The agents are playing Prison Break this week. We also have two very cool exploit chains and a question I keep coming back to: is AI going to make exploit chains more complex?

Unless you live under a rock, you probably heard about this story already. This week, an OpenAI agent escaped its evaluation environment and compromised Hugging Face while trying to pass a benchmark. The strongest lesson is not that agents have suddenly become malicious, but that capable agents will explore every path available to them unless the environment, scope and stopping conditions are much stronger than the objective they have been given. A good reminder that reward hacking can have consequences.

OpenAI says the agent used a zero-day in the package-registry cache proxy to escape the isolated environment, but no further technical details have been provided yet.

There are a lot of different angles to this, legal and technical among others. I can tell you one thing: it kept influencers busy all week.
OpenAI and Hugging Face partner to address security incident during model evaluation.

ProjectDiscovery’s response is almost more interesting than the original incident (previous link). They have repeatedly seen agents find unintended paths during internal benchmarks, including other challenge containers, tracing systems, public source code and mounted secrets.

Their point is not that the OpenAI incident was unremarkable, but that the behaviour was predictable and should have been contained. We spend too much time comparing final benchmark scores and not enough time reading the trajectories. An agent may have “solved” a challenge because it found the intended vulnerability, because it escaped the challenge, or because it found the answer somewhere else. Those are very different capabilities.

So while the entire cyber world is shocked, PD is telling us: if you like it, you should have put a better sandbox on it. Oh My Rogue Agent.

Fastjson 1.2.83 was the version everyone treated as the safe end of the 1.x line. AutoType was disabled by default, there was no useful gadget on the classpath and the problem was supposed to be over.

This research shows that attacker-controlled @type values can still reach class metadata loading, fetch a remote JAR and eventually load an attacker-controlled class. On modern JDKs, the chain goes even further by reopening the JVM’s deleted JAR cache through /proc/self/fd. The exploit conditions matter, particularly the use of Spring Boot’s fat-JAR class loader, but the result is still remarkable: gadget-free RCE in the version people were told to upgrade to.

This bug also raises an interesting question about end-of-life software and libraries. When the opportunity cost of trying a few new ideas is approaching zero, what happens to all the old code nobody is supposed to be using anymore?

I would not be surprised if we see a few major vulnerabilities in things such as Struts 1 or Apache OFBiz over the next few months. This may, of course, become a self-fulfilling prophecy.

We built two labs for this issue that are now available to our PRO subscribers. FastJson 1.2.83 Remote Code Execution.

This is probably the deepest technical article this week. The research starts with two memory-safety bugs in the Oj JSON parser, then traces the vulnerable parser call back through GitLab’s Jupyter notebook diff renderer until repository-controlled bytes reach native C code.

From there, it turns a constrained nesting overflow and a key-length bug into heap manipulation, Ruby Array overlap and ultimately code execution inside a GitLab Puma worker. The important part is not only the exploit development. It shows why reachability is such an important part of vulnerability research: a bug in a JSON parser becomes a GitLab RCE only after someone understands exactly where that parser sits inside the product and who controls its input.

The initial Oj vulnerabilities were surfaced by the depthfirst system, but turning two constrained memory-corruption bugs into a GitLab RCE clearly required substantial human research and exploit engineering.

This brings me back to something I first thought about with wp2shell: are we going to see increasingly complex web exploit chains? It is not necessarily that vulnerabilities are becoming more complex, but that AI makes it cheaper to keep working on primitives that would previously have been abandoned as too constrained or too time-consuming to exploit. Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities.

Capital One released VulnHunter as a Hunt, Fix and Verify loop for Claude Code. It is a thoughtful attempt to turn a security code review methodology into a repeatable agent workflow, rather than simply asking a model to “find vulnerabilities.”

The public benchmark is still limited, but there are several ideas here that are genuinely worth studying.

It inventories every attacker-controlled input before hunting and makes sure each one is either investigated, proven safe or explicitly accepted as intended behaviour. It also actively tries to disprove each finding, asks what capability the attacker actually gains and uses a separate agent to verify the fix.

This is where agentic code review becomes interesting to me. The advantage may not come from finding a better model, but from encoding a strong review methodology into several constrained agents. capitalone / VulnHunter.

EthiBench is a more serious attempt to answer a question that most AI pentesting benchmarks avoid: did the agent actually find the vulnerabilities?

It scores reports against 108 expert-annotated ground-truth findings, uses an LLM for semantic matching, then applies one-to-one assignment so the same vulnerability cannot be credited multiple times. That is much better than measuring flag capture, but it should still not be confused with measuring real-world pentesting. The targets are intentionally vulnerable, the ground truth may be incomplete and the agent’s own untrusted report is inserted directly into the judge prompt.

The most valuable part may be the data rather than the framework itself: 108 vulnerability specifications and 999 real agent findings, including working payloads, duplicates and false positives. ethiack / ethibench.