Why centralized desktop delivery is making a comeback

The pendulum of enterprise IT has swung again. For years, the narrative was dominated by “decentralization” and “edge computing,” as organizations scrambled to support a mobile workforce with a proliferation of high-powered laptops and local processing. However, a significant shift is occurring. CIOs are increasingly returning to a centralized strategy as a sophisticated leap forward into a secure, AI-native future. Gartner® predicts virtual desktops will be the main workspace for 20% of workers by 2027, doubling the 2019 figure.

The “comeback” of centralized IT is driven by a stark reality: the distributed model has reached a point of diminishing returns, characterized by “shadow data,” escalating security breaches, and ballooning management costs. Modern centralized architectures, specifically Desktop as a Service (DaaS), is now the strategic engine driving enterprise speed, productivity, and resilience.

Why distributed risk is becoming untenable

The status quo of managing thousands of vulnerable, independent endpoints is a losing proposition in today’s threat landscape. When sensitive data lives on every device, the attack surface expands exponentially.

• The shadow data crisis: 35% of breaches involved data stored in unmanaged data sources – AKA “shadow data.”
• Endpoint vulnerability: 46% of organizations have experienced a breach specifically due to an unsecured device.
• Management paralysis: IT teams are often slowed down chasing thousands of PCs, reacting to individual endpoint failures instead of driving strategic innovation.
• “Whack-a-mole”: Even when endpoints are managed, any gap in control can be exploited. It’s a costly game of “whack-a-mole” to lock down every attack vector and mitigate every point of data leakage or compromise.

The five pillars of the centralized renaissance

Modern centralization delivers more than just control; it addresses five core requirements of the modern enterprise.

1. Speed and business velocity

Onboarding a new employee should be faster than most enterprises currently achieve. With a centralized model, you can onboard new staff 60% faster by deploying full desktops within minutes, regardless of the user’s physical location or hardware.

2. Operational savings

Centralization drives a reduction in Total Cost of Ownership (TCO) by up to 33% through sheer operational efficiency. Shifting from reactive, device-by-device management to proactive, single-image provisioning, IT teams are freed from the “firefighting” cycle.

3. Workforce productivity

A stable, high-performance workspace leads to a boost in productivity. Centralized approaches like Citrix DaaS and Citrix Secure Access with Chrome Enterprise provide a uniform “like-local” experience that dynamically adjusts to network conditions, ensuring remote workers aren’t penalized by latency.

4. Zero trust security and compliance

By keeping data off endpoints and within a secure, audited environment, centralization becomes the ultimate enabler of zero trust. It simplifies audits for HIPAA, PCI DSS, FedRAMP, and GDPR by providing a single source of truth for all data access and logging.

5. Enterprise resiliency

Disaster recovery shifts from a weeks-long ordeal to a matter of days. Because application logic and data reside in a logically defined central location, business continuity is no longer dependent on the health of individual user devices.

Dismantling the myths

Despite these advantages, some leaders still view centralization through the lens of the “mainframe era.” It is critical to separate these myths from modern reality.

Myth	Reality
Single point of failure	Modern DaaS reduces single points of failure by separating the SaaS control plane from customer-hosted workloads, and then using redundant connectors, zones, and failover-ready resource locations to maintain access during outages.
Poor user experience	New protocols optimize data streams to deliver a responsive experience that is virtually indistinguishable from a local desktop, even for remote workers.
Inflexible /rigid	Current architectures embrace hybrid IT, managing resources across on-premises and multiple public clouds from a single “pane-of-glass” console.
High CapEx	Cloud-based DaaS eliminates upfront capital expenditure entirely, converting it into a predictable, scalable operational expense (OpEx).

The financial case: Managed PCs vs. DaaS

To understand why centralized IT can win the budget battle, let’s look at some data. A modeled TCO comparison across 3-years with 3,000 users implies that a centralized DaaS strategy is projected to be more cost-effective than the traditional managed PC approach.

The hard and soft costs of computing

While hardware costs for DaaS can sometimes appear higher due to server infrastructure, the overall savings in licensing, operations, and productivity are undeniable. In our e-book, Centralized desktops vs. managed PCs: A smarter model for control and cost, we break down the costs of how the two models compare and where the numbers come from. And while your mileage may vary, so to speak, the pendulum has certainly swung in DaaS’s favor for a variety of reasons. Hardware prices have exploded, not to mention the layers of controls and associated costs per solution of endpoint security software.

Cost category (Per user/ per year)	Managed PC	DaaS	Difference (Savings)
Licensing costs	$531.90	$357.00	$174.90
Platform costs (hardware or cloud)	$257.50	$233.89	$23.61
IT operational costs	$198.27	$72.40	$125.87
Total annual cost per user	$987.67	$663.29	$324.38

The net result is that centralized infrastructure using DaaS can be up to 33% less expensive than a distributed model. That figure includes licensing costs. Although this is a projected model, we have seen similar ROI in practice, including when Cloud Software Group, Citrix’s parent company, moved to a Citrix DaaS environment. Let’s dig deeper into how we arrived at these numbers.

Operational efficiency

The most dramatic savings are found in IT labor. Centralization allows for “single-image provisioning,” where an IT team manages one image rather than patching hundreds of individual machines. The e-book details the following IT cost savings:

• Security: The annual cost to patch applications on a managed PC is approximately $62.67 per user, compared to just $12.53 in a centralized environment.
• Helpdesk volume: Centralized management and automated capacity recovery reduce helpdesk tickets and the time required to resolve them. The annual helpdesk cost per user drops from $84.44 (distributed) to $27.86 (DaaS).
• Testing: Citrix’s single image approach reduces testing efforts by 20%, allowing each update to apply consistently across thousands of users.
• Rollout preparation: Rollout is prepared once at the image level rather than per user. By shifting readiness checks from thousands of users to a small set of centrally validated images, rollout preparation costs are reduced by 60%.

Preparing for 95% prediction

Centralized computing is no longer a niche solution for task workers; it is the superior model for modern enterprises. Industry analysts at Gartner predict that by 2027, virtual laptops are on track to be cost-effective for 95% of workers compared to 40% in 2019.

As you evaluate your strategy for the coming years, ask yourself: Is your IT team spending their time defending the data, applications, and operating systems residing on of thousands of endpoints, or are they leveraging a modern, centralized core to drive business agility? The comeback of centralization isn’t just about control; it’s about giving your organization the foundation it needs to thrive in an increasingly complex digital world.

Learn more: Centralized desktops vs. managed PCs: A smarter model for control and cost

Gartner, Critical Capabilities for Desktop as a Service, By Sunil Kumar, Todd Larivee, Stuart Downes, 18 August 2025. GARTNER is a trademark of Gartner, Inc. and/or its affiliates.

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

from Citrix Blogs https://bit.ly/4dQNIGB
via IFTTT

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent.

According to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors. The activity entails distributing spear-phishing emails containing ZIP attachments to trigger an infection chain that uses a Rust loader to drop the final payload for data exfiltration and remote control.

"When extracted, the archive contains multiple files that appear legitimate but are actually part of a structured infection chain designed to execute malicious payloads in the background," security researcher Priya Patel said.

The attack chain uses two different pathways to launch the final-stage malware. One infection sequence begins when the recipient of the ZIP archive opens a malicious Windows Shortcut (LNK) file that masquerades as a PDF document. This leads to the execution of a PowerShell script that's responsible for extracting an executable ("RuntimeBroker_update.exe") from an intermediate DAT file and running it.

