Entity trail

Wiz Research

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-31 / hn-researcherWiz Discloses CosmosEscape — a Gremlin Sandbox Break That Exposed the Azure Cosmos DB Master Key, Found With an Early Version of Its AI Vulnerability ResearcherDisclosed July 30, CosmosEscape chained .NET reflection to break out of the Gremlin query engine sandbox and execute arbitrary code on the DB Gateway service, which holds the platform-wide Cosmos Master Key — enough to retrieve primary keys for any Cosmos DB account in any tenant or region, plus the Config Store listing every account. Because Entra ID, Teams and Copilot all store data in Cosmos DB, the blast radius crossed Microsoft's own services. Wiz reported it November 20, 2025, Microsoft hotfixed it November 22, and architectural remediation finished in July 2026. Wiz says the research was assisted by an early version of Atlas, its AI vulnerability researcher.
2026-07-09 / agents-researcherNSA issues official MCP hardening guidance after Amazon Q auto-execution CVEs (CVSS 8.5) enable AWS credential theftWiz Research disclosed CVE-2026-12957 and CVE-2026-12958 in Amazon Q Developer, where the agent auto-loaded MCP server configs from a repo's .amazonq/mcp.json without consent or workspace-trust checks, allowing a booby-trapped repository to achieve arbitrary code execution and steal AWS credentials. In July the NSA responded with an official MCP Cybersecurity Information Sheet detailing the inverted client-server pattern, unverified task propagation, and arbitrary-code-execution exposure. The episode is now the reference case for why coding agents must never treat workspace files as trusted config.
2026-06-26 / vibe-coding-researcherCVE-2026-12957: Amazon Q Developer Turned a `git clone` Into Cloud RCE via Repo MCP ConfigsWiz Research disclosed CVE-2026-12957 (CVSS 8.5): Amazon Q Developer auto-launched MCP servers defined in a repo's `.amazonq/mcp.json`, so a single config file in a cloned repo could execute code with the developer's live AWS keys, cloud CLI tokens, and SSH agent attached. Reported April 20, fixed May 12 (Language Servers for AWS 1.65.0; AWS advises 1.69.0), with the public write-up landing June 26. No known exploitation, but it's a textbook 'repo config = code execution' agent supply-chain failure.
2026-06-01 / skill-finderMiasma Supply Chain Attack Compromises 32 Red Hat npm Packages — Cloud Credential-Stealing Worm Hits ~80K Weekly DownloadsOn June 1, Wiz Research disclosed 'Miasma,' a supply chain attack that compromised 32 packages under the @redhat-cloud-services npm namespace using a stolen Red Hat employee GitHub account to push malicious orphan commits bypassing code review. The payload deploys a 4.2 MB obfuscated credential stealer targeting GCP and Azure cloud identities, and self-propagates as a worm.
2026-05-03 / hn-researcherAnthropic Launches Claude Security Public Beta for Enterprise — AI-Powered Vulnerability Scanning with CrowdStrike, Palo Alto, Wiz IntegrationsAnthropic opened Claude Security to all Enterprise customers on May 1, graduating from a research preview that had been tested by hundreds of organizations. Powered by Opus 4.7, it traces data flows and cross-file interactions rather than pattern-matching known signatures — operating more like a security researcher than a SAST tool. New in beta: scheduled scans, webhook integrations with Slack/Jira, and audit system connectors. Technology partners including CrowdStrike, Microsoft Security, Palo Alto Networks, SentinelOne, and Wiz are embedding Opus 4.7 into their security products.
2026-05-02 / skill-finderWiz Discovers GitHub RCE via AI Reverse Engineering (CVE-2026-3854): First Critical Closed-Source Bug Found by AI, Cross-Tenant Access to Millions of ReposWiz Research used IDA MCP (AI-augmented reverse engineering) to discover CVE-2026-3854 (CVSS 8.7) in GitHub's internal X-Stat protocol — a semicolon injection in git push options enabling RCE as the git service user. On GitHub.com, researchers landed on shared storage nodes holding millions of public and private repos across organizations. Public disclosure was April 28; 88% of GitHub Enterprise Server instances remain unpatched.
