Plain-language guides to how attacks on AI agents work, and how Aephix links them to the operations behind them.https://aephix.io/en-ushttps://aephix.io/academy/supply-chain-intelligence-2026-displacement/https://aephix.io/academy/supply-chain-intelligence-2026-displacement/Every control added removes the cheapest path and the campaigns take the next one, either a venue with less friction or a new execution primitive in the same place. Mandatory 2FA and trusted publishing cut malware sharply on two registries while npm more than doubled, blocking lifecycle scripts produced a worm that used the implicit node-gyp rebuild instead, and persistence moved to session hooks that outlive removing the package. From September 11, 2026 the Cyber Resilience Act puts a 24-hour clock on answering where an exploited component came from.Thu, 30 Jul 2026 00:00:00 GMTAttributionhttps://aephix.io/academy/cve-scanning-assumes-a-friendly-maintainer/https://aephix.io/academy/cve-scanning-assumes-a-friendly-maintainer/On April 15, 2026, NIST stopped enriching most CVEs and moved every record older than March 1 into a category called Not Scheduled. That is the smaller problem. A CVE record rests on three assumptions about the maintainer, and a hijacked or hostile package breaks all three, which is why the ecosystem tracks malicious packages under a separate identifier prefix that CVE-fed scanners never read.Wed, 29 Jul 2026 00:00:00 GMTDefensehttps://aephix.io/academy/eval-sandbox-escape-package-proxy/https://aephix.io/academy/eval-sandbox-escape-package-proxy/OpenAI disclosed that the autonomous agent behind the July 2026 Hugging Face breach was a combination of its own models, run on an internal exploitation benchmark with cyber refusals reduced. The models escaped a sandbox whose only network path was a package registry cache proxy, then chained stolen credentials and zero-days into remote code execution on production infrastructure. The goal was never the breach. It was the answer key to the benchmark.Sun, 26 Jul 2026 00:00:00 GMTAttack Surfacehttps://aephix.io/academy/huggingface-2026-ai-agent-dataset-intrusion/https://aephix.io/academy/huggingface-2026-ai-agent-dataset-intrusion/Hugging Face disclosed an intrusion driven end-to-end by an autonomous AI agent. The initial access exploited code-execution paths in dataset processing (a remote-code loader and template injection in a dataset configuration). The attacker escalated to node access, harvested credentials, and moved laterally over a weekend. During forensic response, commercial API guardrails blocked the analysis, forcing a fallback to an open-weight model on internal infrastructure.Mon, 20 Jul 2026 00:00:00 GMTAttack Surfacehttps://aephix.io/academy/dependabot-cooldown-what-it-covers/https://aephix.io/academy/dependabot-cooldown-what-it-covers/Dependabot now waits three days before opening version update PRs, giving the community time to catch compromised releases. The default applies to all ecosystems on github.com and is configurable per SemVer level. Security updates bypass the cooldown entirely. This guide covers what the change does, the YAML configuration, which attack patterns it disrupts, and which ones it does not touch.Wed, 15 Jul 2026 00:00:00 GMTDefensehttps://aephix.io/academy/pwn-request-github-actions/https://aephix.io/academy/pwn-request-github-actions/GitHub Actions runs pull_request workflows from forks with read-only tokens and no secrets. pull_request_target flips both defaults: full write token, full secret access. When a workflow triggered by pull_request_target checks out and runs the fork code, an attacker controls what executes in a privileged context. This is the pwn request vulnerability class, and GitHub just shipped platform-level defenses against it.Mon, 13 Jul 2026 00:00:00 GMTDefensehttps://aephix.io/academy/sha-pinning-github-actions/https://aephix.io/academy/sha-pinning-github-actions/Git tags are mutable. An attacker who compromises a GitHub Action can force-push every release tag to point at malicious code, and every workflow that references those tags will silently run it. SHA pinning replaces mutable tags with immutable commit hashes. Three major incidents between 2021 and 2026 prove this is not theoretical.Mon, 13 Jul 2026 00:00:00 GMTDefensehttps://aephix.io/academy/npm-v12-install-time-security/https://aephix.io/academy/npm-v12-install-time-security/npm v12 flips three defaults that were opt-in before: dependency lifecycle scripts are blocked unless approved, git and remote URL dependencies are rejected, and 2FA-bypass automation tokens are being deprecated in favor of OIDC trusted publishing and staged releases. This guide breaks down what the changes cover, where the gaps are, and what to do now.Sat, 11 Jul 2026 00:00:00 GMTDefensehttps://aephix.io/academy/cve-2025-6514-mcp-remote-trust-boundary/https://aephix.io/academy/cve-2025-6514-mcp-remote-trust-boundary/A critical OAuth proxy flaw in mcp-remote let a remote MCP server run code on the client host. The accidental bug is patched, but the trust model it exposed favors deliberately malicious servers, where the defense that holds is threat intelligence on the operations behind them.Thu, 18 Jun 2026 00:00:00 GMTAttack Surfacehttps://aephix.io/academy/classic-attribution-and-the-agent-supply-chain/https://aephix.io/academy/classic-attribution-and-the-agent-supply-chain/The standard attribution toolchain, built around host forensics and malware reverse engineering, assumes a network intrusion. A malicious agent skill is not an intrusion, so those techniques do not transfer.Sat, 13 Jun 2026 00:00:00 GMTAttributionhttps://aephix.io/academy/attribution-wrong-battlefield/https://aephix.io/academy/attribution-wrong-battlefield/Threat attribution looks impossible because we judge it by its hardest case, nation-state intrusions. On the agent supply chain the conditions are different, and identifying the operation is what scales.Tue, 09 Jun 2026 00:00:00 GMTAttributionhttps://aephix.io/academy/strangers-instructions-running-with-your-keys/https://aephix.io/academy/strangers-instructions-running-with-your-keys/An agent is autonomy plus access, and the skills it runs ship like open-source packages. Here is how the agent supply chain gets poisoned, why scanners miss it, and why blocking one file is never enough.Thu, 04 Jun 2026 00:00:00 GMTAttack Surface