In the second attack chain, the victim directly launches a binary from the same archive. The binary functions as a self-contained Rust-based dropper to launch "RuntimeBroker_update.exe." Regardless of the path chosen, the executable loads a malicious DLL ("UnityPlayer.dll") via DLL side-loading, resulting in the deployment of a Rust-based loader called RUSTCLOAK.

The loader then decrypts and runs the main payload, an AdaptixC2 agent codenamed AZUREVEIL owing to the use of Microsoft Azure Blob Storage for command-and-control (C2). The loader is designed to perform anti-analysis checks to proceed only if the malware determines that it's being run within a sandboxed environment.

"The malware just talks to Azure Blob Storage, the same service used by thousands of legitimate enterprises worldwide," Seqrite Labs said. "Instead of using a traditional pull-based C2 model, AZUREVEIL follows a dead drop approach. The attacker and the infected system never communicate directly. Instead, both sides use the same Azure storage container to exchange data."

AZUREVEIL supports 36 commands that allow it to perform a wide range of post-compromise actions on the host, including file operations, file uploads and downloads, shell command execution, process enumeration and termination, port forwarding, SOCKS proxy control, C2 server management, and in-memory execution of Beacon Object Files (BOFs).

These capabilities grant the attacker complete control over the compromised endpoint. Although the activity has been attributed to a known threat actor or group, it's assessed to be China-aligned.

The disclosure comes as Cato Networks said it detected and blocked an attempted intrusion against the Indian branch of an unnamed global manufacturing customer to deliver TencShell, a previously undocumented Go-based implant derived from the open-source rshell C2 framework.

The attack is believed to be the work of China-nexus threat actors based on the historical use of rshell, Tencent-themed API impersonation, and infrastructure patterns. The initial access vector used in the intrusion is currently unknown.

"If successful, TencShell could have given the attacker remote command execution, in-memory payload execution, proxying, pivoting, system profiling, and a path to deploy additional tooling," researchers Idan Tarab, Dr. Guy Waizel, Zohar Buber, and Shani Kurtzberg said.

In a report published last week, ESET said China-aligned threat actors have remained "highly active" globally from October 2025 through March 2026. This includes an unreported cluster dubbed SteppeDriver that was first discovered in 2024 and has since targeted entities in France, Mongolia, and South America using tools like ShadowPad, COOLCLIENT, CurlyDoor, RudeGull, and MKTDownloader.

Also identified by the Slovakian cybersecurity vendor is a new toolkit linked to UNC5221 dubbed PhiliKit that acts as a passive backdoor for executing shell commands, Python scripts, and Perl scripts. It's suspected that PhiliKit is deployed as part of the SPAWN malware suite used by the Chinese hacking group in the past.

A third China-affiliated threat group is NegativeGlimmer, which is believed to share some level of overlap with TGR-STA-1030, which Palo Alto Networks Unit 42 documented earlier this year as having breached at least 70 government and critical infrastructure organizations across 37 countries over the past year.

In at least one instance observed in December 2025, the threat actor has been found to target a governmental organization in Panama, using a DLL side-loading chain initiated via spear-phishing to deliver a downloader that then deploys AdaptixC2 and simultaneously displays a decoy document to the victim.

Subsequent iterations in January 2026 have swapped out AdaptixC2 in favor of Cobalt Strike, with infections also reported in Cambodia and South Korea.

"The latter targeting in South Korea aligns with Beijing's enduring interest in strategic technologies prioritized under the Made in China 2025 industrial development policy," ESET's Jean-Ian Boutin said.

from The Hacker News https://bit.ly/4fjxYNf
via IFTTT

Coding Agent Horror Stories: The rm -rf ~/ Incident

This is Part 2 of our AI Coding Agent Horror Stories series, an in-depth look at real-world security incidents exposing the vulnerabilities in AI coding agents, and how Docker Sandboxes deliver workspace-scoped isolation that contains the worst failures at the execution layer.

In part 1 of this series, we mapped six categories of AI coding agent failures and the architectural reason they keep happening: the agent runs as you, on your filesystem, with your credentials, and nothing sits between the model’s decision and the shell’s execution. For Part 2, we’re going deep on the most destructive failure mode in the entire ecosystem: an AI coding agent deleting a developer’s entire home directory in a single command.

Today’s Horror Story: The Tilde That Wiped a Mac

In December 2025, a Reddit user posting under the handle u/LovesWorkin shared what became one of the most-discussed AI coding agent incidents of the year. They had asked Claude Code to clean up an old repository. Claude executed rm -rf tests/ patches/ plan/ ~/, and the trailing ~/ wiped their entire Mac.

This wasn’t a CVE. It wasn’t a sophisticated attack. It was the AI coding agent doing exactly what it was told, in a way the user did not anticipate, with no architectural boundary to catch the mistake.

In this issue, you’ll learn:

• How a single trailing slash in a rm -rf command erased a developer’s entire Mac
• Why the --dangerously-skip-permissions flag exists, and why developers keep using it anyway
• The pattern this incident shares with the GitHub-issue-#10077 Ubuntu wipe and the Claude Cowork family-photos incident
• How Docker Sandboxes contains this entire class of failure at the execution layer

Why This Series Matters

Each “Horror Story” in this series examines a real-world incident that turns laboratory findings into production disasters. These aren’t hypothetical attacks. They’re documented cases with named victims, screenshotted command logs, and in several cases, public apologies from the vendors. Our goal is to show the human impact behind the security statistics, demonstrate how these failures unfold in practice, and provide concrete guidance on protecting your AI development infrastructure through Docker’s workspace-scoped execution model.

The story begins with something every developer has done: asking the agent to clean up an old repository.

The Problem

On December 8, 2025,a developer posting under the handle u/LovesWorkin shared a Reddit thread on r/ClaudeAI with the title that says everything: “Claude CLI deleted my entire home directory! Wiped my whole mac.” The post climbed past 1,500 upvotes within hours, was amplified by Simon Willison on X, covered by Gigazine in Japan on December 16, and became one of the most-discussed AI coding agent incidents of 2025.

The setup was unremarkable. The user asked Claude Code to clean up packages in an old repository. Routine maintenance, the kind any developer would hand off without thinking. Claude generated and executed:

rm -rf tests/ patches/ plan/ ~/

On the surface, this is a command to delete three project directories. The fatal error is the trailing ~/. In Unix, ~ expands to the user’s home directory. ~/ with the trailing slash means “everything inside the home directory.” Combined with rm -rf, which removes recursively and without confirmation, the command deletes the user’s entire home directory in a single shot.

Within seconds, the developer had lost:

• The Desktop, Documents, and Downloads folders
• The Library folder containing application state for every app on the system
• The Keychain, which broke authentication across every app, including Claude Code itself, which could no longer talk to its own backend
• Years of project files, family photos, and work product
• All of it on an SSD where TRIM had already zeroed the freed blocks by the time recovery was attempted

There was no recovery. As the developer put it in the original thread: “It nuked my whole Mac! What the hell?”

Caption: Once an AI agent gains direct filesystem access, “organize my desktop” can become catastrophic.

The Scale of the Problem

This wasn’t a one-off. It was an instance of a pattern.

On October 21, 2025, weeks before the LovesWorkin incident, developer Mike Wolak filed GitHub issue #10077 against the Claude Code repository. Wolak’s report described a similar failure on Ubuntu/WSL2: Claude Code had executed rm -rf starting from root, and the logs showed thousands of “Permission denied” messages for /bin, /boot, and /etc as the agent worked its way through the system trying to delete files it didn’t own. Every user-owned file on the system was gone. Anthropic tagged the issue area:security and bug. The damning detail in Wolak’s report: he was not running with --dangerously-skip-permissions. Claude Code’s permission system simply failed to detect that the agent’s command would expand destructively before the user approved it.

