Skip to main content
BreachLine Blog

Security research blog

Security research, product updates, CVE analysis, and offensive security insights from the BreachLine Labs team.

Active Directory Takeover: Low-Priv to Domain Admin
Offensive ResearchFeatured

Active Directory Takeover: Low-Priv to Domain Admin

How an AI security engineer chained DFSCoerce, NetNTLMv1, and DCSync to go from one low-privileged account to Domain Admin, live and fully anonymised.

Jun 2, 2026 8 min
Read more
llms.txt Is Directing Agents to Install Unowned Code
Threat Intelligence

llms.txt Is Directing Agents to Install Unowned Code

Researchers found 120 corporate llms.txt files pointing at packages nobody owned. Claude, Codex, and Hermes then installed them inside real networks.

Aug 30, 20265 min
When Prompt Injection Becomes RCE: The Cursor and AI-Editor Flaws of 2026
Threat Intelligence

When Prompt Injection Becomes RCE: The Cursor and AI-Editor Flaws of 2026

Three flaw clusters turned Cursor, VS Code, and Google Antigravity into a remote-code-execution surface in 2026. Here is how each one worked and how to shut it down.

Aug 20, 202610 min
HumanBrowser: The Live Browser Nebula Uses to Pentest Like a Person
Product

HumanBrowser: The Live Browser Nebula Uses to Pentest Like a Person

Most AI browser tools script clicks and get flagged as bots. HumanBrowser gives Nebula a real Chromium it drives by sight, through an intercepting proxy.

May 29, 202611 min
TeamPCP: The Group Turning Your Security Tools Into Malware
Threat Intelligence

TeamPCP: The Group Turning Your Security Tools Into Malware

TeamPCP poisoned Trivy, Checkmarx, and LiteLLM in a 2026 supply chain campaign (CVE-2026-33634). Who they are, what they hit, and how to stop them.

May 29, 202614 min
Claude Mythos Didn't Kill Pentesting. Read Anthropic's Own Fine Print.
Industry Analysis

Claude Mythos Didn't Kill Pentesting. Read Anthropic's Own Fine Print.

Anthropic's Claude Mythos post claimed 181 Firefox exploits and an overnight FreeBSD RCE. The model card's fine print tells a far more careful story.

Apr 20, 20268 min
Every AI Pentest Tool Is #1 on a Leaderboard. Here's the Catch.
Industry Analysis

Every AI Pentest Tool Is #1 on a Leaderboard. Here's the Catch.

XBOW raised $120M, Claude Mythos writes exploits overnight, yet curl's maintainer has never seen a valid AI bug report. What actually works versus theatre.

Apr 20, 20269 min
The Vercel Breach: One Third-Party OAuth Token, Full Compromise
Threat Intelligence

The Vercel Breach: One Third-Party OAuth Token, Full Compromise

Vercel's April 2026 breach traces to one compromised third-party OAuth token from Context.ai. The full attack chain, the IOCs, and the lessons for your team.

Apr 20, 202613 min
The Axios npm Supply Chain Attack: What Teams Need to Know
Threat Intelligence

The Axios npm Supply Chain Attack: What Teams Need to Know

Attackers backdoored Axios on npm on March 31, 2026, deploying cross-platform RATs in under 3 hours. Here's what happened and how to protect your builds.

Mar 31, 202612 min
The LiteLLM Supply Chain Attack: What Every AI Team Needs to Know
Threat Intelligence

The LiteLLM Supply Chain Attack: What Every AI Team Needs to Know

Attackers compromised LiteLLM on PyPI on March 24, 2026, stealing credentials from thousands of AI deployments. Here's what happened and how to respond.

Mar 27, 202611 min
Newsletter

Get the BreachLine Intelligence Digest

Security research, CVE analysis, and offensive security findings. Delivered weekly.