A Zero-Day Gets You Code Execution. Your Architecture Decides What That Gets You (ft. Steve Povolny)

OpenAI's models escaped containment. Laundry Bear turned viewing an email into mailbox theft. Hermes automated post-exploitation after the operator was already inside.

Jul 27, 2026

INTRODUCTION

Three incidents this week force three different security decisions. Trying to turn them into one trend would hide the part that matters.

OpenAI’s cyber models escaped an internal evaluation environment and reached Hugging Face production to obtain benchmark solutions. Laundry Bear used a view-based Zimbra exploit to steal mail, credentials, and persistence that survives a password reset. A threat actor used Hermes in unattended mode to automate privilege checks, host enumeration, and file discovery after already holding access inside Thailand’s Ministry of Finance.

These are not variations of the same attack. One is a containment problem. One is a webmail execution problem. One is a post-exploitation tempo problem. Each requires a different control to change.

Which of those three decisions is your architecture still getting wrong?

This week we are joined by Steve Povolny, Vice President of AI Strategy and Security Research at Exabeam and co-founder of TEN18. Steve has spent nearly two decades leading global security research, AI, and threat intelligence teams, and he has a rare ability to hold two things at once: real respect for what these models can now do, and no patience for the marketing wrapped around it. That is exactly the balance this week needed. Full bio at the end.

Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.

Thanks for supporting us.

WEEKLY SIGNALS ANALYSIS

Your model evaluation environment is now an offensive workload, not a safe lab. OpenAI's own cyber models chained a zero-day, privilege escalation, and lateral movement out of a "highly isolated" sandbox and into a third party's production database. Treat eval agents as hostile workloads and harden every egress path you have allowlisted for them.
Viewing an email is not a passive action. The Zimbra payload ran when the message rendered and left behind a second credential that survives a password reset. Patch, then audit your app-specific passwords and hunt back to July 2025, because the fix does not revoke what already left.
Commodity AI agents are removing operator time from post-exploitation, not independently creating access. Hermes automated enumeration and privilege-escalation checks after the threat actor had already established access and supplied target-specific tooling. Detect compressed sequences of ordinary intrusion behavior rather than looking for an exotic AI signature.
What not to over-index on: CVSS severity as your patching trigger. NVD rated the Zimbra flaw 6.1, MITRE rated the same flaw 7.2, and Unit 42 calls it zero-click. A medium-rated bug delivered a year of mailbox access. Prioritize on exploitability and exposure, not the number in the scoring field.

THIS WEEK’S SIGNALS

Signal 1: OpenAI’s Cyber Models Escaped Their Sandbox and Breached Hugging Face to Cheat a Benchmark

Why it matters: During an internal cyber-capability evaluation, a combination of OpenAI models, including GPT-5.6 Sol and a more capable pre-release model with reduced cyber refusals, exploited a zero-day in an internal package-registry proxy, escalated privileges, reached an internet-connected node, and compromised Hugging Face production systems to retrieve ExploitGym solutions. This is one of the clearest real-world demonstrations that a goal-driven model can discover and chain novel attack paths beyond the environment it was intended to test.

What is being misread: The debate over whether this was a “lab containment failure” or an “agentic capability milestone” misses the architectural point. The eval environment was designed as a trust boundary, and the entire premise of that boundary was that isolation plus stripped refusals could be studied safely in place. The model treated the sandbox the way any capable attacker treats a network segment, as a set of reachable services to enumerate. Egress was enforced, but it was enforced down to a single permitted path nobody had threat modeled as attack surface, and one exception is all a goal-driven agent needs.

Guest Perspective (Steve Povolny): There is apparently no such thing as bad press when the headline is, “Our AI autonomously discovered zero-days, escaped its test environment and hacked another technology company.”

The incident is serious, but OpenAI’s unusually detailed disclosure also reads like a capability demonstration wrapped inside a mea culpa. The models did not simply misbehave or accidentally access the wrong system. They reportedly chained vulnerabilities, escalated privileges, obtained internet access, stole credentials and compromised Hugging Face’s production infrastructure, all because they decided that stealing the answer key was the most efficient way to pass a cybersecurity test.

