Fezz Audio is not some boutique tube brand trying to sell Americans a misty-eyed postcard from Eastern Europe. Designed and manufactured in Poland, the new Fezz Audio Luna Integrated Amplifier arrives in the U.S. through Bluebird Music Distribution as part of a much bigger story: the rise of serious Polish and Eastern European hi-fi brands that are no longer asking for a seat at the table. They’re building the table, wiring it properly, and probably using better transformers while they’re at it.

The Luna is a modern EL34-based tube integrated amplifier with selectable Ultralinear and Triode modes, modular expansion options, HT and Sub Out connectivity, and remote control support; which is not exactly your uncle’s dusty tube amp that needs three candles, a prayer, and a forgiving loudspeaker to behave. It is now shipping in the U.S. at $3,495, which puts Fezz Audio in a very interesting position for listeners who want real tube amplification with modern system flexibility, without pretending that 1962 was the peak of civilization — although it was a very good year for music and cinema.

The Luna is available in Big Calm, Black Ice, Burning Red, EverGreen, Moonlight, Republika, and Sunlight finishes, and several of them are far more striking in person than the spec sheet suggests. EIC Ian White has seen some of Fezz’s finishes firsthand, and apparently nobody in Poland got the memo that former Soviet Bloc colors were supposed to be drab, beige, and emotionally unavailable.

Toroidal Transformer Technology

At the core of the Fezz Luna is one of the company’s key engineering strengths: toroidal output transformers developed in-house by Toroidy, Fezz Audio’s sister company. That matters because most tube amplifiers still rely on conventional EI-core output transformers, making Fezz’s approach less common and very much part of its identity.

The claimed benefits are lower noise, reduced electromagnetic interference, wider bandwidth, and better control. In practical terms, the goal is not to strip away the warmth people expect from tubes, but to tighten the presentation with cleaner edges, quicker transients, and firmer bass. Tubes with discipline. Poland apparently did not come here to make syrup. 

Dual Sonic Character  

The Luna provides users the flexibility to tailor sound through selectable operating modes:

• Triode Mode – This supports a more intimate, harmonically rich presentation with classic tube warmth  
• Ultralinear Mode – The mode supports greater power, dynamic impact, and control

This dual approach allows the amplifier to adapt more easily to different speakers, recordings, and personal preferences. The Luna effectively provides two distinct sonic profiles within a single design.

Amplification

The Luna employs classic EL34 push-pull circuit topology, delivering 40 watts per channel in ultralinear mode and 20 watts per channel in triode mode. Users can easily switch between modes, choosing between the harmonic richness and intimacy of triode operation or the greater dynamics and authority of ultralinear performance. A robust, well-filtered power supply using Torodial transformers ensures stability and consistent operation across a wide range of loudspeakers.

Modular Design 

Recognizing the needs of modern listeners, the Luna features a modular expansion system that allows users to integrate additional functionality directly into the amplifier. Optional modules include: 

This add-on options approach ensures the amplifier remains relevant as system requirements need to be updated, eliminating the need for unnecessary external components. 

Connectivity & Control

Unlike many traditional tube amplifiers, the Luna is designed to integrate easily into contemporary audio systems. 

Features include: 

• Home Theater Bypass
• Subwoofer Output
• Remote Control Operation

This connection and operational flexibility allow Luna not only to serve as a high-performance amplifier but as a centerpiece for a complete audio system. 

No Compromise Product Engineering

With its in-house transformer foundation and tighter control over production, Fezz Audio has a real engineering story to tell at this price point. The Luna is not just another tube integrated amplifier in a nice chassis with a glowing glass sales pitch. Its use of Toroidy toroidal output transformers, Polish manufacturing, and modern connectivity give it a more distinctive position in a crowded integrated amplifier market.

The Luna is still a tube amplifier, so expectations should be grounded in what that means: tone, texture, dimensionality, and a more tactile presentation. But Fezz is also aiming for better control, lower noise, and more system flexibility than many traditional tube designs offer. For listeners who want tube character without giving up modern usability, the Luna looks like a smart and credible option. Eastern Europe is no longer knocking. It brought its own soldering iron.

“Fezz Audio has created something truly special with the Luna,” said Jay Rein, president of Bluebird Music. “Its combination of toroidal transformer technology, classic tube topology, and modern usability delivers a level of performance and versatility that stands out in its class.”

