forensic analysis

Security incident disclosure – July 2026

2 months ago

Unauthorized access to internal datasets and credentials occurred, with ongoing assessment of potential impact on partners and customers.
The intrusion exploited vulnerabilities in the data-processing pipeline via a malicious dataset, leading to node-level access and lateral movement within internal clusters.
An autonomous agent framework executed thousands of actions across sandboxes, matching industry-predicted 'agentic attacker' scenarios.
Response actions included fixing vulnerabilities, eradicating footholds, rotating credentials, deploying additional controls, and collaborating with cybersecurity specialists and law enforcement.
AI-assisted detection and LLM-driven analysis were used to quickly reconstruct the attack timeline and identify indicators of compromise, reducing analysis time from days to hours.
A challenge arose as commercial model safety guardrails blocked forensic analysis of attack data, leading to the use of an open-weight model (GLM 5.2) on internal infrastructure to avoid data exposure.
The incident highlights the reality of AI-driven offensive tooling, emphasizing the need for defenders to have self-hosted models ready to avoid guardrail lockouts and protect sensitive data.
Recommendations for the community include rotating access tokens and reviewing account activity, with contact provided for security concerns.