TL;DR Sec #347: Autonomous AI Attacks, GitHub Threat Hunting, and LLM Gadget Discovery

Issue #347 of the tl;dr sec newsletter highlights threat actors using open-source AI agent harnesses to autonomously attack companies for around $25 per target. It also covers techniques for threat hunting via GitHub logs and using LLMs to discover novel Java deserialization gadgets. The drastically reduced cost of running autonomous AI agent attacks demonstrates that offensive AI is becoming a practical threat for low-cost, high-scale cybercrime. Meanwhile, leveraging LLMs to discover gadget chains shows how generative AI is rapidly reshaping automated vulnerability research. In one cited campaign, an attacker ran three open-source AI harnesses nearly unattended against hundreds of online retailers to breach them at minimal expense. In vulnerability research, security engineers are utilizing LLMs to systematically construct complex Java deserialization payload chains that previously required extensive manual analysis.