Ruby, escapes and good memories...

Luke Jahnke is back at it. Two weeks after publishing a universal Ruby 4.0 deserialization chain, he questioned whether removing explicit callbacks and RubyGems gadgets would eventually exhaust the attack surface.

Luke found six methods that Marshal.load invokes implicitly, including hash, eql?, <=> and to_s. These calls emerge from rebuilding ordinary Ruby objects, making them difficult to remove without changing the language itself.

Gadget hardening raises the cost of exploitation, but it cannot make untrusted Marshal data safe. The durable defence remains removing the primitive. Ruby Marshal Kick-off Gadgets - elttam.

Trail of Bits asked GPT-5.6-Cyber to escape a virtual machine. Each time the environment was hardened, the agent went deeper. It moved from a disclosed kernel vulnerability, to combining a CVE with an unclassified bug fix, and finally to building a chain containing several zero-days.

The agent spent roughly 12 hours exploring CUPS, hardware side channels, the kernel, QEMU and supporting libraries. With enough tokens, you get a tester that never becomes bored, discouraged or embarrassed by increasingly desperate rabbit holes.

Cyber agents may become the most persistent adversaries we have ever faced, provided you can afford the tokens. VMs won't contain cyber-capable agents - The Trail of Bits Blog.

Long-running agents often resurrect assumptions that were disproved hours earlier. Lemmalog addresses this by treating an investigation as maintained analysis state.

The LLM converts observations into structured facts, while Datalog tracks their dependencies, provenance and validity. When an assumption is disproved, conclusions derived from it can be removed automatically.

The current benchmarks cover conversational memory rather than vulnerability research, so the security benefits remain unproven. Still, this offers a useful new direction: agent memory designed around maintaining current truth, not simply retrieving relevant history. This could become a game changer for long-running audits of very large codebases, where assumptions and code keep changing underneath the agent. I accidentally turned LLM memory into program analysis :: pwning.systems.

One of the first skills in security is learning to read error messages properly. This write-up starts with a great example.

Direct Java access returned a strange Rhino TypeError. Trying the same thing through reflection produced a SecurityException that revealed Google’s custom JavaScriptPermissionChecker.

That small difference exposed how the sandbox worked and gave the researcher a specific class to investigate. The trail eventually led to a complete escape into Google’s Borg infrastructure. Sometimes everything begins with noticing that two failures failed differently. Escaping Google Cloud Application Integration Sandbox: Straight into Borg.