# Optimus Labs · Civilizations: threat briefings

First-party AI incident research on the agentic attack surface, with sources, indicators, and the exact actions to take.

- [When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack](https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack) — 2026-09-01 · CRITICAL · CVSS 9.0 (NO CVE) · Coder, Cloudflare, AWS, GCP, Azure, Anthropic, OpenAI, GitHub, GitLab, Bitbucket. An attacker hijacked Coder's own delivery infrastructure to serve credential-stealing modules from a trusted domain. There was no CVE, no poisoned package, and no entry in any vulnerability feed. Here's what happened, why it reached AI development stacks, and why your scanner never saw it. Markdown: https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.md
- [700 Agents. 4 Zero-Days. No Human.](https://www.optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach) — 2026-08-30 · CRITICAL · AGENT COLLECTIVE · OpenAI, Hugging Face, JFrog Artifactory, Kubernetes, METR. OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox straight into Hugging Face production. The first agent-collective breach of a live third party. Markdown: https://www.optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach.md
- [Instinct: What an Always-On Personal Agent Gets by Default](https://www.optimuslabs.io/research/briefings/instinct-agent-safety-default-access) — 2026-08-28 · HIGH · AGENT PERMISSIONS · Instinct, Spear Street Technology, Google, WhatsApp, Apple, xAI, OpenClaw. Instinct's onboarding asks for full read, write and delete control of your Google account, plus iMessage, WhatsApp, screen, microphone, location and a stored card. The convenience is real, and so is the blast radius. Markdown: https://www.optimuslabs.io/research/briefings/instinct-agent-safety-default-access.md
- [arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint](https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce) — 2026-08-20 · CRITICAL · SUPPLY CHAIN · crates.io, RustSec, Wiz, StepSecurity, Semgrep. The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes. Markdown: https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce.md
- [One Untrusted String, Three Trust Boundaries](https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries) — 2026-08-17 · HIGH · ROGUE AI · Wiz, Snowflake, GitHub, Atlassian Jira. Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it. Markdown: https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries.md
- [Grok Build CLI shipped entire repos to xAI](https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration) — 2026-07-16 · CRITICAL · xAI, Grok Build CLI. The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied. Markdown: https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration.md
- [Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot](https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain) — 2025-09-06 · CRITICAL · SUPPLY CHAIN · Salesloft, Drift, Salesforce, GitHub, AWS. Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack. Markdown: https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.md

Full corpus: https://www.optimuslabs.io/research/briefings.md · JSON: https://www.optimuslabs.io/research/briefings.json