Two weeks later, on November 28, 2025, GitHub issue #12637 documented yet another variant. Claude Code had earlier created a directory literally named ~ by mistake. Later, when the agent tried to clean up that directory by running an unquoted rm -rf ~, the shell expanded ~ to the user’s actual home directory before rm saw the argument. Same destructive outcome, completely different mechanism. The agent had found a new way to destroy a developer’s work.

Shortly after the January 2026 launch of Anthropic’s Claude Cowork, Nick Davidov, founder of a venture capital firm, used Anthropic’s Claude Cowork, a general-purpose AI agent product to organize his wife’s desktop. He explicitly granted permission for temporary Office files only. The agent deleted a folder containing 15 years of family photos, somewhere between 15,000 and 27,000 files, via terminal commands that bypassed the macOS Trash entirely. Davidov recovered the photos only because iCloud’s 30-day retention happened to still be in effect. The Trash had been bypassed entirely.

These aren’t isolated stories. They’re the same story with different file paths.

How the Failure Works

To understand why these incidents keep happening, we need to look at the architecture of how a modern AI coding agent executes commands on a developer’s machine. The agent is doing exactly what its design says it should do. The architecture is the failure.

• The Coding Agent (Claude Code, Cursor, Replit, Kiro) is an AI-driven shell. It reads your prompt, reasons about how to satisfy it, generates a command, and runs that command directly on your operating system. There is no separate “execution proposal” step that a human approves. The reasoning step and the execution step are the same step.
• The User’s Shell is whatever shell the agent inherited when you launched it. On macOS, that’s typically zsh. The agent’s commands run through this shell with the developer’s full user permissions. ~ expands to the developer’s home directory because that’s what ~ means in zsh.
• Permission Inheritance is implicit and total. Whatever the developer’s shell can do, the agent can do. There is no separate identity for “the agent acting on the developer’s behalf.” The agent is the developer for as long as the session lasts.
• The --dangerously-skip-permissions Flag, which Lanzani’s technical blog post analyzes in detail, is what removes the one safety net that exists by default. Without the flag, Claude Code asks for confirmation before each shell command. With it, the agent runs commands in the background while the developer goes back to other work.

That last point is the one that matters. The flag exists because the default behavior, asking for confirmation on every shell command, makes multi-step tasks tedious. Developers add the flag to make the agent useful. The agent then becomes capable of executing destructive commands without intervention. The flag is named honestly. It is a dangerous flag. But it is also a popular one, because the alternative is approving every ls and cat the agent runs.

The vulnerability happens between steps 2 and 3. The agent reasons about what command to run. The shell executes that command on the host. Nothing sits in between. There is no architectural boundary that says “this command would delete the user’s home directory, refuse to run it.” The shell sees a syntactically valid rm -rf and does what rm -rf does.

Technical Breakdown: How a Trailing Slash Wipes a Mac

Here’s how the incident unfolds, step by step:

Caption: Diagram illustrating how unrestricted AI agent execution can escalate a simple cleanup task into full home-directory destruction

1. The User’s Request

The developer asks Claude Code to clean up packages in an old repository. The prompt is the kind of thing every developer types daily:

Please clean up unused test files, patches, and plan documents from this old repo.

2. The Agent’s Reasoning

The agent identifies three directories that match the request: tests/, patches/, and plan/. It then generates a rm -rf command, because removing directories recursively is the standard way to delete them. So far, this is correct behavior.

3. The Hallucinated Argument

The agent appends ~/ to the command. We don’t know exactly why. Possibly the agent inferred that “clean up” included tidying the home directory. Possibly it generated ~/ as a no-op separator and didn’t realize it was a destructive argument. Possibly its training data included shell snippets where ~/ appears in this position and it pattern-matched. The result either way is the same:

rm -rf tests/ patches/ plan/ ~/

This is a syntactically valid shell command. There is nothing in the syntax that says “this is dangerous.”

4. Shell Expansion

When this command runs in zsh on macOS, the shell expands ~/ to /Users/loveswarkin/. The command becomes, effectively:

rm -rf tests/ patches/ plan/ /Users/loveswarkin/

The shell does not warn. It does not confirm. It does not flag the home directory as protected. There is no system-level check that says “this command would delete a user’s entire home directory.” The shell does what shells do: expand the path and execute.

5. Recursive Force Deletion

rm -rf walks the filesystem under each argument and deletes everything. The Desktop, Documents, Library, Keychain, Application Support folders, Claude Code’s own config and credentials, the user’s SSH keys, the user’s git config, the user’s photos. All of it. In order. Without pausing.

The deletion runs to completion in seconds because most of these files are small, and the SSD’s controller acknowledges deletes nearly instantly. By the time the user notices their terminal is unresponsive and tabs out to check, it’s done.

6. The Aftermath

The keychain is gone, which means every app that authenticates against the keychain is now logged out. Mail, browsers, Slack, GitHub Desktop, every service that stored a token, every saved password. The user’s identity infrastructure on that machine is gone.

Claude Code itself can no longer authenticate, because its own credentials lived in the home directory. The agent that did the destruction can’t even apologize properly, because it can’t connect to its own backend.

The Impact

Within a single command execution, the developer has:

• Lost years of personal and professional files
• Lost cryptographic keys (SSH, GPG) needed to access remote systems
• Lost authentication state for every app on the system
• Lost git history for any uncommitted work
• Inherited a system in a partially-broken state where logging back in and reinstalling apps will take days

There is no recovery path. SSDs with TRIM enabled (which is the default on every modern Mac) zero freed blocks at the controller level, so even forensic recovery tools come up empty. The data is not “deleted” in the sense of “marked unavailable but recoverable.” It is gone.

This is what one trailing slash in one AI-generated command produces.

How Docker Sandboxes Eliminates This Attack Vector

The current AI coding agent ecosystem forces developers into the same dangerous tradeoff that the MCP ecosystem forced on users in Part 1 of our companion series. Every time you run claude --dangerously-skip-permissions or any equivalent flag in another agent, you’re executing arbitrary AI-generated commands directly on your host system with full access to:

• Your entire file system
• Your home directory and everything in it
• Your credentials, keychain, SSH keys, and cloud config
• Every running process and every network connection your shell can make

This is exactly how the rm -rf ~/ incident achieves total system destruction. The agent runs as the developer, on the developer’s filesystem, with no architectural boundary to stop it.

Docker’s Security-First Architecture

Docker Sandboxes represents a fundamental shift in how AI coding agents execute. Rather than running directly on the host with user-level permissions, the agent runs inside a microVM with its own kernel, its own filesystem, and its own network. The agent’s view of ~/ is the workspace mount, not the developer’s actual home directory. The developer’s actual home directory simply does not exist from inside the sandbox.

Docker Sandboxes are managed through the sbx CLI. A quick distinction worth making: Docker Sandboxes are the isolated microVM environments where agents actually run. sbx is the standalone CLI tool used to create, launch, and manage them. Sandboxes are the environments. sbx is what you type to control them.

Docker Sandboxes solves the rm -rf ~/ class of failure by making the destructive command architecturally impossible. The agent can absolutely generate rm -rf tests/ patches/ plan/ ~/. It can absolutely run that command. The command will absolutely succeed. But what gets deleted is the workspace inside the sandbox, not the developer’s actual home directory. The host filesystem isn’t visible from inside the microVM, so there is nothing to delete.

