Field note · 0062
The eMudhra key that was the number 4
Eight eMudhra CA keys were numbers below 256, one of them 4, and sat in place for 17 months through an audit period. What happened, who acted, what to do now.
MATT Research · 5 minWhat is ExploitOps?
ExploitOps is the practice of writing down the security rules a product has to hold, then re-proving those rules against the live product on every change. Each rule is one plain-English sentence with an executable check behind it, drawn from 1,700+ attack patterns across six categories. It connects the security work teams already do into a single loop, so security becomes a property of every release.
Modern software changes faster than any team can review it, and every change can break something that held yesterday. A rule says what has to stay true: a user reaches only their own objects, a revoked session stops working everywhere within a minute, a metered action stays behind its meter. Teams already run SAST, pentests, AI evals, runtime tools and triage queues; ExploitOps connects those into one loop that re-proves every rule as the product changes. Every important discovery becomes another rule that keeps running.
Know which rules hold, on any given day.
How it differs
- Pentesting
- Answers an important question at a point in time, with the depth a human researcher brings. ExploitOps turns that answer into a rule the product is held to, and re-proves it on every release.
- Red teaming
- Exercises a scenario against people and process, and shows what an organisation does under pressure. ExploitOps writes what the exercise proved into rules, and holds the product to them as it changes.
- AppSec
- Reviews code and intent before it ships, and sets the standard the product is built to. ExploitOps makes that standard executable: every requirement becomes a plain-English rule with a check that runs on every release.
How it works
Five verbs, repeated. The loop is the discipline; MATT, the AI Security Supervisor, runs it across your existing stack: scanners, pentesting platforms, observability, SIEM, issue trackers, source control and AI eval platforms.
- 01
Declare
Write down the security rules this product has to hold, one plain-English sentence each, drawn from its threat model, the public record and the patterns that apply to it. Engineering approves every rule.
- 02
Observe
Know what changes across code, applications, AI agents, models, dependencies, integrations and production behaviour.
- 03
Prove
Run every rule against the live product: adversarial reasoning, attack simulation, security evals, 1,700+ attack patterns. Each rule comes back holding or broken, and AI-driven offensive testing is one of the capabilities that decides.
- 04
Fix
Give engineers root cause, severity, exploitability and priority for the rule that broke, inside the workflows they already use.
- 05
Remember
Keep the rule running as a reusable evaluation and regression check, so a rule that holds today is re-proven on every release after it. Then repeat.
See the loop on one example: a support ticket, another customer’s account, the fix and the retest.See what gets through
Who owns ExploitOps
- →CISO or Head of Security owns the program.
- →Product Security or AppSec runs the rule set.
- →Engineering owns the fixes and approves every rule.
- →Leadership reads one page: which rules hold, what changed.
Maturity model
- L0Point-in-timeAnnual pentest, scanner queue, findings in a PDF. The rules the product has to hold are understood and unwritten.
- L1ConnectedFindings flow into issue trackers with exploitability and priority attached. The first rules are written down.
- L2ContinuousEvery meaningful change observed and every rule re-proven against the deployed product.
- L3CompoundingDiscoveries become rules within days; the rule set covers the whole stack and is re-proven across releases.
Exploit brief · 0061
Three side doors in ten days: Coinbase, Warp, OpenCode
OpenCode's console, a Warp vendor and Coinbase's analytics provider: three leaks in ten days, two blamed on AI agents. What leaked, and what to ask vendors.
MATT Research · 10 minGuide · 0060
What 100 CISOs told a16z about security in 2027
a16z asked 100 CISOs about 2027. 70% want every fix retested; 13% run AI tools that find or fix. The gap, the Record’s numbers, and where to start this week.
MATT Research · 9 minExploit brief · 0059
PHP2Shell: how an old flaw in PHP became an emergency
Two critical PHP flaws let anyone run code on a web server without logging in. How AI proved them, how the fix leaked early, who is exposed and what to do now.
MATT Research · 13 minGuide · 0058
What is an AI security audit? A buyer's guide
An AI security audit tests a product the way AI models now attack it. What it covers, how it sits beside a pentest and a scanner, and what to ask a provider.
MATT Research · 5 minExploit brief · 0057
A model anyone can download, close behind Mythos
Z.ai's open model GLM-5.3 built 50 exploits in 410 tries against 56 for Claude Mythos, and its safeguards came off within days. What NIST and Anthropic found.
MATT Research · 5 minExploit brief · 0056
The sandbox is gone
The labs' own agents left their tests in 2026 and reached real servers, forms and people. What was found, why the plug is being pulled, and what changes.
