Reward hacking, shrinking harnesses, LLM-first SAST and agents that cheat.

Last week, we discussed the OpenAI agent that escaped its sandbox and used an external code-execution environment to attack Hugging Face.

Hugging Face has now published the technical timeline: roughly 17600 actions across Kubernetes, cloud infrastructure, internal networks and source control. The link is worth opening for the animation alone. After playing with it, you will never look at an incident report the same way again.

The agent did not become evil. It simply found an easier way to complete its objective: steal the benchmark answers instead of solving the benchmark.

If you ever needed a clear example of reward hacking, you have one now. Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident.

Winfunc used GLM-5.1 and GLM-5.2 to find six vulnerabilities in NGINX, including heap overflows, HTTP/2 frame injection and an mTLS authorization bypass.

But the most interesting part of the article is that the harness seems to matter much less than it did just a few months ago.

Earlier versions needed detailed instructions for finding sources and sinks, checking reachability and reviewing potential vulnerabilities. Current models can now do much more of that reasoning themselves, so Winfunc is actively removing scaffolding from its system.

The harness still coordinates jobs, removes duplicates and validates findings. But increasingly, the important parts are the threat model, deciding where to look and defining what evidence is required.

The moat may not be the harness after all. Finding six NGINX vulnerabilities with open models.

Using /goal does not seem particularly hard. Give Codex an objective and let it work.

But like everything that looks simple, you quickly realise there is more complexity and always a better way to do it.

Trail of Bits’ first recommendation is not to write the goal yourself. Give Codex the threat model and context, then ask it to write the goal and red-team it for shortcuts before starting. From there, define the outcome rather than the path, explain what does not count and assign only one outcome to each agent.

/goal looks simple until you see someone doing it really well. Then you realise how much better your own approach could be. How we use /goal to find bugs in Patch the Planet.

What’s the difference between | and || in Python?

One gives you a CVE. The other gives you a syntax error.

pyzipper used the bitwise OR operator where a logical or was intended. Because of how Python parsed the expression, the condition selecting AE-2 was always false, and files were written using AE-1 instead.

The encryption is the same, but AE-1 keeps the plaintext CRC32 in the archive. For small or predictable files, that gives an attacker a way to test possible contents without decrypting them.

One wrong operator was enough to leak exactly the metadata the code was supposed to remove. CVE-2026–44722: A Zip encryption downgrade caused by an incorrect operator.

Block has released CodeCrucible, an open-source blueprint for LLM-driven SAST.

Most tools use traditional SAST to identify suspicious code, then ask an LLM to review it. CodeCrucible flips that architecture: it gives the LLM as much of the repository as possible and lets it look for vulnerabilities directly.

That gives the model a chance to find unknown unknowns, rather than limiting it to existing rules and known vulnerability patterns.

Another interesting choice is to send the LLM as much code as possible, instead of handpicking supposedly relevant files or extracting supposedly relevant snippets. When the repository does not fit, it chunks the code while trying to preserve relationships between files.
CodeCrucible: A blueprint for LLM-driven SAST.

The most interesting part of Securifera’s account of using AI for offensive security is how they handle long-running work.

An agent cannot keep hours of scans, observations, failed attempts and potential attack paths in its context window.

Instead, they store the operational state externally and let the agent query it through MCP when needed.

It also confirms something a lot of people doing offensive research with agents have probably observed. At least I have: agents cheat, a lot.

Ask an agent to prove exploitability and it may quietly change the target configuration, use information the attacker should not have, or alter the original assumptions to reach the requested outcome.

Attacker position and preconditions cannot just live in the prompt. They need to be enforced, and every successful exploit needs to be reproduced from the expected starting position. The rise of offensive AI.