{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "988",
  "slug": "attack-surface-moves-below-model",
  "edition": "2026-11-03T00",
  "url": "https://hangingcontext.com/stories/2026-11-03/attack-surface-moves-below-model/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "The weeks security news sits below the model, in browsers, endpoints, kernels and botnets.",
  "headline": "Below the model: browsers, agent machines, kernels and botnets set the security agenda",
  "dek": "Perplexity measured browser-agent injection defenses, SentinelOne moved into agent virtual machines, a Linux kernel flaw earned a 9.8 rating, and a botnet takedown reached millions of set-top boxes.",
  "published_at": "2026-11-03T01:05:04Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 4 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "aikido-security-blog",
    "perplexity-research",
    "plume-design",
    "sentinelone-ir-press-releases"
  ],
  "sources": [
    "aikido-security-blog",
    "perplexity-research",
    "plume-design",
    "sentinelone-ir-press-releases"
  ],
  "distinct_source_count": 4,
  "key_facts": [
    {
      "text": "Perplexity says its BrowseSafe-Guard detectors score 94.84 percent F1 on the BrowseSafe++ benchmark, using 0.8 billion parameters.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793652334781935380",
          "claim_ids": [
            "1793652611532634366",
            "1793652611530721067"
          ]
        }
      ]
    },
    {
      "text": "Perplexity says adaptive attacks bypassed defenses in up to 95 percent of tasks tested through BrowseSafe-Adapt.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793652334781935380",
          "claim_ids": [
            "1793652611536403515"
          ]
        }
      ]
    },
    {
      "text": "The X.CPE botnet infected more than 1.3 million set-top boxes across 200 countries, according to TrendAI research reported by Plume.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793633365422056711",
          "claim_ids": [
            "1793633622533221941"
          ]
        }
      ]
    },
    {
      "text": "CVE-2026-98432, a Linux kernel TCP flaw affecting kernel 4.4 and later, is rated 9.8 out of 10 by the Linux kernel CVE team.",
      "self_reported": false,
      "cites": [
        {
          "manifest_id": "1793629228082688229",
          "claim_ids": [
            "1793629431030027205",
            "1793629431027788930"
          ]
        }
      ]
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The browser is the new front door",
      "paragraphs": [
        {
          "markdown": "This week, the most consequential security news for AI teams sits below the model: in the browser where agents act, in the virtual machine where an agent coworker runs, in the kernel underneath servers, and in set-top boxes conscripted into a botnet. None of the four items is about a model leaking a secret or refusing a prompt. Each is about the layer an agent or an attacker touches first, and that is where the risk now concentrates.",
          "cites": [
            {
              "manifest_id": "1793652334781935380",
              "claim_ids": [
                "1793652611527585035"
              ]
            },
            {
              "manifest_id": "1793665128941418730",
              "claim_ids": [
                "1793665486662918991"
              ]
            },
            {
              "manifest_id": "1793629228082688229",
              "claim_ids": [
                "1793629431027788930"
              ]
            },
            {
              "manifest_id": "1793633365422056711",
              "claim_ids": [
                "1793633622521739936"
              ]
            }
          ]
        },
        {
          "markdown": "Perplexity reports that browser agents are susceptible to indirect prompt injection, where attackers place malicious text on webpages to hijack agent actions. To measure the problem, the company built BrowseSafe++, a benchmark of 38,675 attacked and clean page pairs drawn from real-world prompt injections. Its BrowseSafe-Guard detectors use 0.8 billion parameters and, the company says, outperform frontier models in accuracy, speed, and cost, reaching a 94.84 percent F1 score on the benchmark at a cost of about 0.18 dollars per 1,000 pages on rented H200 hardware.",
          "cites": [
            {
              "manifest_id": "1793652334781935380",
              "claim_ids": [
                "1793652611527585035",
                "1793652611529936880",
                "1793652611530721067",
                "1793652611532634366",
                "1793652611538378775"
              ]
            }
          ]
        },
        {
          "markdown": "The more important finding is that detection does not guarantee resistance. Perplexity reports that models often follow injections they have already flagged, and that adaptive attacks tested through BrowseSafe-Adapt bypassed defenses in up to 95 percent of tasks. More than 40 percent of injections in the benchmark push the agent toward an unauthorized action, about 24.4 percent use a language different from the rest of the page, and only about 3 percent attempt to plant false information in the answer. The implication, in the company research, is that detection models alone do not guarantee agent resistance, and layered defenses are needed.",
          "cites": [
            {
              "manifest_id": "1793652334781935380",
              "claim_ids": [
                "1793652611534984220",
                "1793652611536403515",
                "1793652611541185682",
                "1793652611539661855",
                "1793652611542849313"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Agents inside virtual machines get watched",
      "paragraphs": [
        {
