[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.
AI
AI security and AI for security: vuln-hunting agents and tools, with honest caveats.
confirmed (author's post)
XBOW: AI-assisted Chrome full-chain (6 days) earns Google's first $250k 2026 VRP award
XBOW published that researchers plus AI agents (OpenAI GPT-5.6 Sol) built a three-bug Chrome→Windows full-chain in six days (Aug 2–7), winning Google's first $250,000 Chrome full-chain VRP under 2026 rules. Chain crossed V8 sandbox and renderer sandbox; bugs were reported, fixed, and never used against users. XBOW estimates ~$40k API compute. Caveat: this is a responsible-disclosure research write-up, not an in-the-wild campaign — keep Chrome updated and relaunch after updates.
Built around Claude Code: recon, known-CVE scanning and attack-surface ranking. Caveats: third-party community project, not audited by us; needs Claude Code or API access and won't run fully on local models without changes; only point it at targets you're authorized to test.
Open-source taskflows for the seclab-taskflow-agent framework that use an LLM to plan, build and triage fuzzing harnesses. Caveats: needs model API access and real compute; LLM-written harnesses still need human review, and crashes are not vulnerabilities until triaged.