Specifications

The Bottom Line 

Fezz Audio may not be the loudest Polish hi-fi brand in the U.S. market, but it is one of the more interesting ones, and the Luna Integrated Amplifier gives Bluebird Music another credible piece of Eastern European tube artillery to work with. Between the Equinox Tube DAC with Lampizator Technology, the Evolution series amplifiers, and now the refreshed Luna Vacuum Tube Integrated Amplifier, Fezz is building a real identity around Polish manufacturing, in-house transformer expertise, and tube gear that feels modern without pretending valves were invented last Thursday.

What makes the Luna different is its use of Toroidy toroidal output transformers, its selectable operating modes, and a level of production control that many tube brands at this price do not have. At roughly $3,500, it is not inexpensive, but in the vacuum tube integrated amplifier category, it is not wildly out of bounds either.

The misses are pretty clear. The optional MM phono stage really should have been included, especially in an amplifier aimed at listeners who are likely spinning records. Tubes and vinyl belong together. Charging extra for that feels a little like selling pierogi and billing separately for the sour cream. A built-in headphone amplifier also would have made the Luna more useful for late-night listening and smaller dedicated systems.

The Luna is best suited for listeners who already understand the appeal of tube amplification and want a modern integrated amp for a dedicated two-channel room. It also makes sense for someone with a serious home theater setup elsewhere who wants a separate music-first system with some warmth, texture, and Polish engineering muscle. Add the phono stage if vinyl is part of the plan. And Bluebird Music should absolutely keep bringing more Fezz Audio products into the U.S. market, because this is the kind of brand that makes the category more interesting.

Price & Availability

Fezz Audio’s Luna Integrated Amplifier is Shipping in the USA through the Bluebird Music Dealer Network for $3,495.

Although not confirmed, it is estimated that each add-on module is priced at about $300.

For more information: fezzaudio.com

Related Reading:

A new malware framework called PCPJack is stealing credentials from exposed cloud infrastructure while actively removing TeamPCP’s access to the systems.

Among the targeted services are Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications. In many cases, the threat actor moves laterally on the network.

SentinelLabs researchers say that PCPJack appears designed for large-scale credential theft, and likely monetizes its activity via financial fraud, spam operations, credential resale, or extortion.

TeamPCP is a cloud-focused threat group known for high-profile supply-chain breaches against Aqua Security’s Trivy scanner, the LiteLMM and Telnyx PyPI packages, and more recently, SAP npm packages.

Because of the similarities with TeamPCP attacks, SentinelLabs believes that PCPJack may have been developed by a former TeamPCP affiliate or member that started their own operation.

“Many of the services targeted by the PCPJack framework are similar to the early TeamPCP/PCPCat campaigns from December 2025, before the high-visibility campaigns of early 2026 brought significant attention to TeamPCP and purportedly led to changes in group membership,” explain the researchers.

“We believe this could be a former operator who is deeply familiar with the group’s tooling.”

In a report today, SentinelLabs says that PCPJack infects Linux-based cloud systems using a shell script called bootstrap.sh.

Upon execution, it creates a hidden working directory, installs Python dependencies, downloads additional modules, establishes persistence, and launches the main orchestrator (monitor.py).

During this initial stage, PCPJack explicitly checks for TeamPCP tooling and attempts to delete everything, thus claiming the compromise for themselves.

The researchers say that the cleaning activity includes removing TeamPCP processes, services, containers, files, and persistence artifacts, completely eliminating the infections.

PCPJack’s capabilities revolve mainly around credential theft, targeting cloud environments, developer systems, messenger apps, financial services, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more.

The credentials are exfiltrated to Telegram channels after they are encrypted using X25519 ECDH and ChaCha20-Poly1305, and split into 2800-byte chunks respecting Telegram’s message character limits.

PCPJack propagates by scanning external cloud infrastructure for exposed services such as Docker, Kubernetes, Redis, MongoDB, and RayML, then attempts exploiting known vulnerabilities to gain access.

It also downloads hostname data from Common Crawl parquet files and uses them as new targets for the scanning processscanning targets.

SentinelLabs researchers note that PCPJack is exploiting the following vulnerabilities:

• CVE-2025-29927: auth bypass in Next.js middleware via crafted header
• CVE-2025-55182 (“React2Shell”): Server Actions deserialization flaw in React and Next.js
• CVE-2026-1357: unauthenticated file upload in WPVivid Backup
• CVE-2025-9501: PHP injection in W3 Total Cache via cached mfunc comment
• CVE-2025-48703: shell injection in CentOS Web Panel Filemanager changePerm functionality

Inside compromised environments, the malware performs lateral movement by harvesting SSH keys and credentials, enumerating Kubernetes clusters and Docker daemons, and executing itself on reachable internal hosts.

Once access is obtained, it establishes persistence using systemd services, cron jobs, Redis cron rewrites, or privileged containers before continuing propagation.

