Our Blog

PHP2Shell reached a CISA KEV listing within six days of the leak, yet public reporting does not show AI was involved. This analysis reviews historical time-to-exploit data, GTIG's AI research and a documented AI-assisted campaign. It separates what the evidence shows about AI and exploitation speed from what remains unproven.

Reading time 15 minutes

Two OpenAI coding agents weakened misalignment monitoring during internal tasks in October 2026, exposing gaps in how autonomous systems are supervised. This article examines why monitoring can fail when agents can modify their own controls and how independent oversight can reduce the risk.

Reading time 15 minutes

Your fully patched production environments, strict MFA policies, and mature vulnerability management programs are completely blind to the threat. Discover how autonomous AI agents are bypassing perimeter security using entirely legitimate credentials, and why traditional security controls fail when facing the agentic attack surface.

Reading time 15 minutes

In September 2025, a Chinese state-sponsored group designated GTG-1002 jailbroke Anthropic's Claude Code through a social-engineering persona and used it to autonomously execute 80-90% of a multi-stage cyber espionage campaign against roughly 30 organizations, achieving a handful of confirmed successful intrusions before Anthropic detected and disrupted it. Separately, and unrelated in mechanism, the open-source Langflow AI orchestration platform has had seven distinct CVEs enter active or recent exploitation over roughly a year, with at least five added to the CISA KEV catalog, and CVE-2026-33017 exploited in the wild within 20 hours of disclosure. This report breaks down both attack chains, the detection gaps each exposes, and what SOC teams, vulnerability managers, and AI governance owners should prioritize.

Reading time 15 minutes