Tag: excessive-agency

All the articles with the tag "excessive-agency".

• Lakera Agent Breaker: Thingularity — Tool Recon 101

  13 Jul, 2026

  First level of Lakera's Agent Breaker (the spiritual sequel to Gandalf) targets a full agent setup instead of a single LLM. Enumeration is still step one: get the agent to disclose its own tools, parameters, and endpoints before touching any of them.

• HTB Crocodile — The Credential Chain

  9 May, 2026

  HackTheBox Crocodile chains anonymous FTP credential disclosure into a hidden web admin login. Same structural failure shows up in agentic systems when leaked API keys legitimately authenticate into production tool-use endpoints.

• HTB Sequel — Blank Root on MariaDB

  9 May, 2026

  HackTheBox Sequel exploits a MariaDB instance bound to the public interface with a blank-password root account. Same structural failure as agentic systems wired with admin-level API tokens that any caller can trigger.