sections

$ ./daily-download --date 2026-11-11

The Daily Download

Wednesday, November 11, 2026

5 findings · 4 briefly notedls ./archive →

// executive briefing

Executive Briefing

  1. 01An attacker used two compromised Qubole IAM users to assume roles that customers had granted Qubole, then emptied Secrets Manager, SSM and S3 across dozens of AWS accounts. Third-party cross-account trust is the attack path, not AWS itself.high
  2. 02A new paper treats coding agents as living-off-the-land platforms and shows a deterministic reference monitor with capability tokens and taint tracking beating an LLM judge, which refused 98.3% of benign work.high
  3. 03Five Go toolchain advisories show that building an untrusted cgo package could inject linker flags or run code at build time. Go 1.27.4 and 1.26.11 fix them, so treat `go build` on third-party code as code execution.medium
  4. 04BypassGym measures whether AI agents can write EDR-evading loaders: one lightweight model succeeded in 17 of 18 runs, an early signal for how defenders should test endpoint controls.medium

// worth learning

Worth learning

  • Cross-account role trust and the confused deputy

    The Qubole breach ran entirely on roles customers trusted. Worth reviewing external IDs, scoped trust policies, source-network conditions and how to inventory unused vendor roles. see finding ↓

  • Capability-based reference monitors for agents

    ActiveSecHarness pairs HMAC capability tokens with taint tracking and deterministic guards. It's the same direction as yesterday's sandbox findings: enforce outside the model. see finding ↓

  • Build-time trust boundaries

    cgo directives, pkg-config and .syso files all let package contents reach the linker. Building untrusted code needs the same isolation as running it. see finding ↓

// ai-engineering

AI Innovation & Engineering1

medium Likely Latent Space · Nov 10, 23:49

OpenAI shows Codex cloud handoff, voice control and 'Dots' personal agents at AIE Code Summit

At the AIE Code Summit workshop, OpenAI showed a local Codex handing a task to Codex Cloud (v2, released after DevDay), which runs in published environments as isolated instances, plus voice as a control plane for managing threads. It also described Dots, personal agents with access to dev boxes, laptops and cloud environments, framed as a 'delegation sink'.

What changed
Agent work moves fluidly between a developer's machine and isolated cloud instances, and a persistent personal agent spans all of them.
Evidence
Vendor claimLatent Space write-up of the OpenAI workshop; no benchmarks.
Opportunity
Long tasks can be handed off to isolated cloud environments instead of running on a laptop with full credentials.

Why it matters to you

An agent with standing access to laptops, dev boxes and cloud environments is a new kind of identity with broad, cross-boundary reach. The write-up does not cover permissions or sandboxing, so that is the question to ask before adopting it.

Learn
  • Delegated identity for persistent agents
  • Latent SpaceAI Engineer Code Summit: OpenAI on New Ways of Working With Codex
Details
Relevance score
28/100 — topics: ai_engineering +14; category ai-engineering +14; established source +5; source priority +2; original research / analysis +8; recent +3; noise: marketing -18

// ai-security

AI & Agentic Security2

high Preliminary arXiv cs.CR (AI-security papers only) · Nov 11, 00:00

Coding-agent harnesses are living-off-the-land platforms; paper argues for a deterministic reference monitor

The paper argues that once instructions are injected into retrieved content, a coding harness's own tools (bash, curl, find) become the payload, so security has to come from architecture and permission composition, not from the model. It proposes ActiveSecHarness: a reference monitor with HMAC capability tokens across four rings, a 2D taint lattice with a provenance ledger, and deterministic Ring-0 guards.

What changed
Shows deterministic enforcement can block every attack in its test set with no false positives, where an LLM-as-judge guard was both slow and unusable.
Evidence
PreprintOn 252 fixtures, a qwen3:4b judge refused 98.3% of benign work at 142.3 ms per decision; Ring 0 reached ABR 1.000 and FPR 0.000 in 12.7 μs. A stateless baseline missed 4 of 12 kill chains (ABR 0.667). Authors' own evaluation, abstract only.
Opportunity
A concrete design to borrow for agent platforms: capability tokens for tool calls, taint labels on retrieved content, and stateful checks across a trajectory rather than per command.

Why it matters to you

It gives architecture-level language and numbers for something security reviews of agents keep running into: regex allowlists and LLM judges both fail, while deterministic, stateful policy outside the model holds up.

