Hunt & Hackett
@huntandhackett.com
We are experts in cybersecurity, our specialists operate on the frontlines to help customers prevent, detect and respond to today’s most advanced adversaries.
Visit our website: www.huntandhackett.com
Visit our website: www.huntandhackett.com
Hope you enjoy these as much as we did!
What’s the best thing you’ve read, watched, or tinkered with lately? Drop it in the comments! Our Hunters are always looking for their next rabbit hole. 🔍
🧵 7/7
What’s the best thing you’ve read, watched, or tinkered with lately? Drop it in the comments! Our Hunters are always looking for their next rabbit hole. 🔍
🧵 7/7
August 12, 2025 at 9:32 AM
Hope you enjoy these as much as we did!
What’s the best thing you’ve read, watched, or tinkered with lately? Drop it in the comments! Our Hunters are always looking for their next rabbit hole. 🔍
🧵 7/7
What’s the best thing you’ve read, watched, or tinkered with lately? Drop it in the comments! Our Hunters are always looking for their next rabbit hole. 🔍
🧵 7/7
𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬 𝐢𝐧 𝐀𝐈 𝐀𝐠𝐞𝐧𝐭 𝐃𝐞𝐩𝐥𝐨𝐲𝐦𝐞𝐧𝐭
The largest AI agent red team ever: 1.8 million prompt-injection attacks, 60k policy violations, and proof that most agents still have a long way to go.
👉 arxiv.org/abs/2507.20526
🧵 6/7
The largest AI agent red team ever: 1.8 million prompt-injection attacks, 60k policy violations, and proof that most agents still have a long way to go.
👉 arxiv.org/abs/2507.20526
🧵 6/7
Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition
Recent advances have enabled LLM-powered AI agents to autonomously execute complex tasks by combining language model reasoning with tools, memory, and web access. But can these systems be trusted to f...
arxiv.org
August 12, 2025 at 9:32 AM
𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬 𝐢𝐧 𝐀𝐈 𝐀𝐠𝐞𝐧𝐭 𝐃𝐞𝐩𝐥𝐨𝐲𝐦𝐞𝐧𝐭
The largest AI agent red team ever: 1.8 million prompt-injection attacks, 60k policy violations, and proof that most agents still have a long way to go.
👉 arxiv.org/abs/2507.20526
🧵 6/7
The largest AI agent red team ever: 1.8 million prompt-injection attacks, 60k policy violations, and proof that most agents still have a long way to go.
👉 arxiv.org/abs/2507.20526
🧵 6/7
𝐂𝐈𝐒-𝐇𝐚𝐫𝐝𝐞𝐧𝐞𝐝 𝐃𝐞𝐛𝐢𝐚𝐧 12 𝐀𝐌𝐈
A reproducible recipe for spinning up a CIS-benchmarked Debian AMI. Cloud-init friendly, and only skips the rules that actually make sense to skip.
👉 behzadan.com/posts/0004-c...
🧵5/7
A reproducible recipe for spinning up a CIS-benchmarked Debian AMI. Cloud-init friendly, and only skips the rules that actually make sense to skip.
👉 behzadan.com/posts/0004-c...
🧵5/7
CIS-Hardened Debian 12 AMI with Packer and Ansible
How I built a CIS-hardened Debian 12 AMI using Packer and Ansible, with notes on IAM permissions and automation for reproducibility.
behzadan.com
August 12, 2025 at 9:32 AM
𝐂𝐈𝐒-𝐇𝐚𝐫𝐝𝐞𝐧𝐞𝐝 𝐃𝐞𝐛𝐢𝐚𝐧 12 𝐀𝐌𝐈
A reproducible recipe for spinning up a CIS-benchmarked Debian AMI. Cloud-init friendly, and only skips the rules that actually make sense to skip.
👉 behzadan.com/posts/0004-c...
🧵5/7
A reproducible recipe for spinning up a CIS-benchmarked Debian AMI. Cloud-init friendly, and only skips the rules that actually make sense to skip.
👉 behzadan.com/posts/0004-c...
