Welcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weekly updates! 📧
Howdy 👋🏽
I hope you’re having an excellent week! Busy one here. I wrote a recap on [un]prompted con + all the slides are in a NotebookLM now. Easily the best security con I’ve been to in years. Thanks to my friends at Opal Security for sponsoring it, and for tomorrow’s virtual event where Sounil Yu and a lineup of CISOs get into ownership and access reviews for AI agents (RSVP here).
Also, A Security Field Guide to AI Audit Trails hit #1 in Cloud Computing (and #4 in computer security) new releases on Amazon! Huge thank you to everyone who picked up a copy. If you’ve read it, a quick review goes a long way 🙏🏽
This week’s a heavy one: the largest crypto theft on record, CrowdStrike shopping spree, and fake Claude Code builds planting SSH keys.
Cool, let’s get into it!
Stop the AI-powered email attacks your filters miss.
AI-powered phishing is built to look legitimate. Adaptive’s Agentic Email Security analyzes email intent, context, and behavior to catch sophisticated phishing, business email compromise, and invoice fraud that traditional filters miss. It automatically removes threats from employee inboxes and explains every detection, so your team can act with confidence. Deploy in minutes through an API connection to Microsoft 365 or Google Workspace, with no MX record changes or disruption to your mail flow.
🗞️ TLDR
💸 Binance lost about $6.4B without losing a single private key. Fake job interviews and a poisoned installer got attackers to a signing service that signed what it was told.
🦅 CrowdStrike bought two AI security startups (~$495m combined) and shipped an AI red team, browser security and cloud AI protection in one week.
🔓 OpenAI says personal Daybreak Blue sessions can be used for training starting Nov 29, even with the training setting off. After pushback, it promised a separate opt-out.
🧩 Malicious Claude Code builds 2.1.312 and 2.1.313 reached Cursor’s marketplace on Oct 29. Uninstalling the extension leaves SSH keys and persistence behind.
🔑 Northflank, Trigger.dev and NVIDIA Brev disclosed incidents as attackers keep raiding AI developer platforms for stored keys. Google has seen LLMjacking victims billed up to $1M.
🤖 WorkOS, Chainstack and GitBook tie breaches to AI-driven attacks, and CrowdStrike watched VAPOR PANDA run ARTEX against 200+ orgs.
🧪 Keith Hoodlet kicks off a local LLM series, from picking hardware to running models with fewer refusals. Part 1 is out.
🔥 Picks of the Week
The $6.4B Binance heist: fake job interviews, an internal AI tool, and a signing service that said yes
Roughly $6.4 billion stolen in a few hours. The biggest digital theft on record. On Oct 29, attackers drained Binance’s hot wallets across 11 blockchains. Elliptic puts the loss at $6.43B, more than four times the Bybit theft earlier this year.
The sequence of events is fucking wild. Binance traces the preparation back to June, with attackers targeting multiple engineers over several months before reaching the systems that authorize transfers.
Here’s the sequence, according to Binance’s preliminary report:
June: A wallet DevOps engineer downloaded a tampered Homebrew installer while trying to install an AI coding tool. Binance replaced the device and rotated credentials, but the attackers learned who worked on wallet infrastructure.
September: A second engineer went through fake job interviews and downloaded a malicious assignment onto his work laptop. The malware evaded Binance’s endpoint tools.
Oct 20: Attackers used that laptop and an internal AI tool to reach two other engineers. Binance’s explanation of that step is still thin.
Oct 29: Stolen credentials and a deployment token let the attackers launch a container and abuse Binance’s signing service to move funds outside the normal withdrawal process.
Even after withdrawals stopped: Malicious EIP-7702 authorizations let them keep moving assets on-chain. Binance had to revoke those permissions separately.
That persistence is what sticks with me. Binance caught the June compromise and took action. Months later, the attackers were back in through another employee and eventually got Binance’s own infrastructure to authorize the theft.
The FBI attributes it to North Korea’s TraderTraitor, and Chainalysis points to stolen funds mixing with proceeds from another North Korea-linked theft. That deserves weight. I still wonder whether someone on the inside knowingly helped. That remains speculation, and insider involvement wouldn’t necessarily rule out North Korea. I’m also wary of how much explanatory work “sophisticated nation-state attack” is doing here. It doesn’t explain the internal AI tool’s role or why the signing controls allowed this.
The story is still unraveling. Elliptic reports $2.85B frozen or seized, with roughly $3.21B still in theft-linked addresses, mostly ETH and BTC, as of Nov 4. Binance says 98% of affected token assets had been replenished as of Nov 3. We’re still working from preliminary findings.