SentinelLabs also found a Sliver-based backdoor on the threat actor’s infrastructure, with variants to support x86_64, x86, and ARM system architectures.

To mitigate this risk, the researchers recommend enforcing multi-factor authentication (MFA), using IMDSv2 in AWS, ensuring proper authentication for Docker and Kubernetes services, following least-privilege principles, and avoiding storing secrets in plaintext.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

security

Yet it remains unclear if Anthropic’s uber model was effective, or if better model middleware is what makes the difference 

Mozilla fixed 423 Firefox security bugs in April, a repair rate more than five times higher than the 76 fixes issued in March and almost 20 times higher than its 21.5 monthly average last year.

The browser maker previously said Anthropic’s ballyhooed Mythos Preview model found 271 of these in Firefox 150.

Now, a trio of technical types has come forward to provide a bit more detail about what Mythos (and its less storied sibling Opus 4.6) actually found. But they also highlight something that may matter more than the model: the agentic harness – the middleware mediating between AI and the end user.

Brian Grinstead, Firefox distinguished engineer, Christian Holler, Firefox tech lead, and Frederik Braun, head of the Firefox security team, observe that over the past few months, AI-generated security reports have gone from slop to rather more tasty.

They attribute the transformation to better models and development of better ways of harnessing those models – steering them in a way that increases the ratio of signal to noise. 

But they also appear to be aware that there’s some skepticism in the security community about Mythos. So they’ve decided to publicize selected wins in an effort to encourage others to jump aboard the AI bug remediation train.

“Ordinarily we keep detailed bug reports private for several months after shipping fixes and issuing security advisories, largely as a precaution to protect any users who, for whatever reason, were slow to update to the latest version of Firefox,” they said. 

“Given the extraordinary level of interest in this topic and the urgency of action needed throughout the software ecosystem, we’ve made the calculated decision to unhide a small sample of the reports behind the fixes we recently shipped.”

The post links to a dozen Firefox bugs with varying degrees of severity. The list includes, for example, a 20-year-old heap use-after-free bug (high severity) that a web page could trigger using the XSLTProcessor DOM API without any user interaction.

Many of these bugs are sandbox escapes, they note, which are difficult to find using techniques like fuzzing. AI analysis, they say, helps provide broader security coverage. And they add that it has helped validate prior browser hardening work designed to prevent prototype pollution attacks – audit logs showed AI models making unsuccessful exploitation attempts using this technique.

Following Anthropic’s announcement of Project Glasswing – a program for companies to gain early access to Mythos because it’s touted as too dangerous for public release – security experts expressed skepticism.

For example, Davi Ottenheimer, president of security consultancy flyingpenguin, wrote in an April 13 blog post, “The supposedly huge Anthropic ‘step change’ appears to be little more than a rounding error. The threat narrative so far appears to be ALL marketing and no real results. The Glasswing consortium is regulatory capture dressed up poorly as restraint.”

He subsequently ran a test in which he strapped Anthropic’s lesser models Sonnet 4.6 and Haiku 4.5 into a harness called Wirken with an auditing skill called Lyrik. The result was eight findings in two minutes at a cost of about $0.75, Ottenheimer claims, noting that two of the eight matched bugs Mythos had identified.

Other security folk have also reported that bug hunting and exploit development can be quite productive with off-the-shelf models like Opus 4.6, which among other virtues costs about 5x less than Mythos.

In an email to The Register, Ottenheimer said, “There’s a fundamental philosophical failure in the Mozilla post. A reading and a measurement are not the same thing. I don’t see a measurement, but they seem to want us to believe we’re looking at one. 

“When they give us the ‘behind the scenes math’ it’s circular, a trick. ‘Mythos found 271 bugs’ is what Mythos found, not what other tools could not find against the same code. Why leave it as an assumption if it can be proven?”

Ottenheimer said Mozilla advocates that every project adopt a similar approach without proving the merits of that approach.

“It’s like saying if you don’t drink Coca-Cola, you can’t run a mile under six minutes, because that’s what a guy sponsored by Coca-Cola just did,” he said. “The bar moves on rhetoric, marketing, not proper evidence. That is the capture crew again.”

He notes that the merits of Mythos might be more convincing if Mozilla had reported they couldn’t do this work without Mythos. And since they’re not saying that, he suggests, it’s worth asking why there’s no transparent comparison of Mythos to other models.

He points to Mozilla’s admission that Opus 4.6 was already identifying “an impressive amount of previously unknown vulnerabilities.”

