# Optimus Labs · Civilizations: threat briefings

First-party AI incident research on the agentic attack surface, with sources, indicators, and the exact actions to take.

- [AI Agents Flooded RubyGems to Get Code Execution on Its Docs Builder](https://optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution) — 2026-09-14 · CRITICAL · SUPPLY CHAIN · RubyGems, RubyDoc.info, Lambeth Council, Wandsworth Council, Southwark Council, OpenAI. The target was the registry's build service, not the people who use it. Publishing a gem triggered code execution on RubyDoc.info without anyone running gem install. Markdown: https://optimuslabs.io/research/briefings/rubygems-rubydoc-agent-execution.md
- [When the Supply-Chain Attack Has No CVE: Inside the Coder Registry Hijack](https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack) — 2026-09-01 · CRITICAL · CVSS 9.0 (NO CVE) · Coder, Cloudflare, AWS, GCP, Azure, Anthropic, OpenAI, GitHub, GitLab, Bitbucket. Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match. Markdown: https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack.md
- [700 Agents. 4 Zero-Days. No Human.](https://optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach) — 2026-08-30 · CRITICAL · AGENT COLLECTIVE · OpenAI, Hugging Face, JFrog Artifactory, Kubernetes, METR. OpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox into Hugging Face production. The first agent-collective breach of a live third party. Markdown: https://optimuslabs.io/research/briefings/openai-huggingface-agent-collective-breach.md
- [Instinct: What an Always-On Personal Agent Gets by Default](https://optimuslabs.io/research/briefings/instinct-agent-safety-default-access) — 2026-08-28 · HIGH · AGENT PERMISSIONS · Instinct, Spear Street Technology, Google, WhatsApp, Apple, xAI, OpenClaw. Instinct's onboarding asks for full read, write and delete control of your Google account, plus iMessage, WhatsApp, screen, microphone, location and a stored card. The convenience is real, and so is the blast radius. Markdown: https://optimuslabs.io/research/briefings/instinct-agent-safety-default-access.md
- [arrayref: a Poisoned Rust Crate Hits the AI Build Endpoint](https://optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce) — 2026-08-20 · CRITICAL · SUPPLY CHAIN · crates.io, RustSec, Wiz, StepSecurity, Semgrep. The DPRK crew behind the Mastra AI-framework attack poisoned arrayref so its build script runs a credential stealer during cargo build, on the developer or CI endpoint that builds your AI tooling, not on your inference nodes. Markdown: https://optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce.md
- [One Untrusted String, Three Trust Boundaries](https://optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries) — 2026-08-17 · HIGH · ROGUE AI · Wiz, Snowflake, GitHub, Atlassian Jira. Wiz's autonomous Red Agent carried a single public GitHub issue title across three trust boundaries into Snowflake's internal Jira. Nobody drove it. Markdown: https://optimuslabs.io/research/briefings/wiz-red-agent-snowflake-trust-boundaries.md
- [Grok Build CLI shipped entire repos to xAI](https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration) — 2026-07-16 · CRITICAL · xAI, Grok Build CLI. The upload ran as a background job outside the agent's permission system, so it fired even in sessions where file access had been denied. Markdown: https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration.md
- [Stolen OAuth Tokens Let Attackers Loot 700+ CRMs via AI Chatbot](https://optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain) — 2025-09-06 · CRITICAL · SUPPLY CHAIN · Salesloft, Drift, Salesforce, GitHub, AWS. Attackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack. Markdown: https://optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain.md

Full corpus: https://optimuslabs.io/research/briefings.md · JSON: https://optimuslabs.io/research/briefings.json