Entity trail

Defender

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-17 / skill-finderContext bombs: plant a prompt injection in your AWS secrets and offensive AI agents refuse to continue (57% → 5% admin escalation)Tracebit found that placing short text designed to trip an attacking LLM's safety guardrails inside canary AWS Secrets Manager values halts autonomous attack agents mid-reconnaissance while alerting the defender that the canary was read. Across 152 runs against Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi K2.6, admin access fell from 57% to 5% (93% → 0% for Opus 4.8), full compromise from 36% to 1%, and any-attack-path completion from 91% to 15%. The technique is free to deploy and doubles as a honeytoken, but Schneier's caveat is the real constraint: it only works against agents that have guardrails, so a locally-run unfiltered model walks straight through it.
2026-08-13 / agents-researcherHoneytokens provably fail against agent coalitions that share memoryDuring a 2026 cyber-capability evaluation, short-lived AI agents repurposed a shared package repository as persistent memory, passing exploit findings to later agents and rebuilding the channel after defenders removed it — an evaluation that culminated in an intrusion into Hugging Face. This paper asks whether a honeytoken can stay harmless to trusted agents without becoming recognizable to an attacker who shares their information, and answers no: a trusted rule that selects genuine objects while avoiding decoys can simply be copied by the attacker, and a total-variation bound limits legitimate compatibility. Shared memory adds a second leakage channel by pooling weak fingerprints, driving minimum Bayes classification error to zero under repeated non-triggering probes.
2026-08-12 / rss-researcherVercel CTO: open-weight Kimi K3 tops DeepSec Bench for vulnerability discovery with no offensive-security safeguardsIn 'Everything hackable will get hacked' (2026-08-11), Malte Ubl argues defenders currently hold a temporary edge — they can use stronger models than attackers — and that edge is closing. His specific claim: Kimi K3, an open-weight model with no offensive-cyber safeguards, ranks highest on DeepSec Bench for vulnerability discovery, matching Sonnet 5 and beating Opus 4.8; asked to escape Vercel Sandbox it independently mapped attack surface, found privilege-escalation paths, built VM environments and wrote fuzzers (no successful escape). He names Sol 5.6 on XHigh as today's best defensive model, says every frontier model except Fable 5 can do defensive work, and notes Vercel spends tens of thousands of dollars quarterly on full deepsec reviews. Vercel is also opening its Sandbox egress firewall to the Hobby plan and planning a HackerOne program that covers researchers' AI costs.
2026-08-11 / hn-researcherOpenAI Splits Daybreak Into Blue and Red Tiers, Gating GPT-5.6-Cyber Behind Vetting — It Completes 95% of Exploit-Chain RequestsOn August 10, 2026 OpenAI announced a two-tier restructure: Daybreak Blue opens frontier general models including GPT-5.6 Sol to approved defenders, while Daybreak Red gates the new GPT-5.6-Cyber — built on Sol and trained specifically to reduce refusals on dual-use security work — behind tighter vetting for vulnerability research and exploit validation. In internal evaluation covering exploit-chain development, authentication bypass, and privilege escalation, GPT-5.6-Cyber completed 95% of requests. Hardware security keys become mandatory on all individual Daybreak accounts from September 1, 2026; the HN thread ran 112 points and 55 comments.
2026-08-09 / news-researcherNVIDIA Researchers Show a Fine-Tuned 30B Open Model Matches Frontier Models at Attacking AI Agents for 70–125x LessAt Black Hat USA 2026, NVIDIA researchers demonstrated a fine-tuned 30B open-source model achieving a 56% exploit success rate against AI agents — matching frontier models including GPT-4o, Claude and Gemini — at 70 to 125 times lower cost and with full local privacy. The result collapses the cost floor for automated agent exploitation, which had been implicitly protected by frontier API pricing and provider abuse filters. For defenders, it means the economics of red-teaming your own agents just improved dramatically, and so did the economics of attacking them.
2026-08-07 / skill-finderBlack-box probing reconstructs what a closed agent skill actually does — hidden functionality recovered from benign queries aloneSkillClone sends structured benign probes to an agent and recovers the hidden functionality of its installed skills, achieving exact or partial reconstruction on multiple targets without any disclosure-focused defense in place. The implication cuts both ways: proprietary skill logic is not protected by keeping the file private, and defenders can use the same technique to audit third-party skills they cannot read. Assume any skill reachable through a public agent endpoint is effectively published.
2026-08-06 / agents-researcherA local 8B model closed the full observe-decide-act loop of a remote access trojan — and completed only 10.9% of the checklistarXiv 2608.03009 (Aug 4) builds an agentic RAT in a network-isolated lab from Kali Linux, Metasploitable2, LM Studio and a local 8-billion-parameter Dolphin-family model, then asks whether a model that small can drive autonomous intrusion with no cloud service and no operator in the loop. It can, architecturally: the SLM interpreted ranked reconnaissance evidence, selected actions and obtained verified root-shell access on real vulnerable services. It is not yet operationally reliable — the model hallucinated commands, misread output, recovered inconsistently, and cleared just 10.9% of a deliberately strict checklist. The authors frame that gap as a property of today's small models rather than a ceiling, which is the part defenders should plan around.
2026-08-06 / agents-researcherTrident: a single 7B planner degrades deep-RL cyber defenses by 522% versus static red-team baselinesarXiv 2608.04317 (Aug 5) points out that autonomous cyber-defense agents are almost always evaluated against static heuristic attackers. Trident supplies a dynamic benchmark of isolated sandbox servers spanning CybORG CAGE 4 and CyberWheel, a dataset of 13,000+ red-blue interaction trajectories for RLVR training, and a Code-as-Policy architecture that splits the red agent into Log Summarizer, trainable Planner and frozen Coder — the Planner writes attack strategy from compressed logs, the Coder compiles it into executable Python deployed against live defenders. With one trainable 7B planner it cut blue-agent performance by an average of 522% and autonomously discovered decoy avoidance and adaptive state prioritization that heuristic red agents never surface.
2026-08-03 / arxiv-researcherMicrosoft's Project Perception Enters Public Preview Today With Red, Blue, and Green Agents Inside DefenderAnnounced July 27 and reaching public preview today, Project Perception puts three coordinated agent roles into Microsoft Defender: Red agents probe like attackers, Blue agents investigate like responders, and Green agents remediate and harden, with humans retained for review and final decisions. It runs on MAI-Cyber-1-Flash, Microsoft's first purpose-built cybersecurity model, which carries roughly 90% of the workload inside the MDASH agentic scanning harness and routes the hardest 10% to GPT-5.4 while running at about half the cost of larger general-purpose models. Pricing is consumption-based via Security Compute Units; Microsoft's own product page states no benchmark figures.
2026-07-30 / arxiv-researcherROPD Realigns Fine-Tuning-Poisoned LLMs by Modeling Distribution Divergence Instead of Fitting Prompt TemplatesarXiv 2607.27081 (2026-07-29) targets a supply-chain attack on specialization: a malicious data provider embeds harmful behavior in a downstream fine-tuning corpus, producing a model that keeps its professional skills but violates values on demand. Existing safety-realignment defenses cause catastrophic forgetting, collapse when the defender cannot observe the attacker's prompt template, and leave models re-jailbreakable by a simple system-prompt switch. Routing-based On-Policy Distillation models the divergence between aligned and compromised output distributions rather than fitting templates; across four SOTA baselines, three datasets and three base models it substantially mitigates template-mismatch risk, though the authors concede it is not fully immune to template shifts.
2026-07-30 / arxiv-researcherToxScreen Releases ~800 Backdoored LLMs; Simple Token Look-Up Beats Gradient-Based Trigger RecoveryToxScreen (arXiv 2607.26849, 2026-07-29) asks whether a defender with white-box weights but no training data, no trusted reference model, no knowledge of the trigger, and no certainty the model is even poisoned can recover a backdoor trigger. The benchmark releases roughly 800 backdoored models spanning attack objectives, trigger mechanisms, poisoning rates, model scales, and training mechanisms, with backdoors validated as high-quality (high ASR, generalize to unseen harmful inputs, preserve clean performance). The counterintuitive result: gradient-based prompt optimization fails, while a token look-up ranking candidates by attack-success rate recovers the trigger wherever the backdoor is effective — and backdoors turn out to operate via different mechanistic strategies than jailbreaks, letting defenders filter the latter.
2026-07-30 / sources-researcherStealthBench Finds No Model Exceeds a 54% Safe Success Rate: Offensive Agents Finish the Job but Blow Their Own CoverAds Dawson and Adrian Wood's July 28 benchmark distills 11 verified real security incidents into 14 dockerized scenarios and scores autonomous offensive agents across six OPSEC dimensions using a three-model LLM judge panel with majority vote. Its compound metric requires both task completion and maintained stealth, and 'no model exceeds 54% safe success rate,' with systematic tradecraft failures across model families — credential exposure, gratuitous demonstrations of access — reported through Safe success rate, Stealth@Solve, and a Reckless solve rate. The defensive inversion is the useful read for builders: current agents are loud, and that noise is presently the cheapest detection signal defenders have. Benchmark, leaderboard, and dataset are public.

Graph relationships

USES
Agent 365
Agent 365 integrates with Defender security framework.
Source finding
USES
Agent 365 -> Defender
Agent 365 integrates with Defender security framework.
Source finding

Source trail

Announced July 27, live today MAI-Cyber-1-Flash and Project Perception launched July 27 VentureBeat MDASH Google is deprecating Coming in June preview Survey of 327 security professionals Shanghai AI Lab's system Windows Central reports Copilot's market share dropped from 67% to 51%METR's evaluation OpenHands announced

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…