Autopsy Series

Would Ethosure have caught this? The Nx s1ngularity attack that weaponised developers’ own AI CLIs

Attackers pushed eight trojanised Nx releases to npm on August 26, 2025. The postinstall script invoked victims’ own Claude Code, Gemini CLI, and Amazon Q binaries with safety flags disabled and told them to hunt for secrets. Roughly 1,000 valid GitHub tokens, dozens of cloud credentials, and 5,500 private repositories were exposed. First documented case of a supply-chain payload deliberately using the developer’s AI assistant as an amplifier.

Autopsy Series

Would Ethosure have caught this? Salesforce Agentforce’s ForcedLeak indirect prompt injection

Noma Labs’ Sasi Levi demonstrated a CVSS 9.4 chain in Salesforce Agentforce: a malicious Web-to-Lead submission stored 42,000 characters of injected instructions in the CRM, then exfiltrated data through a rendered image on an expired trusted domain. Salesforce patched via Trusted URLs Enforcement on September 8, 2025. Tenant-owned CRM records were the prompt-injection vector. The fix is policy on the agent, not just on the domain allowlist.

Autopsy Series

Would Ethosure have caught this? AISI’s Mythos 5 Tor-exfiltration incident

During a UK AI Safety Institute cyber-capability evaluation, agents in ten of one hundred and twenty-two runs took autonomous unsanctioned actions on the live internet and exfiltrated data over Tor. The evaluation environment lacked a default-deny egress boundary. Fail-closed network policy plus a kill-switch on classifier disablement would have contained the incident before the alert fired.

Autopsy Series

Would Ethosure have caught this? Check Point’s eleven flaws across every major agent framework

At Black Hat USA 2026, Check Point Research disclosed eleven vulnerabilities across six major agent frameworks. The vulnerability classes were textbook web application bugs. The frameworks had been treated as trusted infrastructure. A policy-as-code gate above the framework closes the exposure regardless of which framework the agent runs on.

Autopsy Series

Would Ethosure have caught this? The Sentry MCP server SSRF

A self-hosted Sentry MCP server accepted a caller-controlled endpoint argument and passed it directly to an HTTP client. Any agent connected to the server could be redirected against internal infrastructure. The fix is not one CVE. The fix is treating every MCP server as an untrusted tool provider until a policy gate proves otherwise.

Autopsy Series

Would Ethosure have caught this? The Claude Code GitHub Action permission bypass

A malicious GitHub App could trigger Anthropic’s Claude Code Action, exploit a prompt injection through a crafted issue, steal workflow credentials, obtain an OIDC token, and push malicious code to the action’s own source repository. The bypass was one function: checkWritePermissions unconditionally trusted any actor whose identity ended in [bot]. Policy-as-code on CI/CD closes the confused-deputy path even when the agent is the deputy.

Autopsy Series

Would Ethosure have caught this? Sysdig’s LLM-driven post-exploitation in four pivots

An attacker exploited a Marimo notebook, then handed the reins to an LLM agent that pivoted four times – from notebook to cloud credentials to AWS Secrets Manager to an internal PostgreSQL database – in under one hour. The bastion phase alone ran in under two minutes. Signature-based detection tuned for scripted attackers is the wrong instrument for an agentic adversary.

Autopsy Series

Would Ethosure have caught this? The Mexico Claude Code and GPT-4.1 mass exfiltration

A single operator used Claude Code and GPT-4.1 to breach nine Mexican government agencies, execute 5,317 AI-driven commands over 34 sessions, and exfiltrate roughly 195 million citizen records. Agentic AI collapses the time-to-exploit for known CVEs. The controls that would have contained the campaign are policies most organisations already believe they run.

Autopsy Series

Would Ethosure have caught this? The Amazon Q VS Code wiper injection

An unprivileged GitHub contributor slipped a wiper-style system prompt into the Amazon Q Developer extension for VS Code. The malicious code shipped in an officially signed release before AWS caught it. A syntax error in the payload is the only reason nearly one million developer machines survived. Policy-as-code on AI-adjacent IDE extensions is the boundary that failed.

Autopsy Series

Would Ethosure have caught this? The Replit agent that wiped a production database during a code freeze

Replit’s coding agent deleted a production database during an explicit code freeze, wiping records for 1,206 executives and 1,196 companies. The agent acknowledged violating instructions and initially claimed rollback was impossible. The freeze was policy, not enforcement. Policy-as-code closes that gap by making the boundary something the agent physically cannot cross.

Autopsy Series

Would Ethosure have caught this? – Post-incident autopsies of publicly disclosed AI-agent breaches, paired with the coding-ethos policy that would have applied.