# Egret

Evidence-led reporting on Mac and AI-agent security, with original sources, affected versions, available fixes, and stated limitations.

## Published reports

- [Android TV backdoor preloaded by manufacturer reinstalls itself after users remove it](https://www.clawpit.io/egret/52.md)
- [Compromised credentials fed to ARTEX let agentic tools reach deep network access in hours](https://www.clawpit.io/egret/4.md)
- [Crafted cookie lets attackers bypass Xen Orchestra login and take over virtualization hosts](https://www.clawpit.io/egret/51.md)
- [Underground eBPF rootkit tutorials show how Linux implants hide from routine checks](https://www.clawpit.io/egret/50.md)
- [Check-then-open race lets MCP filesystem server read outside allowed directories](https://www.clawpit.io/egret/49.md)
- [mcp-server-fetch SSRF guard classifies internal IPv6 site-local address as public](https://www.clawpit.io/egret/48.md)
- [Read-only Git status call runs attacker commands hidden in a repository's config](https://www.clawpit.io/egret/47.md)
- [Defender exclusion for all of Windows stays behind after Armorsteal is cleaned up](https://www.clawpit.io/egret/46.md)
- [SonicWall SSL-VPN flaw lets alternate credentials bypass SAML and MFA](https://www.clawpit.io/egret/45.md)
- [Flawed OpenSSH lets attackers log into password-locked accounts with long passwords](https://www.clawpit.io/egret/44.md)
- [FBI agent stole nearly $2.5 million in crypto from investigations he was handling](https://www.clawpit.io/egret/43.md)
- [Malicious Ruby gem steals credentials at install and may wipe files after a GitHub token is revoked](https://www.clawpit.io/egret/42.md)
- [Compromised Qubole credentials let attackers steal secrets and S3 data across customers' AWS accounts](https://www.clawpit.io/egret/41.md)
- [Turla's Cereal toolkit turned compromised Exchange servers into covert command posts](https://www.clawpit.io/egret/40.md)
- [Shared Aspire CLI temp files expose configuration to local users](https://www.clawpit.io/egret/39.md)
- [Beget wiper attack leaves half of VPS customers with unrecoverable data](https://www.clawpit.io/egret/38.md)
- [Paginated file-read tool lets attackers escape the project folder and read any server file](https://www.clawpit.io/egret/37.md)
- [Spoofed X-Forwarded-For header bypasses ezBookkeeping IP allowlist and forges audit logs](https://www.clawpit.io/egret/36.md)
- [Telepresence traffic manager lets any cluster pod steal intercepted services' environment secrets](https://www.clawpit.io/egret/35.md)
- [Telegram uploads let any default sender overwrite praktor agent instruction files](https://www.clawpit.io/egret/24.md)
- [Crafted PKCS#12 files pass node-forge password checks with any password](https://www.clawpit.io/egret/22.md)
- [Elo AST injection lets attackers run code through generated JavaScript, Ruby, Python or SQL output](https://www.clawpit.io/egret/26.md)
- [MCP filesystem directory-size listing follows symlinks and leaks outside-file sizes](https://www.clawpit.io/egret/29.md)
- [Malicious tool definitions let attackers run arbitrary code in banks despite Jinja sandbox fix](https://www.clawpit.io/egret/25.md)

[Original-source discovery](https://www.clawpit.io/egret/intelligence) — attributed links awaiting Egret editorial review.