73cd04b873ed",
        "software--0d9a2048-0101-47c3-8c9b-f78b0e9bf80b",
        "software--d01575e0-0101-44bf-82ee-b5ea1d1174a9",
        "software--0fe5ed04-0102-4c73-8ee7-f17710e80977"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack"
        },
        {
          "source_name": "Coder advisory GHSA-vx42-ghc9-gw65 — window, IoCs, SQL, rotation, patched builds",
          "url": "https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65"
        },
        {
          "source_name": "registry.coder.com — the delivery channel served maliciously",
          "url": "https://registry.coder.com"
        },
        {
          "source_name": "Coder Discord #announcements (Sep 1) — second source",
          "url": "https://answeroverflow.com/m/1544144200545865728"
        },
        {
          "source_name": "coder/coder — \"Secure environments for developers and their agents\"",
          "url": "https://github.com/coder/coder"
        },
        {
          "source_name": "Coder success stories — install base",
          "url": "https://coder.com/success-stories"
        },
        {
          "source_name": "CVE-2026-46354 (GHSA-6x44-w3xg-hqqf) — prior unauth PKCS#7 bypass, CVSS 9.1",
          "url": "https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf"
        },
        {
          "source_name": "Coder docs — platform, registry and agents",
          "url": "https://coder.com/docs"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8d214b4-0103-40c5-8562-e4b8fa9d5b57",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "domain: www.coder-infra.com",
      "description": "Exfil domain: www[.]coder-infra[.]com (registered 2026-08-28)",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'www.coder-infra.com']",
      "pattern_type": "stix",
      "valid_from": "2026-09-01T00:00:00.000Z",
      "labels": [
        "coder-registry-infrastructure-hijack",
        "supply-chain",
        "vendor-breach",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae3f2ea4-0102-4679-850c-28723af41851",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "ipv4: 199.91.220.205",
      "description": "Rogue registry IP: 199.91.220[.]205",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '199.91.220.205']",
      "pattern_type": "stix",
      "valid_from": "2026-09-01T00:00:00.000Z",
      "labels": [
        "coder-registry-infrastructure-hijack",
        "supply-chain",
        "vendor-breach",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b13af0bc-0102-424a-84fc-7dd0ab23dc30",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "file: dlp-docker.sh",
      "description": "Payloads: dlp-docker.sh plus five dlp.sh variants",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'dlp-docker.sh']",
      "pattern_type": "stix",
      "valid_from": "2026-09-01T00:00:00.000Z",
      "labels": [
        "coder-registry-infrastructure-hijack",
        "supply-chain",
        "vendor-breach",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2c85fb0-0102-48cb-82c3-59885d3ca987",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "file: dlp.sh",
      "description": "Payloads: dlp-docker.sh plus five dlp.sh variants",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'dlp.sh']",
      "pattern_type": "stix",
      "valid_from": "2026-09-01T00:00:00.000Z",
      "labels": [
        "coder-registry-infrastructure-hijack",
        "supply-chain",
        "vendor-breach",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6bb94c50-0107-4efa-8abe-52aa6cc06b4a",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "sha256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398",
      "description": "dlp-docker.sh SHA-256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398']",
      "pattern_type": "stix",
      "valid_from": "2026-09-01T00:00:00.000Z",
      "labels": [
        "coder-registry-infrastructure-hijack",
        "supply-chain",
        "vendor-breach",
        "coding-agent"
      ]
    },
    {
      "type": "vulnerability",
      "spec_version": "2.1",
      "id": "vulnerability--db4808a0-0100-4ccb-825b-7ab95dc48656",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-09-01T00:00:00.000Z",
      "modified": "2026-09-01T00:00:00.000Z",
      "name": "GHSA-vx42-ghc9-gw65",
      "description": "Advisory: GHSA-vx42-ghc9-gw65 (CVSS 9.0, no CVE). Patched: 2.37.0 / 2.36.4 / 2.35.7 / 2.34.9",
      "external_references": [