Workspace-Scoped Execution

The most important architectural shift is that the agent’s filesystem view is the workspace mount, and only the workspace mount.

# Install sbx and sign in
brew install docker/tap/sbx
sbx login

# Launch the agent inside a sandbox scoped to the project directory
cd ~/my-project
sbx run claude

Three commands and the agent is now running inside a microVM. From inside the sandbox, the agent’s ~/ IS the workspace, not the developer’s actual home directory. The Library folder, the keychain, the SSH keys, the AWS config – none of that exists inside the sandbox. The agent cannot reach what it cannot see.

A rm -rf ~/ from inside the sandbox deletes the workspace files. The developer can throw the sandbox away with sbx rm and start fresh. The host system is untouched.

Blocked Credential Paths

Even if a developer explicitly mounts additional paths into the sandbox, common credential directories are blocked from being mounted by default:

# Credential roots blocked by default:
#   ~/.aws  ~/.ssh  ~/.docker  ~/.gnupg
#   ~/.netrc  ~/.npm  ~/.cargo  ~/.config

# A misconfigured mount that tries to include these is rejected
# before the sandbox even starts.
sbx run claude

This blocklist directly addresses the keychain-deletion fallout from the LovesWorkin incident. Even an agent that decides to recursively delete its workspace cannot reach the credentials that keep the developer’s authentication state intact.

Read-Only Mounts for Sensitive Workspaces

For workflows where the agent should read but not write to a directory, the :ro suffix declares a mount as read-only:

# Mount the project workspace as writable, the docs as read-only
sbx run --name docs-review claude /path/to/project /path/to/docs:ro

A rm -rf against a read-only mount fails at the kernel level. The microVM enforces the mount mode, which means the agent cannot decide to override it through reasoning, prompt manipulation, or flag misuse. The infrastructure decides what’s writable. The model doesn’t get a vote.

Git-Worktree Isolation for Risky Operations

For destructive operations like cleanup tasks, refactors, and “let me just clean this up” requests, sbx run --branch lets the agent operate on an isolated Git worktree:

# Create a sandbox on a fresh feature branch
sbx run --name cleanup-agent --branch=cleanup/old-files claude .

# Review what got cleaned up before merging
sbx exec cleanup-agent git diff main

# If the agent did something destructive, throw it away
sbx rm cleanup-agent

This is the architectural answer to “the agent decided to drop and recreate the schema.” The agent’s changes never touch the main branch until the developer reviews them. If the agent runs rm -rf ~/, the worktree gets wiped and the main branch is untouched. The developer reviews git diff main, sees what happened, and decides whether to merge or discard.

Throwaway Sandboxes by Design

The final piece is that sandboxes are designed to be discarded:

# When the work is done, list active sandboxes and remove the one you're done with:
sbx ls
sbx rm <sandbox-name>

This is what makes the Docker Sandboxes model fundamentally different from running an agent on the host. On the host, a destructive command leaves permanent damage. Inside a sandbox, every session is throwaway. The worst the agent can do is destroy the workspace, which is reproducible from the source repo. The keychain, the credentials, the years of personal data, none of those can be touched, because none of those exist from inside the sandbox.

What This Looks Like in Practice

Here’s the LovesWorkin incident replayed under Docker Sandboxes. The user asks the same question. The agent generates the same command. The shell executes the same expansion.

# After Docker Sandboxes:
$ cd ~/my-project
$ sbx run claude
> Please clean up unused test files, patches, and plan documents
[Agent runs: rm -rf tests/ patches/ plan/ ~/]
[Workspace inside the sandbox wiped. Host home directory intact.]

# The sandbox is throwaway. List it and remove it to start fresh:
$ sbx ls
$ sbx rm <sandbox-name>

The agent’s behavior is identical. The architectural outcome is completely different.

The Practical Improvements

Security Aspect	Traditional AI Coding Agent	Docker Sandboxes
Execution Environment	Direct host execution as the user	Isolated microVM with its own kernel
Filesystem View	Full host filesystem, including ~/	Workspace mount only
Credential Access	All credentials in user’s home dir	Credential paths blocked by default
Destructive Command Impact	Permanent host damage	Throwaway sandbox
Review Before Merge	None	Git worktree isolation with sbx exec <sandbox-name> git diff main
Recovery	Often impossible (TRIM zeroes blocks)	sbx rm and start fresh

Best Practices for Secure AI Coding Agent Deployment

1. Stop running coding agents directly on your host. Containerization or microVM isolation should be the default, not an advanced option.
2. Use sbx run for every coding task that involves filesystem operations. Especially “clean up,” “organize,” “refactor,” and “delete unused” prompts. These are the prompt categories most likely to produce a destructive rm -rf.
3. Use Git worktrees for destructive operations. sbx run --name <name> --branch=<branch> claude ensures the agent’s changes are reviewable before they touch your main branch.
4. Never use --dangerously-skip-permissions on the host machine. If you need the agent to run commands without per-command approval, run it inside a sandbox. The sandbox boundary is what makes “skip permissions” safe.
5. Treat the sandbox as throwaway. Don’t store anything important inside it. The whole point is that you can sbx rm and start fresh.
6. Audit the policy log. sbx policy log shows every allowed and denied connection attempt, which becomes your forensics trail if something does go wrong.

Take Action: Secure Your AI Coding Agent Today

The path to safe AI coding agent execution starts with one command. Here’s how to move away from running agents on the host:

• Install Docker Sandboxes. Visit the Docker Sandboxes documentation to install sbx and run your first sandboxed agent in under five minutes.
• Try it with your existing workflow. sbx run claude (or sbx run cursor, sbx run codex, etc.) drops your existing agent into a microVM with no configuration changes required.
• Read the architecture deep-dive. The Docker Sandboxes architecture documentation explains the microVM model, the workspace mounting, and the network policy layer.
• Browse the MCP Catalog. If your agent uses MCP servers, the Docker MCP Catalog provides containerized, verified servers that complement sandboxed agent execution.

Conclusion

The LovesWorkin incident, the Mike Wolak Ubuntu wipe, the Claude Cowork family-photos deletion, and the GitHub issue #12637 shell-glob expansion bug are all the same story. An AI coding agent reasoned its way through a task, generated a command that contained a destructive argument, and the shell executed it because there was nothing in the architecture to say “this command would destroy the developer’s work.”

These aren’t bugs in Claude Code, or Cursor, or Kiro, or any individual agent. They’re properties of the execution model. As long as agents run on the host with the user’s permissions, this category of failure will keep happening, with new variations each time.

Docker Sandboxes doesn’t try to make the agent smarter. It changes where the agent runs. The agent gets a workspace. It does not get your machine.

Coming up in our series: Issue 3 will explore the AWS Cost Explorer outage, where Amazon’s own Kiro agent decided to delete and rebuild a production environment in seconds, and what scoped-identity sandbox configuration prevents that class of failure.

Learn More

• Run agents safely with Docker Sandboxes: Visit the Docker Sandboxes documentation to get started with workspace-isolated agent execution in minutes.
• Explore the Docker MCP Catalog: Discover MCP servers that connect your agents to external services through Docker’s security-first architecture.
• Download Docker Desktop: The fastest path to a governed AI agent environment, with Docker Sandboxes, MCP Gateway, and Model Runner in a single install.
• Read the MCP Horror Stories series: Start with issue 1 to understand the protocol-layer security risks that complement the agent-layer risks covered here.

from Docker https://bit.ly/3RwllVr
via IFTTT

The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools

Three years ago, the practical question for an MSP building a cybersecurity practice was which "vCISO platform" to buy. The term was good shorthand for the work at the time: assessments, advisory, reporting, maybe a compliance module bolted on the side. The work has since outgrown the descriptor.

