Behk

This was one of the more interesting stories we covered this week. Millions of Pokémon GO players contributed scan data to improve an AR game. Years later, that data is part of a conversation about AI-powered nav and military applications. Full ep: bfx.social/4evx6V6

What are Red Team Arts & Crafts? Honestly, it can be a pretty important part of a successful red team engagement! @BrandonKovacs on how a bit of craftiness saved the day on one of his. From our recent Red Team special episode of Initial Access: bfx.social/4gtmEi3

This Strapi bug is a great example of how small trust-boundary mistakes become major security problems. Full writeup: bfx.social/4ehHUGd

Heading to @BSidesSATX next weekend? The Bishop Fox team will be there and we’d love to connect. Come talk offensive security, AI, Red Teaming, research, career growth, or whatever interesting problem you’re working on.

Now cloud infrastructure, SaaS platforms, IAM, and CI/CD pipelines can all play a role in an attack path to the CDE. Derek Rush breaks down how Bishop Fox approaches modern PCI internal penetration testing. bfx.social/44f8c5V

What happens when the attacker succeeds anyway? @AletheDenis explores why social engineering is ultimately a control design problem and why awareness training alone isn’t enough. Now available on demand: bfx.social/3SsZIFJ

Researchers built an AI-powered worm that compromised nearly 75% of a simulated corporate network. Shad Malloy’s response? The real world is weird. Jackie from Accounting might be a stronger defense than people realize. Full ep: bfx.social/4vkXDdI

New research from David Colón and Shad Malloy explores how they built a Sparkplug B fuzzer covering all 9 message types, all 19 data types, and 87+ protocol field paths with some help from AI. bfx.social/3SgAJ8A

Do red teamers need to know how to code? Leron Gray tackles that question in the latest Red Team episode of Initial Access. And in the age of AI-assisted development, the answer may be changing. Full episode: bfx.social/4gpfjjy

The newest episode of Initial Access is all about Red Teaming! Our consultants share stories about some of the wildest engagements they've ever been on, like this one. Full episode: bfx.social/4aRbLmu

AI upends the idea that systems have fixed roles. Managing Senior Consultant Shad Malloy on why traditional threat modeling starts to fall apart with agentic AI and how frameworks like MAESTRO help fill the gap. His advice: bfx.social/4tVm6ov

Tony West shares what it was actually like building Joro with AI-assisted development, including where the models helped and where they completely hallucinated integrations. Full story: bfx.social/4wYfZ5w

We turned a vulnerable AI support agent into a CTF. Welcome to MCP security: bfx.social/4tKYuTn

MCP is basically RBAC for AI agents. But most teams aren’t treating it that way yet.