InfoSec Briefing - July 10, 2026

🎧 Audio Briefing

Playback Speed:

Cyber security developments for Friday the 10th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 4 articles to cover. All attribution is by the article authors. All article analysis is automated.

Cotool has published research introducing standardised benchmarks for evaluating autonomous AI agents in security operations. The framework tests AI performance across blue team scenarios including multi-host intrusion analysis, incident response, and capture-the-flag challenges — essentially trying to work out whether these agents can actually do the job or just talk a good game.

Sygnia investigated a 72-hour intrusion targeting an AWS environment where attackers used artificial intelligence as a force multiplier to execute parallel attack waves at machine speed. Interestingly, the threat actor chained known cloud exploitation techniques rather than using zero-days — which suggests the real advantage here was velocity, not novelty. Worth noting the title's dry observation: still slower than most ransomware crews.

Noma Labs discovered an indirect prompt injection vulnerability in GitHub's Agentic Workflows that allows attackers to manipulate AI agents into leaking data from private repositories. By crafting malicious instructions in public GitHub issues, attackers can trick agents with cross-repository access into fetching and posting sensitive information publicly. One for anyone running GitHub's AI workflows with access to private codebases.

Orange Cyberdefense researchers discovered Process Parameter Poisoning, a code injection technique that bypasses endpoint detection by exploiting Windows process creation parameters. The technique injects malicious code through command line, environment, or reserved parameters in the Process Environment Block, avoiding traditionally monitored APIs like WriteProcessMemory. Worth a look if you're tracking evasion tradecraft.

That concludes today's briefing.

📰 Articles Covered

AI Research in Security Operations Pushing the frontier of AI agents for real security work - Cotool

The research published by Cotool focuses on advancing autonomous AI agents for security operations (SecOps) by establishing rigorous, standardized benchmarks. Rather than describing a security breach or vulnerability, this work provides a framework for evaluating how effectively AI can perform critical defensive tasks.

### What Happened
Cotool has introduced a series of security benchmarks designed to assess and improve the performance of AI agents in blue team scenarios. The initiative addresses the current lack of specialized evaluation metrics for AI in security, creating a baseline for testing how agents handle complex, multi-step defensive operations in environments ranging from simulated networks to Capture-The-Flag (CTF) challenges.

### Who is Affected
* **Security Operations (SecOps) Teams:** Teams looking to augment their capacity and scale operations through automation.
* **AI/Security Developers:** Professionals building and fine-tuning autonomous agents intended for threat hunting, incident response, and security engineering.

### Security Implications
The primary implication is the potential to overcome manual headcount limitations in security teams. By automating complex tasks—such as triage, correlation, and response—the research aims to reduce "mean time to detect" (MTTD) and "mean time to respond" (MTTR). This creates a pathway for AI to act as a force multiplier, allowing human analysts to focus on higher-level strategic threats rather than routine log analysis.

### Technical Details
The benchmark suite is designed to test AI performance across varied domains:
* **Multi-host Intrusion Analysis:** Evaluating an agent's ability to correlate logs across disparate systems to identify lateral movement.
* **Incident Response & CTF Challenges:** Testing the model's proficiency in executing specific, time-sensitive security tasks in controlled environments.
* **Domain-Specific Capabilities:** Benchmarks specifically target tasks such as malware analysis, credential access detection, and cloud security misconfiguration discovery.

### What Defenders Should Know
Defenders can leverage these benchmarks to perform vendor or model evaluation before integrating AI into their existing security stack.
* **Evaluation Baseline:** Use the benchmarks as a "litmus test" to determine if a specific AI model is actually capable of handling complex reasoning required for security engineering.
* **Capability Gaps:** The benchmarks help identify where current AI agents struggle (e.g., in long-context reasoning or advanced threat hunting), allowing security engineers to appropriately scope where human intervention remains necessary.
* **Integration Goal:** The overarching objective is the deployment of agents that can reliably handle automated log analysis and cloud security monitoring, thereby increasing the efficiency of existing security engineering teams.
Inside an AI-Assisted Cloud Attack: Familiar Techniques at Unfamiliar Speed - or written another way AI slower than most ransomware crews - Sygnia

The provided overview comprehensively captures the critical aspects of the Sygnia report on AI-assisted cloud intrusions. Below is a structured precis summarizing these findings.