A Security Growth Platform is the more precise name for what MSPs and MSSPs need from the software running their security practice in 2026. It combines security program management, CISO-grade decision intelligence, multi-tenant portfolio architecture, and revenue intelligence in one system. Traditional GRC platforms track compliance, vCISO tools support single advisory engagements, and enterprise compliance platforms target end customers directly. None were built around the unit of work that defines a modern MSP security practice: the portfolio.

Why The Work Outgrew The Term

The demand kept outgrowing the category that named it. SMB cybersecurity spending is projected to reach $109 billion in 2026, with small and medium businesses accounting for roughly 60% of global cybersecurity spend (Analysys Mason), and most of that share moves through service providers. The SMBs paying for security don't have an internal CISO function. The MSP is the security function, and what "the security function" has to do has expanded well past what a vCISO methodology was designed to cover.

What expanded was the work itself. The tools designed for solo vCISO engagements increasingly describe only part of it, and the platforms built for enterprise compliance had never been built for this customer in the first place. The category sitting between those two reference points kept getting bigger while the language available to describe it stayed where it was.

The Three Gaps That Created A New Tier

The reason a new descriptor is needed comes down to three structural gaps in the categories already on offer. The Security Growth Platform tier exists because three different software categories each fell short of serving the same buyer, and each gap is structural rather than a feature shortfall.

GRC Platforms Weren't Built For MSP Delivery

Enterprise compliance automation platforms grew into the dominant players in their tier by automating compliance for companies with internal security teams. The architecture optimizes for one customer's compliance posture, controls library, evidence collection, and audit cycle. Recent repositioning across that tier around agentic AI and trust automation reinforces this direction: the answer to expanding the category has been end-customer trust automation, not service-provider delivery infrastructure.

That architecture doesn't carry over to a service provider running security programs across 30 or 100 SMB clients, where there is no internal security team and the MSP itself is the security function. A platform built around one customer's security posture isn't easily turned into a multi-tenant service-delivery system; the premise has to change at the architectural level.

The vCISO services category itself is real and growing. The global market is projected at $1.2 billion in 2026 with a 6.3% CAGR through 2035 (Business Research Insights).

The tools built for it focused on the consultant doing the work: assessment templates, advisory frameworks, and reporting decks. That works well for one senior person delivering one engagement. It works less well for a 30-client MSP that needs to run security as an ongoing program across every account. Compliance requirements have also grown more demanding, with 85% of organizations reporting that compliance is more complex than it was three years ago (PwC Global Compliance Study 2025). That's the depth the original vCISO tools weren't engineered to carry.

vCISO tools also rarely automate compliance depth. Many partners ran the vCISO tool for advisory work and bolted on a separate GRC platform for audit work, ending up with two systems, two sources of truth, and no unified program.

Enterprise-First Compliance Platforms Compete With The Channel

Enterprise compliance platforms sell direct; service providers tend to encounter them when an SMB client asks for the name, typically because an investor or enterprise buyer demanded SOC 2. That motion treats the MSP as a referral channel rather than a partner; the economics flow to the platform, not to the practice running the security program.

The white space opened because the enterprise platforms made a structural choice to go direct, and the channel-native tools made a structural choice to stay narrow on compliance. True CISO-grade intelligence at 100% partner-only delivery, with SMB-accessible pricing and portfolio-level revenue analytics, fell into a gap no existing category was claiming.

The Four-Tier MSP Cybersecurity Market In 2026

The market sorts into four tiers by who the platform is built for and how it goes to market.

Tier	Built For	Channel Model
Enterprise compliance automation	End customers with internal security teams	Direct-first
Security Growth Platform	Service providers delivering, scaling, growing security practices	100% partner only
MSP-native Cyber GRC and vCISO	Compliance tracking and audit readiness via MSPs	Channel-friendly
MSP advisory and assessment tools	QBRs, vCIO presentations, vendor-neutral assessments	Channel

The enterprise tier dominates the top end, serving mostly mid-market and growth-stage companies pursuing SOC 2 or ISO 27001 to unlock revenue, in a direct motion where the MSP rarely sits at the center. The MSP-native Cyber GRC tier clusters around compliance management as the entry point, which serves partners well when compliance tracking is the primary need. The advisory and assessment tier sits closer to a vCIO function than a security function: lower pricing, narrower capability scope, designed for business reviews and presentations rather than running a security program.

The Security Growth Platform tier is its own category because the center of gravity is different. Compliance is an outcome of the program rather than its starting point. Cynomi is the named example of the tier; the platform's design choices, capability set, and 100% partner-only commercial model define what the tier looks like in practice.

What Defines A Security Growth Platform

Five capabilities define the tier. A platform without all five sits in a different category.

CISO Intelligence built in. The decision-making logic of an experienced security leader, integrated into the platform's AI infrastructure and guided workflows. This is what allows any trained team member to deliver senior-level advisory outcomes rather than reproducing what one senior consultant can do alone. Cynomi's named term for this capability is CISO Intelligence; it is a structured methodology rather than the generic "AI-powered" claims that surface across the broader compliance and GRC market.

Unified security, risk, and compliance across 40+ frameworks. One assessment maps controls across NIST CSF 2.0, CIS Controls, ISO 27001, SOC 2, HIPAA, CMMC, GDPR, NIS2, and DORA. Compliance becomes an outcome of the security program rather than a parallel workstream. Cynomi delivers this through its unified framework engine.

Complete security lifecycle management. Context-aware onboarding, risk-based prioritization, automated remediation roadmaps, task-driven execution, policy automation, business impact analysis, business continuity planning, third-party risk management, and executive dashboards in one system. The work runs continuously rather than in audit-cycle bursts.

Portfolio-level revenue intelligence. A multi-tenant view across the partner's entire client base that maps security gaps to the partner's service catalog and quantifies recurring-revenue expansion opportunities. Cynomi's portfolio intelligence is the only platform-level revenue layer in this category; the other tiers do not expose revenue surface area at the portfolio level.

Built for MSP and MSSP scale. Multi-tenant architecture, white-label outputs, no channel conflict, designed for portfolios from 15 to more than 500 clients. The phrase Cynomi uses is "100% partner only," the practical distinction from channel-friendly platforms that still pursue end-customer revenue alongside partner-delivered revenue.

Why MSPs Need More Than A vCISO Platform

If you've built a vCISO practice around single engagements, "vCISO platform" still describes the work you're doing: a fractional security leader, a methodology, a deliverable. The category isn't going anywhere, and the descriptor holds when the work itself is one engagement at a time.

What the "vCISO platform" doesn't describe is what changes when a service provider scales beyond single engagements. A practice running 30, 100, or 500 client security programs needs more than a vCISO methodology. It needs the system that surrounds the methodology: portfolio visibility, service-catalog mapping, executive-ready reporting, and the commercial infrastructure for packaging, pricing, and growing the practice itself.

Channel research from organizations including CompTIA and Service Leadership consistently documents that MSPs invest in cybersecurity tools faster than they package, price, and sell cybersecurity services to clients. The capability is there; the recurring-revenue motion isn't. That gap is where most security practices stall: partners with the tooling to deliver, and no system for turning delivery into a sellable, repeatable service. The Security Growth Platform tier closes that gap on purpose. Portfolio intelligence, service-catalog mapping, and commercialization-ready outputs are engineered into the platform, not bolted onto a vCISO methodology.

Where "vCISO platform" describes the methodology, "Security Growth Platform" describes the system.

The Outcomes That Define The Tier

What separates this tier from compliance-only platforms is what your practice does with the assessment afterward, not what the assessment looks like or how many frameworks it covers.

Service providers running the program model through Cynomi report an average 70% reduction in assessment and reporting workload, a 30% margin improvement on security services, 60% security revenue growth, and 90% shorter discovery time, in line with the MSP cybersecurity benchmark data Cynomi publishes annually. Those are practice-level outcomes, not pilot-program metrics.

A category becomes real when practitioners can name it, buyers can compare against it, and the market can see where its center of gravity sits. The Security Growth Platform tier has the practitioners: partners running 30, 100, and 500 clients through it today. The naming is catching up. Buyers who started by asking "which vCISO platform should we use?" are increasingly asking a more specific question: how do we deliver, scale, and grow a security practice across our entire client base? That's the question the Security Growth Platform is built for.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://bit.ly/4dT4y6f
via IFTTT

OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack

Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that's targeting developers using OpenAI Codex through a legitimate-looking remote web UI.

The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads. The package is still available for download from the repository.

What makes this activity noteworthy is that it's not a traditional attack that uses a typosquat or throwaway package to trick developers. Rather, the malicious code is embedded into a functional npm package that has undergone active development. The associated GitHub repository remains clean.

"And for the past month, every single invocation has been quietly exfiltrating your Codex authentication tokens to an attacker-controlled server," Aikido Security researcher Charlie Eriksen said.

The nefarious changes are said to have been introduced about a month after the package was published to the registry, likely in an effort to build user trust and expand its reach. The npm account associated with the package is "friuns" (aka Igor Levochkin).

Present within the package is code that extracts the contents of Codex's "~/.codex/auth.json" file and exfiltrates them to a remote server ("sentry.anyclaw[.]store") that masquerades as Sentry, a legitimate application monitoring and error tracking platform. The captured data includes the following details: access_token, refresh_token, id_token, and account ID.

"The refresh_token doesn't expire," Eriksen said. "An attacker holding it can silently impersonate you indefinitely. A stolen Codex refresh_token goes beyond access to a chat interface -- it's persistent, silent access to whatever that account can do."

It's worth mentioning here that every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at ~/.codex/auth.json or in the operating system-specific credential store.

"If you use file-based storage, treat ~/.codex/auth.json like a password: it contains access tokens," OpenAI warns in its support documentation. "Don't commit it, paste it into tickets, or share it in chat."

Interestingly, the npm package is far from the only delivery vector the threat actor uses to target Codex developers. Aikido said it observed an Android application named OpenClaw Codex Claude AI Agent (package name: "gptos.intelligence.assistant") that runs the npm package within its PRoot sandbox and sends the Codex credentials to the same endpoint.

"The APK itself is small (26 MB) and looks clean on a Play pre-publish scan," Eriksen explained. "On first run, it extracts a Termux-derived Linux userland into the app's private storage and runs Node.js inside it via PRoot."

"The version is not pinned, so the device pulls whatever is currently published on npm. The exfiltration has been in place since codexui-android@0.1.82. The package runs inside the app's PRoot sandbox, where the in-app Codex sign-in writes its auth.json. Once the user signs in, the package reads that file out of the sandbox and ships the full OAuth blob to sentry.anyclaw.store/startlog."

Released by an entity named "BrutalStrike," the Android app has more than 50,000 downloads. The same exfiltration chain has also been flagged in a second Android app linked to BrutalStrike: Codex (package name: "codex.app"), which has been downloaded over 10,000 times. The remaining three apps offered by the developer do not contain the functionality.

Upon reaching out to the package author on GitHub, Aikido said they initially posted a comment stating they had lost access to their npm account, only to edit the response and post a different one in which they claimed they are "currently investigating this issue internally" and that they "have started removing the affected functionality and related data."

The author further claimed no credential data was shared with any third parties, without answering why this code was inserted only into the npm package build or why they needed access to the Codex tokens in the first place. The X profile linked to the author includes the domain "anyclaw[.]store."

WHOIS records indicate that the domain was registered on April 12, 2026, just two days after the very first version of the npm package (version 0.1.72) was uploaded to npmjs[.]com.

The development comes as threat actors are increasingly targeting real artificial intelligence (AI) developer tooling and workflows to steal credentials and burrow deeper into the software supply chain.

Late last month, the Belgian security company also found that a deleted Google API key remains live for up to 23 minutes, a window that an attacker with access to a leaked key can take advantage of to gain access to user data and other APIs, including those related to Google Gemini. The median revocation window is around 16 minutes.

"An attacker holding your deleted key can keep sending requests until one reaches a server that has not caught up," researcher Joe Leon said. "If Gemini is enabled on the project, they can dump files you have uploaded and exfiltrate cached conversations."

Although Google first opted not to fix the issue, stating it's a "known property of the system and not a security issue," the tech giant has since decided to treat it as a P0 bug, making it a severe issue that "needs to be addressed immediately."

The findings, as with a similar 4-second exploitation window previously observed with deleted Amazon Web Services (AWS) access keys, highlight how credential revocation delays are exploitable and can be used to gain unauthorized access to the cloud environments, while defenders assume the credentials have been revoked.

from The Hacker News https://bit.ly/4fMYpes
via IFTTT

Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts

Threat actors are attempting to actively exploit a critical security flaw impacting WP Maps Pro, a WordPress plugin that has had over 15,000 sales on the Envato Market, to create malicious administrator accounts on susceptible sites.

WP Maps Pro allows site owners to embed customizable Google Maps and OpenStreetMap with markers, listings, and advanced location features on WordPress sites. It is used as a store locator tool, making it easier for users to find nearby locations, view listing details, and get directions.

The vulnerability in question is CVE-2026-8732 (CVSS score: 9.8), a privilege escalation bug that allows unauthenticated attackers to create a WordPress user with administrative permissions, effectively allowing them to take control of a site.

The shortcoming impacts all versions of the plugin prior to and including 6.1.0. It has been addressed in version 6.1.1. Security researcher David Brown has been credited with discovering and reporting the flaw.

At a high level, the problem is rooted in a "temporary access" feature that's designed to allow support staff to log in to a customer's site during troubleshooting. Because this process allows unauthenticated users to invoke the "wpgmp_temp_access_support()" function without adequate checks, it ultimately allows them to create an administrator user.

"This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism," Wordfence said.

"This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover."

The patch released by the plugin maintainers on May 20, 2026, closes the vulnerability by ensuring that only authenticated administrators can access the endpoint.

That said, the security flaw has since come under active exploitation, with Wordfence stating that it has blocked 2,858 attacks targeting the issue over the past 24 hours. It's therefore essential that site owners update their instances to the latest version for optimal protection.

from The Hacker News https://bit.ly/3Q9tw9E
via IFTTT

Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices

Dutch authorities have announced the takedown of a botnet that enslaved millions of infected devices, including computers, tablets, smartphones, and IoT devices, to carry out malicious attacks.

The bot network, per the Dutch Politie and the National Cyber Security Center (NCSC), consisted of at least 17 million infected devices. More than 200 servers located in the Netherlands acted as the platform's backend infrastructure.

According to a statement issued by the NCSC, police officials seized a subset of these servers from a hosting provider that provided the infrastructure. The provider is said to have subsequently taken the botnet offline following its use for criminal purposes.

