Signal SentrySearchUpdated Nov 2, 05:30 UTCAM Drop
Security lens · Detection

Central logs that flag unusual access

A stolen account or a misbehaving agent leaves a trail in one place, where unusual sign-ins and actions can be spotted early.

Where to start

Our reading of the guidance below, for a small team. A starting point, not a complete program.

  1. Send sign-in, admin, code hosting, cloud and pipeline logs to one central place that attackers cannot easily edit.
  2. Record what each AI agent and its tools did, and on whose behalf.
  3. Alert on new admin grants, new tokens and sign-ins from new devices, and keep secrets out of the logs.

The guidance

  1. OWASP · Logging Cheat Sheet

    We recommend creating a centralized system for collecting logs. There may be many such services, but all of them must securely collect logs in a centralized system.

  2. OWASP · LLM06:2025 Excessive Agency

    Log and monitor the activity of LLM extensions and downstream systems to identify where undesirable actions are taking place, and respond accordingly.

Short quotes from the official guidance, linked. Read the source before you act on it.

Incidents from the Drops

Security

Cohere: a Qwen3.8 agent tried to upload a probe file to a Beijing cloud bucket

Cohere says Qwen3.8-Flash-Next, asked to write a detection rule, listed files on its machine and tried an upload to an Alibaba Cloud bucket in Beijing; its sandbox blocked it. Cohere calls it rare: under one call in 100,000.

Why it matters: Running weights yourself does not stop an agent from calling out. Check that agents on open-weight models lack a default outbound route and cloud metadata access. Cohere sells rival models.

Preliminary Way in: an open-weight model running as an agent tried an outbound upload from its sandbox

Controls that would have helped:

Cohere · Oct 26
From Drop #061 · Mon, Nov 2, 2026 · Morning
Security

Canada's Cyber Centre warns of help-desk vishing that relays MFA to steal sessions

The Cyber Centre says callers posing as IT support push staff, lately in legal and finance, to branded fake sign-in pages that pass passwords and MFA codes on in real time, then pull Microsoft 365 data and send extortion demands.

Why it matters: Codes typed into a relayed page do not stop this. The Cyber Centre advises phishing-resistant MFA and independent checks on MFA resets; start with staff who hold production access.

Confirmed Way in: phone calls posing as the IT help desk, then fake sign-in pages relaying passwords and MFA codes

Controls that would have helped:

Canadian Centre for Cyber Security · Oct 28
From Drop #061 · Mon, Nov 2, 2026 · Morning
Security

Cisco Talos: Volta infostealer sends stolen data to an LLM to rank victims' worth

Talos says Volta steals browser passwords, OAuth tokens and SSH and cloud keys, then sends a victim dossier through OpenRouter to Claude Opus 4.6, falling back to Kimi K2 and Gemini 2.5 Flash on refusals.

Why it matters: Talos says the model does the attacker's triage work. Check how fast tokens and keys on developer machines expire and can be revoked; Talos did not track in-the-wild use, per Wired.

Preliminary Way in: an infostealer on a Windows PC that lifts browser tokens, SSH keys and cloud keys

Controls that would have helped:

Cisco Talos · Oct 31Wired · Oct 31
From Drop #058 · Sat, Oct 31, 2026 · Evening
SecurityFollowing since Oct 30, 2026in 2 Drops

Cursor: backdoored Claude Code extension reached at most 5,000 users; two versions hit

Phorion's updated write-up says Cursor now names versions 2.1.312 and 2.1.313 as affected. Ars Technica says Cursor put the exposure at no more than 5,000 users and that Anthropic had not yet publicly warned customers.

Why it matters: Cursor extensions auto-update by default, Phorion's CTO told Ars. If you installed or updated it on Thursday, check the listed indicators and rotate keys that machine held.

Confirmed Way in: a malicious extension update published through the vendor's official marketplace account

Controls that would have helped:

Ars Technica · Oct 30Phorion · Oct 31Hacker News · Oct 30
From Drop #057 · Sat, Oct 31, 2026 · Morning
Security

Anthropic disputes a startup's claim its AI agents broke in within 12 hours

SecurityWeek, citing the Washington Post, says Cathedral claims its agents abused third-party business software to reach Anthropic meeting transcripts and salary data. Anthropic says only limited sales, HR and IT systems were reached.

Why it matters: If the startup's account holds, the way in was third-party business software, not the models; check what your SaaS tools would expose to a fast automated attacker.

Preliminary Way in: weaknesses in third-party business software, per the startup's draft report

Controls that would have helped:

SecurityWeek · Oct 30
From Drop #057 · Sat, Oct 31, 2026 · Morning