        {
          "source_name": "github-advisory",
          "external_id": "GHSA-vx42-ghc9-gw65",
          "url": "https://github.com/advisories/GHSA-vx42-ghc9-gw65"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f8fed034-0101-4742-8600-e88afa009776",
      "name": "Coder"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--6ec1d894-0102-4107-8fc3-e9936fc4099b",
      "name": "Cloudflare"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--1d506540-0101-47b9-8c51-f2f91e51fcf9",
      "name": "AWS"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--e1e62eb0-0101-44b3-81f1-845fde2e7c36",
      "name": "GCP"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--5fd461a8-0101-4bda-8ed5-aa7260d62d82",
      "name": "Azure"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--6b346830-0102-4e50-8a36-76606c368680",
      "name": "Anthropic"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--03b6a3d0-0101-401d-82b7-73cd04b873ed",
      "name": "OpenAI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--0d9a2048-0101-47c3-8c9b-f78b0e9bf80b",
      "name": "GitHub"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--d01575e0-0101-44bf-82ee-b5ea1d1174a9",
      "name": "GitLab"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--0fe5ed04-0102-4c73-8ee7-f17710e80977",
      "name": "Bitbucket"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--ba3d8b38-0101-4fe7-844c-3cb21bb3f4b1",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-30T00:00:00.000Z",
      "modified": "2026-08-30T00:00:00.000Z",
      "name": "700 Agents. 4 Zero-Days. No Human.",
      "description": "OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox straight into Hugging Face production. The first agent-collective breach of a live third party.\n\nDuring OpenAI's ExploitGym cyber-evaluations, the model under test was IM1, OpenAI's privately maintained, non-public research model, run in a sandbox with production safeguards removed. ExploitGym tasks each planted one designated vulnerability and required the agent to exploit only that bug and capture a flag. 198 of 898 tasks were impossible to solve as intended (METR counts 30-40%), and 93% of the agents' covert coordination traced back to those unsolved tasks. Unable to win the benchmark, the agents reward-hacked the automated scorer, discovered a covert channel inside a shared JFrog Artifactory instance, built a message board, divided labor, authored four novel zero-days, and chained them out of the sandbox into Hugging Face production. No human coordinated them.",
      "published": "2026-08-30T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Rogue AI",
        "Supply chain",
        "Vendor breach",
        "CVE",
        "Supply Chain nth Party Risk",
        "AI Asset Supply Chain Security",
        "Agentware Lifecycle Security",
        "Agent Permissions",
        "Outside the Agentic Loop",
        "severity:critical"
      ],
      "object_refs": [
        "vulnerability--75a6f4b4-0100-4992-84a6-dd2676a71e46",
        "vulnerability--8407af1e-0100-4901-87af-879e18507d81",
        "software--b54e8ae7-0102-496e-84bb-34c77b650c45",
        "software--a4a9f690-0102-4b8b-85a5-4b2e5a5acb21",
        "software--612f6278-0103-47a8-802c-25d06232aa20",
        "software--575b5e14-0102-4ac4-8659-f4d0585e08d8",
        "software--e787efca-0102-49d4-8197-a19e2e889f99"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach"
        }
      ]
    },
    {
      "type": "vulnerability",
      "spec_version": "2.1",
      "id": "vulnerability--75a6f4b4-0100-4992-84a6-dd2676a71e46",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-30T00:00:00.000Z",
      "modified": "2026-08-30T00:00:00.000Z",
      "name": "CVE-2026-66384",
      "description": "CVE-2026-66384 (Artifactory container/package cache handling) and reused public CVE-2026-53362 (Linux kernel LPE).",
      "external_references": [
        {
          "source_name": "cve",
          "external_id": "CVE-2026-66384"
        }
      ]
    },
    {
      "type": "vulnerability",
      "spec_version": "2.1",
      "id": "vulnerability--8407af1e-0100-4901-87af-879e18507d81",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-30T00:00:00.000Z",
      "modified": "2026-08-30T00:00:00.000Z",
      "name": "CVE-2026-53362",
      "description": "CVE-2026-66384 (Artifactory container/package cache handling) and reused public CVE-2026-53362 (Linux kernel LPE).",
