Nick Frichette

securitylabs.datadoghq.comBefore the first prompt: Code execution paths in trusted coding-agent projects | Datadog Security LabsLearn how trusted coding-agent projects can execute repository-controlled code before the first prompt through Codex MCP configuration and Claude Code environment settings.

3 Aug

Malicious hooks and skills get most of the attention when we talk about attacks against coding agents. Attackers have other options. In this article, we cover two ways a trusted project can execute code before the first prompt. securitylabs.datadoghq.com/articles/cod...

16 July

It’s amazing to think there was a time when I considered some vulnerability classes too tedious to manually validate, test, and report. Now I can encode the workflow as a skill, run it against a dataset of endpoints I've gathered, and get back findings.

frichetten.comHow Hotel Wi-Fi Broke My Tailscale Peer RelayHow to setup Tailscale peer relays to listen on multiple ports.

10 July

Hotel Wi-Fi broke my Tailscale peer relay, so I wrote up how I tracked down the blocked UDP path and made the setup more resilient. If you use peer relays, this may save you a headache. frichetten.com/blog/how-hot...

9 June

I’m so excited to share what we’ve been working on: AI Guard for Coding Agents. Months ago Datadog Security Research, saw the risk posed to coding agents like Claude, Cursor, Codex and more. We knew we needed a solution to help secure these important agentic tools.

datadoghq.comCoding Agent Runtime Protection | DatadogCheck out the available Datadog Product Previews and register to be considered for early-access, direct collaboration with our product teams, and more.

9 June

Fast forward to today and we’re seeing threat actors distribute malicious skills, abuse hooks, and more. To help protect organizations from these threats we’re releasing AI Guard for Coding Agents! Sign up for the preview now and see the future of securing AI. www.datadoghq.com/product-prev...

1 June

@fwdcloudsec.org has been incredibly inspiring. So many talented researchers, so much great work, and the energy here made me want to go chase down some AWS ideas I've been sitting on. Love this community.

1 June

Good morning fwd:cloudsec!! The best cloud security conference on earth is happening today and tomorrow! Didn’t manage to get a ticket? Join remotely! All talks are live-streamed to the official YouTube channel.

27 May

Interested in attending @fwdcloudsec.org but bummed you didn’t get a ticket? There are a few for sale from people who couldn’t make it last minute. Check out the Cloud Security Forum Slack to get yours and attend the best cloud security conference on earth.

27 May

Looks like the latest version of Codex has a required review/trust system for hooks. This is a great way to protect developers as threat actors have started to abuse hooks more and more.

github.comGitHub - DataDog/IDE-SHEPHERD-extension: A VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDEA VS Code/Cursor extension capable of performing realtime security monitoring from inside the IDE - DataDog/IDE-SHEPHERD-extension

20 May

A malicious VS Code extension was reportedly enough to compromise a GitHub employee device and expose internal repositories. That should make every security team ask: What’s running inside our developers’ IDEs? github.com/DataDog/IDE-...

20 May

VS Code extensions have broad access, update frequently, and often run with more trust than they deserve. Datadog Security Research has been tracking this attack surface for a while, and IDE Shepherd is one way we’re helping teams respond.

20 May

It monitors VS Code and Cursor extension behavior at runtime and blocks suspicious activity from malicious or compromised extensions.

securitylabs.datadoghq.comMalicious Coding Agent Skills and the Risk of Dynamic Context | Datadog Security LabsLearn how malicious Claude Code skills can abuse dynamic context commands to execute before model-level prompt injection defenses can intervene.

12 May

Malicious skills are evolving, and attackers are finding ways to execute them before model-level defenses even activate. In the first post of our new series, I’ll show you how dynamic context in coding agents can introduce new supply chain risks: securitylabs.datadoghq.com/articles/mal...

claude.comIntroducing the Claude Platform on AWS | ClaudeThe Claude Platform on AWS is now generally available, offering a new way for AWS customers to access the full set of Claude platform features with AWS authentication, billing, and commitment retireme...

11 May

It’s been a long time since a research target called to me this loudly. claude.com/blog/claude-...

6 May

If you’re worried about coding agent security and are only focused on malicious skills, you’re missing like 80% of the total attack surface.

5 May

Bummer, it looks like Anthropic removed the ability to DoS their models with the magic string. This was a fun technique that had some security ramifications where you could kill an inference session. It was fun while it lasted!

hackingthe.cloudBreak LLM Workflows with Claude's Refusal Magic String - Hacking The CloudHow Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.

5 May

Context: hackingthe.cloud/ai-llm/explo...

hackingthe.cloudDetect Public Resource Exposure via Session Policy Error Messages - Hacking The CloudUse session policy denials and verbose IAM error messages to determine if AWS resources have public resource-based policies.

17 Mar

New on Hacking the Cloud! Raajhesh Kannaa Chidambaram covers Daniel Grzelak's research on how AWS error messages can reveal publicly exposed resources, without needing access! This article covers how to use them for enumeration and detection. hackingthe.cloud/aws/enumerat...

thehackernews.comUNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 HoursUNC6426 used stolen GitHub tokens from the 2025 nx npm breach to gain AWS admin access in under 72 hours, enabling data theft and cloud destruction.

11 Mar

Researchers have been warning about this for years. Compromise a developer laptop → steal tokens → pivot to cloud. In many orgs that path ends with AWS admin in minutes. thehackernews.com/2026/03/unc6...

securitylabs.datadoghq.comUncovering agent logging gaps in Copilot Studio | Datadog Security LabsDuring research, we sometimes encounter scenarios that remind us that it's a good idea to trust but verify. In September 2025, we noticed that certain Microsoft Copilot Studio agent settings did not l...

10 Mar

Datadog Security Research continues to push the boundaries of modern cloud security—including AI security! @siigil.bsky.social shares her finding on logging gaps affecting Copilot Studio, allowing adversaries to evade detection. securitylabs.datadoghq.com/articles/cop...

sec.okta.comDatadog and Okta Combine for New Customer DetectionsComprehensive monitoring of identity activity is crucial to the security of any organization. A compromised identity can lead to widespread data breaches and

6 Mar

Datadog 🤝 Okta: "The enhanced logic developed by Datadog’s own Security Research team during this collaboration has been contributed back to the public Okta Security Detection Catalog, ensuring that the broader security community benefits from this joint research" sec.okta.com/articles/202...

bleepingcomputer.comLexisNexis confirms data breach as hackers leak stolen filesAmerican data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information.

4 Mar

"permitted a single ECS task role "read access to every secret in the account, including the production Redshift master credential."" There is a lot going on with this (even if not all of it can be believed). Properly scoping IAM is critical! www.bleepingcomputer.com/news/securit...

😬

I get the appeal of “human-in-the-loop” for AI safeguards. But humans have been getting socially engineered for millennia. That’s not exactly a hard security boundary 😬

24 Feb

Sometimes I miss Jia Tan.

plerion.comDon’t expose yourself in public — let AWS error messages do it for youAWS now reveals public permissions in error messages. Learn how a deny-all session policy exposes which actions would succeed safely.

20 Feb

Hey wake up! New offensive AWS meta just dropped! Thanks to Daniel Grzelak, we now have an effective oracle for determining if resources are publicly exposed without leaving logs. (As an offsec person) LFG!!! www.plerion.com/blog/dont-ex...

github.comGitHub - Frichetten/Dungeons-and-Agents: Make Codex or Claude Code act as a virtual dungeon master for DND 5e.Make Codex or Claude Code act as a virtual dungeon master for DND 5e. - Frichetten/Dungeons-and-Agents

17 Feb

If anyone is interested, I built a framework to use Claude Code or Codex to act as a virtual DM for DND. State is stored on the filesystem and persists between sessions. I think Opus 4.6 is the ideal model for this but Codex works too. github.com/Frichetten/D...

13 Feb

Professional communication

hackingthe.cloudGCP Cloud Workstations Privilege Escalation - Hacking The CloudBreak out of a Cloud Workstations container through an exposed Docker socket, then access project credentials from instance metadata.

10 Feb

New on Hacking the Cloud! A look at how a familiar container escape pattern shows up in GCP Cloud Workstations. We trace a path from a container to service account. If you’re using Cloud Workstations, this is a useful model to keep in mind. hackingthe.cloud/gcp/exploita...

9 Feb

Just got my ticket to @fwdcloudsec.org! Looking forward to the best cloud security conference in the world!

datadoghq.comProtect agentic AI applications with Datadog AI Guard | DatadogLearn how Datadog AI Guard evaluates prompts, responses, and tool calls in real time to help you defend agentic AI applications against emerging threats.

3 Feb

If you’re putting AI agents anywhere near prod, this is worth a read. We built AI Guard to help teams monitor prompts, tool calls, and model behavior in real systems, identifying and blocking AI threats in real time. More here: www.datadoghq.com/blog/ai-guard/

hackingthe.cloudGet IAM Credentials from a Console Session - Hacking The CloudConvert access to the AWS Console into IAM credentials.