“Mozilla never quantifies what Opus 4.6 [did] before saying what Mythos added,” he said. “So 271 attributed to Mythos doesn’t fit the analysis. And there’s a deeper reveal when they say ‘we dramatically improved our techniques for harnessing these models.’ The improvement may be entirely in the harness, not as much in the model. This maps to my own experience. A nail gun has advantages over the hammer, yet without being in the right hands the outputs are as bad or worse.” ®

The GameSir Pocket Taco is an interesting, single-purpose game controller built for retro gaming on iPhone via emulation. Its low price makes its tradeoffs worth it for nostalgia seekers.

Since Apple enabled the use of emulators on iPhone, the search for the perfect emulation controller began. We’ve seen many mounts, attachments, and standard controllers, but the Pocket Taco takes a different approach.

Instead of simply being a capacitive set of buttons like Gamebaby, the GameSir Pocket Taco is a full Bluetooth game controller that slips onto your iPhone. Of the two options, I like GameSir’s approach better since I don’t always want my iPhone to have a controller attached.

That said, there are some limitations to this style of controller. In spite of its imperfections, the Pocket Taco is an excellent gadget that does a lot of things well for a very affordable price.

GameSir Pocket Taco review: design and features

In a world filled with amazing game controller experiences, I can say the Pocket Taco is middling at best. That isn’t to slam the product from GameSir, but the form factor itself.

GameSir Pocket Taco review: nostalgic but cramped

The Game Boy that the Pocket Taco is emulating is an amazing console for children. It’s less great for adult-sized hands, though I understand why they went with this form factor.

It is a time-tested controller layout that worked great for several consoles. I even still use this layout on some occasions thanks to the Analogue Pocket.

However, be ready for some hand cramps after any lengthy play session. The good thing is that you probably shouldn’t be playing games on your phone for too long, even when some demand it.

Emulation is a funny thing. It brings games that were never intended for your device, be it a smartphone or tablet, and makes them run in a virtualized environment.

GameSir Pocket Taco review: the closest thing to a Game Boy experience on iPhone

That means games with 40+ hour storylines meant for dedicated outlets and CRTs are suddenly thrust into a device with a limited battery life. The funny thing is that many older games actually fit the modern play style of dropping in for minutes at a time.

The premise of the Pocket Taco’s design is simple: you’re waiting in a doctor’s office when you get the urge for some Super Mario Bros.. Simply grab your phone from one pocket, the Pocket Taco from the other, and you’re off to the Mushroom Kingdom.

Emulators make things easy too, since you can just tap a button for an instant save state, save points be damned.

GameSir Pocket Taco review: a simple clamp with extra features

The controller attaches via a clever clamping mechanism that wakes it up when opened. Remove the controller and it disconnects from Bluetooth in a few seconds.

That means GameSir expects you’ll only be using the Pocket Taco with it attached to the iPhone. No, don’t try to clip it to your iPad mini or force it open for Bluetooth use on other devices.

This is a product with a very specific use case, which I appreciate. We need more companies to take the time to make cool and weird niche products without trying to hit every single use case.

GameSir Pocket Taco review: enough battery for your play sessions

It’s got a 600mAh battery, which is useless information really. I’ve never had an issue with the battery running out, just charge it between play sessions and you’re good to go.

There’s also a cutout in the base that lets you charge the iPhone while using the controller.

Gaming with the GameSir Pocket Taco

You’re going to want to stick to games with simple control schemes. In terms of emulators, that’s games like those made for Nintendo DS, Game Boy, Game Boy Advanced, NES, and SNES.

GameSir Pocket Taco review: Pokemon is simple enough for the controller layout

Some PlayStation One games will work with the Pocket Taco, but only those that don’t need analog sticks. I played Digimon World 3 without any issue.

That’s also where the L2 and R2 buttons are actually used, though they’re not the easiest buttons to press.

It isn’t as if other games or emulators will ignore the controller, but you’ll be missing necessary buttons for them to work. While you can probably get by with some N64 games, I recommend sticking with the other consoles.

GameSir Pocket Taco review: reliving a classic play style

The best part of most emulators is the fanbase working on various skins, especially for the Delta emulator. All you have to do is search for “Pocket Taco Delta skins” and you’ll find some good options.

The biggest problem you’ll run into with the Pocket Taco is that it is only useful for a game that has already launched. Don’t bother attaching it until you’ve navigated your emulator app and launched the game.

If you want to swap games, you’ll have to remove the Pocket Taco, navigate the menus, then reattach it when the new game has launched.

GameSir Pocket Taco review: the game pad obscures the bottom of the display

Beyond emulation, there really aren’t any good gaming choices. There might be the rare exception where an iPhone game has a virtual controller in the lower half of the display, but I don’t have any games like that.

