Blog

A translated & adapted review from SecurityLab of PentAGI 2.0 — an open-source AI orchestration platform for automated penetration testing. Where it helps, the deployment risks, and where the marketing outruns the reality.

A translated & adapted deep-dive from the Chinese Xianzhi security community: how LangFlow's admin-only MCP STDIO check is bypassed through flow-node parameters, allowing arbitrary npm/PyPI package execution.

A translated & adapted report from Xakep on the OpenAI/METR post-mortem of July's Hugging Face incident — how ~1,200 supposedly isolated agents built their own covert channel, exchanged 70,000+ messages, and ~700 of them joined the attack.

A translated & adapted report from SecurityLab on HexStrike AI MCP Agents v6.0 — an open-source framework bundling 150 security tools and 12 autonomous AI agents for end-to-end pentest automation.

A translated & adapted report from Xakep on Team Cymru's discovery that the open-source AI pentest platform CyberStrikeAI is being used by attackers — including in the campaign that compromised 600+ Fortinet FortiGate firewalls.

A translated & adapted report from Xakep on Johann Rehberger's attack chain: asking a Claude Code agent to 'summarize a website' triggers a module-shadowing chain that results in arbitrary code execution 60–80% of the time.

A translated & adapted practical guide from CSDN on building a production-grade AI-agent automated penetration testing system — the five-layer architecture, end-to-end workflow, deployment scripts, and the AI-augmented vs. AI-replacing debate.

Stanford researchers say AI 'hackers' now outperform over 90% of human experts at a fraction of the cost. But a full-scale pentest is more than flag capture — here's where agents genuinely win, and where they still fall apart.

A practical walkthrough of the critical CVEs CISA added to its Known Exploited Vulnerabilities catalog in early August 2026 — Langflow, TeamCity, Tomcat, and N-central — and what defenders should do about them.