~/blog
Every transmission from the lab — adversarial AI research, offensive security tutorials, threat analysis, and the legacy Dr. Chaos archive.
238 articles from the new era
OpenCode called it a "large scale distillation attack." The victims called it an overnight bill. What happened to OpenCode Console users' stored OpenAI, Anthropic, and Google keys, why a hosted key store changes the blast radius, what "distillation" can and cannot mean here, a twenty-minute key lockdown for each provider, and what anyone building a bring-your-own-key console should change.
MITRE ATT&CK v20 adds five AI techniques to the Enterprise matrix: Direct and Indirect Prompt Injection under Execution, AI-Enabled Exfiltration, AI Result Poisoning, and Impair Autonomous Defenses. Why the placement matters more than the count, what the direct versus indirect split means for your trust boundaries, how MITRE's exfiltration analytic actually works, and the detection gaps you should know about before your next coverage report.
Meta's Muse Wonder and Muse Wonder Full are real frontier models built for personal agents. What Meta shipped, how to read its benchmark and safety charts, what independent tests and six launch-week videos found, what r/MetaAI users are saying, and why the security that matters lives in the Muse product, not in the model developers get through the API.
Mistral Large 4 and Reflection AI's Beam are the first Western open-weight frontier models in a long while, and neither has shipped a weight file yet. What the two announcements actually say, what the cyber benchmarks really measure, why a security team should care about weights it can hold, and the straight story on "Mistral Dolphin": what an uncensored fine-tune is, how it is made, how operators use it, and where the guardrail goes once the vendor's is gone.
The serious attack surface is no longer the chatbot. It is the agent's toolbelt: retrieval, memory, skills, CI pipelines, credentials, and every renderer or proxy trusted to move data. A field analysis of EchoLeak, malicious agent skills, coding-agent compromise, state-scale campaigns, and data poisoning, separating confirmed incidents from research demonstrations, with the containment architecture that actually holds up.
Muse, Amazon Quick, Hermes Agent and OpenClaw all promise to do more than chat. That is roughly where the similarities end. A practical comparison of four very different bets (hosted convenience, governed workplace AI, a self-improving runtime, and a local-first gateway), plus a security lens on each: where the lethal trifecta lives, and how to harden the two you run yourself.
Black Hat and DEF CON land in the same week in Las Vegas every year, and every year one story ends up getting told in the hallways more than the others. Usually it takes a couple of days to sort out which story won. This year, it took about a morning.
A balanced cybersecurity review of Moonshot's Kimi K3 and the multi-agent K3 Swarm. Not "is it smart" but the question a red team actually asks: does an open, self-hostable, agentic model make you more effective on an engagement, and what does it give you that Claude and GPT cannot? Data that stays in the room, no vendor holding your engagement hostage, cost at scale, and a swarm that fits the work, weighed honestly against where the closed frontier models still win.
The webshell is the cockroach of offensive security: one line of code, arbitrary command execution, and still everywhere. A deep dive into what webshells are, how attackers plant and use them, how red and blue teams both put them to work, plus a hands-on Docker lab where you build a vulnerable app, drop a shell, use it, and then detect and defend against it three different ways.
AI automation quietly became critical infrastructure that security never signed off on. A deep look at where automation actually is in 2026, the real differences between Zapier, Make, and n8n, when to reach for each, and why every one of them is a beautiful new attack surface: standing credentials, unauthenticated webhooks, shadow automation, and prompt injection into agents that hold tools.
A hands-on Impacket tutorial for beginners: build a lab, then walk Kerberoasting, AS-REP roasting, secretsdump/DCSync, and remote execution end to end — with the red team, blue team, and attacker view of each, plus the exact Windows event IDs that detect them and the controls that stop them.
Build a lab Active Directory domain, collect it with SharpHound, and use BloodHound CE to find the permission chains that lead to Domain Admin — plus how red teams, blue teams, and real attackers each use it, and how to detect and dismantle the paths.