This is a repost of Damien's blog originally featured in his Substack, ABCbyD.
A while back I argued here that the scariest thing in your environment was never a tool, it was a person holding capability they had no business wielding, also known as Two dudes and a GPU. Now; the reality of agentic threat actors is here to stay (s/o Sysdig’s killer research here) and the past month’s developments in the AI world are too great for us to not take a look at in cyber.
The month of models…and minimal safeguards
July has been a firehose, especially in the open weights community. The release that should hold a defender’s attention lands on July 27, when Moonshot ships the full open weights for Kimi K3. The benchmarks put it a few points off Fable 5 and GPT-5.6, at a fraction of the price to run. Open weights, downloadable, yours to point at whatever you like…
Now that’s pretty awesome for the former Runescaper I am, but the network defender in me immediately sensed trouble. And my daily podcast rotation proved that right.
In its coverage of the release, the AI Daily Brief (huge fan and recommend a subscribe) surfaced testing from Signal showing K3 arrived with almost nothing in the way of guardrails, few refusals, little copyright pushback, and thin cyber safeguards underneath. In one documented chain of thought, the model looked at a piece of dangerous cyber work, judged that it looked risky, and then “decided ‘Yes’ to do it anyway.”
The caution was actually present, and that is the genuinely unsettling part. The model weighed the risk and went ahead regardless, which is a stranger failure than never having weighed it. Even where guardrails do exist, open weights turn them into a suggestion. You cannot patch a refusal back into a model that a million people already have on disk. Tuning the caution out of an open model is closer to a weekend hobby than a research effort.
This is already happening
If any of this reads as hypothetical, it stopped being hypothetical on July 1. Sysdig’s Threat Research Team published their work on JADEPUFFER, which they assess to be the first documented case of agentic ransomware. A large language model ran the whole operation, from initial access to database destruction, with the human role reduced to whatever it costs to keep an agent running.
The agent came in through an exposed service, harvested credentials across cloud providers at once, moved laterally into a production database, forged past a configuration service using a default key that had been public for years, then encrypted and dropped the data and left a ransom note behind. The individual techniques were old and unremarkable. What was new was the operator.
The tell lived in the payloads, which narrated themselves, thick with reasoning about which database was worth the most and why. That is commentary a human operator would never type out and a model produces by reflex. When a step failed, the agent diagnosed the real cause and shipped a corrected payload, in one case going from a failed login to a working fix in about thirty seconds. Read Sysdig’s write-up in full, because the details are worse than the summary: a model welded a pile of boring, decade-old techniques into a complete extortion campaign, and the skill it took to run fell to the cost of the tokens.
I have no appetite for the doom market, and this is not written to sell a panic. It is a fire drill before there is smoke in the stairwell, because right now the threat is both real and legible, and that combination will not last long. The early operators left their reasoning lying around for us to read, so we can see the initial access patterns and the behavioral tells while the technique is still young.
As network defenders we still have the advantage: we know our networks. An attacker has to come into your environment, touch your identities, and reach your data, and every one of those moves leaves a trace of intent. An agent leaves more of that trace than a human does, because it cannot stop narrating itself while it works.
What a K3 attack actually looks like
Now picture how this runs inside your own environment. Someone points a K3-derived agent at an exposed service, the way JADEPUFFER leaned on a vulnerable Langflow box. It lands, maps the host, and sweeps for secrets across API keys and cloud credentials in parallel, until it turns up a credential to something it was never meant to reach. From there it behaves like an authenticated user, because at that point it is one.
Once the agent is holding valid credentials, it stops looking like an attacker and starts looking like an ordinary Tuesday. The process tree says a legitimate tool spawned it. The calls carry a real token. The data it reaches is data that identity could already reach. By every traditional measure the activity is routine, which is the whole reason it clears the queue without anyone blinking.
The endpoint tells are sitting right there, once you know the layer to look at. Our detection team catalogued the forensic residue these tools leave in AI artifacts: an AI client spawning a shell that spawns an interpreter, code staged to a temp directory seconds before it runs, tool-call logs, MCP configs reaching external endpoints. An autonomous attack lives inside that residue, which means you have to hunt it before the incident, not go digging in the postmortem.
How you actually prepare
The last few months of our own research line up a little too neatly here, and yes, I run a company in this space, so weigh that accordingly. We can prepare by…
Treating the agent as an insider you authorized. The most dangerous identity in your environment might be a non-human one you handed credentials to yourself: insider access, nobody behind the wheel, and it never trips a rule because it is doing exactly what you allowed. Inventory your agents the way you inventory servers, and learn what a normal day looks like for each one. You cannot find weird if you do not know normal (I have said this enough times that my team is sick of hearing it).
Hunting behavior, not names: It is K3 this month, a distilled variant the next, some fine-tune nobody has named the month after. Anchor a detection to the string “kimi” and it is dead by the weekend. What lasts is the shape: the process lineage, credential access reaching out from a subprocess rather than a person, the sequence that only makes sense if a machine is driving. Names change. Chains don’t.
…and resist the reflex that the answer is always a bigger model: Don’t forget about ML/heurisitcs…our team spots the signature of AI automation with a classical, deterministic model rather than an LLM, because we want results we can reproduce, explain, and afford, and because it flags tools we have never seen by how they behave. Fighting an agent does not mean bolting an agent onto everything you own. It means knowing normal so well that the abnormal has nowhere to sit.
The countdown
So when do we actually need to be ready for this? Bad news/good news…because there is a hard date on the calendar. The weights land on July 27, and as I write this that is a little over a week out.
Before anyone pictures someone running a frontier model off a gaming rig, let me set expectations. K3 is a 2.8 trillion parameter model, the largest open-weight release anyone has announced, and even an aggressively quantized build needs 650GB to a terabyte of memory to run, past every consumer ceiling on the market including a maxed-out Mac Studio. Nobody runs the full thing at home on day one. The realistic path for most people is the hosted API, which went live this month at about three dollars per million input tokens: cheap, quick, and notably light on guardrails.
So the 27th does not close the window, rather it’s the start of something. Open weights turn the 2.8T model into a teacher: community quantizations within days, distilled variants within weeks, small enough to run on hardware people already own. The version nobody can run at home becomes the training source for the ones they can. So the guardrail-light capability is a click away through the API today, and the run-it-yourself version arrives in pieces over the weeks that follow. Neither one is going to wait until you are ready.
Diffusion sets the countdown. You do not need this fully handled by the 27th, you need to have started before the weights land. The teams that come out fine will be the ones who spent these weeks inventorying their agents, baselining their environments, and standing up hunts for autonomous behavior while the technique is still legible and rare. The ones who wait for the first K3-driven incident to hit the queue will be learning all of it live, in production, on the worst possible day for it.
The thesis hasn’t moved
None of this changes the argument I have been making on this newsletter for the better part of two years. You were never really hunting a tool, and you are not hunting Kimi now. You are hunting capability in the wrong hands, and the wrong hands just picked up a frontier-class model for the price of a download.
The point of watching agentic adversaries this closely was always to put teams in a position to meet them, not to stand around admiring the problem. That has been the through-line here since before there was a single documented case to point at, which is why the 27th reads as a starting line rather than a scare. The defenders who spent this window preparing are not the ones who get caught flat when it arrives at scale.
That is not a reason to panic, it is a reason to go hunt, starting before the 27th rather than after. The month of models is genuinely exciting. Just remember that the fleet it launched sails in both directions.
Stay secure and stay curious, my friends.
Damien
.webp)
.webp)
