Case studyShadow Code: an AI built the backdoor. Another AI found it.
A critical stored SQL injection discovered inside four internal codebases published to a personal public repository.
Cylent Labs
What our agents found, and how they found it.
Case studies from live engagements, original research, and the intelligence we act on. Published as findings close.
Case study
Case studyOne pull request to own the supply chain
Two CI workflows trusted a stranger’s code with production secrets and package-publishing rights.
Case studyNo login required: a Grafana that hands out database credentials
An anonymous dashboard exposed a production connection and accepted unauthenticated SQL through its datasource proxy.
Cylent Labs archive
5 articles
Case studyShadow Code: an AI built the backdoor. Another AI found it.
From one company name to a critical stored SQL injection inside code nobody knew was public.
Case studyOne pull request to own the supply chain
How an untrusted pull request reached production secrets and package-publishing rights.
Case studyNo login required: a Grafana that hands out database credentials
A public dashboard became an unauthenticated proxy into its production database.
Case studyOne sign-up form away: anonymous to full recon
Four weaknesses chained from open registration to metadata theft and proprietary model exposure.
Case studyWe published the package they forgot to reserve
A benign public package began receiving callbacks from real machines within days.
No writing matched that search.
Try a broader term or choose “All writing” to reset the archive.
Back to top Published as findings close — no cadence, no newsletter