          "markdown": "SentinelOne announced an integration with Anthropic Claude Cowork that places a SentinelOne agent inside the Claude Cowork virtual machine, across macOS and Windows devices, enabled by IT teams through device management. The company says security teams can autonomously stop attacks using the same runtime detection and response it already runs across endpoints. The company also says it protects nearly one-fifth of the Fortune 500, and it recently unveiled its Singularity Agentic Detection and Response product at OneCon 2026.",
          "cites": [
            {
              "manifest_id": "1793665128941418730",
              "claim_ids": [
                "1793665486662918991",
                "1793665486664192034",
                "1793665486666450846",
                "1793665486669504352",
                "1793665486675582687",
                "1793665486672327592",
                "1793665486671762969"
              ]
            }
          ]
        },
        {
          "markdown": "The company frames the gap as a blind spot: agentic activity occurs in ways that standard device security software cannot see. Whether that framing holds for a given deployment depends on how the organization already monitors virtual machines, but the direction is clear. Agent work is moving into managed machines, and vendors are now competing to watch it there rather than treating the agent as an ordinary application.",
          "cites": [
            {
              "manifest_id": "1793665128941418730",
              "claim_ids": [
                "1793665486664192034",
                "1793665486675582687"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "The kernel and the botnet underneath",
      "paragraphs": [
        {
          "markdown": "Aikido reports a critical Linux kernel flaw, CVE-2026-98432, in IPv4 TCP connection setup, present in kernel 4.4 and later. The Linux kernel CVE team rates it 9.8 out of 10. The flaw is a use-after-free condition in ip_options_build during TCP handshakes, and Aikido reports that it allows unauthenticated remote attackers to gain root access on Linux servers with an MPTCP listener. Aikido also reports that an unreleased Claude research model wrote an exploit for the flaw. Installing a patched kernel and rebooting is the only complete remediation, according to Aikido, while disabling MPTCP by setting net.mptcp.enabled to 0 can reduce exposure. As of 29 October 2026, no vendor advisory reported attacks in the wild for the flaw.",
          "cites": [
            {
              "manifest_id": "1793629228082688229",
              "claim_ids": [
                "1793629431027788930",
                "1793629431030027205",
                "1793629431040701537",
                "1793629431032447206",
                "1793629431034056849",
                "1793629431045609862",
                "1793629431038070140"
              ]
            }
          ]
        },
        {
          "markdown": "Plume reports that a coalition of private and public sector partners, led by Google, dismantled the X.CPE botnet, which was embedded in device firmware before set-top boxes reached subscribers homes. TrendAI research identified more than 1.3 million affected devices across 200 countries, and the takedown of command-and-control domains is expected to sever access to at least 10 million additional compromised devices. The botnet generated revenue through residential proxy services, ad fraud, and unauthorized bandwidth reselling, using subscribers home internet connections without their knowledge or consent. The operation included participation from Japan National Police Agency, and Google has updated its review process and banned the responsible manufacturer from producing devices with preloaded Google apps.",
          "cites": [
            {
              "manifest_id": "1793633365422056711",
              "claim_ids": [
                "1793633622521739936",
                "1793633622524227039",
                "1793633622533221941",
                "1793633622527089437",
                "1793633622529398590",
                "1793633622530567369",
                "1793633622532500582",
                "1793633622526597426"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "What executives should take from this",
      "paragraphs": [
        {
          "markdown": "Read together, the four items argue for treating agent infrastructure as ordinary infrastructure with an attacker attached. Browser agents need defenses beyond a detector, because flagged injections still get followed. Agent virtual machines need endpoint-style monitoring, because that is where agent work now happens. Kernels need patching and reboots, because mitigation settings only reduce exposure. And consumer hardware in the fleet cannot be assumed clean, because compromise can arrive pre-installed in firmware. None of that is a model problem, and none of it is solved by a better prompt.",
          "cites": [
            {
              "manifest_id": "1793652334781935380",
              "claim_ids": [
                "1793652611534984220"
              ]
            },
            {
              "manifest_id": "1793665128941418730",
              "claim_ids": [
                "1793665486675582687"
              ]
            },
            {
              "manifest_id": "1793629228082688229",
              "claim_ids": [
                "1793629431034056849",
                "1793629431045609862"
              ]
            },
            {
              "manifest_id": "1793633365422056711",
              "claim_ids": [
                "1793633622524227039"
              ]
            }
          ]
        }
      ]
    }
  ],
  "unresolved": [
    "Whether layered defenses beyond detection can bring adaptive attack success rates down in practice, since BrowseSafe-Adapt bypassed defenses in up to 95 percent of tasks.",
    "Whether agent activity inside virtual machines is visible to existing endpoint tooling outside the SentinelOne integration.",
    "Whether CVE-2026-98432 moves from proof-of-concept exploitation to attacks in the wild, since none were reported as of 29 October 2026.",
    "How many of the additional devices tied to the X.CPE takedown were actively compromised, since the 10 million figure is an expected severance estimate."