Although the name of the botnet was not explicitly mentioned, local news outlet NL Times reported that the service in question was Asocks, a company that offers residential proxies. In April 2024, HUMAN's Satori Threat Intelligence team identified a campaign dubbed PROXYLIB that involved infected Android devices with proxyware from LumiApps and Asocks.

Per details shared on Asocks' website, the platform advertises corporate, residential, and mobile proxies for monthly subscriptions between $5 and $15, with 5-15% discounts for bulk purchases ranging from 10 to 100 proxies.

Residential proxies have legitimate uses and privacy benefits, including to access geographically-restricted web resources. However, the ecosystem is also shadowy, with many providers catering to bad actors who purchase access to compromised devices enrolled in these networks to route malicious traffic and carry out cyber attacks.

"Devices can become part of a botnet when they are accessible to malicious actors," NCSC said. "After gaining access, attackers can install malware that allows the device to be controlled remotely. This enables the device to become part of a network used for cybercriminal activities."

To counter the threat posed by botnet malware, it's advised to keep the operating systems up-to-date, maintain visibility of edge devices like routers, use strong passwords, enable two-factor authentication wherever possible, install apps from trusted sources, change default passwords, and secure Wi-Fi networks with WPA2 or WPA3.

from The Hacker News https://ift.tt/VviBArk
via IFTTT

How will team collaboration evolve within Enterprise AI?

SUMMARY: The biggest enterprise AI question may no longer be which model is smartest? Instead, which organization can most effectively operationalize, govern, and economically scale AI agents across the business?’

SHOW: 1032

SHOW TRANSCRIPT: The Enterprise AI Show #1032 Transcript

SHOW VIDEO: https://youtu.be/GsK_RUnYroI

SHOW SPONSORS:

• ShareGate - ShareGate Protect. Microsoft 365 Governance. We got this.
• Nasuni - Activate your data for AI and request a demo

SHOW NOTES:

Opening Thesis - How will team collaboration evolve within Enterprise AI?

Question: Any suggestions on how to introduce enterprise-level governance and standardisation for agentic coding? Like skills, rules, plugins, context etc

Key Topics 

1. This isn’t a Coding-specific problem. Every team has this issue. 

• If your processes weren’t well defined and enforced before, they will be worse now
• Not it’s not just process standardization, but “buy-in” standardization

2. Everything moves so fast, so managers don’t have the answers (yet) 

• AI value is being created bottom-up, but paid for (and mandated) top-down
• The current measurements aren’t useful (tokenmaxxing, all-or-nothing, etc.)

3. The governance tools don’t exist yet.

• And it’s not clear that anyone wants them. They didn’t want them before. 
• How do you even define governance? What’s the baby step before that, reuse and basic sharing? 

4. Are we ready to invest in “Centers of Excellence” again? 

5. We under-estimate the “creativity” element in human buy-in. 

• Is success measured in improvement or replacement?
• How much of that did “you” do? We don’t know how to measure that.
• We haven’t lived through an AI-centric promotion cycle yet

6. Bottom-up and Top-down need to find some common language and middle ground. 

• Have they walked a mile in each other’s shoes yet (or lately)?
• How to bring a reality to the hype vs. demands vs. learning curve?
• How long is an AI-centric cycle vs. a pre-AI-centric cycle? 

FEEDBACK?

• Email: show @ the enterprise ai show dot come
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/3niOswd
via IFTTT

ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface

Cybersecurity researchers have disclosed details of a vulnerability in OpenAI ChatGPT that leverages the artificial intelligence (AI) assistant's implicit trust in Markdown links and images to trigger prompt injections and open the door to phishing attacks.

The technique has been codenamed ChatGPhish by Permiso Security.

"The chatgpt.com response renderer trusts Markdown links and Markdown image URLs that originated from a third-party page the assistant has just summarized. It auto-fetches those images and surfaces those links as live, clickable elements inside the trusted assistant UI," security researcher Andi Ahmeti said in a report shared with The Hacker News.

In a hypothetical attack scenario, a bad actor can append a small payload to any web page that the victim later prompts ChatGPT to summarize, causing it to leak their IP, User-Agent, and Referer details when attacker-hosted images embedded in the page are automatically fetched when the answer is rendered.

In addition, it can result in malicious Markdown links being rendered as live clickable elements inside the assistant's response, serve far fake system-style security alerts, and serve a QR code from an attacker's S3 bucket and trick the victim into scanning it via their mobile device, effectively bypassing desktop URL filters and enterprise security controls.

The latest finding demonstrates how summarization can emerge as an adversarial surface. Earlier this March, Permiso also revealed how an attacker-controlled email containing specially crafted instructions, when summarized by Microsoft Copilot, could influence its output via a cross-prompt injection (XPIA) or indirect prompt injection.

What makes ChatGPhish a noteworthy attack technique is not the prompt injection itself, but in the manner in which the instructions embedded in a web page are followed and presented to the user as part of the summary.

In other words, a regular web page summarized with ChatGPT is enough to render phishing links, spoofed account alerts, remote images, and QR codes directly inside a trusted AI interface. As organizations increasingly use ChatGPT for research and summarization, this vulnerability means any malicious web page an employee asks the AI chatbot to process could contain a payload that transforms ChatGPT into a phishing surface.

"The shift from email to the browser significantly expands the potential attack surface. A user no longer has to open a malicious attachment or interact with a suspicious message," Permiso said. "Simply summarizing a page during normal browsing activity can introduce attacker-controlled instructions into the model context and ultimately into the rendered response."

The disclosure comes as Adversa AI documented two attack techniques codenamed SymJack and TrustFall targeting AI coding agents and agentic coding CLIs that allow attackers to achieve code execution and full machine compromise.

SymJack is "a single attack pattern [that] lets a malicious repository achieve remote code execution through AI coding assistants," security researcher Rony Utevsky said. "The agent is tricked into a benign-looking file copy that secretly overwrites its own config, and the next restart runs attacker code with full user privileges."

Specifically, a booby-trapped repository tricks the agent into copying a seemingly harmless file, where the destination is a symlink pointing to the agent's own configuration, causing the attacker's payload to be written to the config. On the next restart, a malicious Model Context Protocol (MCP) server spawns and runs arbitrary code with full user privileges.

TrustFall, on the other hand, is a one-click remote code execution attack via a malicious repository that can ship a configuration that auto-approves and spawns an MCP server without a user's explicit approval or requiring a tool call from the agent.

To put it differently, all a threat actor needs to carry out the attack is to create a repository that includes a malicious MCP server and configuration settings that auto-approve it to run. When a developer clones or opens the repository in the AI coding tool and presses "Enter" on the folder trust prompt, the AI coding tool ends up launching the attacker-controlled code with the developer's full system privileges.

"The moment a victim clones the repo, runs Claude, and clicks the generic 'Yes, I trust this folder' dialog, the MCP server starts as a native OS process with full user privileges," Adversa AI noted. "The payload executes on server startup, before any tool calls and without additional prompts."