Shadow AI agents are multiplying. Here’s how to find them.
Employees are spinning up AI agents faster than security teams can track them. Each one comes with its own credentials and access to your data.
The problem? No single discovery method gives you complete coverage.
Nudge Security’s guide breaks down eight common discovery methods to help you build the right approach for your needs. You’ll learn what each discovery method detects and what it misses, the pros and cons of each approach, and the questions to ask when evaluating vendors.
CrowdStrike’s big week @ Fal.con EU
CrowdStrike announced two AI security acquisitions reportedly totaling about $495M: Fiddler for monitoring AI systems and Dreadnode for offensive testing. It also rolled out announcements across automated red teaming, browser security and cloud protection at Fal.Con Europe.
The buys: Fiddler AI (agent monitoring, becomes Falcon Observe) and Dreadnode (offensive testing of AI apps). WSJ reports about $400M and $95M; CrowdStrike hasn’t disclosed terms.
Agentic Adversary Emulation (automated AI red teaming): an offensive model, Red Tempest, chains vulns, misconfigs and identity gaps into attack paths, then re-runs the attack to confirm the fix. Early access.
Seraphic Enterprise Browser: in-browser controls in the browsers people already use, unmanaged and contractor devices included.
Cloud Security: catches compromised npm and PyPI packages in CI/CD, adds real-time cloud detection and response (CDR) for Azure and Kubernetes. GA.
Dynatrace: federated search across Dynatrace data without re-ingesting it, pitched as a SIEM alternative.
OpenAI changes the training rules for Daybreak researchers
OpenAI told personal-account Daybreak Blue users that starting Nov 29, their sessions may be used to train models, even with the "improve the model for everyone" setting off. Business and enterprise accounts are excluded. After pushback, a second notice promised a separate opt-out, with details closer to Nov 29. Safety-flagged sessions can still be used for safety work. Daybreak sessions can hold unpatched vulns and exploit PoCs.
Two questions remain: will the opt-out be on by default, and does it cover past sessions?
Malicious Claude Code extensions reach Cursor’s marketplace
For about 11 hours on Oct 29, Cursor’s marketplace distributed malicious Claude Code extensions that Anthropic didn’t make. Uninstalling them doesn’t remove everything they planted. On macOS and Windows, the payload beaconed host details, added an SSH key and established persistence. Its reverse tunnel mostly failed without admin rights, but those changes still went through.
The affected builds were Anthropic.claude-code 2.1.312 and 2.1.313, served from 4:27 a.m. to 3:35 p.m. CT. Artifacts include the svc-telemetry SSH key, com.apple.sysmond LaunchAgent and SysMon scheduled task. Cursor has published check and remediation scripts; credential rotation is a separate recovery step. It still hasn’t said how the builds got in.
Stolen AI keys: Northflank, Trigger.dev, NVIDIA Brev, and the LLMjacking bill
Attackers are stealing AI credentials from developer platforms and reselling the access through services advertising $60-a-month “unlimited” plans. The compromised accounts absorb the usage: Google’s threat intel team reports victims charged more than $100K in a day and up to $1M total.
Wiz counts 11 platforms disclosing incidents in October, including Northflank, Railway, Warp, Fireworks AI and Zeabur, which is shutting down over its breach. Root causes vary and Wiz found no shared vuln or attacker. The common target is stored environment variables that unlock AI access.
This week’s additions. Northflank says attackers used customers' AI credentials and points to secrets in its control plane, with no root cause named yet. Trigger.dev confirmed environment-variable access for a subset of orgs. NVIDIA told Brev customers the SSH key Brev sets on their GPU instances may have been exposed between Oct 4 and Oct 20; it rotated keys and found no misuse.
Wiz followed two stolen enterprise Bedrock keys: tested within 30 minutes, idle for days, then used for about 800K and 1.7M calls, mostly Opus, totaling over $100K at list price. Key checks traced back to two LLM resale shops. Google’s Nov 2 report describes access resold through “LLM mixers” and flags a LiteLLM RCE (CVE-2026-40217) used to steal keys.
AI agents on offense: WorkOS, Chainstack and GitBook breached, VAPOR PANDA runs ARTEX at scale
CrowdStrike observed VAPOR PANDA running a human-directed ARTEX campaign targeting 200+ organizations across 14+ countries in 11 days, with confirmed post-exploitation at nine. The operator’s instructions included finding Windows hosts without Falcon. CrowdStrike says the group is separate from Storm-0940. Other disclosures this week describe AI-assisted attacks, though the reporting does not establish a single campaign.