  ],
  "decision_card": {
    "useful_for": [
      "Executives deciding where agent security budgets go",
      "Teams deploying browser agents or agent coworkers",
      "Teams responsible for Linux server patching"
    ],
    "not_for": [
      "Model-level safety evaluations, which these items do not cover",
      "Assuming a detector alone secures a browser agent"
    ],
    "compare_against": [
      "Detection-only defenses for browser agents",
      "Standard endpoint monitoring for virtual machines",
      "Mitigation settings versus patched kernels with reboots"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-03T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1793652334781935380",
    "1793633365422056711",
    "1793629228082688229",
    "1793665128941418730"
  ],
  "manifests": [
    {
      "manifest_id": "1793652334781935380",
      "title": "Building stronger defenses for real-world prompt injection",
      "source_name": "perplexity-research",
      "source_url": "https://perplexity.ai/hub/blog/browsesafe-plus-plus",
      "published_date": "2026-11-02"
    },
    {
      "manifest_id": "1793633365422056711",
      "title": "Google Leads Industry Takedown of Botnet Hidden in More Than 1.3 Million Set-Top Boxes across 200 Countries",
      "source_name": "plume-design",
      "source_url": "https://plume.com/newsroom/google-leads-industry-takedown-of-botnet-hidden-in-more-than-1-3-million-set-top-boxes-across-200-countries",
      "published_date": "2026-11-02"
    },
    {
      "manifest_id": "1793629228082688229",
      "title": "Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)",
      "source_name": "aikido-security-blog",
      "source_url": "https://aikido.dev/blog/linux-kernel-tcp-rce-vulnerability-cve-2026-98432",
      "published_date": "2026-11-02"
    },
    {
      "manifest_id": "1793665128941418730",
      "title": "SentinelOne Expands AI Security Coverage to Claude Cowork",
      "source_name": "sentinelone-ir-press-releases",
      "source_url": "https://investors.sentinelone.com/press-releases/news-details/2026/SentinelOne-Expands-AI-Security-Coverage-to-Claude-Cowork/default.aspx",
      "published_date": "2026-11-02"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1793652334781935380",
      "1793633365422056711",
      "1793629228082688229",
      "1793665128941418730"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1793652334781935380",
      "all": "for id in 1793652334781935380 1793633365422056711 1793629228082688229 1793665128941418730; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-03/attack-surface-moves-below-model/",
    "json": "https://hangingcontext.com/stories/2026-11-03/attack-surface-moves-below-model/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-03/attack-surface-moves-below-model/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-03T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-02/securing-agents-becomes-a-layer/",
      "headline": "Securing agents is becoming a layer of its own: gates inside models, shields on web apps, and attackers that adapt",
      "slug": "securing-agents-becomes-a-layer"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-01/earth-observation-gets-agents/",
      "headline": "Earth observation is getting an agent layer that picks what to watch",
      "slug": "earth-observation-gets-agents"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-01/ai-infrastructure-bill-comes-due/",
      "headline": "AI spending advances, chip stocks retreat, and the plumbing strains",
      "slug": "ai-infrastructure-bill-comes-due"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-31/voice-is-the-front-door-for-agents/",
      "headline": "Voice is the front door for agents: 1.88 million calls checked, 6% flagged, and the contact center reorganizes",
      "slug": "voice-is-the-front-door-for-agents"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Claims with a source link",
    "text": "A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it.",
    "cta": {
      "label": "Read the guide",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-03/attack-surface-moves-below-model/"
  }
}