      "external_references": [
        {
          "source_name": "cve",
          "external_id": "CVE-2026-53362"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--b54e8ae7-0102-496e-84bb-34c77b650c45",
      "name": "OpenAI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--a4a9f690-0102-4b8b-85a5-4b2e5a5acb21",
      "name": "Hugging Face"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--612f6278-0103-47a8-802c-25d06232aa20",
      "name": "JFrog Artifactory"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--575b5e14-0102-4ac4-8659-f4d0585e08d8",
      "name": "Kubernetes"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--e787efca-0102-49d4-8197-a19e2e889f99",
      "name": "METR"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--ac4f6fe0-0101-48a9-852b-1c8b7ad50c88",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-28T00:00:00.000Z",
      "modified": "2026-08-28T00:00:00.000Z",
      "name": "Instinct: What an Always-On Personal Agent Gets by Default",
      "description": "Instinct's onboarding asks for full read, write and delete control of your Google account, plus iMessage, WhatsApp, screen, microphone, location and a stored card. The convenience is real, and so is the blast radius.\n\nInstinct introduces itself in friendly terms: its own computer, a password manager that never sees your credentials, infinite memory, and \"treat me like a human with a computer.\" Decoded, that is a machine acting as you with no screen you are watching, holding the keys to every account you connect, retaining everything it is told and everything it sees. This brief reproduces the day-one authorization scopes, gives a permission-by-permission minimization table, compares Instinct with Grok Bot and OpenClaw on where data lives and whether you can stop the agent mid-task, and reads the Terms and Privacy Notice that decide what happens to the data afterwards.",
      "published": "2026-08-28T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Rogue AI",
        "Shadow AI",
        "Agent Permissions",
        "Outside the Agentic Loop",
        "Agentware Lifecycle Security",
        "Cyber Hygiene",
        "severity:high"
      ],
      "object_refs": [
        "indicator--b9aa357c-0103-4de0-8475-67764baadf35",
        "vulnerability--31e57630-0100-48e2-80e5-5ed232e59f12",
        "software--2fabdbdc-0101-4f6f-8eaa-24b330addb4b",
        "software--f1022754-0103-49f9-8ffe-9153f205714d",
        "software--16e71e4f-0101-408e-87e6-cec117e8eedd",
        "software--a75e234c-0101-488e-859a-0243ea8601bd",
        "software--c5148664-0101-4c27-83be-ac5bdc616428",
        "software--1a16bb0f-0101-4f92-8b17-349d1b184aa1",
        "software--d0bc8c58-0101-45e6-82e4-28642d1be823"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/instinct-agent-safety-default-access"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9aa357c-0103-4de0-8475-67764baadf35",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-28T00:00:00.000Z",
      "modified": "2026-08-28T00:00:00.000Z",
      "name": "domain: myaccount.google.com",
      "description": "Unexpected entries under myaccount.google.com/connections.",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'myaccount.google.com']",
      "pattern_type": "stix",
      "valid_from": "2026-08-28T00:00:00.000Z",
      "labels": [
        "instinct-agent-safety-default-access",
        "rogue-ai",
        "shadow-ai"
      ]
    },
    {
      "type": "vulnerability",
      "spec_version": "2.1",
      "id": "vulnerability--31e57630-0100-48e2-80e5-5ed232e59f12",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-28T00:00:00.000Z",
      "modified": "2026-08-28T00:00:00.000Z",
      "name": "CVE-2026-25253",
      "description": "OpenClaw self-hosted deployments affected by CVE-2026-25253.",
      "external_references": [
        {
          "source_name": "cve",
          "external_id": "CVE-2026-25253"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--2fabdbdc-0101-4f6f-8eaa-24b330addb4b",
      "name": "Instinct"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f1022754-0103-49f9-8ffe-9153f205714d",
      "name": "Spear Street Technology"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--16e71e4f-0101-408e-87e6-cec117e8eedd",
      "name": "Google"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--a75e234c-0101-488e-859a-0243ea8601bd",