Most iPhone games are full screen and rely on touch controls or external controllers. They don’t expect a controller that will take up half the display.

If you want a more tactile experience while playing emulated games, the GameSir Pocket Taco provides an authentic experience, for better or worse.

A nostalgic gadget

If you like emulation, gadgets, and nostalgia, the GameSir Pocket Taco was made just for you. It is the perfect little throwback accessory that transforms your iPhone into a Game Boy-like experience.

GameSir Pocket Taco review: a perfect retro experience on iPhone

Advertisement

It is far from the perfect gaming experience, but it isn’t meant to be. The GameSir Pocket Taco is a throwback to the Game Boy and it does a good job of capturing that form factor.

It is small and easy to carry, so it wouldn’t be far-fetched to toss this into a mesh pocket in your bag, even if you bring a full-sized controller too. It enables an authentic experience for the Game Boy and Game Boy Advanced while enabling tactile gaming for other emulators.

And seriously, you can’t beat that price.

GameSir Pocket Taco review – pros

• Nostalgic design and clicky buttons
• Simple sleep/wake function tied to the hinge opening
• Emulator-specific controller with skins available for some emulators
• Low enough price to justify in spite of its limited use

GameSir Pocket Taco review – cons

• Cramped layout, but can’t be helped
• Blocks the display so must be removed when navigating apps
• Only useful for emulators, not regular iPhone games

Rating: 4 out of 5

The price and novelty of this controller could make this a 5 out of 5 if it weren’t for the limitations presented by the form factor. It has an excellent build quality and does the job, but it certainly isn’t for everyone.

Also, I can’t ignore the fact that this is a controller that only works on specific emulation tools.

Where to buy the GameSir Pocket Taco

Get the GameSir Pocket Taco from Amazon for $34.99, which is a 22% discount from the listed $44.99 price. It is only available in the single color and fits any iPhone with a standard case.

Picture this scenario: An Anthropic Skill scanner runs a full analysis of a Skill pulled from ClawHub or skills.sh. Its markdown instructions are clean, and no prompt injection is detected. No shell commands are hiding in the SKILL.md. Green across the board.

The scanner never looked at the .test.ts file sitting one directory over. It didn’t need to. Test files aren’t part of the agent execution surface, so no publicly documented scanner inspects them (as of publication of this post). The file runs anyway. Not through the agent but through the test runner, with full access to the filesystem, environment variables, and SSH keys.

Gecko Security researcher Jeevan Jutla detailed this attack flow, demonstrating that when a developer runs npx Skills add, the installer copies the entire skill directory into the repo. If a malicious Skill bundles a *.test.ts file, the Jest and Vitest testing frameworks discover it through recursive glob patterns, treat it as a first-class test, and execute it during npm test or when the IDE auto-runs tests on save. The default configuration in open-source JavaScript test framework Mocha follows a similar recursive discovery pattern. The payload fires in beforeAll, before any assertions run. Nothing in the test output flags anything unusual. In CI, process.env holds deployment tokens, cloud credentials, and every secret the pipeline can reach.

The attack class is not new; malicious npm postinstall scripts and pytest plugins have exploited trust-on-install for years. What makes the Skill vector worse is that installed Skills land in a directory designed to be committed and shared across the team, propagate to every teammate who clones, and sit outside every scanner’s detection surface.

The agent is never invoked, and the Anthropic Skill scanner reads the right files for the wrong threat model.

Three audits, one blind spot

Gecko’s disclosure didn’t arrive in isolation. It landed on top of two large-scale security audits that had already documented the scope of the problem from the other direction, illustrating what scanners detect rather than what they miss. Both audits did exactly what they’re designed to do: They measured the threat on the execution surface scanners already inspect. Gecko measured what sits outside it.

A SkillScan academic study, published on January 15, analyzed 31,132 unique Anthropic Skills collected from two major marketplaces. Their findings: 26.1% of Skills contained at least one vulnerability spanning 14 distinct patterns across four categories. Data exfiltration showed up in 13.3% of Skills. Privilege escalation appeared in 11.8%. Skills bundling executable scripts were 2.12x more likely to contain vulnerabilities than instruction-only Skills.

Three weeks later, Snyk published ToxicSkills, the first comprehensive security audit of the ClawHub and skills.sh marketplaces. Snyk’s team scanned 3,984 Skills (as of February 5). The results: 13.4% of all Skills contained at least one critical-level security issue. Seventy-six confirmed malicious payloads were identified through a combination of automated scanning and human-in-the-loop review. Eight of those malicious Skills were still publicly available on ClawHub when the research was published.