The findings coincide with the discovery of a number of attack methods against AI models in recent months -

• The use of a novel jailbreak approach called Involuntary In-Context Learning (IICL) that "exploits the tension between in-context learning (ICL) and safety alignment" to bypass GPT-5.4 safety constraints
• The safety guardrails of LLMs can be circumvented if a user tricks the model into having a multi-turn conversation. "Multi-turn evaluation matters for one reason: it is where attackers actually live," Cisco said. "Real adversaries iterate. They reframe refusals, decompose tasks across turns, adopt personas, and escalate gradually. A single-turn benchmark cannot see any of that."
• A vulnerability in Anthropic Claude Code that employs a user-level configuration change in "~/.claude.json" to rewrite MCP endpoints via a rogue npm package to put an attacker in between Claude Code and an OAuth-backed MCP server, allowing the bad actor to capture tokens used for downstream SaaS access.
• The use of a remote update mechanism that allows an OpenClaw skill to appear benign at installation time, but later allows the attacker to influence the agent through workspace files by instructing the user during skill setup to append specific instructions to the HEARTBEAT.md file.
• The use of hidden text featuring content pulled from a legitimate newsletter or a romance novel in phishing emails to confuse an AI-based email security system into flagging the message as benign.
• A vulnerability in Claude's Chrome browser extension called ClaudeBleed allows any extension, even those without any special permissions, to hijack it and trick the AI assistant to perform active agentic actions on their behalf. "The flaw stems from an instruction in the extension's code that allows any script running in the origin browser to communicate with Claude's LLM, but does not verify who is running the script," LayerX said. "As a result, any extension can invoke a content script (which does not require any special permissions) and issue commands to the Claude extension."
• A study from Cisco has found that adversarial text rendered as images, an attack known as typographic prompt injection, can be used to bypass safety filters in vision language models (VLMs). "When a model fails to read the original image (small font, heavy blur, rotation), a bounded perturbation can recover semantic content in the model's internal representation without restoring visual legibility to a human," Cisco said. "This means an attacker can craft images that look like noise or illegible distortion to any OCR-based content filter yet carry fully readable instructions to the target VLM."
• A set of vulnerabilities in Microsoft Semantic Kernel (CVE-2026-25592 and CVE-2026-26030) that could turn a prompt injection into host-level remote code execution.
• The use of the Neural Exec prompt injection attack and the Unicode right-to-left-override function to bypass Apple's input and output filters and the safety guardrails on Apple Intelligence's local model and trick the LLM into producing attacker-directed results. The issue has been addressed in iOS 26.4 and macOS 26.4.
• An indirect prompt injection vulnerability codenamed WebPromptTrap impacts BrowserOS, an open-source agentic browser, that deceives users into approving an authorization step through an AI summary generated from processing a legitimate-looking article with hidden instructions. The issue has been patched in BrowserOS version 0.32.0.
• An audit of the agent skills ecosystem spanning ClawHub and skills.sh has uncovered that 13.4% of 3,984 skills (i.e., 534 in total) have at least one critical security issue, including malware distribution, prompt injection attacks, and exposed secrets. About 1,467 skills have at least one security flaw, ranging from hard-coded API keys and insecure credential handling to third-party content exposure.
• A pair of attacks targeting NemoClaw, NVIDIA's open-source reference stack to secure OpenClaw AI agents, to exfiltrate OpenClaw data using the sandbox's default configuration via a malicious GitHub repository or an npm package.

As frontier AI models continue to evolve and mature, threat actors are increasingly experimenting with the technology to write malware with added capabilities to dynamically adapt its behavior in an attempt to evade detection, as well as offload decision-making to the LLM to ascertain if the compromised environment is valuable or safe enough to drop next-stage payloads.

"In the short term, the proliferation of frontier AI models capabilities risks empowering adversaries to exploit zero-days and N-days at an unprecedented scale," Palo Alto Networks Unit 42 said. "It is also likely to enable attackers to move at greater scale, sophistication, and speed than ever before."

Last month, the cybersecurity company also detailed a proof-of-concept (PoC) agent called Zealot that harnesses the power of LLMs to conduct end-to-end cloud attacks with minimal human guidance by exploiting known misconfigurations and vulnerabilities.

This, in turn, stems from the fact that cloud environments are "AI-Attack-Ready" by default, given that every action has an API equivalent, have varied discovery mechanisms like metadata and enumeration services, are rife with misconfigurations, and are driven by credential-based access.

"Current LLMs can chain reconnaissance, exploitation, privilege escalation, and data exfiltration with minimal human guidance," Unit 42 researchers Yahav Festinger and Chen Doytshman noted. "The attacks aren't novel, but automation means that operations that once required specialized expertise can now be orchestrated by an AI agent following established patterns."

from The Hacker News https://ift.tt/awr0lPG
via IFTTT

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection

As threats become more coordinated and faster to execute, endpoint protection has become the proving ground for modern defense. For the seventh consecutive time, Microsoft has been named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. We believe this reflects both the strength of our technology, and the trust customers place in Microsoft Defender. 

Microsoft Defender delivers industry-leading Endpoint Detection and Response (EDR), powered by global threat intelligence and built for the scale and speed of today’s attacks. For many of our customers, Defender’s endpoint capabilities are the foundation for a coordinated system of defense that spans endpoints, identities, email, apps, cloud, and data.

Bringing these signals together changes what’s possible. It enables earlier detection, stronger prevention, and capabilities like predictive shielding that help stop attacks before they spread. This is the shift underway in security: from isolated tools to a connected system that can see across the environment, understand what’s changing, and take action in real time. It’s what makes the next generation of AI-driven, agentic security possible and helps defenders stay ahead of threats, not just respond to them.

Get started with Microsoft Defender for Endpoint

Sustained innovation to stay ahead of changing threats

Over the past year, Microsoft has introduced key advancements to endpoint protection that have empowered defenders to stay ahead of evolving cyberthreats, including:

Proactive defense during attacks: Attack disruption now expands autonomous protection to predicting and blocking an adversary’s next move during active attacks. It acts just in time to harden against some of the most common attacker tactics, such as group policy objects (GPOs), Safeboot, and identity compromise, to stop lateral movement and defend dynamically.

Custom telemetry: With new custom data collection capabilities, Defender makes it easy for security teams to collect specialized data directly within the Defender portal. It allows organizations to extend their endpoint telemetry beyond the 200+ default signals to support tailored detections and advanced hunting scenarios, such as AMSI for hunting over script content and Kerberos for auth-based and network attacks.

Simplified onboarding: To help security teams onboard simply and securely, we’ve built new Defender deployment tools for Windows and Linux, which handle the entire process for you. Just download a single package and it will dynamically adapt to the operating system, take care of prerequisites, and install the latest version of Defender available as needed for older devices that don’t have it already built in. The Defender deployment tools eliminate friction, automate tricky steps, and provide predictability throughout the onboarding journey.

Sovereign-ready protection: Defender enables customers to meet data storage and privacy needs while operating under public, sovereign, hybrid, or disconnected models. Its multi‑tenant architecture enables organizations to balance centralized security visibility with localized control over their data, reflecting a shift from basic compliance to operational governance.

End-to-end security for local AI agents: Microsoft announced agentic endpoint security as a part of A365 to discover, govern, and block AI agents such as OpenClaw and previously unseen applications running locally on endpoints.

Innovations such as these represent the continued commitment to drive the next wave of innovation. Stay tuned for more exciting advancements at Microsoft Build on June 2^nd.

Disrupt ransomware on any platform with Microsoft Defender for Endpoint

Learn more

If you’re not yet taking advantage of Microsoft’s leading endpoint security solution, visit Microsoft Defender for Endpoint and start a free trial today to evaluate our leading endpoint protection platform. 

Are you a regular user of Microsoft Defender for Endpoint? Share your insights on Microsoft Defender for Endpoint and get rewarded with a $25 gift card on Gartner Peer Insights™.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

---

Gartner, Magic Quadrant for Endpoint Protection, Deepak Mishra, Evgeny Mirolyubov, Nikul Patel, 26 May 2026.

Gartner is a registered trademark and service mark and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. 

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 

The post Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/3dz4XhH
via IFTTT