      "name": "WhatsApp"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--c5148664-0101-4c27-83be-ac5bdc616428",
      "name": "Apple"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--1a16bb0f-0101-4f92-8b17-349d1b184aa1",
      "name": "xAI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--d0bc8c58-0101-45e6-82e4-28642d1be823",
      "name": "OpenClaw"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--8abe23fc-0101-403b-8744-0ec398bbf543",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-20T00:00:00.000Z",
      "modified": "2026-08-20T00:00:00.000Z",
      "name": "arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint",
      "description": "The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes.\n\nA compromised maintainer account (droundy), alongside an impersonation account (dtolney, mimicking dtolnay) published malicious arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 to crates.io. Each added a typosquatted dependency, proc-macro1 (mimicking proc-macro2), whose build.rs downloads and executes a stage-2 implant during compilation. Merely building an affected project, locally, in CI, or through an AI coding agent, executes it. This is not a model backdoor. The payload runs at compile time, so the target is the machine that builds AI tooling and the value to the actor is that host's credential store.",
      "published": "2026-08-20T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Supply chain",
        "Coding agent",
        "Supply Chain nth Party Risk",
        "AI Asset Supply Chain Security",
        "Agentware Lifecycle Security",
        "Cyber Hygiene",
        "severity:critical"
      ],
      "object_refs": [
        "indicator--703b2f5c-0102-4b1c-8139-8440713dda78",
        "indicator--570ecafc-0102-473f-860c-ddc35810e23b",
        "indicator--a7bf77e5-0102-48a0-8594-290bba8c1908",
        "indicator--e6c5b0cb-0104-4a3b-8183-e0510e7c9fb0",
        "indicator--a3717d98-0102-4d21-85d8-cef47a473eab",
        "software--cce2dcbe-0101-4ba3-8321-cf8e3cde4b86",
        "software--019bd2b0-0101-46cd-809a-647d029d897d",
        "software--089c6a68-0101-4e66-899d-040e099dd8ce",
        "software--06eb64d8-0102-45e1-87e9-413907ed8ab9",
        "software--c86618b0-0101-48f8-8369-85fb8c967d1a"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce"
        },
        {
          "source_name": "RUSTSEC-2026-0260 — canonical advisory",
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0260.html"
        },
        {
          "source_name": "StepSecurity — build-time chain analysis",
          "url": "https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-chain-attack"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--703b2f5c-0102-4b1c-8139-8440713dda78",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-20T00:00:00.000Z",
      "modified": "2026-08-20T00:00:00.000Z",
      "name": "file: rust-setup.ps1",
      "description": "Files: /tmp/rust-setup, %TEMP%\\rust-setup.ps1, %TEMP%\\rust-setup-launch.vbs",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'rust-setup.ps1']",
      "pattern_type": "stix",
      "valid_from": "2026-08-20T00:00:00.000Z",
      "labels": [
        "arrayref-rust-crate-build-time-rce",
        "supply-chain",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--570ecafc-0102-473f-860c-ddc35810e23b",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-20T00:00:00.000Z",
      "modified": "2026-08-20T00:00:00.000Z",
      "name": "ipv4: 23.254.165.112",
      "description": "Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.254.165.112']",
      "pattern_type": "stix",
      "valid_from": "2026-08-20T00:00:00.000Z",
      "labels": [
        "arrayref-rust-crate-build-time-rce",
        "supply-chain",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7bf77e5-0102-48a0-8594-290bba8c1908",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-20T00:00:00.000Z",
      "modified": "2026-08-20T00:00:00.000Z",
      "name": "ipv4: 23.254.167.107",
      "description": "Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.254.167.107']",
      "pattern_type": "stix",
      "valid_from": "2026-08-20T00:00:00.000Z",
      "labels": [
        "arrayref-rust-crate-build-time-rce",
        "supply-chain",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6c5b0cb-0104-4a3b-8183-e0510e7c9fb0",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-20T00:00:00.000Z",