🧵5/7
𝐅𝐨𝐫𝐭𝐢𝐖𝐞𝐛 𝐏𝐫𝐞-𝐀𝐮𝐭𝐡 𝐑𝐂𝐄
From SQL injection to RCE in Fortinet’s WAF. Creative payloads, root-level fun, and a few laughs along the way.
👉 pwner.gg/blog/2025-07...
🧵 4/7
From SQL injection to RCE in Fortinet’s WAF. Creative payloads, root-level fun, and a few laughs along the way.
👉 pwner.gg/blog/2025-07...
🧵 4/7
FortiWeb Pre-Auth RCE (CVE-2025-25257)
Hey! and welcome to another THEY BURNED MY BUG episode. This time, we introduce CVE-2025-25257. An SQLi that I spotted back in Feb. in case someone burn them before i get my bragging rights8157d429953...
pwner.gg
August 12, 2025 at 9:32 AM
𝐅𝐨𝐫𝐭𝐢𝐖𝐞𝐛 𝐏𝐫𝐞-𝐀𝐮𝐭𝐡 𝐑𝐂𝐄
From SQL injection to RCE in Fortinet’s WAF. Creative payloads, root-level fun, and a few laughs along the way.
👉 pwner.gg/blog/2025-07...
🧵 4/7
From SQL injection to RCE in Fortinet’s WAF. Creative payloads, root-level fun, and a few laughs along the way.
👉 pwner.gg/blog/2025-07...
🧵 4/7
𝐂𝐫𝐚𝐜𝐤𝐢𝐧𝐠 𝐭𝐡𝐞 𝐕𝐚𝐮𝐥𝐭
Nine zero-days in HashiCorp Vault. Subtle logic flaws, the first public RCE in Vault, and a reminder that “secure” isn’t always secure.
👉 cyata.ai/blog/crackin...
🧵3/7
Nine zero-days in HashiCorp Vault. Subtle logic flaws, the first public RCE in Vault, and a reminder that “secure” isn’t always secure.
👉 cyata.ai/blog/crackin...
🧵3/7
Cracking the Vault: how we found zero-day flaws in authentication, identity, and authorization in HashiCorp Vault - Cyata | The Control Plane for Agentic Identity
Introduction: when the trust model can’t be trusted Secrets vaults are the backbone of digital infrastructure. They store the credentials, tokens, and certificates that govern access to systems, servi...
cyata.ai
August 12, 2025 at 9:32 AM
𝐂𝐫𝐚𝐜𝐤𝐢𝐧𝐠 𝐭𝐡𝐞 𝐕𝐚𝐮𝐥𝐭
Nine zero-days in HashiCorp Vault. Subtle logic flaws, the first public RCE in Vault, and a reminder that “secure” isn’t always secure.
👉 cyata.ai/blog/crackin...
🧵3/7
Nine zero-days in HashiCorp Vault. Subtle logic flaws, the first public RCE in Vault, and a reminder that “secure” isn’t always secure.
👉 cyata.ai/blog/crackin...
🧵3/7
𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠 𝐒𝐩𝐞𝐜𝐢𝐚𝐥𝐢𝐬𝐭 𝐌𝐨𝐝𝐞𝐥𝐬
Small, self-hosted LLMs that can outshine the big guys — if you train them for one very specific, very sneaky job.
👉 www.outflank.nl/blog/2025/08...
🧵2/7
Small, self-hosted LLMs that can outshine the big guys — if you train them for one very specific, very sneaky job.
👉 www.outflank.nl/blog/2025/08...
🧵2/7
Training Specialist Models | Outflank
Training specialized LLMs with reinforcement learning with verifiable rewards (RLVR), using evasive malware development as a case study.
www.outflank.nl
August 12, 2025 at 9:32 AM
𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠 𝐒𝐩𝐞𝐜𝐢𝐚𝐥𝐢𝐬𝐭 𝐌𝐨𝐝𝐞𝐥𝐬
Small, self-hosted LLMs that can outshine the big guys — if you train them for one very specific, very sneaky job.
👉 www.outflank.nl/blog/2025/08...
🧵2/7
Small, self-hosted LLMs that can outshine the big guys — if you train them for one very specific, very sneaky job.
👉 www.outflank.nl/blog/2025/08...
🧵2/7