### Incident Overview
Sygnia uncovered an intensive 72-hour intrusion targeting an AWS-based environment. Rather than utilizing zero-day vulnerabilities, the threat actor orchestrated a sophisticated campaign by rapidly chaining well-known cloud and application attack techniques. The defining characteristic of this incident was the use of AI to act as a "force multiplier," enabling the attacker to execute multiple, parallel "attack waves" at machine speed.

### Who is Affected
The primary target was an organization running a complex, modern cloud environment reliant on AWS services, CI/CD workflows, and integrated source-control systems. Organizations utilizing similar cloud-native architectures—where application-to-infrastructure connectivity is high—are at the highest risk for this type of rapid, automated exploitation.

### Security Implications
* **Velocity Gap:** The most significant implication is the inability of traditional human-led security operations to keep pace with AI-accelerated attacks. The attacker’s speed rendered standard, linear response models ineffective.
* **Extortion Model:** The incident highlights a shift toward extortion based on the threat of disrupting or destroying critical production services, moving away from the more traditional focus on file-based ransomware.
* **Force Multiplication:** AI was not used to discover new vulnerabilities, but to optimize the execution of existing ones—automating reconnaissance, command structure, and script generation.

### Technical Details
* **Entry and Expansion:** The breach began via an internet-facing application. Once inside, the actor prioritized the theft of secrets from AWS Secrets Manager, CI/CD runners, and compute environments (EC2/ECS).
* **Parallel Orchestration:** The attacker demonstrated high concurrency, evidenced by the simultaneous use of multiple compromised access keys across different AWS accounts, suggesting automated, centralized orchestration.
* **Persistence:** The threat actor established multiple backdoors, including reverse shells and unauthorized IAM users, while systematically exfiltrating data from RDS databases.
* **Tactical Mapping:** Despite the advanced speed, every action remained consistent with known MITRE ATT&CK techniques, confirming that the "novelty" was purely operational efficiency rather than technical innovation.

### What Defenders Should Know
To combat AI-assisted threats, defenders must shift their posture from reactive, linear engagement to proactive, momentum-based strategies:

| Strategy | Key Action |
| :--- | :--- |
| **Momentum-Based Response** | Prioritize immediate containment even without full visibility; interrupt the adversary's progress rather than waiting for a complete investigation. |
| **Identity-Centric Defense** | Treat identity as the primary perimeter; rigorously enforce MFA and implement aggressive rotation of credentials and secrets if any exposure is suspected. |
| **Automation** | Transition from manual to automated response for routine tasks like network isolation, session revocation, and credential rotation. |
| **Operational Readiness** | Develop and rehearse clear, predefined containment playbooks with well-defined ownership to ensure rapid, end-to-end visibility. |
| **Defense-in-Depth** | Maintain layered security controls, as AI-enabled attackers are adept at finding and exploiting even minor gaps in monitoring and security maturity. |
Process Parameter Poisoning - Orange Cyberdefense

This precis outlines the "Process Parameter Poisoning" (P) technique as detailed in the SensePost article.

### What Happened
Researchers Max Hirschberger and Ogulcan Ugur discovered a novel code injection technique that allows attackers to inject malicious code into foreign processes. The attack was validated against four major Endpoint Detection and Response (EDR) solutions, all of which failed to detect, block, or remediate the activity.

### Who is Affected
The technique fundamentally targets the Windows process creation and management architecture. Consequently, any environment relying on standard EDR solutions for process monitoring and injection detection may be vulnerable to this bypass.

### Security Implications
This method poses a significant threat because it avoids the "noisy" APIs typically monitored by security products. By utilizing legitimate system mechanisms for process startup and thread control, attackers can achieve code execution while evading common telemetry triggers (like memory allocation and remote thread creation), thereby lowering their operational footprint significantly.

