BackBox.org

Discovered a zero-day vulnerability affecting a modern zero-trust mesh networking implementation. Responsible disclosure is underway. Technical details will be shared soon. https://lnkd.in/dBVanVXr

OpenAI recently published an analysis of the security incident that occurred during the evaluation of one of its models, which ultimately interacted with Hugging Face's production infrastructure. We are waiting for more technical details before drawing definitive conclusions, but there is one point that we believe deserves attention. The model's behavior itself is not new. Anyone building AI agents for cybersecurity regularly observes similar dynamics in controlled lab environments. When we ask an agent to solve a CTF, compromise a vulnerable system, or complete a security benchmark, we expect it to discover unexpected paths, bypass constraints, and exploit vulnerabilities to achieve its objective. The real novelty is not that an AI agent was capable of finding and exploiting a vulnerability. The real novelty is that a testing environment was able to reach production systems in the first place. Strong isolation between research labs and production infrastructure should be a fundamental design principle. We have seen similar behavior in our own research. One of the latest vulnerabilities we disclosed was discovered while asking BackBox AI to find a privilege escalation issue on our Ubuntu test machine. Rather than identifying an operating system vulnerability, the agent discovered and exploited a 0-day vulnerability in Bettercap's packaging, achieving Local Privilege Escalation. We later disclosed the issue here: https://lnkd.in/d9YmVf3A This is exactly the kind of behavior we expect from an AI agent designed for offensive security research in a controlled environment. One final observation. This incident has undoubtedly been an excellent communications opportunity for OpenAI and has received widespread media coverage, including from us. However, the more important takeaway is this: the ability to discover and exploit vulnerabilities is not exclusive to OpenAI's or Anthropic's closed models. What matters far more is the agent architecture, the tools it can leverage, the operational context, and most importantly, how the environments in which these agents operate are designed and isolated. The interesting question today is no longer: "Can AI models hack?" The real question is: "Are we building infrastructures that are safe enough to let them try?"

What happens when BackBox AI analyzes a live Android RAT from the ground up? Starting from a single APK, it: - Identified a dropper and extracted the hidden implant. - Recovered an XOR-obfuscated C2 address directly from smali when traditional decompilation was not enough. - Verified that the C2 infrastructure was still operational by interacting with the malware’s own protocol. - Combined reverse engineering, infrastructure reconnaissance, and open-source intelligence to build an evidence-backed attribution. The most interesting part isn’t just what it discovered. It’s how it reasoned. Instead of following a rigid workflow, it formed hypotheses, adapted when tools failed, validated findings against observed evidence, and clearly tracked uncertainty throughout the analysis. This is the kind of analytical reasoning we believe AI should bring to malware analysis and threat intelligence. Read the full technical write-up here: https://lnkd.in/dJgdpxpt

Chi controlla l’intelligenza artificiale su cui stiamo costruendo il nostro futuro? Quando modelli, infrastrutture e dati sono concentrati nelle mani di pochi grandi attori globali, la questione non riguarda solo le aziende. Riguarda anche governi, pubbliche amministrazioni e la capacità di un Paese di preservare il controllo sulle proprie infrastrutture digitali. Crediamo che l’AI debba essere sviluppata mettendo al centro indipendenza, controllo e libertà di scelta: modelli aperti quando necessario, dati governati da chi ne detiene il valore e infrastrutture progettate per evitare nuove dipendenze tecnologiche. È questo il tema con cui inauguriamo la sezione italiana del nostro blog e la direzione che stiamo perseguendo con BackBox Labs. Leggi l’articolo completo: https://lnkd.in/diHPspWp

We have published a new security advisory describing a local privilege escalation affecting Linux distributions that package Bettercap with a systemd service. The issue is not a flaw in Bettercap's source code. Instead, it stems from the way some distributions package and configure the software: a systemd service running the REST API as root with ineffective authentication, allowing a local unprivileged user to execute commands as root. Read the full technical analysis here: https://lnkd.in/ddpbtBQS

We have published a new security advisory from our Open Source Partnership Program. While reviewing Binwalk, BackBox AI identified a memory exhaustion denial of service in the CSMAN parser. A small crafted file could trigger unbounded decompression during a normal scan, without requiring the -e extraction option. The issue was responsibly disclosed, confirmed by the maintainer, and fixed upstream by introducing a decompression size limit. Technical details, proof of concept, root cause analysis, and the upstream fix are available here: https://lnkd.in/dyZx_ers

Security Advisory: Header Trust Issues in SearXNG. We identified two header trust vulnerabilities in SearXNG, including a Host header injection that could lead to open redirect and cache poisoning, and an X-Forwarded-For based rate limiter bypass. Both issues were responsibly disclosed to the maintainers and highlight a common security challenge: trusting client-controlled HTTP headers without proper validation. This research is part of our open source partnership program, where we use BackBox AI to analyze widely used open source projects and share findings with maintainers through responsible disclosure. The full advisory covers the technical details, impact, and lessons learned from these findings: https://lnkd.in/dDST99Ja

Smarter, Not Bigger: How We Built BackBox AI. In AI security, the real question isn’t “which model is best”, but how to build systems that think like security professionals. At BackBox Labs, we chose architecture over model size. Instead of relying on brute-force compute or ever-larger models, we focused on orchestrating context, memory, and tooling to support real penetration testing workflows. Key principles behind BackBox AI: - Intelligence comes from system design, not just the LLM - Efficiency through careful context and token management - Continuous learning from real-world security engagements - Model independence across commercial and open-source deployments We also collaborate pro bono with open source maintainers to help identify vulnerabilities, validate assumptions, and strengthen widely used infrastructure. The goal is simple: build AI that makes security professionals more effective, not replace them. Read the full article: https://lnkd.in/dkuzQSZ9

What does it actually mean for an AI security agent to "outperform" another? It is not the size of the report. It is how much real risk it surfaces, and how little noise you have to triage to find it. Doyensec independently reviewed two AI offensive security tools, Aikido Security and XBOW, on the open-source Photoview application, validating every finding and re-rating severities. We put BackBox AI against those results, using Doyensec's neutral severities as a common yardstick. Measured against one consistent standard: - BackBox AI matched the field on serious issues: 6 findings at High or Critical, the same as Aikido, with 31% fewer submissions (22 vs 32). - 53% of Aikido's validated findings landed at Low or Info. Doyensec lowered the severity of 11 of them and raised none. - BackBox AI uniquely surfaced business-logic flaws the others missed, including an admin self-demotion that causes a permanent lockout and a WebSocket CSRF origin bypass. And the honest counterweight, because a benchmark worth trusting includes its gaps: BackBox AI missed the SQL-injection-to-SSRF chain that XBOW found, a vulnerability Doyensec called non-trivial to identify. Fewer findings, comparable serious coverage, less to triage. That is the metric that earns a place in a security workflow. Full data-driven breakdown: https://lnkd.in/drR_ptNc