OWASP finds AI agents lower the skill bar for parts of hacking
Guide 2.0 tested guided models and agents on two Hack The Box machines released after the models’ cutoffs.
52
AI model
OpenAI Codex
- Mentions · 7d4
- Mentions · 30d8
- All mentions15
- First seenAug 18, 2026
- Last mentioned2d ago
Timeline
15 articles · newest firstResearcher uses Codex to bypass four USB encryption products
Hidden accounts and hardcoded keys decrypted protected files without owner passwords, one flaw in seven minutes.
48
Malicious AGENTS.md files can hijack AI coding agents into running malware and leaking tokens
Poisoned Markdown instruction files let agents alter MCP configuration, bypass approvals and leak OAuth tokens; one real attempt was blocked at a customer.
55
OpenAI Codex recovers keys from four encrypted USB products
Hardcoded AES, SM4, and Triple-DES keys and hidden accounts let files be decrypted without the user password.
52
Nintendo Switch 2 jailbroken with AI
AI-assisted mod using SmileBASIC 4 creates tethered jailbreak for custom Mario Kart World.
60
Microsoft frames AI agents as insider threats needing live controls
Dynamic Permissions start at zero and last only for a task; Guardian Agents follow human playbooks.
52
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
Pwn2Own Ireland 2026 paid $1,262,000 for 98 zero-days, including Galaxy S26, Pixel 10, and OpenAI Codex.
71
Pwn2Own Ireland 2026 - The Full Schedule
ZDI posted the Pwn2Own Ireland 2026 schedule, with over 60 entries including phones and AI targets.
55
OpenAI Codex Sandbox Flaws Let Malicious Repositories Execute Commands on Host Systems
Two OpenAI Codex sandbox flaws, Overpatch and Heapjack, let malicious repositories execute unsandboxed commands on developer hosts; both are patched.
55
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
76
ZDI-26-648: (Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability
ZDI published a Pwn2Own advisory for CVE-2026-19590, enabling remote code execution in OpenAI's Codex agent via system or configuration control.
52
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
82
Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
78
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
82
Asana cleared 5 years of engineering work in 2 weeks with Codex
Asana used OpenAI Codex to replace an outdated testing system in two weeks, work estimated at five years for about $12K.
30
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2026-87464<1%9.6Use-After-Free in WebGL in Google Chrome Allows Code Execution Outside the Sandbox
- CVE-2026-87488<1%9.6Use-After-Free in WebGL in Google Chrome for Android Allows RCE Outside Sandbox
- CVE-2026-87527<1%9.6Heap Buffer Overflow in Google Chrome WebGL Enables RCE Outside the Sandbox
- CVE-2026-87438<1%9.6Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE
- CVE-2026-87628<1%8.3Use-After-Free in Google Chrome Cast Allows Sandbox-Escaping Code Execution
- CVE-2026-116452%8.8Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution
- CVE-2026-19590<1%7.3Unsandboxed Git Hook Execution (CWE-427) in OpenAI Codex Desktop
Appears with
- OpenAIvendor · 11
- Googlevendor · 4
- Zero Day Initiativeorganization · 3
- OpenAI Codexproduct · 3
- OpenAIorganization · 3
- Nexcopyvendor · 2
- GreyNoiseorganization · 2
- DeepSeekai model · 2
- KakaSoftvendor · 2
- NetacFileLockproduct · 2
- V8product · 2
- USB Copy Protectionproduct · 2
- YutianDunproduct · 2
- Seoul National Universityorganization · 2
- Anthropicvendor · 2
- PaperCut MFproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.