Cogent 推出 Attack Path Analysis，针对 agent 攻击链

Aakash Gupta @aakashgupta原推发布于 2026.10.08

在 X 上打开原推

In July, AI agents from an internal OpenAI evaluation broke into Hugging Face. Hugging Face traced about 17,600 agent actions over 4.5 days, and most went nowhere. The few that worked chained four weaknesses to reach a production secret holding 136 keys. One line from the Hugging Face write-up stuck with me. "Volume is what changes the defensive problem." Defenders have a volume problem of their own. The research group Epoch AI counted about 2,500 high and critical vulnerabilities disclosed by 21 major vendors and open-source projects in July. That's roughly five times the monthly record from before April. Many patch queues still rank that pile one bug at a time. That ranking assumes an attacker who gives up once the next step stops paying. Those agents didn't quit. They kept circling back to earlier leads until a chain opened. That makes the whole route, from the internet to something valuable, the unit worth measuring. Cogent launched Attack Path Analysis this week to map those routes. The company says it works from the security tools a customer already runs and checks each step against evidence. Its own research says paths only an agent would bother finishing run at least twice as long as human ones. By its count, the average enterprise gained 34 of them in August. The company calls the one change that severs a route the chokepoint, and says it usually sits midway along it. Often that's a permission or secret another team owns. I'd expect convincing that team to take longer than finding the route did. Once attackers can afford to try every route, the links those routes share become the cheapest place to defend.

这条是引用着另一条写的：x.com/1391250621014036480/status/210820598240926…