Platform
Solutions
Resources
Company
Attack research you can run against your own environment. Mitiga Labs' researchers and responders work real breaches across cloud, SaaS, identity, third-party services, and AI. Every finding comes with the method to check your own estate.
Explore Our ResearchAI & Agent Security
Mitiga Labs Team
Read the Post →Identity & Access
Threat Hunting & Detection
Ucha Gobejishvili
Read the Post →AWS
Threat Hunting & Detection
Yafit Shayo
Read the Post →
INSTRUCTION FILES YOUR AGENT READS — AND NOBODY OPENS.
Rule files, hooks, and CLAUDE.md run automatically the moment an agent loads them. Mitiga Labs found instruction files quietly recording prompts, tokens, and environment variables, then shipping them out. No malware, often no audit log.
See How it WorksLet them come
A Research Report from Mitiga Labs
Mitiga Labs is where we take apart cloud, SaaS, identity, third-party services and AI attacks, then write what they find into the detections customers run. Those detections interrupt the next attack before it reaches the business. That's Zero-Impact Breach Prevention.
Explore the latest discoveries, deep dives, and technical how-tos from the Mitiga Labs team. Our research is dedicated to informing defenders and disrupting attackers.
A Mitiga Labs report on PromptLoggers and exfiltration hidden in AI instruction files — six real public-repo case studies, the techniques, and how to detect them before an agent runs.
Mitiga Research Team
Stolen ConnectWise app credentials gave attackers app-only access to Microsoft 365. A six-part method for hunting third-party app abuse in Entra ID.
Ucha Gobejishvili
Read the Post →In a security data lake, a detection can be correct and still never finish. How two months of PySpark tuning became 34 rules that cut runtime up to 60%.
Yafit Shayo
Read the Post →Cloud Forensics & Logging
Kubernetes adds complexity to incident response. Use our problem scoping guide to measure blast radius and identify container escapes effectively.
Ucha Gobejishvili
Read the Post →AI Agents & MCP
SaaS Applications
How a Claude Code–Slack integration becomes an attack path — and how to detect and contain AI agent compromise through forensic log analysis.
Idan Cohen
Read the Post →AWS
Identity & Access
Look inside the new AWS Login mechanism using Mitiga's technical research to discover how threat actors build fully automated cloud-hosted phishing kits.
Idan Cohen
Read the Post →Threat Hunting & Detection
Detection is just a hypothesis. Investigation is reality. Maximize investigative value with behavior-based threat detection. See why rules fail & get resilient.
Jed Morley
Read the Post →SaaS Applications
Breach & Campaign Analysis
ShinyHunters exploited Salesforce guest access to breach 400+ companies using AuraInspector. Learn detection methods and immediate fixes.
Oshrat Bar
Read the Post →Software Supply Chain & CI/CD
Breach & Campaign Analysis
Supply chain attacks hide behind trusted vendors. Learn how incident responders detect, scope, and contain vendor compromise in cloud and SaaS environments.
Jed Morley
Read the Post →AI Agents & MCP
Software Supply Chain & CI/CD
Mitiga Labs shows how a malicious AI agent skill can silently exfiltrate an entire codebase, exposing a new supply chain risk in agentic AI environments.
Idan Cohen
Read the Post →AI Agents & MCP
Attack Research
A path traversal vulnerability exposed an AI training pipeline to data poisoning and backdoor injection. See how the attack unfolded and how to prevent it.
Ucha Gobejishvili
Read the Post →Identity & Access
Attack Research
ConsentFix abuses OAuth consent in Microsoft Entra ID to steal access tokens without triggering MFA. How the attack works and how to detect it.
Ucha Gobejishvili
Read the Post →Head of Cloud Security Research
Senior Incident Responder
Senior Director, Mitiga Research
Cloud Researcher
Cloud Security Researcher
Cloud Security Researcher
Cloud Security Researcher
Cloud Security Researcher
AI Detection and Response for modern infrastructure. Defend with AI, from AI, and your AI.
Learn more