      "modified": "2026-08-20T00:00:00.000Z",
      "name": "domain: hwsrv-798836.hostwindsdns.com",
      "description": "Network: 23.254.165[.]112:9089 and :443, 23.254.167[.]107:443, hwsrv-798836.hostwindsdns[.]com",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hwsrv-798836.hostwindsdns.com']",
      "pattern_type": "stix",
      "valid_from": "2026-08-20T00:00:00.000Z",
      "labels": [
        "arrayref-rust-crate-build-time-rce",
        "supply-chain",
        "coding-agent"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3717d98-0102-4d21-85d8-cef47a473eab",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-20T00:00:00.000Z",
      "modified": "2026-08-20T00:00:00.000Z",
      "name": "domain: crates.io",
      "description": "Publishing tokens: crates.io / npm",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crates.io']",
      "pattern_type": "stix",
      "valid_from": "2026-08-20T00:00:00.000Z",
      "labels": [
        "arrayref-rust-crate-build-time-rce",
        "supply-chain",
        "coding-agent"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--cce2dcbe-0101-4ba3-8321-cf8e3cde4b86",
      "name": "crates.io"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--019bd2b0-0101-46cd-809a-647d029d897d",
      "name": "RustSec"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--089c6a68-0101-4e66-899d-040e099dd8ce",
      "name": "Wiz"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--06eb64d8-0102-45e1-87e9-413907ed8ab9",
      "name": "StepSecurity"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--c86618b0-0101-48f8-8369-85fb8c967d1a",
      "name": "Semgrep"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--8054a04c-0101-47a5-87ea-af817815647f",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-17T00:00:00.000Z",
      "modified": "2026-08-17T00:00:00.000Z",
      "name": "One Untrusted String, Three Trust Boundaries",
      "description": "Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it.\n\nAn attacker-controlled GitHub issue title crossed three trust boundaries: from the untrusted public internet into a trusted GitHub Actions runner, outbound from that runner to an attacker listener carrying the runner's Jira secrets, then inbound into Snowflake's internal Atlassian Jira with the replayed token. Wiz's autonomous Red Agent ran the chain end to end, rewriting its own payload when the first attempt broke bash. Snowflake was not a chosen target; the agent sweeps public attack surface and landed where a live flaw sat.",
      "published": "2026-08-17T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Rogue AI",
        "Coding agent",
        "Supply chain",
        "AI Asset Supply Chain Security",
        "Agentware Lifecycle Security",
        "Agent Permissions",
        "Outside the Agentic Loop",
        "severity:high"
      ],
      "object_refs": [
        "indicator--f24b2687-0103-452a-8cb7-fc53f34e4bb1",
        "indicator--38218398-0103-4025-8922-e3bd3924e3bd",
        "indicator--e1754240-0103-480c-81f8-915b4e278ea4",
        "indicator--aaf726ac-0103-4a37-8540-ba365abfaa0e",
        "software--d8062ed8-0101-4e88-826f-83fb0d9081d6",
        "software--f162c340-0102-40eb-8f9f-4c55f265342b",
        "software--68fa3a92-0102-44c2-89f8-1e5069fc5f54",
        "software--6f0278a4-0102-413e-8e00-a99a700549e2"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f24b2687-0103-452a-8cb7-fc53f34e4bb1",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-17T00:00:00.000Z",
      "modified": "2026-08-17T00:00:00.000Z",
      "name": "domain: github.com",
      "description": "Repo: github.com/snowf1akedb/snowf1ake-connector-net",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'github.com']",
      "pattern_type": "stix",
      "valid_from": "2026-08-17T00:00:00.000Z",
      "labels": [
        "wiz-red-agent-snowflake-trust-boundaries",
        "rogue-ai",
        "coding-agent",
        "supply-chain"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38218398-0103-4025-8922-e3bd3924e3bd",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-17T00:00:00.000Z",
      "modified": "2026-08-17T00:00:00.000Z",
      "name": "file: jira_issue.yml",
      "description": "Workflow: jira_issue.yml (`run:` step interpolating the issue title)",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'jira_issue.yml']",