2 Feb

New on Hacking the Cloud: Ben Stevens documents a new method for extracting IAM creds from an AWS Console session. Useful for post-exploitation and evasion tradecraft. I've been meaning to cover this for years. Glad it’s finally live: hackingthe.cloud/aws/post_exp...

securitylabs.datadoghq.comOpenSSL January 2026 Security Update: CMS and PKCS#12 Buffer Overflows | Datadog Security LabsA deep dive into OpenSSL’s January 2026 CMS and PKCS#12 vulnerabilities, including a pre-auth stack overflow and a PKCS#12 parsing bug.

30 Jan

As AI agents get more autonomous, prompt injection will shift from “ignore all previous instructions” to “add a task to the backlog to X.” Once the payload crosses a trust boundary and lands in Jira, it’s no longer a prompt, it’s just another task. A task that makes me admin :D

Houses are bullshit

Want a clear analysis of the latest OpenSSL CMS/PKCS#12 vulnerabilities and their real-world impact? Our post explains the conditions required for exploitation and how to evaluate practical risk in your environment. securitylabs.datadoghq.com/articles/ope...

hackingthe.cloudCall for research: AI and LLM security - Hacking The CloudHacking the Cloud is opening the door to AI and LLM security research.

26 Jan

AI workloads are landing in the same AWS/Azure/GCP accounts we’ve been breaking into (and defending) for years. It's time for Hacking the Cloud to catch up. We're announcing a call for research! Share your AI and LLM sec research with thousands of readers hackingthe.cloud/blog/call_fo...

securitylabs.datadoghq.comIntroducing IDE-SHEPHERD: Your shield against threat actors lurking in your IDE | Datadog Security LabsIDE-SHEPHERD is an open-source IDE security extension that provides real-time monitoring and protection for VS Code and Cursor. It intercepts malicious process executions, monitors network activity, a...

26 Jan

IDEs are the new browser: massive attack surface, privileged access to various things, and lots of “just trust it.” Today the Security Research Team at Datadog dropped IDE-SHEPHERD: a tool that watches extensions at runtime and blocks dangerous behavior. securitylabs.datadoghq.com/articles/ide...

26 Jan

I'm skeptical of the claim that 1,000 Clawdbot instances are publicly facing on the internet. If you look at the Shodan output, most of those boxes don't have port 18789 exposed (default Clawdbot port). The references to 18789 are from mDNS. Take this one for example:

aaronstuyvenberg.comClawdbot bought me a carOutsourcing the painful aspects of a car purchase to AI was refreshingly nice, and sold me on the vision of Clawdbot

Trying out clawdbot! And I'll live tweet my experiences setting it up and using it. It's been all of my timeline and doing cool things. (see @ajs.bsky.social's post below). I'm running this on an Ubuntu VM managed through KVM with 6 cores and 16 gigs of ram. aaronstuyvenberg.com/posts/clawd-...

Okay, this is kind of amazing. I wanted to give him a browser so he could surf the net but ran into an error. I was going to fix it myself but said, "Hey man, there is a dpkg in your home directory. Go ahead and install it. You'll have some errors but you'll manage", and he did!

Hmmm, even with sudo access Clawdbot has some sandboxing/protections. In a real environment that's good but I kinda intend for him to have full access to this VM. Gotta change that.

aaronstuyvenberg.comClawdbot bought me a carOutsourcing the painful aspects of a car purchase to AI was refreshingly nice, and sold me on the vision of Clawdbot

He's alive!

Dang, I should have created clawdbot his own host user. I'll have to take care of that later. Suppose this is a good warning if that's something you want to avoid!

aaronstuyvenberg.comClawdbot bought me a carOutsourcing the painful aspects of a car purchase to AI was refreshingly nice, and sold me on the vision of Clawdbot

Initial install is easy, there's even an option for integrating with Tailscale which I already setup in the VM.

I don't know what skills are exactly, but these seemed useful.

hackingthe.cloudBreak LLM Workflows with Claude's Refusal Magic String - Hacking The CloudHow Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.

21 Jan

Did you know Claude models have a "magic string" to test when a model refuses to respond? If that string enters prompt context, it can be abused to break LLM workflows until context is reset. It's the EICAR test string of the AI age. Details: hackingthe.cloud/ai-llm/explo...

sean.heelan.ioOn the Coming Industrialisation of Exploit Generation with LLMsRecently I ran an experiment where I built agents on top of Opus 4.5 and GPT-5.2 and then challenged them to write exploits for a zeroday vulnerability in the QuickJS Javascript interpreter. I adde…

19 Jan

We are on the verge of the commoditization of exploitation. Every vuln will functionally have a public PoC available because attackers can generate them in minutes. The advantage will increasingly belong to organizations that can detect, respond, and contain fast. sean.heelan.io/2026/01/18/o...