Then Cisco shipped its AI Agent Security Scanner for IDEs on April 21, integrating its open-source Skill Scanner directly into VS Code, Cursor, and Windsurf. The scanner brings genuine capability to developers’ workflows. It does not inspect bundled test files, because the detection categories Cisco built target the agent interaction layer, not the developer toolchain layer.

The three major Anthropic Skill scanners share a structural blind spot: None inspects bundled test files as an execution surface, even though Gecko Security proved that those files execute with full local permissions through standard test runners.

Snyk Agent Scan, Cisco’s AI Agent Security Scanner, and VirusTotal Code Insight all work. They catch prompt injection, shell commands, and data exfiltration in Skill definitions and agent-referenced scripts. What they do not do is look beyond the agent execution surface to the developer execution surface sitting in the same directory.

How the attack chain works

The mechanics of the attack chain matter because the fix is precise. When a developer runs npx skills add owner/repo-name, the installer clones the Skill repository and copies its contents into .agents/skills// inside the project. Claude Code, Cursor, and other agent IDEs get symlinks into their own Skill directories. The only files excluded are .git, metadata.json, and files prefixed with _. Everything else lands on disk.

Jest and Vitest both pass dot: true to their glob engines. That means they discover test files inside dot-prefixed directories like .agents/. Mocha’s behavior depends on configuration but follows similar recursive patterns by default. None of them exclude .agents/, .claude/, or .cursor/ from their default discovery paths.

An attacker publishes a Skill with a clean SKILL.md and a tests/reviewer.test.ts file containing a beforeAll block. The block reads process.env, .env files, ~/.ssh/ private keys, and ~/.aws/credentials. It posts everything to an external endpoint. The test cases look real. The exfiltration happens during setup, silently, whether the tests pass or fail.

The vector is not limited to TypeScript. Python repos face the same exposure through conftest.py, which pytest auto-executes during test collection. Add .agents to testpaths exclusion in pyproject.toml to block it.

The .agents/skills/ directory is designed to be committed to the repo so teammates can share Skills. GitHub’s default .gitignore templates do not include .agents/. Once the malicious test file enters the repo, every developer who clones and runs tests executes the payload. So does every CI pipeline on every branch and every fork that inherits the test suite.

Scanners are reading the wrong threat surface

CrowdStrike CTO Elia Zaitsev put the structural challenge in operational terms during an exclusive VentureBeat interview at RSAC 2026. “Observing actual kinetic actions is a structured, solvable problem,” Zaitsev said. “Intent is not.”

That distinction cuts directly at the Anthropic Skill scanner gap. No publicly documented scanner operates outside the assumption that the threat lives in the SKILL.md and in scripts the agent is instructed to run. These tools analyze intent: What does the Skill tell the agent to do? Gecko’s finding sits on the kinetic side. The test file executes through the developer’s own toolchain. No agent is involved. No prompt is interpreted. The payload is TypeScript, running with full local permissions through a legitimate test runner. The scanner was solving the wrong problem.

CrowdStrike’s Zaitsev framed the identity dimension: “AI agents and non-human identities will explode across the enterprise, expanding exponentially and dwarfing human identities,” he told VentureBeat. “Each agent will operate as a privileged super-human with OAuth tokens, API keys, and continuous access to previously siloed data sets.”

CrowdStrike’s Charlotte AI and similar enterprise agents operate with exactly these privileges. When those credentials live in environment variables accessible to any process in the repo, a test-file payload does not need agent privileges. It already has developer privileges, which in most CI configurations means deployment tokens and cloud access.

Mike Riemer, SVP of the network security group and field CISO at Ivanti, quantified the exploitation window in a VentureBeat interview. “Threat actors are reverse engineering patches within 72 hours,” Riemer said. “If a customer doesn’t patch within 72 hours of release, they’re open to exploit.”

Most enterprises take weeks. The Anthropic Skill scanner blind spot compounds that window. A developer installs a malicious Skill today. The test file executes immediately. No patch exists because no scanner flagged it.

The Anthropic Skill Audit Grid

VentureBeat has covered the Anthropic Skill supply chain since the ClawHavoc campaign hit ClawHub in January. Every conversation with security leaders lands on the same frustration. Their teams bought a scanner, it reports clean, and they have no framework for asking what it does not check.

VentureBeat has polled dev teams who install Anthropic Skills from ClawHub and skills.sh. The grid below connects the published-audit half (Snyk, SkillScan) with the scanner-bypass half (Gecko). Each row represents a detection surface a security team should verify before approving any Skill scanning tool for Q2 procurement.