Learn
  • Reference monitors and capability tokens
  • Taint tracking for LLM context
  • Trajectory-level (stateful) policy checks
Details
Relevance score
47/100 — topics: ai_engineering, ai_security +30; category ai-security +14; community source +0; recent +3
medium Preliminary arXiv cs.CR (AI-security papers only) · Nov 11, 00:00

BypassGym benchmarks whether AI agents can build loaders that evade real EDR products

BypassGym runs agents against real Windows VMs with EDR installed (on Proxmox VE) and asks them to build a loader that runs C2 shellcode without being blocked or killed. It tests 5 lightweight model backends against 6 EDR products and 3 payloads.

What changed
Defense evasion, a gap in existing offensive-AI benchmarks, now has a measurable harness, and small models already score highly on it.
Evidence
PreprintDeepSeek-V4.1 Flash succeeded in 17 of 18 runs; Bitdefender allowed only 5 of 15 runs through. The abstract does not name the other models or EDRs.
Opportunity
A template for testing your own endpoint controls against agent-generated tooling rather than known samples.

Why it matters to you

If cheap models can iterate on evasion against a live EDR, detection based on known tooling weakens. Testing controls against agent-generated variants, and relying on layers beyond endpoint detection, matters more.

Learn
  • EDR evasion techniques (loaders, shellcode execution)
  • Designing offensive-capability evals
Details
Relevance score
47/100 — topics: ai_engineering, ai_security +30; category ai-security +14; community source +0; recent +3

// incidents

Exceptional Incidents1

high Likely BleepingComputer · Nov 10, 14:31

Compromised Qubole IAM users used customers' trusted roles to raid dozens of AWS accounts

Between October 14 and 26, an attacker used two compromised Qubole IAM users to call STS AssumeRole on otherwise unused roles in customer accounts that trusted a Qubole-associated account. Per Wiz and Sentra, they read Secrets Manager, SSM Parameter Store and Lambda environment variables, validated keys with TruffleHog and downloaded S3 objects, hitting tens of companies; Sentra cites millions of files from one customer. AWS says its services were not compromised and operated as designed.

Why it matters to you

This is a vendor-integration attack path: every role you grant a SaaS provider is a standing credential that someone else holds. Nothing was exploited; the trust policies did exactly what they said, which makes this a design and inventory problem rather than a patching one.

Action

List roles trusted by third-party accounts, remove unused ones, add external IDs and source-network conditions, review CloudTrail AssumeRole activity from October 1, and rotate secrets reachable from any Qubole-trusted role.

Learn
  • Confused-deputy protection with sts:ExternalId
  • Scoping role trust policies by source IP/VPC
  • Detecting dormant-role AssumeRole in CloudTrail
UncertainQubole had not publicly confirmed the breach or explained how its IAM users were compromised; details come from Wiz and Sentra via BleepingComputer.
Exploited in the wild · per press reports
  • BleepingComputerHackers exploit trusted AWS access to breach multiple cloud environments
Details
Affected
AWS customers with roles trusting a Qubole-associated account
Mitigation
Review CloudTrail from Oct 1, rotate exposed credentials, revoke active role sessions, remove unused integrations, restrict role permissions, trusted identities and source networks.
Relevance score
48/100 — topics: identity_authz, aws, systemic, major_incident +32; category incidents +2; established source +5; source priority +2; exploitation reported by press +6; recent +1

// go

Go & Engineering1

medium Confirmed Go Vulnerability Database · Nov 10, 21:51

Five Go toolchain bugs let a malicious cgo package inject linker flags or run code at build time

The Go team published five advisories (GO-2026-6848, 6849, 6850, 6852, 6853) for cmd/go, cmd/cgo, cmd/compile and cmd/link. Crafted //go:cgo_* directives, escaped quotes in //go:cgo_ldflag, '#cgo pkg-config:' arguments, PE DLL names and .syso or linker input files could each bypass flag validation and reach the external linker, up to arbitrary code execution at build time. Fixed in Go 1.27.4 and 1.26.11.

Why it matters to you

Go's promise that building code doesn't run it rests on cgo flag allowlists, and this batch shows several ways around them. Anywhere that builds third-party modules (CI, dependency scanners, build services) should treat a build as running untrusted code.

Action

Upgrade toolchains in CI and build images to 1.27.4 / 1.26.11, and isolate builds of untrusted modules.

