We examined artifacts left behind by attackers during the recent Citrix #NetScaler compromises. Many were already covered by existing generic THOR rules, including rules we've shipped for years. One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more than six years ago(!). The script also matched SUSP_Bash_Jul26. The recovered webshells matched these existing generic rules: - SUSP_WEBSHELL_PHP_Encoded_Jun21_1 - SUSP_Eval_Base64_Indicators_Feb22_1 - EXT_WEBSHELL_PHP_Generic_Eval - EXT_WEBSHELL_PHP_OBFUSC_3 - EXT_WEBSHELL_PHP_Generic - EXT_WEBSHELL_PHP_Gzinflated - EXT_WEBSHELL_PHP_Dynamic_Big Some of those webshell rules are in THOR Lite, too (EXT_*) This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind. A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there. Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm. Don't wait for the next advisory to start looking Why THOR detects what others miss nextron-systems.com/2025/06/…

One thing about this OpenAI / Hugging Face incident really bothers me. Hugging Face says the intrusion was driven “end to end” by an autonomous AI agent system. But how do they actually know that? Victim-side telemetry can show automation, speed, thousands of actions, short-lived sandboxes, changing infrastructure etc. It cannot show what happened upstream. It cannot tell us whether humans changed prompts, restarted runs, selected successful paths, provided more context, redirected agents or manually helped at certain points. We also don’t know what was actually decided by a model and what was simply automated by the surrounding agent framework. Maybe OpenAI has all those traces. Fine. Then publish them. Show the prompts, tool calls, failed runs, model handoffs, restarts and human interventions. Without that, “end-to-end autonomous” is a claim, not a proven technical finding. The forensic-refusal dataset Hugging Face published proves something much smaller: huggingface.co/datasets/hugg… It shows that Claude refused to analyze one small Python backdoor while GLM 5.2 completed the analysis. That is a valid example of hosted-model guardrails getting in the way of incident response. But this is not evidence that the intrusion itself was carried out end to end by an autonomous agent. And this claim matters because it pushes a very specific idea into people’s heads: AI agents can now independently find zero-days, escape sandboxes, move laterally, steal credentials and compromise companies. Then comes the second part of the story: Hugging Face used local AI models to investigate the AI attacker “at machine speed”. So the message basically becomes: - AI attacked us - AI helped save us - Therefore, everyone needs more AI Come on 🙄 Weak isolation, excessive privileges, poor credential boundaries, insufficient segmentation and far too much blast radius. You don’t need an AI defender to fix those things. Even fairly basic controls like rate limits and temporary blocks across source IPs, accounts, tokens and job volume could have throttled at least parts of this activity and created a very obvious signal for an analyst to review. Add proper egress restrictions, isolated workers and credentials that do not open the door to production clusters .. none of this requires an LLM Using a local model to analyze 17,000 events may have helped during the investigation. Good - I’m not questioning that. But that happened after the compromise. What I really hate is that something which would have been an embarrassment ten years ago is now repackaged as a capability demo, a heroic AI-vs-AI story and a marketing pitch. Maybe the attack really was fully autonomous. Then show the evidence. Until then, I don’t think this claim should be repeated as if it had already been proven. Sources xitter.cf/OpenAI/status/20796589… xitter.cf/XciD_/status/207967807… huggingface.co/datasets/hugg…

This is what the near future may look like: a widening gap between the economics on the attacker side and the defender side. Attackers will be able to move faster, scale better and operate far more efficiently. Some of them will even start going after smaller organizations and private individuals again, simply because it becomes economically viable to do so. With unrestricted AI assistance, fast iteration and low-cost tooling, they can do much more in the same amount of time than before. Defenders are in a very different position. We are constrained by policy, data restrictions, approval processes, testing requirements, QA cycles and the general need to build stable, trustworthy software for enterprise use. That imbalance is going to get ugly. But I also think this will be our catharsis as an industry. A lot of assumptions that felt solid or even foundational may change over the next 24 months.