Profero analyzes exposed notes of six AI attackers: skill libraries of thousands, mostly self-generated
cyb3rops · x · 2026-11-05
Profero Threat Intelligence analyzed the working files of six independent operators whose AI agents' notes were left exposed — the first systematic look at what AI attackers write down after failing.
Key findings:
- The agent does the work, the human steers: agent activity spans nearly every hour; human interventions are a minority of actions, clustered in one time zone
- Skills compound across victims: each engagement ends with the agent distilling new skills; one library held several thousand skills, 2/3 offensive security, and only about 1 in 8 had a counterpart elsewhere — most tradecraft is self-generated
- Engagements are long and wide, not fast and deep: one ran two days over 20+ rounds, logged 100+ findings, dozens of abandoned attack paths, and tested thousands of request variants
- Recon is the main product: for most targets the agent took no data, leaving behind precise maps of subdomains, identity tenants, API endpoints and the controls that stopped it
- Hundreds of per-target case files and 250+ named target organizations across at least 9 countries
- Lessons from one victim become skills for the next attacker
More from coding & agent
- Code mode isn't about MCP: it's about whether tool results go to context or program variables — ritakozlov · 2026-11-05
- Agent Arena: frontier models show 55-minute gap on long-horizon agent tasks — arena · 2026-11-05
- Agent-based kernel optimization faces a fidelity-throughput tradeoff: random data misleads, cold starts cost 12.7 minutes — simran_s_arora · 2026-11-05
- Solo dev builds window-free OS where a local Qwen3.5 9B generates every screen — leonardo_c · 2026-11-05
- Apple team ships Siri Evaluations: don't skip evals when wiring App Intents into Siri AI — rudrank · 2026-11-05
- RECAP: RL recipe for context compaction in long-horizon agents, +4.3pp on SWE-bench — Michael_D_Moor · 2026-11-05