CloudSec Wine

🤖 Inside the OpenClaw Ecosystem: What Happens When AI Agents Get Credentials to Everything Permiso researchers deployed an AI agent (Rufio) into the OpenClaw ecosystem and found active malware campaigns in its unvetted skill marketplace (ClawHub), credential-harvesting skills with 377+ downloads, C2 infrastructure, and prompt injection attacks targeting agents holding plaintext credentials to email, Slack, and file systems. https://permiso.io/blog/inside-the-openclaw-ecosystem-ai-agents-with-privileged-credentials #AI

🤖 New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs A study of ~200,000 LLM responses found 5 frontier models (Claude, GPT, Gemini, DeepSeek) hallucinate nonexistent package names at 4.62-6.10%, with 53 shared fictitious names on PyPI/npm still registrable and exploitable via slopsquatting attacks. https://socket.dev/blog/slopsquatting-targets-across-frontier-llms #AI

🔶 Introducing the Amazon GuardDuty investigation agent: on-demand AI-powered threat assessment Amazon GuardDuty investigation agent (public preview) uses AI to auto-investigate GuardDuty security findings, reducing investigation time from hours to minutes. It returns risk levels, confidence scores, MITRE ATT&CK mappings, and remediation steps via console, CLI, API, or AWS MCP server. https://aws.amazon.com/ru/blogs/security/introducing-the-amazon-guardduty-investigation-agent-on-demand-ai-powered-threat-assessment #aws

🔶 Introducing the Amazon GuardDuty investigation agent: on-demand AI-powered threat assessment Amazon GuardDuty investigation agent (public preview) uses AI to auto-investigate GuardDuty security findings, reducing investigation time from hours to minutes. It returns risk levels, confidence scores, MITRE ATT&CK mappings, and remediation steps via console, CLI, API, or AWS MCP server. https://aws.amazon.com/ru/blogs/security/introducing-the-amazon-guardduty-investigation-agent-on-demand-ai-powered-threat-assessment #aws

🤖 Delegated authority, running locally: Give an agent on your machine an identity you can trust A reference architecture for giving a locally-running AI agent a trustworthy, auditable identity, without long-lived credentials on disk, including a structural defense against prompt injection built into the protocol layer. https://1password.com/blog/ai-agent-identity-delegated-local #AI

🤖CISO's guide to agentic AI Anthropic's Deputy CISO shares a four-question framework for assessing agentic AI risk, and walks through controls that keep agent deployments bounded and auditable. https://claude.com/blog/ciso-guide-to-agentic-ai #AI

🔶 Introducing Claude apps gateway for AWS Amazon announced the Claude apps gateway for AWS, a self-hosted control plane that gives organizations a single point of control over access, cost, and policy for Claude Code and Claude Desktop. https://aws.amazon.com/ru/blogs/machine-learning/introducing-claude-apps-gateway-for-aws #aws

🔶🔷🔴 The Two Mitigations for the Service-Account Confused Deputy in the Cloud Two mitigations exist for cloud service-account confused deputy attacks: for customer-managed identities, an attachment gate (GCP actAs, AWS iam:PassRole, Azure assign/action) controls bind-time authorization; for provider-managed identities, the CSP enforces internal checks, with AWS uniquely exposing this via Forward Access Sessions and condition keys. https://kattraxler.cloud/the-two-mitigations-for-the-service-account-confused-deputy-in-the-cloud #aws #azure #gcp

🔶 OIDC tokens can now restrict which AWS roles they assume AWS STS now supports a new OIDC claim that restricts which role ARNs a token can assume. Enforced before trust policy evaluation. The boolean condition key sts:RoleAuthorizedByIdp enables mandatory enforcement via trust policies or RCPs. https://awsteele.com/blog/2026/07/13/oidc-tokens-can-restrict-which-aws-roles-they-assume.html #aws

🔶 Authenticate legitimate AI agent traffic with AWS WAF Bot Control AWS WAF Bot Control now supports Web Bot Authentication (WBA), using ed25519 cryptographic signatures (RFC 9421) to verify AI agent identities. It introduces new WAF labels (verified, invalid, expired, unknown_bot) enabling granular allow/block rules, replacing unreliable IP-based bot filtering. https://aws.amazon.com/ru/blogs/security/authenticate-legitimate-ai-agent-traffic-with-aws-waf-bot-control #aws

🔶 Introducing OAuth Support for AWS MCP Server AWS MCP Server now supports OAuth-based sign-in using existing AWS credentials (IAM, IAM Identity Center, federated). Includes dynamic client registration, headless token API, new IAM condition keys, token introspection/revocation, and CloudTrail logging for OAuth events. https://aws.amazon.com/ru/blogs/security/introducing-oauth-support-for-aws-mcp-server #aws

👩‍💻 No single pane of glass: Anatomy of an Azure permission takeover Sysdig TRT observed an attacker use one leaked service principal (with RoleManagement.ReadWrite.Directory) to self-grant Global Administrator, then elevateAccess to root RBAC Owner, harvest storage/Event Hub/Key Vault keys, and plant backdoors on 26 app registrations. https://www.sysdig.com/blog/no-single-pane-of-glass-anatomy-of-an-azure-permission-takeover #azure

👨‍💻 Coordinated GitHub API enumeration and access token abuse Datadog Security Research has tracked multiple coordinated campaigns enumerating GitHub organizations, repositories, and users through the public GitHub API, abusing leaked access tokens, and cloning private repositories. https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration #github

🤖 GhostApproval: AI Coding Assistant Trust Boundary Flaw GhostApproval is a symlink-following vulnerability affecting 6 AI coding assistants (Amazon Q, Claude Code, Augment, Cursor, Google Antigravity, Windsurf). Malicious repos trick agents into writing outside the workspace sandbox, enabling RCE. Critically, agents internally recognize the dangerous target but confirmation prompts hide it from users, nullifying Human-in-the-Loop protections. https://www.wiz.io/blog/ghostapproval-a-trust-boundary-gap-in-ai-coding-assistants #AI

🤖 GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos Noma Labs found a prompt injection flaw (GitLost) in GitHub Agentic Workflows: posting a crafted issue in a public org repo causes the AI agent to exfiltrate private repository contents as a public comment, bypassing guardrails via the keyword "Additionally.". https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos #AI

🤖 Zero Trustfor AI Agents Anthropic eBook applying Zero Trust principles to enterprise autonomous AI agents, covering threat taxonomy (prompt injection, tool/MCP hijacking, memory poisoning, supply chain risks), tiered controls (Foundation/Enterprise/Advanced) for identity, least-privilege, observability, and AI-accelerated defensive operations. #AI

🤖 Solving the Identity Crisis for AI Agents Uber extended its Zero Trust architecture to assign SPIRE-backed cryptographic identities to AI agents, issuing short-lived, single-hop JWTs via a Security Token Service. Full actor chains (user to agent to tool) propagate across multi-agent MCP calls, enabling end-to-end auditability with sub-40ms P99 token exchange latency. https://www.uber.com/us/en/blog/solving-the-agent-identity-crisis #AI

🔶 whim Throwaway root shells in AWS Lambda Firecracker microVMs. https://github.com/udgover/whim #aws