WorkOS: An Oct 30 breach of an internal sales app exposed CRM contacts, sales notes, support threads and customer Slack, but not production. Founder Michael Grinich identified the tool as ARTEX, an open-source AI pentesting framework.
Chainstack: A third-party component led to dev and production breaches. Names, emails and password hashes were stolen; node credentials are treated as exposed. The ARTEX attribution comes from The Hacker News.
GitBook: Says an attacker “using AI agents” stole infrastructure credentials on Nov 2. It went offline, replaced secrets and revoked customer API tokens, including those used for MCP connections. No tool was named.
Chainalysis: Pulled Reactor and Data Solutions offline after an “offensive agentic techniques” breach. It says the incident is unrelated to Binance.
Getting started with local LLMs
Keith Hoodlet walks through running open-weight models locally: hardware compatibility tools, the models he uses and setup guides. The practical advice: benchmark against your actual workload before buying more compute. Smaller models can handle lightweight coding and reasoning, but may need more work on the surrounding tooling. He also highlights Matt Suiche’s Weightless for reducing model refusals without retraining.
Keith’s a friend (and a wizard), and I’m looking forward to the rest of the series. With hosted models placing more restrictions on security research, this is a useful starting point for anyone exploring local alternatives.
🚨 Threats & Research
OpenAI details its agent monitoring system
OpenAI’s Oct 29 post describes its agent monitoring system. Low-cost activation probes flag suspicious activity, a model reviewer reads the agent’s chain of thought and tool calls, and an investigative agent reconstructs the incident and checks network logs before a human gets paged. Replaying the Hugging Face incident, the system alerted about 30 minutes after the sandbox escape, 30 hours before the real breach. Paging is off for internal Codex traffic, and enterprise API customers can get webhook alerts.
Infostealers now grab Claude Code, Codex and Cursor tokens
Commodity infostealers WardenStealer and Aoki now grab OAuth tokens, API keys, configs and session cookies from Claude Code, Codex, Cursor, GitHub Copilot and the Claude and ChatGPT desktop apps, per SpyCloud’s Oct 30 research. For Claude Code, that includes the file holding tokens for connected MCP servers. SpyCloud counts 130,000+ WardenStealer infections since August, and underground shops resell AI access at 40% to 91% off list. A stolen refresh token can remain usable after a password reset.
DHS "Icepick" leak exposes about 41,000 employees
DDoSecrets published "Icepick" on Oct 28: records on about 41,000 DHS employees and contractors, including CBP, roughly 10,000 at ICE and nearly 1,000 at CISA. Beyond names, titles and cell numbers, it lists 55,000+ access group names, some referencing undercover operations and wiretap programs. The group names could help attackers identify internal systems and tailor phishing or impersonation attempts. The leakers claim it came from DHS’s Okta SSO; Okta says it has no evidence its systems were compromised.
Max-severity GitLab flaw is now exploited (CVE-2026-97229)
CISA added CVE-2026-97229 to KEV on Oct 29. It’s a max-severity integer overflow in GitLab’s CI/CD regex compiler: a crafted regex in a pipeline config gives an unauthenticated attacker code execution on the server. Compromise could expose deployment credentials held by the CI server. Fixes are available in self-managed CE/EE 19.4.2, 19.3.5 and 19.2.8, alongside GitLab’s published detections. Shadowserver sees about 2,800 exposed instances.
WordPress core’s upgrade-window RCE lands in KEV (CVE-2026-119977)
Wordfence observed attackers polling the same WordPress sites for up to 14.5 hours, waiting for a temporary installer to become accessible during a core update. Reaching it before cleanup could give an unauthenticated attacker code execution. Wordfence logged 18,500+ probes in 21 hours.
During a full core update, WordPress unpacks a complete copy of itself, installer included, into a predictable folder under wp-content/upgrade that many servers serve publicly. CISA added CVE-2026-119977 to KEV on Nov 3. Fixed in 7.1.4 with backports; Wordfence says 4.7.0 through 7.1.3 are affected.
cPGuard’s auto-update gets hijacked to steal server credentials
Attackers used stolen credentials to get into OpsShield’s update CDN and, starting 8:06 p.m. CT on Nov 1, pushed a malicious script through cPGuard’s auto-update (5.88.12 to 5.88.19). cPGuard is a Linux security suite common on cPanel servers. The script grabbed password hashes, root database config, shell history and SSH files, and shipped them out through OpsShield’s own licensing server. OpsShield told BleepingComputer 2,946 servers were hit. The recommended update is 5.88.25+. Credentials taken from affected servers remain exposed after updating.
