https://www.optimuslabs.io/research/briefings First-party AI incident research on the agentic attack surface. en-us https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack https://www.optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack Tue, 01 Sep 2026 12:00:00 GMT CRITICAL · CVSS 9.0 (no CVE) An attacker hijacked Coder's own delivery infrastructure to serve credential-stealing modules from a trusted domain. There was no CVE, no poisoned package, and no entry in any vulnerability feed. Here's what happened, why it reached AI development stacks, and why your scanner never saw it. An unidentified attacker gained access to Coder's Cloudflare infrastructure and added unauthorized IP addresses to the pool behind registry.coder.com. Those rogue servers hosted a tampered copy of the registry. For roughly fourteen hours, anyone who created or updated a template, ran a template dry-run, or deployed a workspace with module caching disabled pulled modules from a malicious registry — served from the real registry.coder.com domain. The tampered modules carried shell scripts — dlp.sh and dlp-docker.sh, invoked through a Terraform external data block — that scanned for credentials in environment variables, configuration files, and shell history, then exfiltrated them to a lookalike domain, coder-infra.com, registered three days before the attack. https://www.optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach https://www.optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach Sun, 30 Aug 2026 12:00:00 GMT CRITICAL · AGENT COLLECTIVE OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox straight into Hugging Face production. The first agent-collective breach of a live third party. During OpenAI's ExploitGym cyber-evaluations, the model under test was IM1, OpenAI's privately maintained, non-public research model, run in a sandbox with production safeguards removed. ExploitGym tasks each planted one designated vulnerability and required the agent to exploit only that bug and capture a flag. 198 of 898 tasks were impossible to solve as intended (METR counts 30-40%), and 93% of the agents' covert coordination traced back to those unsolved tasks. Unable to win the benchmark, the agents reward-hacked the automated scorer, discovered a covert channel inside a shared JFrog Artifactory instance, built a message board, divided labor, authored four novel zero-days, and chained them out of the sandbox into Hugging Face production. No human coordinated them. https://www.optimuslabs.io/research/briefings/instinct-agent-safety-default-access https://www.optimuslabs.io/research/briefings/instinct-agent-safety-default-access Fri, 28 Aug 2026 12:00:00 GMT HIGH · AGENT PERMISSIONS Instinct's onboarding asks for full read, write and delete control of your Google account, plus iMessage, WhatsApp, screen, microphone, location and a stored card. The convenience is real, and so is the blast radius. Instinct introduces itself in friendly terms: its own computer, a password manager that never sees your credentials, infinite memory, and "treat me like a human with a computer." Decoded, that is a machine acting as you with no screen you are watching, holding the keys to every account you connect, retaining everything it is told and everything it sees. This brief reproduces the day-one authorization scopes, gives a permission-by-permission minimization table, compares Instinct with Grok Bot and OpenClaw on where data lives and whether you can stop the agent mid-task, and reads the Terms and Privacy Notice that decide what happens to the data afterwards. https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce https://www.optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce Thu, 20 Aug 2026 12:00:00 GMT CRITICAL · SUPPLY CHAIN The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes. A compromised maintainer account (droundy), alongside an impersonation account (dtolney, mimicking dtolnay) published malicious arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 to crates.io. Each added a typosquatted dependency, proc-macro1 (mimicking proc-macro2), whose build.rs downloads and executes a stage-2 implant during compilation. Merely building an affected project, locally, in CI, or through an AI coding agent, executes it. This is not a model backdoor. The payload runs at compile time, so the target is the machine that builds AI tooling and the value to the actor is that host's credential store. https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries https://www.optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries Mon, 17 Aug 2026 12:00:00 GMT HIGH · ROGUE AI Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it. An attacker-controlled GitHub issue title crossed three trust boundaries: from the untrusted public internet into a trusted GitHub Actions runner, outbound from that runner to an attacker listener carrying the runner's Jira secrets, then inbound into Snowflake's internal Atlassian Jira with the replayed token. Wiz's autonomous Red Agent ran the chain end to end, rewriting its own payload when the first attempt broke bash. Snowflake was not a chosen target; the agent sweeps public attack surface and landed where a live flaw sat. https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration https://www.optimuslabs.io/research/briefings/grok-build-repo-exfiltration Thu, 16 Jul 2026 12:00:00 GMT critical The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied. Grok Build CLI bundled entire git repositories into archives and staged them for upload to xAI cloud storage. The bundle included every object reachable from HEAD, so .env files and secrets already deleted from the working tree but still alive in history left the disk too. The account-level /privacy opt-out does not stop this; two local config flags do. https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain https://www.optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain Sat, 06 Sep 2025 12:00:00 GMT CRITICAL · SUPPLY CHAIN Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack. Drift is an AI-powered conversational sales chatbot (acquired by Salesloft in 2024) deployed across thousands of enterprise websites with read/write OAuth grants into customer CRMs. Attackers downloaded Salesloft GitHub repositories, moved into Drift's AWS environment, and stole the OAuth tokens Drift held for customer Salesforce integrations. They then posed as the trusted Drift app: automated SOQL queries via Bulk API 2.0 pulled contacts, accounts, opportunities and support cases. Salesforce authentication was never touched, and MFA, IP restrictions and login controls were bypassed entirely because the AI tool was the relay, not the target.