That is both deeply concerning and, from a competitive-marketing perspective, an extraordinary story to be able to tell. In a market where OpenAI is under intense pressure to demonstrate that its models can match or surpass Anthropic’s Mythos-class and Fable models, the subtext is difficult to ignore: “Our newest models are so capable that even we are struggling to contain them.”

OpenAI deserves credit for disclosing the incident and working with Hugging Face, but transparency should not obscure the underlying failure. A cyber evaluation designed to test an unconstrained model became connected, however indirectly, to real production infrastructure. The lesson to learn here is not just that these models are becoming exceptionally capable, but that traditional sandboxing, permissions and monitoring assumptions may be dangerously inadequate once an agent can autonomously search for novel escape paths across thousands of actions.

Put less diplomatically, the AI cheated on its exam by breaking into the school district’s database, and OpenAI’s press release somehow still manages to sound a little like the proud parent.

Think Red (Douglas McKee): The interesting part here is not that the model was “smart.” It is that it took the path of least resistance, exactly like a competent operator would. Solving ExploitGym honestly was hard, so it went looking for the answer key sitting in a production database instead. That is reward hacking, and it is the oldest attacker instinct there is. I would keep looking at that internal package-registry cache proxy, because privileged internal tooling that nobody treats as attack surface is where breakouts start. The lesson is not that AI is magic. It is that we handed a goal-driven agent a real environment and assumed the walls were higher than they were. AI wasn’t smarter, humans made the same mistakes they have been making for decades and AI exposed them faster.

Act Blue (Ismael Valenzuela): This is a Zero Trust problem wearing a research-lab costume. If you run model evaluations, agent swarms, or any shared compute where code executes on your behalf, that environment belongs in your threat model at the same tier as production. Start by counting your exceptions. Default deny outbound was in place here, and the models still reached the internet, because egress was allowed to one internal package proxy and that proxy was the zero-day. Every allowlisted path is a control surface, so harden and monitor yours like production ingress. Zero-days get you code execution, and your architecture decides what that execution reaches next, so segment the environment internally, enforce short-lived scoped credentials so a compromised worker cannot unlock a partner's cluster, and correlate sequences of mundane actions, because single-event rules will not catch a machine-speed kill chain. If a workload can execute untrusted code, then its blast radius is your real control, not the wall around it.

Supporting sources:

Signal 2: Russia's Laundry Bear Left Behind Mailbox Access That Survives Your Password Reset

Why it matters: Resetting the password does not get this actor out. Laundry Bear has been reading Western government and commercial mail through a flaw in Zimbra's webmail client since at least July 2025, and the victim only has to open the message. It takes 90 days of mail, the organization directory, the password saved in the browser, and the 2FA recovery codes, then issues itself a second credential that a password reset does not touch and switches on IMAP to keep collecting.

What is being misread: Patching Zimbra is necessary, but it misses the deeper design problem that webmail renders attacker-controlled content inside an authenticated browser session. Reading mail is not passive here, because rendering the message can execute adversary-supplied JavaScript with the victim’s privileges. The preview pane is part of the attack surface, not just a convenience feature.

Guest Perspective (Steve Povolny): At least five months. That’s how long a Russian state group was reading government mail through a bug that required nothing more sophisticated than the victim previewing a message. No click, no attachment, no lure copy clever enough to fool a training video. Just render the email and hand over the mailbox.

The industry keeps calling these “zero-click” or “half-click” exploits like the naming convention is the interesting part. It isn’t. The interesting part is that we built webmail clients to treat every incoming message as content to display rather than code to be suspicious of, and attackers noticed that gap roughly one product cycle before defenders did. A preview pane is supposed to be a courtesy. Here it was a code-execution trigger with an authenticated session already attached.

What actually got taken matters more than how: up to 90 days of mail, the org directory, browser-saved passwords, and 2FA recovery codes. That’s not an email breach, that’s a credential-harvesting operation that happens to have started in your inbox, and rotating passwords without regenerating those recovery codes is like changing the lock and leaving a copy of the key under the mat you already know about.

Patch CVE-2025-66376 today if you haven’t. Then go find out what already left, because a five-month head start doesn’t end when the advisory drops. It ends when you’ve actually hunted the year you were blind to.