Learn
  • Go build-time trust model and cgo flag allowlists
  • Sandboxing CI builds of untrusted code
No known exploitationCVE-2026-97042
Details
Mitigation
Upgrade to Go 1.27.4 or 1.26.11.
Affected (from advisory data)
Go: toolchain
Fixed versions
1.26.11, 1.27.4
Relevance score
31/100 — topics: supply_chain, prevalence +12; category go +4; primary source +8; source priority +4; recent +3

// briefly noted

Briefly noted4

  • #ai-engineering
    BotPsy: an on-device personal assistant built on a sub-billion-parameter agentic model Hugging Face post on running an agentic assistant fully on-device with a very small model. Hugging Face Blog
  • #ai-security
    Paper: private retrieval and private inference to resist memory poisoning in multi-agent systems Proposes privacy-preserving retrieval and inference so malicious agents can't poison or read other agents' knowledge; early research. arXiv cs.CR (AI-security papers only)
  • #ai-security
    TERM: jailbreak defense that adjusts internal activations per input without a predefined target Entropy-guided residual modulation aims to block jailbreaks while limiting over-refusal; preprint, model-internal defense. arXiv cs.CR (AI-security papers only)
  • #ai-security
    Aqua: for AI agents in banking, an alert doesn't revoke the agent's authority Vendor post arguing agent controls must deny prohibited actions before they complete, since agents can cause exposure with legitimate credentials. Aqua Security Blog

Analyst note. Quiet window. Left out: Mercor's funding round, OpenAI customer stories (Gilbert + Tobin, ChatGPT Plus for veterans), Workday's LangGraph case study, and compliance announcements from Wiz (ISMAP) and AWS (ProcessUnity). The arXiv item titled 'POEM' was dropped because the feed paired it with another paper's abstract. Latent Space's 'Designing for Agents' interview had too little detail to summarize.

Source health: 56/56 sources OK
SourceStatusItemsLast success
AWS Security Blogok20Nov 11, 08:30
AWS Security Bulletinsok43Nov 11, 08:30
Anthropic Engineeringok24Nov 11, 08:30
Anthropic Newsok22Nov 11, 08:30
Anthropic Researchok23Nov 11, 08:30
Aqua Security Blogok10Nov 11, 08:30
Artificial Analysisok12Nov 11, 08:30
BleepingComputerok15Nov 11, 08:30
CISA Cybersecurity Advisoriesok14Nov 11, 08:30
CISA Known Exploited Vulnerabilitiesok40Nov 11, 08:30
CISA News (incl. Secure by Design)ok10Nov 11, 08:30
Claude Code Releasesempty0Nov 11, 08:30
Cloudflare Blog (security)ok20Nov 11, 08:30
Datadog Security Labsok30Nov 11, 08:30
Embrace The Red (Johann Rehberger)ok231Nov 11, 08:30
GKE Security Bulletinsok30Nov 11, 08:30
GitHub Advisories (Go ecosystem)ok3Nov 11, 08:30
GitHub Advisory Database (critical/high)ok29Nov 11, 08:30
GitHub Security Labok10Nov 11, 08:30
Go Releases (golang/go tags)ok10Nov 11, 08:30
Go Vulnerability Databaseok12Nov 11, 08:30
Google Cloud Blog (identity & security)ok20Nov 11, 08:30
Google Cloud Security Bulletinsok30Nov 11, 08:30
Google DeepMind Blogok100Nov 11, 08:30
Google Online Security Blogok25Nov 11, 08:30
Google Project Zerook10Nov 11, 08:30
Google Threat Intelligence (Mandiant)ok20Nov 11, 08:30
Hugging Face Blogok400Nov 11, 08:30
Hugging Face Daily Papersok11Nov 11, 08:30
Krebs on Securityok10Nov 11, 08:30
Kubernetes Blogok50Nov 11, 08:30
Kubernetes Official CVE Feedok95Nov 11, 08:30
LangChain Blogok99Nov 11, 08:30
LangGraph Releasesempty0Nov 11, 08:30
Latent Spaceok20Nov 11, 08:30
MCP Specification Releasesok6Nov 11, 08:30
METRok102Nov 11, 08:30
MITRE ATLAS (data releases)ok10Nov 11, 08:30
Meta AI Blogok5Nov 11, 08:30
Model Context Protocol Blogok28Nov 11, 08:30
Mozilla Security Blog (incl. root store / PKI)ok10Nov 11, 08:30
OWASP GenAI Security Projectok10Nov 11, 08:30
OpenAI Agents SDK Releasesok3Nov 11, 08:30
OpenAI Codex CLI Releasesempty0Nov 11, 08:30
OpenAI News & Researchok400Nov 11, 08:30
OpenSSF Blogok10Nov 11, 08:30
PortSwigger Researchok40Nov 11, 08:30
Qwen (open-weight models)ok44Nov 11, 08:30
Simon Willisonok15Nov 11, 08:30
Snyk Labsok5Nov 11, 08:30
The Go Blogok10Nov 11, 08:30
The Recordok5Nov 11, 08:30
Trail of Bitsok20Nov 11, 08:30
Wiz Blog & Researchok400Nov 11, 08:30
arXiv cs.CR (AI-security papers only)ok24Nov 11, 08:30
vLLM Releasesok3Nov 11, 08:30