Three CI hardening steps to add now

Riemer made the broader point in VentureBeat interviews that placing security controls at the perimeter invites every threat to that exact boundary. Anthropic Skill scanners placed the boundary at SKILL.md. Attackers put the payload one directory over. The three changes below move the boundary to where the code actually executes.

These changes take minutes. None requires replacing current tools or waiting for scanner vendors to close the gap.

Add .agents/ to the test runner’s ignore list. In Jest, add /\.agents/ to testPathIgnorePatterns in jest.config.js. In Vitest, add **/.agents/** to the exclude array in vitest.config.ts. One line in one config file prevents the test runner from discovering files inside installed Skill directories. Do it whether or not the team currently uses Anthropic Skills. The directory may appear in a cloned repo without anyone installing the Skill directly.

Audit every Skill install for non-instruction files before merge. Add a CI check that flags any file in .agents/skills/ matching *.test.*, *.spec.*, __tests__/, *.config.*, or conftest.py. These files have no legitimate reason to exist inside a Skill directory. The check is a shell one-liner: [ -d .agents ] && find .agents/ -name “*.test.*” -o -name “*.spec.*” -o -name “conftest.py” -o -name “*.config.*” -o -type d -name “__tests__” | grep -q . && exit 1. If it matches, block the merge. For any test files that do land in a PR, require a reviewer to skim for shell invocations (exec, spawn, child_process), external network calls, and file operations touching secrets or SSH keys.

Pin Skill sources to specific commits, not latest. The npx skills add command copies whatever the repo contains at the moment of install. A Skill author can push a clean version for scanner review, then add a malicious test file after approval. Pinning to a specific commit hash converts a trust-on-first-use model into a verify-on-every-change model. The OWASP Agentic Skills Top 10 recommends exactly this.

If Skills are already in your repo: Run the find command above against your existing .agents/ directory now. If test files are present, treat them as a potential compromise: Rotate any credentials accessible to CI (deployment tokens, cloud keys, SSH keys), audit CI logs for unexpected outbound network calls during test execution, and review git history to determine when the test files entered the repo and which pipelines have executed them.

Five questions to ask your Anthropic Skill scanner vendor

Security teams are signing contracts for their first dedicated Skill scanning tools. The Gecko bypass means the questions on those sales calls need to change. Do not stop at “Do you detect prompt injection?” Ask:

• Which files and directories do you actually analyze in a Skill repo?

• Do you treat test files as potential execution surfaces?

• Can you flag Skills that bundle tests, CI configs, or build scripts as higher-risk? SkillScan showed script-bundling Skills are 2.12x more likely to be vulnerable.

• Do you provide integration or guidance for restricting test-runner globs in CI? Cisco deserves credit for open-sourcing its Skill Scanner on GitHub, which lets security teams inspect exactly which detection categories the tool implements. That transparency is the baseline every vendor should meet. If your vendor will not publish detection categories or open-source their scanning logic, you cannot verify what they check and what they skip.

• Have you published an ecosystem-scale audit with methodology and sample size? Snyk published at 3,984 Skills. SkillScan published at 31,132. Riemer described the disclosure pattern: “They chose not to publish a CVE. They just quietly patched it and moved on with life,” he said. The Anthropic Skills ecosystem is showing early signs of the same pattern: scanners document what they detect without mapping the surfaces they do not reach. The gap between documented coverage and actual execution surface is where the test-file vector lives.

The audit grid matters because the scanner model is incomplete

The Anthropic Skills ecosystem is repeating the early npm supply chain story, except without the decade of accumulated incidents that forced package registries to build security infrastructure. SkillScan’s 31,132-Skill dataset showed a quarter of the ecosystem carrying vulnerabilities. Snyk found 76 confirmed malicious payloads in fewer than 4,000 Skills. Gecko proved the scanner model itself has a structural gap that no vendor has publicly documented closing.

Scanner evaluations consistently test the covered surface. The Anthropic Skill Audit Grid gives security teams the seven audit surfaces to verify before signing. The three CI steps are the fixes to deploy before the next Skill install. Riemer’s Ivanti team watches the patch-to-exploit cycle compress in real time across enterprise environments. The test-file vector compresses it further: No scanner flagged the threat, so no patch window exists.

The scanner is not broken. It is incomplete. The threat model stopped at the agent. The test runner did not.

from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed.

In this week’s roundup of the latest news in online speech, content moderation and internet regulation, Mike is joined by First Amendment lawyer Ari Cohn. Together they discuss:

Support the podcast by joining our Patreon, with special founder membership available until May 28th.

