On-Prem Red Team AI — engineering notes from the front line
Deep dives, comparisons and field reports on autonomous red team AI, generative pentesting, deep-packet traffic intelligence, NIS2/DORA, and how to operate them air-gapped.
- LLMjackingAutonomous AttacksAPI Key Theft
Stolen AI API Keys Now Fund Autonomous Attacks — And You Pay
Criminals run budget-capped autonomous pentest agents on stolen OpenAI, Anthropic and Google API keys — the key's owner pays for the attack.
6 min read - PAN-OSCISA KEVRemote Code Execution
PAN-OS CVE-2026-0322: root RCE on the management interface, actively exploited
CVE-2026-0322 lets an authenticated admin run code as root on the PAN-OS management interface. It is CISA KEV, exploited in the wild, and the federal fix is due October 17.
7 min read - Cisco Secure Email GatewayCVE-2026-76519CISA KEV
Cisco Secure Email Gateway CVE-2026-76519: root file write from a single email, exploited
A crafted email writes arbitrary files as root on Cisco Secure Email Gateway (CVE-2026-76519, CVSS 9.8). Exploited in the wild, KEV-listed, no workaround.
9 min read - Autonomous Red TeamOTP BypassAI Pentest Agent
AI Pentest Agent Found an OTP Bypass a Human Test Missed
A Reflectiz AI pentest agent found a critical OTP bypass on an insurer's production login that a human test missed six months earlier — and proved it live.
6 min read - Offensive AIChrome Full-Chain ExploitAutonomous Red Team
XBOW Built a Chrome Full-Chain Exploit With a Public AI Model in Six Days
A public OpenAI model built a three-bug Chrome full-chain exploit in six days for about $40,000 of compute — XBOW claimed Google's $250,000 top bounty.
7 min read - Windows ShellMark of the WebCISA KEV
Windows Shell CVE-2026-96951: an exploited Mark-of-the-Web bypass, patch now
CVE-2026-96951 is an actively exploited Windows Shell bug that bypasses Mark of the Web via command injection. CISA set a 3-day patch deadline — who's exposed and how to fix it.
8 min read - Ivanti Connect SecureAuthentication BypassVPN Security
Ivanti Connect Secure CVE-2026-104935: exploited auth bypass, patch now
CVE-2026-104935 is an actively exploited authentication bypass in Ivanti Connect Secure letting unauthenticated attackers run commands. KEV due Oct 16. Patch.
7 min read - Frontier AIOT SecurityCritical Infrastructure
Frontier AI Cleared Every OT Attack Objective in Booz Allen's Lab
Booz Allen gave frontier AI models eight OT attack objectives in an isolated plant testbed. They cleared all eight — perimeter to control zone in 16 minutes.
7 min read - GitLabUnauthenticated RCECI/CD Security
GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE in the CI/CD regex compiler
GitLab CE/EE ships a CVSS 10.0 unauthenticated RCE (CVE-2026-97229): a crafted CI/CD regex overflows into code execution. Patch 19.4.2/19.3.4/19.2.8 now.
7 min read