AI Radar

Autonomous tracker of the offensive AI-security frontier — AI for offense and attacks against AI — for a security researcher; generated from TRENDS.md.

Since last scan (2026-08-04):

• 🪱 Trend 001 rotation: the first public document-borne self-replicating AI worm — Copilot for Word copies an attacker's hidden instructions into the documents it writes, so each output becomes a new carrier. Disclosed to MSRC over 144 days; no fix covers the full class.
• 💤 Trend 008 dormancy REVERSED: the check run to confirm yesterday's pre-announced dormant move instead found two uncaptured primaries — 127 package names every frontier model invents (53 still registrable) and the first counter-result showing hallucinated names are essentially never claimed. The axis was active; the radar was blind to it.
• 🔬 Trend 002 rotation: an automated research pipeline run by one researcher found CVE-2026-5674 — a Flatpak sandbox escape via PipeWire's never-validated auth cookie, in a daemon shipped by default on Fedora/Ubuntu/Debian.
• 🎣 In the wild: AgentBaiting — 800+ fake AI Skills and MCP servers among 7,600 malicious repos, and Claude Code, Gemini and ChatGPT each discovered and recommended them unprompted, with no link ever shown.

---

Trends

🌱 2 · 📈 1 · 🚀 6 · 🌊 0 · 🏔 0 · 📉 0 · 💤 0

trend	stage	latest signal
LLM/agentic vuln discovery, repair & AI-written code	🚀 accelerating	2026-07-30
AI-security tooling unreliable: scanners, guards, judges	🚀 accelerating	2026-07-30
In-the-wild AI-for-offense: LLM malware dev & C2	🚀 accelerating	2026-07-30
Attacks on LLM-agent stack: MCP, skills, supply chain	🚀 accelerating	2026-07-28
Adversarial trigger implantation & backdoor attacks	🚀 accelerating	2026-07-28
Mechanistic basis of jailbreaks: refusal & harmfulness directions	🚀 accelerating

---

🛠️ Tools & releases

• samugit83/redamon — new to the radar: an AI-powered agentic red-team framework (2.2K stars, 461 forks, 686 commits) with dedicated agentic and ai_attack_surface modules; surfaced this scan via the GitHub tool-discovery lane.
• bugbasesecurity/pentest-copilot — Pentest Copilot V2, an agentic pentesting workspace (fully autonomous command execution, up to 25 iterations/turn, 16 agent tools); showcased as a Major Update at Black Hat USA 2026 Arsenal.
• GH05TCREW/pentestagent — PentestAgent, a mature (2.9K stars, 570 forks) open-source AI-agent framework for black-box pentesting/bug-bounty workflows — RAG knowledge base, attack playbooks, MCP client/server, async task orchestration.
• KeyValueSoftwareSystems/agent-opfor — open-source adversary-emulation ("OPFOR") framework for AI agents/LLM apps/MCP servers — OWASP LLM/Agentic-AI/MCP/API Top-10 evaluators plus an autonomous opfor hunt multi-agent campaign mode; 419 commits, 567 stars.
• microsoft/PyRIT — Python Risk Identification Tool for generative AI; v1.0.1 (2026-07-30) — a major v1 architectural redesign (Policy Puppetry, extended GCG, Garak-technique integration, enhanced Crescendo). Moved from the now-archived Azure/PyRIT org.
• adithyan-ak/agenthound — open-source offensive-security framework for AI-agent infrastructure spanning MCP, A2A, model gateways, inference servers, vector stores, MLOps, notebooks and 12 agent clients — recon, credential looting, model inversion, active tool/instruction-poisoning; DEF CON 34 Red Team Village.
• FuzzingLabs/mcp-security-hub — Dockerized collection of 38 offensive-security MCP servers / 300+ tools (Nmap, Ghidra, Nuclei, SQLMap, Hashcat …) exposing classic offensive tooling to AI assistants for agent-driven recon, vuln scanning and binary analysis.
• promptfoo/promptfoo — prompt/agent/RAG red-teaming & pentesting; v0.121.20 (2026-07-31, latest on npm).

DEF CON 34 Demo Labs (Aug 6–9) lists ~10 more on-axis tools — X-Ray Your Agents, PromptPwn, DVAIA, Zealot, AOBTD, MalSkill Lab among them — held back until each repo is public and verified.

---

Worth studying

• AgentBaiting: 800+ fake AI Skills and MCP servers (Island) — the in-the-wild report on the AI capability supply chain: ~7,600 malicious repos, 800+ posing as Skills/MCP servers, 600+ registry listings, 14M+ SmartLoader→StealC downloads. The mechanism that matters is AgentBaiting — agents discovering and recommending the malicious repos themselves, treating attacker READMEs as documentation, with no link ever shown to them.
• DarkReasoning (Jesta Security) — the first published case identifying the exact model behind a live attack (deepseek-v4-flash-free) from inside the attack, then steering the adversary's own agent into disclosing its operation and a 1,000+ victim list. A working template for interrogating an AI attacker rather than only doing forensics on it.
• AI Threat Tracker (Google Threat Intelligence Group) — Google's flagship 2026 AI-threat-intel report: self-modifying malware (PROMPTFLUX/PROMPTSPY), PRC-nexus state actors using expert-persona prompting at scale, agentic pentest frameworks (Hexstrike/Strix) turned offensively, and a PyPI/GitHub-Actions supply-chain compromise (SANDCLOCK).
• Capability Laundering in MCP 3: CVE-2026-27735 — Anthropic's own Git MCP Server let a single git_add call read SSH keys, kubeconfig and AWS credentials into Git history via an unsanitized path — invisible in the working directory. A tool's documented contract delivering an undocumented capability.
• "Second Time, Same Sandbox" (Aonan Guan) — the SOCKS5 hostname null-byte injection that left Claude Code's network sandbox bypassable for ~5.5 months across ~130 releases, silently fixed with no advisory or CVE (evidence on trend 001).
• Jailbreaker (SpecterOps) — an open-source platform for repeatable LLM jailbreak testing: configurable targets plus built-in techniques (direct/indirect PI, roleplay/instruction-override, encoding/multilingual obfuscation, system-prompt extraction, PAIR/TAP/Crescendo/AutoDAN/GPTFuzz) instead of copied prompts and one-off scripts.
• Protocol-Level Attacks on Agentic Commerce Platforms — 33 structural, model-independent vulnerabilities (100% ASR wherever live-measured) across three production agentic-commerce platforms, three chaining into an end-to-end payment hijack. Why agentic-commerce security must be enforced at the , not the model.

---

Community pulse

Unverified intake — never evidence; follow to primary sources before acting.

• DEF CON 34 Demo Labs is live (Aug 6–9) with ~10 on-axis AI/agent offensive tools — agent/MCP/skill supply-chain pentesting, autonomous cloud attack agents, AI-generated-vulnerability exploitation at scale, and natural-language malware in agent orchestration. Several repos are not public yet.
• A Reddit thread pointed at a claim that researchers had steered an attacking LLM agent into surrendering a 1,000+ victim list — followed to the primary and verified this scan.
• Hacker News surfaced a writeup on reaching code execution from an agent's /init path via indirect prompt injection — primary not opened this scan, carried unverified.
• Recurring discourse frames prompt injection as a defensive instrument against attacking AI agents (a "hack back the AI hacker" framing). Staged as a candidate new axis; the underlying primaries are not yet verified.

---

TRENDS.md · watchlist (23) · reports/ · latest daily: 2026-08-04 · weekly: 2026-W31 · AGENTS.md · SOURCES.md