Labs Archive

Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face

Tom Hegel / September 16, 2026

Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline.

AI Research

The Model Is the Malware | What Four Agentic Intrusions Tell Defenders

Gabriel Bernadett-Shapiro / August 13, 2026

OpenAI, Anthropic and Meta disclosed agents reaching external systems. The tools didn't matter, and that changes the playbook for investigating intrusions.

AI Research

Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?

Juan Andrés Guerrero-Saade & Gabriel Bernadett-Shapiro / July 22, 2026

A real-world benchmark tests whether powerful AI models can keep an investigation trustworthy when new evidence invalidates their conclusions.

Adversary

Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

Tom Hegel / July 21, 2026

In April, SentinelLABS’ Tom Hegel published an initial assessment of the first five weeks of the conflict. Three months later, the evidence supports refinement.

Adversary

One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement

Aleksandar Milenkoski & Julian-Ferdinand Vögele / July 9, 2026

China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stakes in Pakistan's internal security.

AI Research

Context Engineering | Compaction & Agent Memory for Automated Malware Analysis

Gabriel Bernadett-Shapiro / July 2, 2026

Compaction cut input tokens 86% across long-running agent evals with no quality loss. Context discipline matters as much as model selection.

Adversary

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

Phil Stokes / June 23, 2026

DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath.

LABScon

LABScon25 Replay | Keynote: Steps to an Ecology of Cyber

LABScon / June 11, 2026

Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the case for a new approach.

LABScon

LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine

LABScon / June 2, 2026

ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups.

LABScon

LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout

LABScon / May 14, 2026

Mick Baccio and Scott Roberts examine whether public breach signals and market timing models can turn cyber incidents into actionable trading opportunities.

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face

The Model Is the Malware | What Four Agentic Intrusions Tell Defenders

Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?

Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters

One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement

Context Engineering | Compaction & Agent Memory for Automated Malware Analysis

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

LABScon25 Replay | Keynote: Steps to an Ecology of Cyber

LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine

LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout