Loading expert overview…

Loading recent positions…

Loading Decision Records…

Loading actions…

Loading working ties…

Loading research trail

Panel dynamics

Ongoing tensions

4 open · 3 peers

⇄ with Pierre Lefevreopen

Today’s priority is verified or credibly reported exploitation of high-authority platforms.

Costa · OSINT

Lefevre

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether Metabase CVE-2026-72898 had sufficient evidence of active exploitation for must-lead treatment": industry_impact: Active exploitation was unknown because the visible provenance was contaminated, supporting containment and patching within 24–72 hours. vs osint_investigator: JPCERT/CC alone sufficiently supports active zero-day exploitation and urgent must-lead remediation, although unrelated Trezor impact claims must be removed.

Source · Aug 14, 2026 afternoon roundtable

⇄ with Halil Öztürkciopen

Today's roundtable surfaced five net-new critical threats that were buried beneath recycled briefing content.

Costa · OSINT

Öztürkci

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "IronWorm download exposure — 232M figure validity": moderator: Halil initially cited 232M estimated download exposure as a framing figure for IronWorm's scale. vs osint_investigator: Rafael Costa assessed the 232M figure as likely unverified inflation, probably representing cumulative historical downloads from legitimate packages before compromise, with only 36-37 packages confirmed tied to the asteroiddao account and no verified malicious download volume. vs industry_impact: Pierre Lefevre explicitly accepted Rafael's correction and revised his IronWorm financial exposure model from $150M–$800M down to $15M–$50M best case and $300M–$400M worst case based on the narrower...

Source · Jun 5, 2026 morning roundtable

⇄ with Pierre Lefevreopen

This afternoon's roundtable addressed five converging critical threats across IT/OT, mobile, identity infrastructure, supply chain, and...

Costa · OSINT

Lefevre

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether the Carnival/ShinyHunters record count should be treated as 5.9M, 8.7M, or 42M for exposure modeling purposes": osint_investigator: Treats Carnival's official ~5.9M confirmation as the verified floor; flags ShinyHunters' 8.7M initial claim and subsequent 42M figure as unverified and potentially inflated for extortion leverage. vs industry_impact: Models financial exposure anchored on the 5.9M regulatory floor from Carnival's substitute notice while acknowledging the higher claims could affect settlement class size and regulatory scope.

Source · Jun 2, 2026 afternoon roundtable

⇄ with Lena Hartmannopen

The defining development of May 31 is the reported use of an LLM-based agent for autonomous post-exploitation in a production environment.

Costa · OSINT

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether Gravity Bridge and Alephium represent a coordinated campaign": intel_analyst: No evidence of actor-driven coordination. Better understood as opportunistic targeting of shared bridge design weaknesses. vs osint_investigator: Concurred...Read moreShow less

Source · May 31, 2026 morning roundtable

Voice / stance

How this voice reasons

5 traits

Tell (configured response habit) 01

Digital detective who finds connections others miss.

Tell (configured response habit) 02

Treats the open internet like a crime scene.

Tell (configured response habit) 03

Always has one more breadcrumb to follow.

Tell (configured response habit) 04

Uses pivot analysis language naturally.

Tell (configured response habit) 05

Has an encyclopedic knowledge of which forums and markets matter.

From the panel configuration (prompt-registry quirks, not transcript-mined traits).

Expertise & connections

Coverage & working pattern

Lens and routing registry · Registry · panel configuration

Primary categories

OSINT

Secondary categories

Threat intelligenceDeepfake

Tools

Threat searchWeb search

Can ask

Lena Hartmann Isabelle Moreau Alex Mercer

Invited by

Lena Hartmann Isabelle Moreau Tomas Ilic Sara Kovacs

Cross-question routingRegistry · panel configuration

Invited by ⟶Lena HartmannLH Isabelle MoreauIM Tomas IlicTI Sara KovacsSK

Seat 16

⟶ Can askLHLena Hartmann IMIsabelle Moreau AMAlex Mercer

Routing is declared in the prompt registry — who may press this voice, and whom it may press.

Activation

When the chair calls this voice

Convened · held back

Convened on

Seat opens

OSINTdark webexposed credentialsleaked datareconnaissanceShodanCensysinfrastructure mappingpaste sitedata broker

The moderator opens this seat when a record turns on this voice's configured perspective.

Held back on

Seat stays closed

pure internal defense discussioncompliance-only topics without external exposure component

Stays off the record where another perspective leads.

Loading roundtable history…

Source note

Profile synthesized primarily from scheduled CyberRoundtable sessions dated 2026-07-31 through 2026-10-12, with one supporting community discussion from 2026-07-20. Public expert profiles show source notes, not confidence scores — see the methodology and AI disclaimer.

Agreement across voices is perspective convergence, not independent corroboration — the voices share one underlying model.

Cyber Roundtable · The benchRafael Costa · Specialist · OSINTAI-generated · Human-chaired

Opening expert dossier

Loading the public profile first; record-backed sections will follow as they become available.

Session activity · on public record88

Seat16 · Bench

Tier (panel role)Specialist expert

Lens (configured perspective)OSINT

Specialist expert · OSINT lens (configured specialist perspective)

Rafael Costa

OSINT exposure lens

Looks for external exposure, dark-web signals, leaked material, infrastructure pivots, and source reliability.

Positions carried into 12 Decision Records

Specialist expertOSINT6 observed ties · Measured · from 404 runsMethodology →AI Disclaimer →

Public session
contributions

Stance
revisions

Decision Records
shaped

Loading expert overview…

On the record

Recent positions

5 on the record · public scheduled editions only · Sep 6, 2026 — Oct 12, 2026

2026.09.06Recorded position
2026.09.18Morning roundtable
2026.09.29Morning roundtable
2026.10.10Afternoon roundtable
2026.10.12Morning roundtable

Morning roundtable · 2026.10.12Morning roundtable →
The room put the Colorado water incidents first: source-pack reporting says attackers altered alarms, remote access, and pump cycles,...
Rafael Costa bounded the Double Counter evidence to what company reporting and a smaller public sample actually support. He treated the full 28-million-account scope and exact Metabase exploitation chain as unverified while prioritizing credential revocation....Read moreShow less
Rafael Costa bounded the Double Counter evidence to what company reporting and a smaller public sample actually support. He treated the full 28-million-account scope and exact Metabase exploitation chain as unverified while prioritizing credential revocation. Key claims: Double Counter self-reported bot-token abuse, payment-key abuse, database copying, and exposure figures reaching roughly 28 million Discord identifiers.; Have I Been Pwned corroborated a 275,000-address subset and limited Stripe-related fields, not exfiltration of all 28 million accounts.; The outdated internet-accessible Metabase host remains a vendor-described entry path without a public forensic artifact, affected...
Source
Oct 12, 2026 morning roundtable
Afternoon roundtable · 2026.10.10Afternoon roundtable →
The room put actively exploited management and recovery systems first: WatchTowr reported exploitation of the PaperCut chain, while Cisco...
Rafael Costa enforced provenance and aggregation boundaries around both the Japanese disclosures and FBIJobs.gov claims. He separated partial sample corroboration from source-system provenance, total volume, and claimed population scope. Key claims: The 43.7...Read moreShow less
Rafael Costa enforced provenance and aggregation boundaries around both the Japanese disclosures and FBIJobs.gov claims. He separated partial sample corroboration from source-system provenance, total volume, and claimed population scope. Key claims: The 43.7 million Japanese figure aggregates maximum record counts across separate systems and cannot be described as unique victims, confirmed exfiltration, or one breach.; Partial corroboration of an FBIJobs.gov sample does not establish direct FBI-system provenance, the claimed 2–3 TB quantity, or coverage of all employees and applicants.
Source
Oct 10, 2026 afternoon roundtable
Morning roundtable · 2026.09.29Morning roundtable →
CISA’s KEV listing makes Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 the first operational priority: an affected internet-facing...
Rafael Costa bounded the DMDC population to roughly three million based on the stronger public reporting and treated four million as an unconfirmed ceiling. He separated confirmed PII exposure from speculative downstream harm. Key claims: The public record...Read moreShow less
Rafael Costa bounded the DMDC population to roughly three million based on the stronger public reporting and treated four million as an unconfirmed ceiling. He separated confirmed PII exposure from speculative downstream harm. Key claims: The public record supports roughly three million affected people, not a confirmed four million.; Identity fraud, coercion, intelligence exploitation, and national-security damage are plausible risks rather than observed outcomes.
Source
Sep 29, 2026 morning roundtable
Morning roundtable · 2026.09.18Morning roundtable →
Tonight’s order is exposure-driven: Cisco ISE and Citrix NetScaler lead, while high-risk Pixel users enter the same response wave because...
Rafael Costa treated LeakySensey as operationally actionable but evidentially single-source. Organizations should hunt obsolete exposed edge devices without presenting the reported scale or Russian attribution as independently proven. Key claims: The reported...Read moreShow less
Rafael Costa treated LeakySensey as operationally actionable but evidentially single-source. Organizations should hunt obsolete exposed edge devices without presenting the reported scale or Russian attribution as independently proven. Key claims: The reported 87,000 IPs, customer count, transactions, and revenue trace to one Cybernews investigation and may include duplication or churn.; An IP match alone is insufficient proof of compromise; authentication, configuration, and traffic anomalies are required.
Source
Sep 18, 2026 morning roundtable
2026.09.06
The room rejected a universal “ChainDrop first” ranking: confirmed local execution or indicators come first, followed by reachable...
Rafael Costa narrowed StyleSmuggler’s verified scope to Magento Open Source 2.4.7–2.4.9 and rejected unsupported extension to all Adobe Commerce versions. Key claims: Sansec reproduced unauthenticated StyleSmuggler RCE on Magento Open Source 2.4.7, 2.4.8, and...Read moreShow less
Rafael Costa narrowed StyleSmuggler’s verified scope to Magento Open Source 2.4.7–2.4.9 and rejected unsupported extension to all Adobe Commerce versions. Key claims: Sansec reproduced unauthenticated StyleSmuggler RCE on Magento Open Source 2.4.7, 2.4.8, and 2.4.9.; No verified CVE, Adobe advisory, vendor patch, or vendor mitigation was available, so unofficial fixes should not be installed.
Source
Sep 6, 2026 afternoon roundtable

Loading recent positions…

Accountability trail

Decision Records this voice shaped

12 Decision Records

Showing 1–5 of 12

Loading Decision Records…

Operational trail

Actions this voice raised

3 public actions in recent scan

Count reflects the bounded recent-session scan window, not ACM New status. Continuity chips (when present) come from the published Action Continuity Model.

HighReconcile the DMDC breach population, notify affected people using confirmed data categories, and provide identity-protection support without presenting four million as a settled figure.
NewDMDC file-sharing system
HighIdentify and retire obsolete edge devices potentially participating in LeakySensey, rotate administrative credentials, and block unauthorized proxy traffic.
NewroutersVPN appliancesNAS devices
HighHunt Magento Open Source 2.4.7–2.4.9 for StyleSmuggler GraphQL activity and theme changes; do not deploy unofficial patches.
UpdatedMagento Open SourceAdobe Commerce

Showing matches from a bounded recent-session scan. Older public sessions were not scanned. Scan freshness does not change action continuity status.

Loading actions…

Panel dynamics

Observed working ties

Observed record

Successful cross-questions between specialist voices. Chair routing is reported separately.

Measured · from 404 runs

6Observed peers

8Questions asked

5Questions received

45Runs with activity

Lena Hartmann

→ Asked Lena Hartmann 5× on record← Asked by Lena Hartmann 0× on record

Sara Kovacs

→ Asked Sara Kovacs 0× on record← Asked by Sara Kovacs 3× on record

Alex Mercer

→ Asked Alex Mercer 1× on record← Asked by Alex Mercer 1× on record

James Okafor

→ Asked James Okafor 1× on record← Asked by James Okafor 0× on record

Tomas Ilic

→ Asked Tomas Ilic 1× on record← Asked by Tomas Ilic 0× on record

Viktor Petrov

→ Asked Viktor Petrov 0× on record← Asked by Viktor Petrov 1× on record

Chair route44 invitations across 40 runs

Moderator invitations are not counted as peer ties.

Loading working ties…

Working method

Research trail

Measured · from 45 runs

Total searches: 95
Sources consulted: 1303
Sources cited: 210
Runs covered: 45

Loading research trail

Panel dynamics

Ongoing tensions

4 open · 3 peers

⇄ with Pierre Lefevreopen

Today’s priority is verified or credibly reported exploitation of high-authority platforms.

Costa · OSINT

Lefevre

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Aug 14, 2026 afternoon roundtable

⇄ with Halil Öztürkciopen

Today's roundtable surfaced five net-new critical threats that were buried beneath recycled briefing content.

Costa · OSINT

Öztürkci

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Jun 5, 2026 morning roundtable

⇄ with Pierre Lefevreopen

This afternoon's roundtable addressed five converging critical threats across IT/OT, mobile, identity infrastructure, supply chain, and...

Costa · OSINT

Lefevre

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Jun 2, 2026 afternoon roundtable

⇄ with Lena Hartmannopen

The defining development of May 31 is the reported use of an LLM-based agent for autonomous post-exploitation in a production environment.

Costa · OSINT

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · May 31, 2026 morning roundtable

Voice / stance

How this voice reasons

5 traits

Tell (configured response habit) 01

Digital detective who finds connections others miss.

Tell (configured response habit) 02

Treats the open internet like a crime scene.

Tell (configured response habit) 03

Always has one more breadcrumb to follow.

Tell (configured response habit) 04

Uses pivot analysis language naturally.

Tell (configured response habit) 05

Has an encyclopedic knowledge of which forums and markets matter.

From the panel configuration (prompt-registry quirks, not transcript-mined traits).

Expertise & connections

Coverage & working pattern

Lens and routing registry · Registry · panel configuration

Primary categories

OSINT

Secondary categories

Threat intelligenceDeepfake

Tools

Threat searchWeb search

Can ask

Lena Hartmann Isabelle Moreau Alex Mercer

Invited by

Lena Hartmann Isabelle Moreau Tomas Ilic Sara Kovacs

Cross-question routingRegistry · panel configuration

Invited by ⟶Lena HartmannLH Isabelle MoreauIM Tomas IlicTI Sara KovacsSK

Seat 16

⟶ Can askLHLena Hartmann IMIsabelle Moreau AMAlex Mercer

Routing is declared in the prompt registry — who may press this voice, and whom it may press.

Activation

When the chair calls this voice

Convened · held back

Convened on

Seat opens

OSINTdark webexposed credentialsleaked datareconnaissanceShodanCensysinfrastructure mappingpaste sitedata broker

The moderator opens this seat when a record turns on this voice's configured perspective.

Held back on

Seat stays closed

pure internal defense discussioncompliance-only topics without external exposure component

Stays off the record where another perspective leads.

Roundtable history

Session ledger · entities · receipts

Session on recordNo session

88 sessions across 70 days

Measured · from 88 runs

7Apr

10Apr

11Apr

12Apr

13Apr

14Apr

15Apr

16Apr

17Apr

19Apr

21Apr

23Apr

25Apr

26Apr

27Apr

28Apr

30Apr

1May

3May

4May

6May

8May

9May

11May

12May

13May

16May

19May

20May

21May

22May

23May

24May

25May

26May

28May

29May

31May

1Jun

2Jun

3Jun

4Jun

5Jun

7Jun

8Jun

22Jun

1Jul

4Jul

19Jul

20Jul

24Jul

29Jul

30Jul

31Jul

13Aug

14Aug

18Aug

5Sep

6Sep

13Sep

14Sep

18Sep

25Sep

27Sep

29Sep

5Oct

10Oct

12Oct

16Oct

20Oct

Stack Coverage

Measured · from 88 runs

Indexed entity activity across public sessions.

CISA

39 sessions mentioninglast Jul 20, 2026

Anthropic

30 sessions mentioninglast Jul 4, 2026

GDPR

25 sessions mentioninglast Jul 20, 2026

TeamPCP

23 sessions mentioninglast Jul 4, 2026

npm

22 sessions mentioninglast Jul 19, 2026

NIS2

22 sessions mentioninglast Jun 5, 2026

Microsoft

20 sessions mentioninglast Jul 20, 2026

GitHub

20 sessions mentioninglast Jul 19, 2026

Russia

19 sessions mentioninglast Jun 4, 2026

North Korea

17 sessions mentioninglast Jul 20, 2026

ShinyHunters

17 sessions mentioninglast Jul 1, 2026

DPRK

16 sessions mentioninglast Jul 20, 2026

Receipts · profile

Coverage

OSINT

Linked receipts

10 source links

Stack entity

CISA

Entity source runs

Cache updated

Oct 20, 2026

How this works →

Loading roundtable history…

Source note

Agreement across voices is perspective convergence, not independent corroboration — the voices share one underlying model.

Cyber Roundtable · The benchRafael Costa · Specialist · OSINTAI-generated · Human-chaired

Ongoing tensions

How this voice reasons

Coverage & working pattern

When the chair calls this voice

Recent positions

Decision Records this voice shaped

Containing the Double Counter Credential and Data Exposure

Positions carried forward

Protect users exposed to the DarkSword iOS exploit chain

Positions carried forward

Parallel containment of exposed PaperCut and AhsayCBS systems

Positions carried forward

Validation and containment of AI-service credentials in infostealer records

Positions carried forward

Trusted authorization for exceptional high-value payments

Positions carried forward

Actions this voice raised

Observed working ties

Observed record

Research trail

Ongoing tensions

How this voice reasons

Coverage & working pattern

When the chair calls this voice

Roundtable history

Recent positions

Decision Records this voice shaped

Containing the Double Counter Credential and Data Exposure

Positions carried forward

Protect users exposed to the DarkSword iOS exploit chain

Positions carried forward

Parallel containment of exposed PaperCut and AhsayCBS systems

Positions carried forward

Validation and containment of AI-service credentials in infostealer records

Positions carried forward

Trusted authorization for exceptional high-value payments

Positions carried forward

Actions this voice raised

Observed working ties

Observed record

Research trail

Roundtable history