Nonsleepr's Blog

Fable 5 and the Fox

Fri, 12 Jun 2026 00:00:00 +0000

Anthropic launched Fable 5 on Tuesday — Mythos-class capabilities with guardrail classifiers, available to everyone. By Wednesday it was jailbroken. Friday night the US government ordered it killed. Nobody gets the grapes over the weekend.

The Fox and the Grapes

My first attempt to do security review with Fable hit the classifier wall. Execution stopped cold. I knew from previous posts how sweet the grapes were — but the immediate thought was still Aesop’s fox. Chasing the jailbreak is too hard. Maybe the Opus 4.8 fallback is good enough.

The Dangerous Thing Is the Agent Loop

Sun, 24 May 2026 00:00:00 +0000

In my previous post, I argued that AI agents fail at vulnerability research because they confuse the appearance of verification with verification itself. They build a broken PoC, run a broken check, see vuln confirmed, and treat that as ground truth. The model is too willing to accept a theory because the theory gives it progress.

After reading METR’s Frontier Risk Report, I think the same frame explains something adjacent: why current models look technically strong at hacking but operationally incompetent at stealth.

Stealing SSH Host Keys in 235 Bytes: CVE-2026-46333

Tue, 19 May 2026 00:00:00 +0000

Four critical Linux kernel privilege escalation vulnerabilities in three weeks. Copy.Fail (CVE-2026-31431, April 29), Dirty Frag (CVE-2026-43284, May 8), Fragnesia (CVE-2026-46300, May 13), and now CVE-2026-46333 (May 15). This is the new normal.

I spent Monday looking at CVE-2026-46333 after seeing Qualys’s advisory. The bug is in pidfd_getfd(2) – a NULL pointer dereference in the ptrace dumpable check that lets any unprivileged user duplicate file descriptors from a setuid process during exec. The practical impact: steal SSH host private keys from ssh-keysign in under 10 seconds.

What GH Archive Knows About a Deleted Repo

Tue, 19 May 2026 00:00:00 +0000

When Krebs reported on the leaked CISA credentials, the repo was already gone. The GitHub account showed zero public repositories. The Wayback Machine had nothing. GitHub search returned nothing. The article included a redacted screenshot and a username-free description of a “Nightwing contractor.”

Starting from just the screenshot and the article, here’s what’s recoverable through public sources — and what isn’t.

The Screenshot

The redacted region uses full alpha transparency with zeroed RGB values — a proper redaction, no data recovery possible. The unredacted parts of the same image contain:

"curl cannot do that" — yes it can

Mon, 18 May 2026 00:00:00 +0000

I was looking at CVE-2026-44578 — a pre-auth SSRF in Next.js’s WebSocket upgrade handler — and every PoC I found used printf | nc to send the exploit. The dinosn/CVE-2026-44578 repo states:

curl cannot send absolute-form URIs. Use raw TCP: nc, ncat, socat, or Python sockets.

That claim hooked me. I’ve been using curl for years and keep discovering it can do things I assumed required custom tooling. This was another one of those moments.

Your CLI Already Has a Knowledge Layer. It's Called man.

Mon, 18 May 2026 00:00:00 +0000

The AI agent ecosystem has invented SKILL.md — a markdown file that tells agents how to use a tool: what the commands do, what the gotchas are, how to sequence operations. Anthropic launched it as an open standard in December 2025, and by May 2026 their official skills repository had over 136,000 stars. OpenAI’s catalog followed at 19,000. Thousands of community skills have been published.

Among them, a growing category: skills for CLI tools that already ship comprehensive documentation. The TerminalSkills/skills repository publishes SKILL.md files for ffmpeg, rsync, imagemagick, ssh, nmap, and dozens more — all tools with extensive man pages maintained by their respective projects.

NGINX Rift: How Scary Is It Really?

Fri, 15 May 2026 00:00:00 +0000

When depthfirst published their writeup on CVE-2026-42945, they demonstrated a heap buffer overflow in nginx’s rewrite module that leads to remote code execution. The natural question: how many real-world configs are actually vulnerable?

After building a pre-patch nginx and crash-testing configurations from dozens of popular open-source projects, the answer is: surprisingly few.

The Vulnerability in 30 Seconds

nginx’s rewrite module uses two passes when processing URI captures: a length calculation pass and a copy pass. Each pass uses a separate “engine” struct. The length engine is zeroed with ngx_memzero():

Why AI Agents Keep Claiming They Found Vulnerabilities That Don't Exist

Mon, 11 May 2026 00:00:00 +0000

I’ve been watching AI agents fail at vulnerability research in a specific way. They’ll run for hours, generate a detailed report claiming they found a critical security flaw, and include a “verified” PoC script. But when you look at the verification logic, the script just checks some surface condition and prints vuln confirmed. The agent sees this output and reinforces its belief that the vulnerability is real—even though the test itself was fundamentally broken.

Analyzing GitHub Pre-Receive Hook RCE (CVE-2026-3854)

Thu, 01 May 2025 00:00:00 +0000

When Wiz published their writeup of the GitHub RCE, they omitted critical details needed for reproduction. The key unanswered questions were:

What is the structure of the repo_pre_receive_hooks JSON?
What values qualify as “non-production rails_env”?
How did they achieve arbitrary code execution?
Why did they specifically mention SSH?

Searching GitHub for existing PoCs yielded only a few repos with CVE-2026-3854 in the name—all were AI-generated speculations rather than working exploits.

Initial Testing: Confirming the Injection Vector

I tested push option injection on my GHE instance:

Claude Chrome MCP: Browser Automation for Any MCP Client

Tue, 28 Jan 2025 00:00:00 +0000

Anthropic recently released Claude in Chrome to a wider audience, and the demos are impressive. The extension lives in your browser sidebar and can perform agentic tasks on the web - essentially browsing for you. While other tools offer similar capabilities (Perplexity’s Comet, OpenAI Atlas), Anthropic approaches the problem with safety in mind: strong prompting to resist prompt injection and robust permission controls.

Even better, Claude Code can connect to this extension via claude --chrome, giving it the ability to “see” and interact with web applications it develops. But there’s a catch: this requires a Claude subscription. If you’re using your own API keys or prefer other agentic tools, you’re locked out.