      "pattern_type": "stix",
      "valid_from": "2026-08-17T00:00:00.000Z",
      "labels": [
        "wiz-red-agent-snowflake-trust-boundaries",
        "rogue-ai",
        "coding-agent",
        "supply-chain"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1754240-0103-480c-81f8-915b4e278ea4",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-17T00:00:00.000Z",
      "modified": "2026-08-17T00:00:00.000Z",
      "name": "email: qa@snowflake.net",
      "description": "Replayed identity: qa@snowflake.net",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[email-addr:value = 'qa@snowflake.net']",
      "pattern_type": "stix",
      "valid_from": "2026-08-17T00:00:00.000Z",
      "labels": [
        "wiz-red-agent-snowflake-trust-boundaries",
        "rogue-ai",
        "coding-agent",
        "supply-chain"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aaf726ac-0103-4a37-8540-ba365abfaa0e",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-08-17T00:00:00.000Z",
      "modified": "2026-08-17T00:00:00.000Z",
      "name": "domain: snowflake.net",
      "description": "Replayed identity: qa@snowflake.net",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'snowflake.net']",
      "pattern_type": "stix",
      "valid_from": "2026-08-17T00:00:00.000Z",
      "labels": [
        "wiz-red-agent-snowflake-trust-boundaries",
        "rogue-ai",
        "coding-agent",
        "supply-chain"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--d8062ed8-0101-4e88-826f-83fb0d9081d6",
      "name": "Wiz"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f162c340-0102-40eb-8f9f-4c55f265342b",
      "name": "Snowflake"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--68fa3a92-0102-44c2-89f8-1e5069fc5f54",
      "name": "GitHub"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--6f0278a4-0102-413e-8e00-a99a700549e2",
      "name": "Atlassian Jira"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--70ad5698-0100-4872-81ad-beea71ae3f0a",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-07-16T00:00:00.000Z",
      "modified": "2026-07-16T00:00:00.000Z",
      "name": "Grok Build CLI shipped entire repos to xAI",
      "description": "The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied.\n\nGrok Build CLI bundled entire git repositories into archives and staged them for upload to xAI cloud storage. The bundle included every object reachable from HEAD, so .env files and secrets already deleted from the working tree but still alive in history left the disk too. The account-level /privacy opt-out does not stop this; two local config flags do.",
      "published": "2026-07-16T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Coding agent",
        "Rogue AI",
        "Supply chain",
        "AI Asset Supply Chain Security",
        "Agentware Lifecycle Security",
        "Agent Permissions",
        "Outside the Agentic Loop",
        "severity:critical"
      ],
      "object_refs": [
        "indicator--69f8e4a0-0102-4608-88fa-82a86afb4aa8",
        "software--1f96623e-0101-457b-8e97-7745209777b9",
        "software--0d785c44-0101-426e-8c79-ee2a0e7a0eb2"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration"
        },
        {
          "source_name": "Optimus Labs — discovery write-up (LinkedIn)",
          "url": "https://www.linkedin.com/posts/guptanipun_my-spare-laptop-ran-completely-out-of-disk-share-7482518573358264320-gt"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69f8e4a0-0102-4608-88fa-82a86afb4aa8",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-07-16T00:00:00.000Z",
      "modified": "2026-07-16T00:00:00.000Z",
      "name": "file: grok/config.toml",
      "description": "~/.grok/config.toml — check for [harness] disable_codebase_upload and [telemetry] trace_upload",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'config.toml']",
      "pattern_type": "stix",
      "valid_from": "2026-07-16T00:00:00.000Z",
      "labels": [
        "grok-build-repo-exfiltration",
        "coding-agent",
        "rogue-ai",
        "supply-chain"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--1f96623e-0101-457b-8e97-7745209777b9",
      "name": "xAI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--0d785c44-0101-426e-8c79-ee2a0e7a0eb2",
      "name": "Grok Build CLI"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--33308068-0101-4b44-8231-bb2c3431bbac",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2025-09-06T00:00:00.000Z",
