PHP2ShellAI-assisted research
DISCLOSED
Security research exposed critical PHP flaws that could let attackers run code on vulnerable servers without logging in.
Research reportPHP FoundationBLACKWALL BY HEGEMON / IN DEVELOPMENT
Website security testing.With AI agents.
Authorized assessments for founders and product teams. We’re building Blackwall to show what’s vulnerable and what to address first.
Public security reports
FortiGateCustomer devices
REPORTED
Amazon reported an AI-assisted attacker compromising over 600 devices through exposed management interfaces and weak credentials.
Campaign reportAmazonGTG-1002AI-orchestrated espionage
REPORTED
Anthropic reported attackers using Claude Code against roughly 30 organizations, with a small number successfully breached.
Campaign reportAnthropicPROMPTSTEALAI-powered malware
GOOGLE REPORT
Malware targeting Ukraine used AI during execution to generate commands for stealing documents.
Threat reportGoogle GTIG
Polymarket
INCIDENT
A compromised third-party script used active sessions to sell positions and move funds.
Official reportpolymarket.com
CircleCI
INCIDENT
A stolen employee session enabled the theft of customer environment variables, tokens and keys.
Official reportcircleci.com
Dropbox Sign
DISCOVERED
A compromised service account exposed customer data, API keys, OAuth tokens and hashed passwords.
Official reportdropbox.com
OktaSupport system
DISCLOSED
Stolen support credentials exposed files containing session tokens, enabling attackers to hijack five customers’ sessions.
Official reportokta.com
GitHubThird-party integrations
DETECTED
Stolen OAuth tokens issued to Heroku and Travis CI exposed private GitHub repositories.
Official reportgithub.blog
LastPass2022 breach
ICO REPORT
An attacker stole LastPass backup data containing customer names, email addresses and stored website URLs.
Regulator findingsUK ICO
Cloudflare
DETECTED
Stolen credentials exposed internal tools and source code. Cloudflare reported no impact to customer data.
Official reportcloudflare.com01 / THE PROBLEM
Know what
could be exposed.
A missing permission check can turn a public entry point into access to private information. AI agents can look for the same weaknesses an attacker would exploit.
- Private records.
- Restricted features.
- Website controls.
Concept illustration: an ordinary visitor requests another account owner’s private record. The server should require permission. If the ownership check is missing, the record could be exposed. This is a hypothetical example, not a Blackwall finding.
02 / HOW BLACKWALL HELPS
Your scope.
Our assessment.
With your permission, our team will use Blackwall’s AI agents to test the website areas and workflows we agree with you.
- 01 Agree authorization and scope.
- 02 Test with Blackwall’s AI agents.
- 03 Explain the findings and potential impact.
Planned service. Testing starts with an agreement.
03 / WHAT YOU RECEIVE
Findings you
can act on.
An agent-generated report showing what was tested, the vulnerabilities found, supporting demonstrations, and suggested fixes. Severity ratings help you prioritize.
Progress updates and support vary by tier. Additional testing requires a separate paid assessment. Blackwall is in development.
See an illustrative finding04 / HEGEMON
The team
behind Blackwall.
Hegemon researches AI security and is developing Blackwall. Our team is building Citadel, the planned software system for running and managing Blackwall’s AI agents.
Blackwall is in development. Talk to us about your website, the scope you have in mind, and planned assessment availability.