Ivanti fixes two more exploited VPN flaws missed by its Oct 13 patches
Ivanti’s Oct 29 fixes close two more zero-days in the chain UTA0576 used to get unauthenticated root on fully patched VPN appliances: CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (file upload to a predictable path). The Oct 13 releases (25.1.1.2, 22.8R2.5) don’t fix them; 25.1.1.3 and 22.8R2.6 do. CISA added both to KEV on Oct 30. Volexity says the activity evades Ivanti’s Integrity Checker, limiting what a clean result can establish.
A hijacked monitoring script drained logged-in Polymarket traders
On Oct 29, malicious JavaScript served from DebugBear’s monitoring-script domain ran inside logged-in Polymarket sessions and used traders' own permissions to dump positions or move assets to an attacker wallet. It didn’t need passwords or keys. DebugBear says its DNS was hijacked at its registrar. Polymarket says 726 wallets were hit and about $2.7M was stolen directly; it’s paying out $3.9M in total, including halt-related losses.
🛠️ Security Products, Tools & Programs
Bigger bug bounties: OpenAI raises its payouts, Google adds a $250K cloud bounty
OpenAI’s Nov 2 update more than quadruples the midpoint of its medium, high and critical reward ranges on average. Criticals in ChatGPT, Codex or the API Platform now pay up to $30,000, exceptional ones up to $100,000, or about $172,000 with new quality, loyalty and campaign multipliers, retroactive 30 days. Google’s Oct 29 Root-in-Cloud tier pays $250,000 for full admin control of arbitrary Google Cloud orgs with no prior access, stolen credentials or social engineering.
Cloudflare launches Zero Wire, a free critical-CVE briefing feed
Cloudflare launched Zero Wire on Nov 3, a free feed in Radar covering critical vulns in internet-facing software. Each briefing says what broke in plain language, who should investigate and what to do now, with links to KEV entries and vendor advisories. Some add Cloudflare WAF traffic charts, which Cloudflare says aren’t a compromise count, plus a read-only prompt you can hand your own agent to check exposure. No Cloudflare account needed.
A Railway engineer’s signup-testing agent probed Primcloud’s internal network
Railway engineer Jake Runzer’s signup-testing agents hit rival host Primcloud. Founder Josh Manders says the agent never deployed an app. Per Manders, in about 24 commands over 15 minutes, it used its container’s credentials to request every secret on the platform, other customers' included, hit the cloud metadata endpoint (where servers fetch their credentials) and port-scanned all 65,536 internal addresses, twice. All of it was blocked, Manders says. Runzer confirmed it; CEO Jake Cooper apologized and banned non-manual external testing.
Descope’s Envoy lets consumer apps sign in your personal AI agent as itself
When a shopping agent uses a person’s login, its activity can be difficult to distinguish from the account holder’s. Envoy gives the agent its own identity under Sierra and Meta’s draft Personal Agent Protocol, with scoped permissions (orders yes, payment methods no) and phone approval for sensitive actions. Apps can revoke the agent without signing you out. GoFundMe and GoodRx are launch partners.
💰 Industry, Funding & M&A
Sentra raises $150M to control what AI agents can reach
Sentra raised a $150M Series C led by Capital One Ventures, taking total funding past $250M. It protects data at rest across cloud, SaaS, warehouses and file shares, and controls which human and AI identities can reach it. Sentra reports 300%+ growth over the past year and didn’t disclose a valuation.
Cognition acquires Corridor
Cognition, the company behind Devin and Windsurf, acquired Corridor, which puts security checks inside AI coding workflows: scanning agent-written code before it hits a PR and blocking merges by severity. Ex-CISA cofounders Jack Cable and Ashwin Ramaswami join Devin Security, reuniting with CSO Alex Stamos. Terms undisclosed. Corridor raised a $25M Series A at $200M in March. Coding agent companies are now buying security in-house.
Northstar raises $7M to give security agents a context graph
Northstar came out of stealth Oct 28 with a $7M seed led by Wing Venture Capital. It builds a "Security Context Graph" linking assets, identities, vulns and business systems across 70+ integrations, then lets agents investigate and kick off fixes, like pushing endpoint protection to an unprotected laptop owned by a privileged payroll user. The graph is also exposed over MCP.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.