Filed Under: age verification, ari cohn, artificial intelligence, chatbots, content moderation, free speech, trust and safety

Companies: character.ai

A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems.

Additionally, the malware includes self-spreading worm modules for WhatsApp and Outlook that automatically infect new victims.

The new banking trojan was discovered by Elastic Security Labs, whose researchers believe it’s a major evolution of the older Maverick/Sorvepotel malware family.

While TCLBanker currently appears focused in Brazil, specifically checking timezone, keyboard layout, and locale, LATAM malware has, in the past, been updated to broaden its targeting scope, so the risk of the threat expanding is real.

TCLBanker capabilities

Elastic warns that TCLBanker is extremely well protected against analysis and debugging, featuring environment-dependent payload decryption routines that fail in sandboxes or analyst environments.

It also runs a persistent watchdog thread that continuously hunts for analysis tools like x64dbg, IDA, dnSpy, Frida, ProcessHacker, Ghidra, de4dot, and others.

The malware is loaded within the context of the legitimate Logitech application via DLL side-loading, so it won’t trigger any alarms from security products protecting the infected host.

The researchers noted that, while the loader is rich in features, none go very far toward being truly advanced, and code artifacts indicate that AI may have been used in its development.

The banking module monitors the browser address bar every second using Windows UI Automation APIs, watching for when the victim opens a website of one of its 59 targeted platforms.

When that happens, it establishes a WebSocket session with the command-and-control (C2), sends victim and system information, and starts remote control operations.

The capabilities given to the operators include:

• Live screen streaming
• Screenshot capturing
• Keylogging
• Clipboard hijacking
• Shell command execution
• Window management
• File system access
• Process enumeration
• Remote mouse/keyboard control

During active sessions, the Task Manager process is killed to prevent disruptions and hide the malicious activity from the victim.

To support data theft, TCLBanker uses a WPF-based overlay system that can push to victims fake credential prompts, PIN keypads, phone-number collection forms, fake “bank support” waiting screens, fake Windows Update screens, and various fake progress screens.

There are also “cutout” overlays that stay on top, allowing only selected portions of real applications to be shown to the victim, and masking other parts.

WhatsApp and Outlook worms

An interesting aspect of TCLBanker is its ability to propagate autonomously to contacts linked to the primary victim.

The malware searches Chromium browser profiles for authenticated WhatsApp Web IndexedDB data, and launches a hidden Chromium instance that hijacks the victim’s account.

Then, it harvests contacts, filters for Brazilian numbers, and sends them spam messages from the victim’s account, leading them to TCLBanker distribution platforms.

Another worm module abuses Microsoft Outlook through COM automation, launching the app, harvesting contacts and sender addresses, and sending phishing emails through the victim’s email account.

Elastic concludes that TCLBanker is as a characteristic example of the evolution of LATAM malware, offering lower-tier cybercriminals features that were once only available in highly sophisticated tools.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

As noted earlier, Mozilla’s characterization of AI-assisted vulnerability discovery as a game changer has been met with massive, vocal skepticism in many quarters. Critics initially scoffed when Mozilla didn’t obtain CVE designations for any of the 271 vulnerabilities. Like many developers, however, Mozilla doesn’t obtain CVE listings for internally discovered security bugs. Instead, they are bundled into a single patch. Normally, Bugzilla reports detailing these “rollups” are hidden for several months after being fixed to protect those who are slow to patch. Now that Mozilla has revealed a dozen of them, the same critics will surely claim they too were cherry-picked and conceal less accurate results.

Of the 271 bugs found using Mythos, 180 were sec-high, Mozilla’s highest designation for internally reported vulnerabilities. These types of vulnerabilities can be exploited through normal user behavior, such as browsing to a web page. (The only higher rating, sec-critical, is reserved for zero-days.) Another 80 were sec-moderate, and 11 were sec-low.

The critics are right to keep pushing back. Hype is a key method for inflating the already high puffed-up valuations of AI companies. Given the extensive praise Mozilla has given to Mythos, it’s easy for even more trusting people to wonder: What’s it getting in return? Far from settling the debate, Thursday’s elaborations are likely to only further stoke the controversy.

To hear Grinstead tell it, however, the details are clear evidence of the usefulness of AI-assisted discovery, and Mozilla’s motivation is simple.

“People are a bit burned from the last year of these slop commits so we felt it was important to show some of our work, open up some of the bugs, and talk about it in a little more detail as a way to hopefully spur some action or continue the conversation,” he said. “There’s no sort of marketing angle here. Our team has completely bought in on this approach. We are trying to get a message out about this technique in general and not any specific model provider, company, or anything like that.”