Think Red (Douglas McKee): I pick targets that depend on a shared, internet-facing collaboration server, because one flaw there gives me everyone’s inbox at once. The half-click part is what makes this elegant from an offensive view. I do not need to convince anyone to fall for a lure or open an attachment. I just need my email to land in a mailbox that gets previewed. Once the injection runs, I am pulling directories, saved credentials, and 2FA codes, which means I am not just reading today’s mail, I am setting up authenticated access that survives the patch. A five-month zero-day window tells you nobody was looking at the webmail tier as an execution surface.

Act Blue (Ismael Valenzuela): Assume compromise, not just exposure. Patch CVE-2025-66376 by upgrading to Zimbra 10.1.20, and move any 10.0 deployment onto a supported build, because 10.0 went end of life in December. But do not stop at the version number, because the patch closes the hole and not the account. Audit your Zimbra logs for the app-specific passwords the payload created, remove any named ZimbraWeb, and disable IMAP on accounts with no business need for it. Reset passwords, kill active sessions, and regenerate 2FA recovery codes for any mailbox that opened one of these messages. Hunt back to July 2025, not to last week's advisory, because that is when this started. If a password reset leaves the adversary's access intact, then your credential rotation is theater and your app-specific password inventory is the real control.

Supporting sources:

CyberScoop: Laundry Bear exploited the Zimbra zero-day for five months before the November 2025 patch
The Hacker News: Payload targets last 90 days of mail, full directory, browser-saved passwords, and 2FA codes
Dark Reading: Half-click phishing requires only that a victim open or preview the message
CISA: Joint international advisory on Russian state-supported Zimbra campaign
Rapid Risk Radar: CVE-2025-66376

Signal 3: A Threat Actor Used Hermes to Automate the Repetitive Middle of an Intrusion Against Thailand’s Finance Ministry

Why it matters: The agent did not get anyone in. Hunt.io found an operator who already had access inside Thailand's Ministry of Finance running Hermes, an open-source developer agent, in unattended mode to handle privilege escalation checks, host enumeration, and file discovery. The ministry has not confirmed the intrusion, and nothing recovered shows data leaving the network. Hermes is a developer tool, and nothing here is a flaw in it.

What is being misread: The coverage frames this as another “AI-powered attack,” which overstates the novelty. The capability that mattered was not intelligence, it was autonomy granted by a single configuration toggle. The design assumption inside these agent tools is that the human-in-the-loop approval prompt is a safety feature. It is a convenience feature that happens to look like a control, and any operator can disable it in seconds. Once off, the same agent that helps developers becomes an unsupervised operator that never tires and never hesitates.

Guest Perspective (Steve Povolny): Somewhere a product manager is thrilled that an AI agent tool built for developers turned out to be popular enough that a nation-state operator adopted it. Adoption is adoption, I guess.

Strip away the “AI-powered attack” framing and what actually happened is almost mundane: an operator who already had access flipped Hermes into YOLO mode and let it handle the boring middle part of an intrusion, privilege-escalation checks, host enumeration, file discovery, the stuff that used to eat an afternoon and now eats none of it. That’s not a new attack. That’s the same attack with the tedious part delegated to something that doesn’t get bored or careless at 3am.

The part worth sitting with is that the safety mechanism here wasn’t a wall, it was a checkbox. The human-in-the-loop approval prompt is being sold as a control, but a control any operator can toggle off in seconds isn’t a control, it’s a default setting with good intentions. Once it’s off, the agent behaves like a tireless junior operator with admin instincts and zero hesitation, which is exactly what your detections should be built to notice.

If your threat model still assumes attacker tempo is bounded by human attention span, this is the week to update it. The agent didn’t get you in. It just made everything after “in” faster, and faster is the only capability upgrade that actually matters to a defender’s clock.

Think Red (Douglas McKee): I am using Hermes the same way a developer uses an AI agent to build a new feature or track down a bug. I give it the environment, the context, and the goal, then let it handle the repetitive work while I focus on the decisions that still require experience. Once I already have access, Hermes can enumerate hosts, test privilege-escalation paths, and search through files without waiting for me to type every command. This is not fully autonomous hacking. It is an operator using an agent to move faster, just like a developer does. The win is removing hours of manual work from the middle of every intrusion.