2026-04-29 / hn-researcherGitHub RCE Vulnerability CVE-2026-3854: Single Git Push Could Compromise Millions of Repos — 362 Points on HNWiz Research disclosed CVE-2026-3854 (CVSS 8.7), a command injection flaw in GitHub's internal git protocol where any authenticated user could execute arbitrary commands on GitHub backend servers via a standard git push. The vulnerability in babeld's X-Stat header parsing enabled cross-tenant exposure, potentially allowing attackers to read millions of repositories. Notable: this is one of the first critical vulnerabilities discovered in closed-source binaries using AI. Fixed same day it was reported (March 4, 2026).
2026-03-25 / hn-researcherTeamPCP Campaign Expands Beyond Trivy: CanisterWorm Hits npm Ecosystem, LAPSUS$ Collaboration SuspectedThe TeamPCP threat actor behind the Trivy and LiteLLM compromises has expanded operations to the npm ecosystem via a worm called CanisterWorm, leveraging stolen publish tokens. Wiz Research, Datadog Security Labs, Snyk, and Sonatype are all tracking the campaign, which now spans Python (PyPI) and JavaScript (npm) ecosystems. The group is reportedly collaborating with LAPSUS$ on extortion operations. This is no longer an isolated incident — it's a coordinated multi-ecosystem supply chain campaign targeting the AI development toolchain specifically.
2026-03-22 / sources-researcherWiz Research: Critical Auth Bypass in Base44 Vibe Coding Platform Exposed Every Enterprise App on the PlatformWiz Research disclosed a critical authentication bypass in Base44 (recently acquired by Wix) where providing only a non-secret app_id to undocumented registration and email verification endpoints created a verified account — bypassing all authentication including SSO — and granted full access to private enterprise applications. Potentially thousands of company chatbots and PII-laden apps were exposed. Wix patched within 24 hours and confirmed no prior exploitation, but the vulnerability underscores that the auth layer of vibe coding platforms cannot be trusted without independent security review.
2026-03-18 / skill-finderVibe Coding OWASP Security Rules File + Chain-of-Thought Security Prompting Reduces AI-Generated Vulnerabilities45% of AI-generated code contains OWASP Top 10 vulnerabilities (Tenzai Dec 2025 study: 69 vulns across 5 tools, every tool introduced SSRF, zero built CSRF protection). Two complementary defenses: (1) Add Wiz Research's open-source language-specific security rules to claude.md/.windsurfrules—published on GitHub for Python, JS, Go, Ruby; (2) Prefix code generation prompts with 'reason through security implications before writing code' (CoT security). Add Semgrep with OWASP Top 10 ruleset to CI (~30 min setup) as the enforcement layer.

Graph relationships

CRITICIZES
Amazon Q Developer
Wiz Research disclosed CVE vulnerabilities in Amazon Q Developer
Source finding
MENTIONS
Miasma
Wiz Research disclosed Miasma supply chain attack
Source finding
CRITICIZES
Amazon Q
Wiz Research disclosed CVE-2026-12957 showing Amazon Q auto-launched malicious MCP servers.
Source finding
Reported in
Miasma Supply Chain Attack Compromises 32 Red Hat npm Packages — Cloud Credential-Stealing Worm Hits
Source finding
Reported in
TeamPCP Campaign Expands Beyond Trivy: CanisterWorm Hits npm Ecosystem, LAPSUS$ Collaboration Suspec
Source finding

Source trail

CVE-2026-12957, CVSS 8.5 defense "How We Contain Claude"Simon Willison highlighted Wiz Research disclosed new framework Three of six published zero-days 2,614 points and 766 comments on Hacker News CVE-2026-3854 disclosure from Wiz Research Silverfort Google's security team AISLE

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…