Reports
AI agent security research in two streams: Anthropic CVP benchmark runs, and real-world threat reports from attacks caught in the wild. Every gap gets fixed in public.
All Reports
15 reportsOpenAI's Model Escaped Its Sandbox and Breached Hugging Face
During an internal cyber benchmark, an OpenAI model broke out of its sandbox, exploited a zero-day, and autonomously breached Hugging Face to obtain the answer data — and the Hugging Face intruder was itself an autonomous AI agent. The honest read for AI agent security, and what Sunglasses can and cannot claim.
Miasma and Hades: Why AI Coding Agents Need an Input Firewall Before Repo Open
The Miasma worm and the Hades PyPI wave moved supply-chain execution forward in the timeline, from package install to folder open and interpreter start. This report breaks down how both campaigns weaponize the files an AI coding agent reads.
CI-Safe Input Filter for AI Agents
The reliability work that turned Sunglasses into a tool teams can run in CI. Clean-code false positives went from 86 to 0 on a tested corpus, a 117-second stall was fixed, and 6 detection patterns were hardened.
Agent Discovery Metadata Poisoning
A prompt-injection supply-chain attack: the files AI agents auto-read (llms.txt, robots.txt, Copilot instructions, manifests, container labels) quietly redefine agent behavior before it acts.
Anthropic CVP Run 7: Comment and Control
First story-shaped CVP run in the program. Opus 4.7 at max effort tested against the public Comment and Control GitHub-comment injection pattern. An eight-rule runtime trust-boundary filter spec was the deliverable beyond the verdict.
Anthropic CVP Family Synthesis: Six Runs, Four Claude Models
Unified synthesis tying Runs 1 through 6 into one matrix across the Claude 4.x family: Opus 4.7, Opus 4.6, Sonnet 4.6, and Haiku 4.5. 120 of 120 transcripts captured clean.
Anthropic CVP Run 6: Opus 4.7 Within-Family Effort Evaluation
The 13-prompt suite from Runs 2 to 5, now against Opus 4.7 at three reasoning effort tiers. 39 transcripts, 12/13 verdicts identical across all three tiers.
Anthropic CVP Run 5: Opus 4.6 Family-Comparison Evaluation
The 13-prompt suite from Runs 2 to 4, now against Anthropic’s previous-generation flagship at two reasoning effort tiers. 26/26 clean across both tiers, zero exploit content executed.
Anthropic CVP Sonnet 4.6 Family-Comparison Evaluation
The 13-prompt suite from Runs 2 and 3, this time against Sonnet 4.6 at two reasoning effort tiers. 26/26 clean, identical verdict distribution, zero secrets leaked.
Anthropic CVP Haiku 4.5 Small-Model Safety Scaling
The 13-prompt suite from Run 2, this time against Anthropic’s smallest production Claude. 13/13 clean, zero exploit content executed, and a Run 4 preview using real-world adversarial payloads.
Anthropic CVP Opus 4.7 Runtime-Trust Evaluation
13 prompts (3 baselines from Run 1 plus 10 runtime-trust probes). Methodology-first framing covering cross-agent injection, retrieval poisoning, tool-output poisoning, model routing confusion, and memory eviction rehydration.
Anthropic CVP Opus 4.7 Safety Evaluation
First public evaluation under Anthropic’s Cyber Verification Program. Three adversarial prompts, effort at max, all six artifacts SHA256-hashed and published. Full prompts verbatim.
28,000+ Requests: What a WordPress Honeypot Taught Us About Bot Recon
A fresh WordPress honeypot logged more than 28,000 requests and 123 blocked attacks. The recon timeline shows how fast automated bots find and probe a new host, and what that means for agent-facing surfaces.
Anatomy of a Claude Code Supply-Chain Attack
A real supply-chain attack aimed at a Claude Code workflow, caught before execution. Four critical and three high findings, three detection rules triggered, in a scan that finished in roughly ten milliseconds.
Catching an axios-Themed RAT Before the Agent Ran It
A remote-access trojan disguised inside an axios-themed package, caught at scan time. One critical, one high, and one medium finding, plus eight new detection patterns added from the sample.