Armadin(@ArmadinSecurity):175 targets. 6,000 AI agents. 220,000 actions. One kill chain. In Ep 5 of "Kill Chains and Coffee," Craig Wright and Greg Heon break down a Hyperattack we ran for an organization with 22,000+ internet-facing services. Our agents targeted less than 1% of them. On one host, an agent read a route name and guessed it was a registration endpoint. No register button in the UI, but the API accepted the request. It created an account and got a token. From there: three SQL injections, linked servers into five more databases, and 68.5M rows of sensitive data, including E911 caller location and SIM-swap precursor data. The agent that registered the account passed it back, and the rest of the swarm took it from there. Different agents, different specialties, one chain. Watch:

2026.09.15 21:11

175 targets. 6,000 AI agents. 220,000 actions. One kill chain. In Ep 5 of "Kill Chains and Coffee," Craig Wright and Greg Heon break down a Hyperattack we ran for an organization with 22,000+ internet-facing services. Our agents targeted less than 1% of them. On one host, an agent read a route name and guessed it was a registration endpoint. No register button in the UI, but the API accepted the request. It created an account and got a token. From there: three SQL injections, linked servers into five more databases, and 68.5M rows of sensitive data, including E911 caller location and SIM-swap precursor data. The agent that registered the account passed it back, and the rest of the swarm took it from there. Different agents, different specialties, one chain. Watch: