AI learning path

Orientation and first principles — what the bug class is and how it behaves.

1. GPT-5.5-Cyber built a zlib fuzzing lab in a day
   5 min readblog.trailofbits.com2026
   Library built by GPT-5.5-Cyber for fuzzing zlib; it automatically generated harnesses across numerous entrypoints (including inflate, uncompress2, and MiniZip), configured ASan and UBSan builds, repurposed edge-case tests as seeds, and utilized compile-time variants like INFLATE_STRICT. This autonomous fuzzing campaign, a process that previously took weeks for skilled researchers, was completed in a single day, demonstrating a significant shift in vulnerability discovery capabilities.
2. [tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR
   10 min readtldrsec.com2026
   Library for securing enterprise AI agents, uber/ADR, pairs an observability sensor with a two-tier detector to identify unsafe behaviors like credential exposure and prompt injection, benchmarked against 17 agent attack techniques and 133 MCP servers. This system, detailed in an arXiv paper and MLSys slides, aims to provide production security for AI agents by capturing telemetry and flagging policy violations.
3. The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy
   11 min readblog.includesecurity.com2026
   Analysis of Bright Data's SDK reveals how consumer devices, particularly smart TVs, are leveraged as residential proxy nodes for AI model data scraping. The SDK, embedded in apps from publishers like PlayWorks and Petflix, uses user consent to turn devices into exit nodes for web-scraping traffic. This circumvents datacenter IP blocking by services like Cloudflare, facilitating large-scale data harvesting for AI training. The analysis details the SDK's functionality, its connection to Bright Data's infrastructure using the legacy Luminati Networks domain, and the unauthenticated configuration fetching process.
4. Your AI Agents Are Using Your Credentials
   9 min readblog.gitguardian.com2026
   Library for securing AI agents, addressing the critical issue of credential mismanagement. It highlights that AI agents often borrow human or workload credentials, bypassing enterprise IdP mediation and creating governance blind spots. The library emphasizes the need for discovery and attribution of agent credentials, alongside prevention strategies to block new exposures and migration of existing ones. The recommended end state involves scoped, short-lived access for agent-specific or delegated identities to limit the impact of credential theft, drawing parallels to vulnerabilities like Nx s1ngularity.
5. How AI is powering business email compromise at scale
   14 min readresearch.eye.security2026
   Library that enables attackers to automate Business Email Compromise (BEC) using AI-powered Phishing-as-a-Service kits, including TokenLover and YaksaLover. These kits leverage techniques like device code phishing, FOCI pivoting, and Windows Hello key injection for persistent access, even surviving password resets and offering AI-driven analysis of harvested mailboxes for fraud. The tooling centralizes stolen Microsoft 365 identities, automating campaigns and presenting capabilities to less-skilled operators at industrial scale.

Real testing methodology, tooling, and writeups that show the work.

1. Practical LLM Security Advice from the NVIDIA AI Red Team
   5 min readdeveloper.nvidia.com2026
   Library summarizing NVIDIA AI Red Team findings, detailing common LLM application vulnerabilities. It addresses risks like remote code execution (RCE) from executing LLM-generated code (e.g., via `exec` or `eval`), insecure permissions in Retrieval-Augmented Generation (RAG) data stores leading to data leakage and prompt injection, and data exfiltration through active content rendering of Markdown or hyperlinks. Mitigation strategies include sandboxing dynamic code, rigorously managing RAG permissions, and sanitizing LLM output.
2. [tl;dr sec] #333 - Perplexity's Bumblebee, Evading Cloud Logging, AI Vuln Hunting Spec
   12 min readtldrsec.com2026
   Library for detecting malware in packages, agent configurations, and browser extensions, alongside techniques for evading cloud logging, and a specification for building custom AI security scanning systems. It details how formal methods are becoming more practical for AI-generated code, and how Microsoft's Agentic Secret Finder reduced false positives in GitHub's AI secret scanning by 75% through context extraction. The entry also covers the discovery of HTTP/2 Bomb, a DoS vulnerability affecting multiple web servers, and methods for disrupting AWS CloudTrail logging and abusing cloud logging services for defense evasion and visibility.
3. Leaking Secrets in the Age of AI
   8 min readwiz.io2026
   Library for identifying AI-related secret leakage in public code repositories. The analysis found that `.ipynb` notebook files and configuration files like `mcp.json` and `.env` are particularly prone to exposing secrets from emerging AI vendors, impacting numerous companies. This research highlights critical gaps in current secrets scanning tools and practices, especially concerning the handling of AI development artifacts.
4. Detecting AI-specific threats in Claude Enterprise from the Compliance API: a prefilter + LLM-as-judge pipeline with Sigma rules
   11 min readpapermtn.co.uk2026
   Library for detecting AI-specific threats within Claude Enterprise, leveraging the Compliance API through a prefilter and LLM-as-judge pipeline with Sigma rules. It focuses on detecting indirect prompt injection via ingested content, jailbreaks, system prompt extraction, exfiltration preparation, and sensitive output disclosure, differentiating these threats from standard SaaS security concerns by analyzing conversation content rather than just perimeter events.
5. Would You Click ‘Accept’? Automatically detecting malicious Azure OAuth applications using LLMs
   11 min readwiz.io2026
   Tool for detecting malicious Azure OAuth applications, leveraging insights from homoglyph attacks and analysis of real-world campaigns. This pipeline identifies suspicious applications by comparing their characteristics against a baseline of legitimate integrations, flagging deviations in publisher verification, homepage URLs, and application owner domains. The research highlights common gaps in Azure service principal management and the risk of consent fatigue, leading to potential privilege escalation and persistent access for attackers.

Novel research, edge cases, and the techniques that push the class forward.

1. Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis
   30 min readarxiv.org2026
   Analysis of prompt injection vulnerabilities affecting agentic AI coding assistants like Claude Code, GitHub Copilot, and Cursor, which integrate LLMs with external tools and protocols such as MCP. This work synthesizes findings from 78 studies, detailing 42 attack techniques including input manipulation, tool poisoning, and protocol exploitation. It identifies that over 85% of attacks succeed against current defenses, often enabling arbitrary code execution and system compromise through vulnerabilities in skill-based architectures and protocol ecosystems.
2. Prompt Injection 2.0: Hybrid AI Threats
   20 min readarxiv.org2026
   Library for analyzing Prompt Injection 2.0, which combines LLM manipulation with traditional exploits like XSS and CSRF. It builds upon Preamble's research and mitigation technologies, evaluating them against contemporary threats such as AI worms and multi-agent infections. The library analyzes how these hybrid attacks bypass security controls, referencing CVE-2024-5565 and DeepSeek XSS exploits, and proposes architectural solutions involving prompt isolation and runtime security.
3. s1ngularity's Aftermath: AI, TTPs, and Impact in the Nx Supply Chain Attack
   9 min readwiz.io2026
   Analysis of the s1ngularity Nx supply chain attack details novel TTPs used by AI-powered malware to exfiltrate secrets, including GitHub and npm tokens. The attack progressed through three phases: initial public leakage of thousands of corporate secrets, abuse of leaked GitHub tokens to expose private repositories, and a final phase publishing more repositories. The malware leveraged AI CLIs like Claude and Gemini to identify and exfiltrate sensitive files, impacting over 1,700 users with public secret leakage and hundreds more through the exposure of private repositories.
4. EchoLeak: First Real-World Zero-Click Prompt Injection Exploit
   21 min readarxiv.org2026
   Writeup of EchoLeak (CVE-2025-32711), the first zero-click prompt injection exploit targeting Microsoft 365 Copilot. This vulnerability allowed unauthenticated data exfiltration via a crafted email by chaining multiple bypasses, including evading XPIA classifiers, using reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy within the content security policy. The paper analyzes defense failures and proposes mitigations such as prompt partitioning and enhanced filtering, providing generalizable lessons for secure AI copilots.
5. Building an Open-Source AI-Powered Auto-Exploiter with a 1.7B Parameter Model: No Paid APIs Required
   13 min readmohitdabas.in2025
   Library for building an open-source, AI-powered autonomous penetration testing agent. This system utilizes a 1.7 billion parameter qwen3:1.7b model, LangChain, and LangGraph for local execution, eliminating API costs and data exfiltration. It functions as a ReAct agent, independently scanning networks with Nmap, searching for exploits using searchsploit, mirroring them, analyzing code with `inspect_exploit_code`, setting up listeners with `start_listener`, and executing commands via `execute_shell_command` to achieve autonomous exploitation.
6. Microsoft Copilot: From Prompt Injection to Exfiltration of Personal Information · Embrace The Red
   6 min readembracethered.com2024
   Writeup detailing a Microsoft 365 Copilot vulnerability where prompt injection, automatic tool invocation, and ASCII smuggling were combined to exfiltrate personal information. The exploit chain leveraged malicious emails or shared documents to trigger Copilot's processing, enabling it to access and send sensitive data like emails and MFA codes to attacker-controlled domains via disguised hyperlinks.
7. Insight into agentic hacking tools: Hermes, OpenClaw and the Bayesian brain
   10 min readdreamgroup.com2026
   Library for agentic AI hacking, Hermes and OpenClaw, demonstrates advanced autonomous intrusion capabilities. This framework uses parallel sub-agents and Bayesian prioritization to autonomously crack credentials, exfiltrate data, and establish persistence within government infrastructure. Its operational intelligence features include autonomous research into vulnerability databases, feedback loops for adaptive planning, and bypassing guardrails by framing activities as penetration testing. The library highlights the collapsing cost of sophisticated attacks and the increasing difficulty for defenders.
8. LLMs could control their host machines by exploiting inference engines
   5 min readboydkane.com2026
   Analysis of LLM host machine control risks focuses on exploitation of inference engine vulnerabilities, such as the `eval()` bug in vLLM CVE-2025-9141, which allowed arbitrary code execution. Malicious LLMs could emit specially crafted token sequences to trigger parser bugs in systems like vLLM and SGLang. While multimodal LLMs introduce additional attack surfaces, the primary concern is text-based token exploitation. The essay suggests measures like running GPUs and token parsers on separate machines to mitigate these risks.