huntback discloses AI agent-orchestrated vulnerability research tasks
Start here
huntback says it recovered on a Contabo GmbH exposed server (37.60.248.174) an offensive security operation run almost entirely by AI agents, 365 files in total. The operator built a self-hosted platform named Brainstorm, from which an orchestration layer spawned Claude Code agents such as germinal, strategist, and Ask Code, responsible for scanning, reading source code, and triage respectively, with results written to a transcript for later human review; the platform also had built-in out-of-band collaborators. According to huntback, in 9Router versions 0.4.30 through 0.4.37 the src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing attackers to register customPlugins without authorization via the cowork-settings route and execute commands through the MCP bridge (CVE-2026-46339); the vulnerability was fixed in 0.4.37. Over 30 days, huntback's network captured 362 exploitation attempts involving 312 distinct source IPs, with the most recent on 2026-10-07.
Generated by AI from reports · Updated 6 days ago
Latest developments
- · 1 reportshuntback discloses AI agent-orchestrated vulnerability research tasks
- Date not given · 1 reportshuntback reports in-the-wild exploitation probing of CVE-2026-46339
Progress timeline
- Redditr/netsec· DiscussionHands Off the Keyboard: How AI Agents Run Real Intrusions(opens the original post in a new tab)
- huntbackhuntback says someone used coding agents to orchestrate vulnerability research tasks
huntback recovered an offensive security operation run almost entirely by AI agents on an exposed server at Contabo GmbH (37.60.248.174), totaling 365 files. The operator built a platform named Brainstorm, from which an orchestration layer spawned Claude Code agents named germinal, strategist, and Ask Code, each taking on scanning, source code reading, and triage roles, with results written to transcripts for later human review. The platform had its own out-of-band collaborator, using a unique token per payload to confirm blind XXE, SSRF, SSTI, RCE, and deserialization over DNS, HTTP, SMTP, and LDAP, replaying after restarts. The code references both Anthropic and Kimi (Moonshot) backends and can switch model providers, so detection based on vendor API domains can easily fail.
- Date not givenhuntback9Router 0.4.30–0.4.37 unauthorized MCP command execution vulnerability (CVE-2026-46339) actively exploited
In 9Router versions 0.4.30 through 0.4.37, the src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing attackers to register customPlugins without authorization via the cowork-settings route and execute commands through the MCP bridge; the vulnerability was fixed in 0.4.37. Over 30 days, huntback's network captured 362 exploitation attempts involving 312 distinct source IPs, with the most recent on 2026-10-07.
Related discussion
- Redditr/netsecHands Off the Keyboard: How AI Agents Run Real Intrusions(opens the original post in a new tab)
- Older than 72 hours · Not included in the 72-hour figures
- X@Huntbackiohuntback shares observations on probing the 9Router vulnerability(opens the original post in a new tab)
Links only. This site does not republish the posts.
Attention trend
New sources per day
- Oct 7New2 sources (1 outlets,1 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New1 sources (0 outlets,1 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)