Thinkst Q1 2026 Review Highlights Browser Phishing, AI Agent Risks and Exploit Proliferation
Summary
Thinkst’s Q1 2026 review surveys browser deception, AI-assisted vulnerability discovery, agent compromise and cloud configuration risks. AI featured in over 33% of reviewed talks, up from 11% the previous quarter.
Key points
- The review covers January–March 2026 research drawn from more than 1,100 blog posts and 1,606 conference talks and papers.
- Browser phishing research combined full-screen mode, a looping WebGL shader and keyboard locking to conceal browser warnings and imitate an operating-system unlock screen.
- The report highlights researchers’ claims of improving LLM vulnerability-discovery capabilities while warning that limited reproducibility and increased triage demands complicate assessment and remediation.
- Agent research demonstrated risks from invisible Unicode instructions in skills and familiar code patterns that mislead LLM analysis; separating task planning from untrusted data offers protection but still faces bypasses.
- A researcher’s claudleak scan found committed secrets in over 2% of sampled public repositories, highlighting exposure through Claude-specific configuration files and persistent Git history.
- AWS console and Terraform defaults can diverge on encryption, Lambda invocation permissions and IAM password requirements; the review recommends policy enforcement, configuration analysis and secure templates.
- The Coruna iOS kit contained five exploit chains spanning 23 exploits. The report describes its observed use across surveillance, watering-hole and cryptocurrency-targeting activity, and notes that Lockdown Mode was effective against the attacks.
Article Details
- Publisher
- Thinkst
- Report Period
- 2026-01-01 to 2026-03-31
- Scope
- Selected security research published or presented during Q1 2026, covering browser abuse, LLM security, cloud defenses, infrastructure configuration, and exploitation.
- Sample Size
- More than 1,100 blog posts and 1,606 conference talks and papers.
- Key Statistics
- Over 33% of reviewed talks involved AI, compared with 11% in the previous quarter.
- The AgentRx research reported approximately 23% better performance than existing tools at identifying agent failure root causes; the report does not specify the evaluation population.
- Niels Hofmans found committed secrets in over 2% of a sample of public repositories; the sample size was not provided.
- Coruna contained five iOS exploit chains encompassing 23 exploits, targeting iOS 13 through 17.2.1.
- Recommendations
- Maintain least privilege, rapid patching, network segmentation, ephemeral credentials, and assume-breach detection practices.
- Separate agent task planning from untrusted task data where feasible.
- Exclude sensitive tool-specific configuration directories from source control.
- Obtain agent skills only from trustworthy sources and maintain internal copies rather than referencing mutable online versions.
- Audit infrastructure-as-code configurations, enforce organization-wide cloud policies, and provide secure internal configuration templates.
MITRE ATT&CK
People
Alexander HurbeanDisclosed a phishing technique combining browser full-screen mode, a WebGL-induced UI freeze, keyboard locking, and CSS-based impersonation of an operating-system unlock screen.Dan GuidoPresented organizational changes used to integrate AI into Trail of Bits workflows.Ilia ShumailovPresented task-data separation for agents and a cookie-notice impersonation attack against segregated planning architectures.Laurence TennantDocumented security-default differences between resources created through the AWS console and Terraform.Lyra RebanePresented CSS and SVG research demonstrating information leakage, content exfiltration, and complex clickjacking.Nicholas CarliniAnthropic research scientist who presented examples of Claude finding and exploiting vulnerabilities in Ghost CMS and Linux kernel NFSv4 code.Niels HofmansDeveloped claudleak after accidentally committing secrets in a Claude-specific configuration file.Petrus VaseniusDemonstrated Azure data honeytokens monitored through Purview and connected to Sentinel for incident creation.Sean HeelanAnalyzed improving LLM exploit-generation capabilities and their implications for vulnerability triage and remediation.wunderwuzziDemonstrated malicious agent skills containing invisible Unicode instructions or prompt injections.
Vendors
Amazon Web Services- [The AWS Console and Terraform Security Gap](#the-aws-console-and-terraform-security-gap)AnthropicThis speaker is a research scientist at Anthropic, and the overarching thrust of his research is to see what bad things can be done with language models, in order to make them safer.Apple- The top-end of exploitation against the most hardened platform is impressive, hands down. With all Apple’s work on security, the top-tier exploitation teams can still maintain exploit chains that work on uninterruptedMicrosoftThis talk created data honeytokens in Azure by using Microsoft’s Purview data governance tool to monitor honeytoken accesses.
Products
AzureThis talk created data honeytokens in Azure by using Microsoft’s Purview data governance tool to monitor honeytoken accesses.ClaudeAs evidence he pointed to example bugs that Claude had found and exploited, including a remotely exploitable blind SQL-injection vulnerability in Ghost CMS that had been lying around for five years, and a remote LinuxClaude Codeprevent secrets from being added to the repository and pushed, LLM-assisted development tools (e.g., Claude Code) create new directories to store their configuration.Firefox NightlyFirefox Nightly includes the client-side verification logic as a way to slowly roll out this technology to browsers.Ghost CMSClaude had found and exploited, including a remotely exploitable blind SQL-injection vulnerability in Ghost CMS that had been lying around for five years, and a remote Linux kernel bug in the NFSv4 code that wasiOS- [Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit](#coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit)Linux kernelblind SQL-injection vulnerability in Ghost CMS that had been lying around for five years, and a remote Linux kernel bug in the NFSv4 code that was introduced 22 years ago.Microsoft PurviewThis talk created data honeytokens in Azure by using Microsoft’s Purview data governance tool to monitor honeytoken accesses.Microsoft SentinelBy connecting Purview to Sentinel, SIEM incidents would be created for any access.Terraform- [The AWS Console and Terraform Security Gap](#the-aws-console-and-terraform-security-gap)
Tools
AgentRx- [Systematic debugging for AI agents: Introducing the AgentRx framework](#systematic-debugging-for-ai-agents-introducing-the-agentrx-framework)claudleakThe author suspected they were not the only one to mistakenly commit secrets from these sources, and wrote a tool, claudleak, to automatically search and validate any findings.Coruna- [Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit](#coruna-the-mysterious-journey-of-a-powerful-ios-exploit-kit)