VulnHub

Real-time Cybersecurity News

We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.

The Hacker News

Overview

Token, a company focused on AI agents, built a new agent that inadvertently violated its own security rules regarding identity, access control, and traceability. This agent operated using a user's authenticated browser session, exposing potential risks associated with AI integration. The team at Token realized that these oversights could lead to significant security vulnerabilities, prompting them to rethink their defensive strategies for AI agents. This incident serves as a cautionary tale for companies developing similar technology, emphasizing the need for strict adherence to security protocols to prevent unauthorized access and data breaches. As AI continues to evolve, ensuring robust security measures is crucial for safeguarding user information.

Key Takeaways

  • Affected Systems: AI agents developed by Token
  • Action Required: Implement strict identity and access management protocols for AI agents, ensure traceability mechanisms are independent of human users.
  • Timeline: Disclosed on [date not specified]

Original Article Summary

We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated

Impact

AI agents developed by Token

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on [date not specified]

Remediation

Implement strict identity and access management protocols for AI agents, ensure traceability mechanisms are independent of human users

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

eBPF Rootkits: Why Underground Actors Are Taking Notice

BleepingComputer

Researchers have found that Linux eBPF rootkits are gaining traction among cybercriminals, who are utilizing these advanced techniques to conceal malicious activities on systems without needing to load traditional kernel modules. This method allows attackers to evade detection by conventional security measures. The information is being actively shared in underground forums, where hackers are posting source code, tutorials, and exploits specifically targeting Linux environments. This development is concerning for organizations that rely on Linux systems, as the ability to hide harmful actions makes it significantly harder for security teams to identify and respond to intrusions. As these rootkits become more prevalent, companies using Linux must enhance their security protocols to defend against these stealthy threats.

Nov 11, 2026

N-able releases security hotfixes for zero-day vulnerabilities

BleepingComputer

N-able has released hotfixes to address serious zero-day vulnerabilities in its N-central remote monitoring and management (RMM) platform. These vulnerabilities were publicly disclosed over the weekend, prompting the company to take affected hosted environments offline to mitigate potential risks. Users of the N-central platform should apply these hotfixes promptly to secure their systems against possible exploitation. The situation emphasizes the importance of timely updates in the face of emerging security threats, as attackers often seek to exploit newly discovered vulnerabilities. This incident serves as a reminder for organizations using this platform to remain vigilant and proactive in their cybersecurity practices.

Nov 11, 2026

Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

The Hacker News

A recent security review by Claroc revealed that over 35,000 apps built using the Grok platform were publicly accessible without any sign-in requirements. Out of 37,571 apps examined, 35,578 were found to be open, including 24 developed by employees of X, the social media network, and SpaceXSI, the company behind the Grok AI assistant. While many of these apps were benign, such as games and calculators, approximately 10% contained sensitive internal business data, raising serious concerns about data exposure. This incident highlights a significant risk for companies that may unintentionally expose confidential information through poorly secured applications. Organizations using Grok-built apps need to take immediate action to secure their applications and protect user data.

Nov 11, 2026

eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

The Hacker News

eMudhra has revoked eight of its intermediate certificate authorities (CAs) following a key compromise incident in October. Initially, the company believed these CAs were unaffected, but a flaw in an internal Python script led to their revocation. Each CA has its own private key, which is used to sign the certificates eMudhra issues. Although the keys themselves were not compromised, the issue with the script raised concerns about the integrity of the certificates. This situation affects users relying on eMudhra's certificates for secure communications, highlighting ongoing challenges in certificate management and security practices.

Nov 11, 2026

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two vulnerabilities in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder, noting that they are currently being exploited in the wild. The first vulnerability, identified as CVE-2026-20320, has a CVSS score of 7.5 and involves improper restrictions on XML external entities. This means attackers could potentially manipulate XML data to gain unauthorized access or execute malicious commands. Organizations using these products should take immediate action to secure their systems, as the vulnerabilities can lead to significant data breaches or system compromises. Patches are available, but the urgency is heightened due to ongoing exploitation.

Nov 11, 2026

Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon

darkreading

The open-source Artex framework, along with 45 other penetration testing tools, has been repurposed by hackers to conduct credential attacks and cloud breaches at unprecedented speeds. This misuse allows attackers to target various industries, raising significant concerns about security among companies that utilize these tools. Researchers have highlighted that the forks of Artex are not just theoretical threats; they are actively being exploited, making it crucial for organizations to be vigilant. As these tools can execute attacks swiftly across different platforms, the risk of widespread breaches increases. Companies using Artex or similar tools should review their security measures to mitigate potential risks.

Nov 10, 2026