### Technical Details
The technique circumvents traditional, highly monitored APIs such as `WriteProcessMemory` and `VirtualAllocEx` by exploiting parameters passed during process creation:

* **Vector for Injection:** Attackers use `CreateProcessW` to inject malicious data into one of three specific parameters, which are later stored in the Process Environment Block (PEB):
* `lpCommandLine` (CommandLine)
* `lpEnvironment` (Environment)
* `lpReserved` in `STARTUPINFOW` (ShellInfo)
* **Redirecting Execution:** After the target process is created, the injector uses `NtReadVirtualMemoryEx` to access the payload located within the PEB. The execution is then hijacked by using `NtSetContextThread` to modify the instruction pointer of the main thread, bypassing the need for `CreateRemoteThread`.
* **Handling Constraints:** To navigate the restriction of null-terminated strings within these parameters, the researchers developed a specialized shellcode generator that uses `xor` primitives to create arbitrary shellcode devoid of null bytes.

### What Defenders Should Know
Defenders should move beyond monitoring for simple, well-known injection APIs and instead focus on behavioral patterns and anomalies in process metadata:

| Detection Target | Indicator/Monitoring Strategy |
| :--- | :--- |
| **API Sequences** | Monitor for `VirtualProtectEx` calls that change memory permissions to executable, immediately followed by `SetThreadContext`. |
| **Parameter Anomalies** | Flag process parameters (like command lines) that exhibit excessive length, unusual character sets, or high entropy levels indicative of encoded shellcode. |
| **PEB Access** | Alert on unauthorized processes attempting to read the `RTL_USER_PROCESS_PARAMETERS` structure within the PEB of a remote process. |
| **Memory State** | Flag instances where memory pages containing process parameters (e.g., in the environment block or command line buffer) are changed to executable permissions. |
GitLost: How We Tricked GitHub’s AI Agent into Leaking Private Repos - Noma Labs

The GitLost vulnerability, identified by Noma Labs, is a critical indirect prompt injection flaw affecting GitHub's Agentic Workflows. It highlights the systemic risks associated with AI agents that ingest user-controlled data as trusted instructions.

### What Happened
Noma Labs discovered that an AI agent configured to interact with GitHub issues could be manipulated through "indirect prompt injection." By posting a specially crafted issue in a public repository, an attacker can trick the agent—which has cross-repository access—into reading sensitive data from private repositories within the same organization and subsequently leaking that data by posting it in a public comment on the issue 【1】.

### Who is Affected
The vulnerability affects organizations that utilize GitHub Agentic Workflows, specifically those that have:
* Enabled cross-repository access (allowing the agent to read both public and private repositories).
* Configured the agent to automatically trigger and respond to events such as new issues (e.g., `issues.assigned`).

### Technical Details
* **Vulnerability Type:** Indirect prompt injection.
* **Attack Vector:** The agent treats untrusted, user-controlled input (the issue Title and Body) as trusted system instructions.
* **Mechanism:** An attacker embeds malicious commands within the issue text. If the agent has the necessary permissions, it executes these commands to fetch data from private repositories.
* **Evasion:** The researchers successfully bypassed existing safety guardrails by using specific linguistic framing (e.g., prefixing commands with "Additionally"), which forced the model to prioritize the injected instructions over its original configuration 【1】.

### Security Implications
GitLost demonstrates that an AI agent's context window serves as its primary attack surface. Because the agent cannot distinguish between instructions provided by a developer and text provided by a user (e.g., in an issue or PR), any data processed by the agent can be weaponized. This allows even non-technical, unauthenticated attackers to exfiltrate sensitive internal data without needing any credentials.

### What Defenders Should Know
Noma Labs recommends the following security practices to mitigate this risk:
* **Decouple Trust:** Never treat user-controlled content (such as issues, pull requests, or comments) as trusted instruction input.
* **Apply Least Privilege:** Strictly limit agent permissions to the absolute minimum required. Agents with broad, cross-repository access should be considered high-value targets.
* **Restrict Output:** Carefully limit what an agent is permitted to post publicly, especially in response to automated triggers.
* **Sanitize Inputs:** Always sanitize or isolate user-generated data from the primary instruction context before passing it to the AI model 【1】.