Evidence

Where AI Vulnerability Discovery Harnesses Go Quiet

Commit-specific harness analysis with selection-stage demonstrations.

Who Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers, William Jeffries

Who Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers, William Jeffries

WIRED - Zoom screen-sharing takeover bug

Wiz incident reconstruction: Anatomy of a real AI-driven cloud attack

Wiz CIRT reconstructs a real cloud intrusion through an exposed Kafka UI, compromised cloud and IdP identities, and CI/CD or GitOps effects. The same IP scanned over 600 other environments, not 600 known breaches. The precise automation share and final exported data volume remain uncertain.

Wiz: Black October for AI Developer Platforms and downstream Bedrock key abuse

Research telemetry reconstructing two distinct compromised Bedrock credentials and broader incidents without asserting a common exploit.

Wiz: LiteLLM 1.107.0 credential theft

Wiz traces malicious LiteLLM release artifacts, observed quarantine times and follow-on AWS/Bedrock reconnaissance, separately from vendor removal timestamps.

X-AgentRed: Red-Teaming Personal Agents in Evolving Multi-Service Ecosystems

x402 foundation: per-payment spend controls for TypeScript clients

xAI: Grok Bot approvals, security and privacy

October 20 documentation of approval rules, shared per-user computer state and limits of model-based action review.

XBOW Labs: Zero to Calc in Six Days, full Chrome exploit chain

Technical Oct 13 research account of V8 Maglev, animated WebP and Crashpad issues, with a tested Windows sandbox-escape chain.

XRPL 3.4.1 coordinated disclosure: overflow and Batch wrapper validation

Original XRPL maintainer report on distinct XRP overflow and Batch inner-wrapper issues; credits Veria AI for the overflow report only. Checkpoints DB-RADAR-CP7-CP7A-052 and -053.

ZDI-26-648 / CVE-2026-19590

ZDI-26-649 / CVE-2026-19591