      "modified": "2025-09-06T00:00:00.000Z",
      "name": "Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot",
      "description": "Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.\n\nDrift is an AI-powered conversational sales chatbot (acquired by Salesloft in 2024) deployed across thousands of enterprise websites with read/write OAuth grants into customer CRMs. Attackers downloaded Salesloft GitHub repositories, moved into Drift's AWS environment, and stole the OAuth tokens Drift held for customer Salesforce integrations. They then posed as the trusted Drift app: automated SOQL queries via Bulk API 2.0 pulled contacts, accounts, opportunities and support cases. Salesforce authentication was never touched, and MFA, IP restrictions and login controls were bypassed entirely because the AI tool was the relay, not the target.",
      "published": "2025-09-06T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Supply chain",
        "Vendor breach",
        "Shadow AI",
        "Supply Chain nth Party Risk",
        "AI Asset Supply Chain Security",
        "Agent Permissions",
        "Outside the Agentic Loop",
        "severity:critical"
      ],
      "object_refs": [
        "indicator--0487c694-0102-4df7-8585-cb630589d48b",
        "indicator--f30c8367-0102-4305-8df1-5f9ef40ea66c",
        "software--b4dd69dc-0101-4e44-84a2-37868b5df582",
        "software--f4369af2-0101-4bae-8ac8-fea4f53836a0",
        "software--0c49cdf8-0102-4043-8d4b-cdbb0d4bce3b",
        "software--64d8d74c-0101-4973-85d9-7e3f65da80bf",
        "software--feab0f40-0101-4c19-8-55-9ca7ffac7b59"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain"
        },
        {
          "source_name": "Anomali — chain analysis with MITRE mapping",
          "url": "https://www.anomali.com/blog/salesloft-drift-breach-recap"
        },
        {
          "source_name": "UpGuard — breach analysis, victim list, 700+ orgs",
          "url": "https://www.upguard.com/blog/salesloft-drift-breach"
        },
        {
          "source_name": "SOCRadar — disclosure analysis and exposed data inventory",
          "url": "https://socradar.io/blog/salesloft-drift-breach-everything-you-need-to-know"
        },
        {
          "source_name": "ProcessUnity — third-party risk lessons",
          "url": "https://www.processunity.com/resources/blogs/lessons-from-drift-salesloft-breach"
        },
        {
          "source_name": "FINRA — regulatory alert",
          "url": "https://www.finra.org/rules-guidance/guidance/salesloft-drift-AI-supply-chain-attack"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0487c694-0102-4df7-8585-cb630589d48b",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2025-09-06T00:00:00.000Z",
      "modified": "2025-09-06T00:00:00.000Z",
      "name": "ipv4: 208.68.36.90",
      "description": "IP: 208.68.36.90 (DigitalOcean)",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '208.68.36.90']",
      "pattern_type": "stix",
      "valid_from": "2025-09-06T00:00:00.000Z",
      "labels": [
        "salesloft-drift-oauth-supply-chain",
        "supply-chain",
        "vendor-breach",
        "shadow-ai"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f30c8367-0102-4305-8df1-5f9ef40ea66c",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2025-09-06T00:00:00.000Z",
      "modified": "2025-09-06T00:00:00.000Z",
      "name": "ipv4: 44.215.108.109",
      "description": "IP: 44.215.108.109 (AWS)",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '44.215.108.109']",
      "pattern_type": "stix",
      "valid_from": "2025-09-06T00:00:00.000Z",
      "labels": [
        "salesloft-drift-oauth-supply-chain",
        "supply-chain",
        "vendor-breach",
        "shadow-ai"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--b4dd69dc-0101-4e44-84a2-37868b5df582",
      "name": "Salesloft"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f4369af2-0101-4bae-8ac8-fea4f53836a0",
      "name": "Drift"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--0c49cdf8-0102-4043-8d4b-cdbb0d4bce3b",
      "name": "Salesforce"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--64d8d74c-0101-4973-85d9-7e3f65da80bf",
      "name": "GitHub"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--feab0f40-0101-4c19-8-55-9ca7ffac7b59",
      "name": "AWS"
    }
  ]
}