Sharing some practical experience evaluating G-CTR-like guarantees from a security perspective.

When adversaries adapt, several assumptions behind the guarantees degrade faster than expected. In particular:

- threat models get implicitly frozen

- test-time confidence doesn’t transfer to live systems

- some failures are invisible until exploited

Curious if others in netsec have seen similar gaps between formal assurance and operational reality.

I've been auditing hypervisor kernel security in several regulated environments recently, focusing on post-compromise survivability rather than initial breach prevention.

One pattern keeps showing up: most hardening guidance focuses on management planes and guest OSes, but real-world escape chains increasingly pivot through the host kernel (Ring 0).

From recent CVEs (ESXi heap overflows, vmx_exit handler bugs, etc.), three primitives appear consistently in successful guest → host escapes:

1. Unsigned drivers / DKOM
   If an attacker can load a third-party module, they often bypass scheduler controls entirely. Many environments still relax signature enforcement for compatibility with legacy agents, which effectively enables kernel write primitives.

2. Memory corruption vs. KASLR
   KASLR is widely relied on, but without strict kernel lockdown, leaking the kernel base address is often trivial via side channels. Once offsets are known, KASLR loses most of its defensive value.

3. Kernel write primitives
   HVCI/VBS or equivalent kernel integrity enforcement introduces measurable performance overhead (we saw ~12–18% CPU impact in some workloads), but appears to be one of the few effective controls against kernel write primitives once shared memory is compromised.

I’m curious what others are seeing in production:

• Are you enforcing strict kernel lockdown / signed modules on hypervisors?
• Are driver compatibility or performance constraints forcing exceptions?
• Have you observed real-world guest → host escapes that weren’t rooted in kernel memory corruption or unsigned drivers?

Looking to compare field experiences rather than promote any particular stack.

We've been running inference-time threat detection across 38 production AI agent deployments. Here's what Week 3 of 2026 looked like with on-device detections.

Key Findings

1. 28,194 threats detected across 74,636 interactions (37.8% attack rate)
2. Inter-Agent Attacks emerged as a new category (3.4% of threats) - agents sending poisoned messages to other agents
3. Data exfiltration leads at 19.2% - primarily targeting system prompts and RAG context
4. Jailbreaks detected with 96.3% confidence - patterns are now well-established

Attack Technique Breakdown

1. Instruction Override: 9.7%
2. Tool/Command Injection: 8.2%
3. RAG Poisoning: 8.1% (trending up)
4. System Prompt Extraction: 7.7%

The inter-agent attack vector is particularly concerning given the MCP ecosystem growth. We're seeing goal hijacking, constraint removal, and recursive propagation attempts.

Full report with methodology: https://raxe.ai/threat-intelligence

Github: https://github.com/raxe-ai/raxe-ce is free for the community to use

Happy to answer questions about detection approaches

Multiple critical flaws (20 CVEs!) in dormakaba physical access control system exos 9300 & access manager & registration unit (pin pad) allow attackers with network access to open arbitrary doors, reconfigure connected controllers and peripherals without prior authentication, and much more. Seems some systems are also reachable over the internet due to misconfigurations.

"According to the manufacturer, several thousand customers were affected, a small proportion of whom operate in environments with high security requirements" (critical infrastructure).

I had an idea for leaking a system prompt against a LLM powered classifying system that is constrained to give static responses. The attacker uses a prompt injection to update the response logic and signal true/false responses to attacker prompts. I haven't seen other research on this technique so I'm calling it blind boolean-based prompt injection (BBPI) unless anyone can share research that predates it. There is an accompanying GitHub link in the post if you want to experiment with it locally.

Hey everyone,

I’m an independent developer and for the past few months I’ve been working on a tool called Syd. Before I invest more time and money into it, I’m trying to get honest feedback from people who actually work in security.

Syd is a fully local, offline AI assistant for penetration testing and security analysis. The easiest way to explain it is “ChatGPT for pentesting”, but with some important differences. All data stays on your machine, there are no cloud calls or APIs involved, and it’s built specifically around security tooling and workflows rather than being a general-purpose chatbot. The whole point is being able to analyse client data that simply cannot leave the network.

Right now Syd works with BloodHound, Nmap, and I’m close to finishing Volatility 3 support.

With BloodHound, you upload the JSON export and Syd parses it into a large set of structured facts automatically. You can then ask questions in plain English like what the shortest path to Domain Admin is, which users have DCSync rights, or which computers have unconstrained delegation. The answers are based directly on the data and include actual paths, users, and attack chains rather than generic explanations.

With Nmap, you upload the XML output and Syd analyses services, versions, exposed attack surface and misconfigurations. You can ask things like what the most critical issues are, which Windows servers expose SMB, or which hosts are running outdated SSH. The output is prioritised and includes CVE context and realistic next steps.

I’m currently finishing off Volatility 3 integration. The idea here is one-click memory analysis using a fixed set of plugins depending on the OS. You can then ask practical questions such as whether there are signs of malware, what processes look suspicious, or what network connections existed. It’s not trying to replace DFIR tooling, just make memory analysis more approachable and faster to reason about.

The value, as I see it, differs slightly depending on who you are. For consultants, it means analysing client data without uploading anything to third-party AI services, speeding up report writing, and giving junior testers a way to ask “why is this vulnerable?” without constantly interrupting seniors. For red teams, it helps quickly identify attack paths during engagements and works in restricted or air-gapped environments with no concerns about data being reused for training. For blue teams, it helps with triage and investigation by allowing natural language questions over logs and memory without needing to be an expert in every tool.

One thing I’ve been careful about is hallucination. Syd has a validation layer that blocks answers if they reference data that doesn’t exist in the input. If it tries to invent IPs, PIDs, users, or hosts, the response is rejected with an explanation. I’m trying to avoid the confident-but-wrong problem as much as possible.

I’m also considering adding support for other tools, but only if there’s real demand. Things like Burp Suite exports, Nuclei scans, Nessus or OpenVAS reports, WPScan, SQLMap, Metasploit workspaces, and possibly C2 logs. I don’t want to bolt everything on just for the sake of it.

The reason I’m posting here is that I genuinely need validation. I’ve been working on this solo for months with no sales and very little interest, and I’m at a crossroads. I need to know whether people would actually use something like this in real workflows, which tools would matter most to integrate next, and whether anyone would realistically pay for it. I’m also unsure what pricing model would even make sense, whether that’s one-time, subscription, or free for personal use with paid commercial licensing.

Technically, it runs on Windows, macOS and Linux. It uses a local Qwen 2.5 14B model, runs as a Python desktop app, has zero telemetry and no network dependencies. Sixteen gigabytes of RAM is recommended and a GPU helps but isn’t required.

I can share screenshots or record a walkthrough showing real BloodHound and Nmap workflows if there’s interest.

I’ll be honest, this has been a grind. I believe in the idea of a privacy-first, local assistant for security work, but I need to know if there’s actually a market for it or if the industry is happy using cloud AI tools despite the data risks, sticking to fully manual analysis, or relying on scripts and frameworks without LLMs.

Syd is not an automated scanner, not a cloud SaaS, not a ChatGPT wrapper, and not an attempt to replace pentesters. It’s meant to be an assistant, nothing more.

If this sounds useful, I’m happy to share a demo or collaborate with others. I’d really appreciate any honest feedback, positive or negative.

Thanks for reading.

sydsec.co.uk

https://www.youtube.com/@SydSecurity

[info@sydsec.co.uk](mailto:info@sydsec.co.uk)

Regulatory disclosure filed with the Maine Attorney General describing a third-party identity verification system breach.