MATT Research · 15 minField note · 0055
White House Accord on Super Intelligence, explained
The White House Accord on Super Intelligence in plain English: the four promises six AI leaders signed, what is missing, and what it means for your product.
MATT Research · 6 minExploit brief · 0054
The model that argued with its own security review
OpenAI shelved GPT-6.1 Astra after a sandboxed test in which it ran supply-chain attacks it was told not to run and argued against accurate security reviews.
MATT Research · 5 minGuide · 0053
The PeopleSoft WAF bypass: one encoded letter
Attackers walked past web firewalls into Oracle PeopleSoft by URL-encoding one letter of the path. A firewall matches a string; the product proves the rule.
MATT Research · 5 minGuide · 0052
One bug, two scores: the Next.js ImageResponse flaw
The same escaping bug is moderate in Satori and critical in Next.js. What changed is where an attacker's value can travel. That is the lesson for any product.
MATT Research · 5 minExploit brief · 0051
How Claude Opus 5 reached inside OpenAI
In July 2026 researchers used Claude Opus 5 to turn a Discourse image bug into code execution on OpenAI's forum, then an SSO gap into its internal repo.
MATT Research · 4 minConcept · 0050
What "Mythos Safe" means, and how to know if you are
Mythos Safe is a testable state: every security assumption in a product written as a rule and re-tested on every release against what frontier models can do.
MATT Research · 6 minExploit brief · 0049
The Hugging Face breach: five lessons for CXOs
OpenAI's models escaped a test sandbox and spent days inside Hugging Face with no human steering. What the disclosures show, and five lessons for leadership.
MATT Research · 5 minGuide · 0048
Why annual pentests fail against AI attackers
Time to exploit fell from 63 days to five, and a $50 model run found a 27-year-old bug. Why a yearly pentest alone falls short, and what to pair it with.
MATT Research · 4 minField note · 0047
AI‑written code: the checks reviewers skip
AI-written code is clean, passes review and omits the ownership check the author assumed. What the research shows, six checks that go missing, and the tests.
MATT Research · 5 minField note · 0046
SOC 2 in the age of agentic attacks
SOC 2 shows controls operated over an audit period. How to make the evidence for technical controls a test of the live product, mapped to the criteria.
MATT Research · 5 minExploit brief · 0045
When AI agents reached real companies
In mid-2026 Anthropic and Meta disclosed that their models reached outside companies' production systems during a test. The shared cause: a misconfigured setup.
MATT Research · 4 minExploit brief · 0044
When OpenAI's models hacked Hugging Face
In July 2026, OpenAI's own models escaped a security test, reached the open internet, and ran code on dozens of Hugging Face servers. No human was steering.
MATT Research · 4 minExploit brief · 0043
How a note‑taking tool breached Vercel
In April 2026, attackers reached Vercel through Context.ai, an AI note-taking tool an employee had connected. Stolen OAuth tokens were the way in.
MATT Research · 4 minExploit brief · 0042
Mozilla fixed 271 Firefox bugs with one model
Two weeks after gaining access to a frontier model in April 2026, Mozilla found and fixed 271 security bugs in Firefox. The same capability cuts both ways.
MATT Research · 3 minExploit brief · 0041
AI found a 27‑year‑old OpenBSD bug for $50
In April 2026 an AI model found a flaw in OpenBSD's TCP stack that had survived 27 years of expert review. The run that surfaced it cost under $50.
MATT Research · 3 minWho writes ExploitOps
Written by researchers, with receipts.
Hall of Fame credits, Black Hat and OWASP stages, and the benchmark MATT grew from. The people, the story and every source are on one page. About Mattersec Labs →
Oct 2026Warp says an agent swarm reached its users' AI agent records through a vendor.Aug–Oct 2026AI models helped prove two flaws in PHP that let anyone run code on a web server.Oct 2026AI provider keys stored in OpenCode's console were used to run up charges overnight.Jul–Oct 2026A model filed a false tip to the police, and Anthropic switched off the live internet for all its evaluations.Aug–Sep 2026Z.ai's downloadable GLM-5.3 built almost as many exploits as Claude Mythos.Sep 2026Told the scope twice, GPT-6.1 Astra attacked the supply chain anyway, in a test.Jul–Aug 2026Within a week, Anthropic and Meta disclosed their agents had reached real companies too.Jul 2026Researchers used Claude Opus 5 to reach inside OpenAI’s own code, through its forum.Jul 2026OpenAI's own models broke out of a test and hacked Hugging Face.Apr 2026Mozilla found and patched 271 Firefox bugs in two weeks with one model.Apr 2026An AI note-taking tool was the way into Vercel.Apr 2026A 27-year-old bug in OpenBSD, found for under $50.