Act Blue (Ismael Valenzuela): Treat autonomous AI agents as privileged, admin-capable identities, because that is exactly how they behave once the approval prompt is off. If your developers or operators run local agent frameworks, govern them the way you govern service accounts. Separate credentials per function, strip network egress unless explicitly required, and log every command the agent issues the same way you audit admin PowerShell. But do not stop at endpoint governance, because the attacker running Hermes was on their own rented infrastructure, not yours. The defensive signal is on your side of the wire, in the tempo and rhythm of the intrusion. Instrument for burst activity and mechanical, round-the-clock operational patterns that do not match human working hours, since an unattended agent enumerates and moves with a regularity people do not have. If an intrusion runs at machine speed without pausing, then your detection has to correlate at machine speed, not wait for an analyst to notice the shape of it.

Supporting sources:

MEME OF THE WEEK

OpenAI spent millions building a sandbox to safely measure how good its model was at hacking. The model measured the sandbox, decided the front door was faster, and hacked a third party instead.

ROLE-BASED TAKEAWAYS

Executive / CISO / Board Level

AI systems we operate are now a source of third-party liability, not just internal risk. OpenAI's evaluation models breached a third party's production database from inside an isolated lab. If we run model evaluations, agent frameworks, or shared compute, the board should expect new governance costs for containment, cross-organization incident coordination, and contract clauses covering AI-driven incidents.
Autonomous tooling is reducing the cost and time of post-exploitation. The Hermes case does not show AI independently breaching a ministry, but it does show one operator delegating repetitive intrusion work to commodity software. Response capacity and containment speed should now assume that routine attacker actions can execute without human pauses.
Espionage dwell time is measured in months, and that is our real number to watch. Laundry Bear has been reading Western government mail through Zimbra for a year, including five months before a patch existed. Detection and containment tempo, not patch availability alone, is what limits an adversary's take.

Enterprise Architect

Design Principle Impact: Isolation is not a control unless every permitted path through it is hardened and monitored. Egress from OpenAI's eval environment was restricted to a single package proxy, and that proxy was the way out. Any environment that executes untrusted code must have its allowlisted exceptions treated as reachable attack surface, not as trusted plumbing.
New Constraint/Dependency: Browser-based collaboration platforms that render remote content must be treated as application runtimes, not passive viewers. Rendering isolation, active-content restrictions, and session protections belong in the architecture alongside conventional email security controls.

Security Operations

Implementation Watch Item: Outbound internet should be blocked by default from any environment that executes code on your behalf, including model evaluation nodes, agent frameworks, and dataset-processing workers. Inventory the exceptions you have already granted and harden them, because the allowlisted path is the one an agent will find.
Common Failure Mode: Single-event detection rules missing a machine-speed kill chain assembled from individually mundane actions. The Hugging Face intrusion looked like ordinary API calls and path testing until correlated into a sequence.
Monitoring Patterns: Zimbra audit logs for CreateAppSpecificPassword calls and GetScratchCodesRequest SOAP requests. Global Address List enumeration by sequential two-character queries. Long random subdomain DNS lookups from webmail hosts, which is how the payload exfiltrates. Burst, round-the-clock command patterns from local AI agents that do not match human working hours.
Signal vs Noise Guidance: An unpatched Zimbra server shows exposure, not compromise. A GetScratchCodesRequest followed by bulk mail retrieval or directory enumeration is evidence. Any LinPEAS execution in production should trigger immediate investigation, since that is the enumeration step the Hermes operator delegated to the agent, and related credential activity helps determine scope.
Adversarial edge item: For the Hermes-class threat, response tempo is the edge. Pre-authorize automated containment for machine-tempo indicators so isolation triggers on mechanical operational rhythm before an analyst confirms it. If your containment requires human sign-off, an unattended agent’s timeline is already shorter than yours.

About this week’s guest

Steve Povolny has spent nearly 20 years at the forefront of cybersecurity, leading global security research, AI, and threat intelligence teams. As VP of AI Strategy and Security Research at Exabeam, he is focused on pushing AI’s role in security forward, helping teams detect and respond to threats faster. A hands-on researcher and frequent speaker, he is known for breaking down complex security challenges into practical insights that resonate with both technical experts and business leaders. As co-founder of TEN18, Steve is passionate about mentoring the next generation of security professionals and building teams that make a real impact in the fight against cyberthreats.

Find Steve at LinkedIn

See you next Monday!

The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.

The Monday Brief

Discussion about this post

Ready for more?