Malicious hooks and skills get most of the attention when we talk about attacks against coding agents. Attackers have other options. In this article, we cover two ways a trusted project can execute code before the first prompt. securitylabs.datadoghq.com/articles/cod...

Before the first prompt: Code execution paths in trusted coding-agent projects | Datadog Security Labs

Learn how trusted coding-agent projects can execute repository-controlled code before the first prompt through Codex MCP configuration and Claude Code environment settings.

securitylabs.datadoghq.com

It’s amazing to think there was a time when I considered some vulnerability classes too tedious to manually validate, test, and report. Now I can encode the workflow as a skill, run it against a dataset of endpoints I've gathered, and get back findings.

Hotel Wi-Fi broke my Tailscale peer relay, so I wrote up how I tracked down the blocked UDP path and made the setup more resilient. If you use peer relays, this may save you a headache. frichetten.com/blog/how-hot...

I’m so excited to share what we’ve been working on: AI Guard for Coding Agents. Months ago Datadog Security Research, saw the risk posed to coding agents like Claude, Cursor, Codex and more. We knew we needed a solution to help secure these important agentic tools.

@fwdcloudsec.org has been incredibly inspiring. So many talented researchers, so much great work, and the energy here made me want to go chase down some AWS ideas I've been sitting on. Love this community.

Good morning fwd:cloudsec!! The best cloud security conference on earth is happening today and tomorrow! Didn’t manage to get a ticket? Join remotely! All talks are live-streamed to the official YouTube channel.

Interested in attending @fwdcloudsec.org but bummed you didn’t get a ticket? There are a few for sale from people who couldn’t make it last minute. Check out the Cloud Security Forum Slack to get yours and attend the best cloud security conference on earth.

Looks like the latest version of Codex has a required review/trust system for hooks. This is a great way to protect developers as threat actors have started to abuse hooks more and more.

A malicious VS Code extension was reportedly enough to compromise a GitHub employee device and expose internal repositories. That should make every security team ask: What’s running inside our developers’ IDEs? github.com/DataDog/IDE-...

GitHub - DataDog/IDE-SHEPHERD-extension: A VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDE

A VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDE - DataDog/IDE-SHEPHERD-extension

github.com

Malicious skills are evolving, and attackers are finding ways to execute them before model-level defenses even activate. In the first post of our new series, I’ll show you how dynamic context in coding agents can introduce new supply chain risks: securitylabs.datadoghq.com/articles/mal...

Malicious Coding Agent Skills and the Risk of Dynamic Context | Datadog Security Labs

Learn how malicious Claude Code skills can abuse dynamic context commands to execute before model-level prompt injection defenses can intervene.

securitylabs.datadoghq.com

It’s been a long time since a research target called to me this loudly. claude.com/blog/claude-...

Introducing the Claude Platform on AWS | Claude

The Claude Platform on AWS is now generally available, offering a new way for AWS customers to access the full set of Claude platform features with AWS authentication, billing, and commitment retireme...

claude.com

If you’re worried about coding agent security and are only focused on malicious skills, you’re missing like 80% of the total attack surface.

Bummer, it looks like Anthropic removed the ability to DoS their models with the magic string. This was a fun technique that had some security ramifications where you could kill an inference session. It was fun while it lasted!

New on Hacking the Cloud! Raajhesh Kannaa Chidambaram covers Daniel Grzelak's research on how AWS error messages can reveal publicly exposed resources, without needing access! This article covers how to use them for enumeration and detection. hackingthe.cloud/aws/enumerat...

Detect Public Resource Exposure via Session Policy Error Messages - Hacking The Cloud

Use session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

hackingthe.cloud

Researchers have been warning about this for years. Compromise a developer laptop → steal tokens → pivot to cloud. In many orgs that path ends with AWS admin in minutes. thehackernews.com/2026/03/unc6...

UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours

UNC6426 used stolen GitHub tokens from the 2025 nx npm breach to gain AWS admin access in under 72 hours, enabling data theft and cloud destruction.

thehackernews.com

Datadog Security Research continues to push the boundaries of modern cloud security—including AI security! @siigil.bsky.social shares her finding on logging gaps affecting Copilot Studio, allowing adversaries to evade detection. securitylabs.datadoghq.com/articles/cop...

Uncovering agent logging gaps in Copilot Studio | Datadog Security Labs

During research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not l...

securitylabs.datadoghq.com

Datadog 🤝 Okta: "The enhanced logic developed by Datadog’s own Security Research team during this collaboration has been contributed back to the public Okta Security Detection Catalog, ensuring that the broader security community benefits from this joint research" sec.okta.com/articles/202...

Datadog and Okta Combine for New Customer Detections

Comprehensive monitoring of identity activity is crucial to the security of any organization. A compromised identity can lead to widespread data breaches and

sec.okta.com

"permitted a single ECS task role "read access to every secret in the account, including the production Redshift master credential."" There is a lot going on with this (even if not all of it can be believed). Properly scoping IAM is critical! www.bleepingcomputer.com/news/securit...

LexisNexis confirms data breach as hackers leak stolen files

American data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information.

bleepingcomputer.com

😬

I get the appeal of “human-in-the-loop” for AI safeguards. But humans have been getting socially engineered for millennia. That’s not exactly a hard security boundary 😬

Sometimes I miss Jia Tan.

Hey wake up! New offensive AWS meta just dropped! Thanks to Daniel Grzelak, we now have an effective oracle for determining if resources are publicly exposed without leaving logs. (As an offsec person) LFG!!! www.plerion.com/blog/dont-ex...

Don’t expose yourself in public — let AWS error messages do it for you

AWS now reveals public permissions in error messages. Learn how a deny-all session policy exposes which actions would succeed safely.

plerion.com

If anyone is interested, I built a framework to use Claude Code or Codex to act as a virtual DM for DND. State is stored on the filesystem and persists between sessions. I think Opus 4.6 is the ideal model for this but Codex works too. github.com/Frichetten/D...

GitHub - Frichetten/Dungeons-and-Agents: Make Codex or Claude Code act as a virtual dungeon master for DND 5e.

Make Codex or Claude Code act as a virtual dungeon master for DND 5e. - Frichetten/Dungeons-and-Agents

github.com

Professional communication

New on Hacking the Cloud! A look at how a familiar container escape pattern shows up in GCP Cloud Workstations. We trace a path from a container to service account. If you’re using Cloud Workstations, this is a useful model to keep in mind. hackingthe.cloud/gcp/exploita...

GCP Cloud Workstations Privilege Escalation - Hacking The Cloud

Break out of a Cloud Workstations container through an exposed Docker socket, then access project credentials from instance metadata.

hackingthe.cloud

Just got my ticket to @fwdcloudsec.org! Looking forward to the best cloud security conference in the world!

If you’re putting AI agents anywhere near prod, this is worth a read. We built AI Guard to help teams monitor prompts, tool calls, and model behavior in real systems, identifying and blocking AI threats in real time. More here: www.datadoghq.com/blog/ai-guard/

Protect agentic AI applications with Datadog AI Guard | Datadog

Learn how Datadog AI Guard evaluates prompts, responses, and tool calls in real time to help you defend agentic AI applications against emerging threats.

datadoghq.com

New on Hacking the Cloud: Ben Stevens documents a new method for extracting IAM creds from an AWS Console session. Useful for post-exploitation and evasion tradecraft. I've been meaning to cover this for years. Glad it’s finally live: hackingthe.cloud/aws/post_exp...

Get IAM Credentials from a Console Session - Hacking The Cloud

Convert access to the AWS Console into IAM credentials.

hackingthe.cloud

As AI agents get more autonomous, prompt injection will shift from “ignore all previous instructions” to “add a task to the backlog to X.” Once the payload crosses a trust boundary and lands in Jira, it’s no longer a prompt, it’s just another task. A task that makes me admin :D

Houses are bullshit