A new academic study used AI agents to find 84 flaws in 4G and 5G core networks, 81 of them now assigned CVEs. Almost all trace back to a single habit: internal components trusting each other without checking. That is the same habit that collapsed OT and IT networks and vanishing air gaps quietly recreate, and it is exactly what cheap, fast-to-deploy decoys are built to catch. To ground that in something first-party, we also exposed our own cellular-gateway decoys three different ways and watched who turned up.
The paper, titled "Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysis," was posted to arXiv on July 11, 2026. The authors studied why security bugs keep appearing inside cellular core networks, the software that routes calls, data sessions, and signaling for billions of subscribers. They named a recurring pattern, implicit trust errors, where an internal component blindly accepts messages from an internal peer and skips syntactic checks, semantic checks, or resource-availability checks. This mattered little when cores ran on physically isolated equipment. It matters a great deal now that cores are cloud-native software where those internal interfaces can be reached.
To hunt for the pattern at scale, they built iFinder, a multi-agent system that pairs a large language model with the same code-navigation tools a human researcher uses, then cross-checks each candidate flaw against the relevant 3GPP specification to weed out the model's false positives. Notably for us, the tool is built on Anthropic's stack, using Claude Code for the initial root-cause study and the Claude Agent SDK with Claude Opus 4.5 for the agents. Pointed at seven prominent open-source cores, including Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF, it reported the following.
Beyond the open-source stacks, the team confirmed a session-hijacking flaw on real commercial 5G core software. In the User Plane Function, the component that actually forwards subscriber traffic, a missing uniqueness check on Packet Detection Rule identifiers lets an attacker inject a duplicate rule with higher priority and quietly redirect a victim's uplink traffic. One vendor, Dotouch, fixed it in its XproUPF product as CVE-2026-8233 (CVSS 4.6), and a related denial-of-service issue was assigned CVE-2026-8232.
Strip away the telecom specifics and the finding is universal. A system trusts a message because of where it came from rather than what it is. Inside a flat network, everything is inside, so everything is trusted. There is no gate between peers, no validation of a message that looks local, and no assumption that a neighbor could be lying. That is convenient to build and comfortable to operate, right up until one component is compromised or one message is spoofed.
The bug was never really the missing check. The bug was believing the inside of the network was a safe place, so the check felt unnecessary.
The core-network paper is one instance of this. The same shape shows up in a factory that runs every controller, historian, and engineering workstation on one subnet, in a hospital where clinical devices share a VLAN with staff laptops, and in any environment where getting one foot in the door means the rest of the room is wide open. The researchers simply proved, with 81 fresh CVEs, that the assumption fails the moment the perimeter is imperfect.
For decades, operational networks leaned on a physical answer to implicit trust. If the plant network is not connected to anything, then trusting everything inside it is defensible. That was the air gap, and it did real work. The trouble is that the gap has been filling in for years, and in most places it is now more story than fact.
Remote maintenance links, cloud dashboards, shared switches, and jump hosts have stitched the operational network back to everything else. Each connection is added for a good reason, and each one chips away at the isolation that made implicit trust survivable. What remains is often a flat, or nearly flat, environment carrying the same assumption the core-network researchers just punished: that internal equals safe. When that assumption is wrong on the plant floor, the stakes are physical, which is why we care about it here even though the study itself is about telecom.
Here we can stop reasoning by analogy and show our own data. Remote operational sites are almost never on a fixed line. A lift station, a substation, a tank farm, or a remote pump house sits where there is no fibre, so it gets an LTE or industrial cellular router, and the operational device lives behind it. That router is the site's entire perimeter: it handles the NAT, the VPN back to SCADA, often the serial-to-IP conversion, and it exposes a web admin plane because someone has to configure it from a truck. We replicate that shape in our decoy fleet in three deliberate postures, and running all three answers a question a single honeypot cannot: does the attacker see a router, a Linux box, or an RTU, and does it change what they do? It changes everything.
The figures below come from a sampled window of research traffic on our own decoy fleet between July 18 and August 1, 2026. They are log-derived, not console estimates, and we have kept the scope honest: these are samples rather than exhaustive counts, and a visible share of the source IPs are indiscriminate internet scanners rather than hands-on adversaries, which we return to at the end.
The SCALANCE gateway drew 654 distinct source IPs in the sample, an order of magnitude more than anything behind it. The traffic was overwhelmingly HTTP against the admin plane, with a side of SNMP device identification using the default public community string. Most of it was ordinary web probing, hits on /, /.env, /.git/config, and the SCALANCE-specific /SDK/webLanguage. The single most telling event was not a login at all. In one POST to /login, the username field carried a shell payload rather than a name:
username: ;`cat /etc/passwd`
That is not someone guessing a password. It is an attempt to break out of the login handler and run a command, which is the classic cellular-router failure mode, because these devices routinely shell out to system tools from their web CGI. Exposed as a router, the box gets attacked as a router.
The Lantronix device server told a completely different story. It saw straightforward credential spray, with admin and root leading, and on a successful login the session ran a compact, well-worn sequence: fingerprint the processor architecture with uname and a stack of fallbacks, then make a dropped binary executable and run it.
That is IoT-botnet boilerplate: identify the CPU, fetch the matching binary, execute. Nobody in that traffic knew or cared that the device is operational-technology gear. To them it was CPU cycles and bandwidth to conscript.
One of our research nodes emulating a power-station RTU is designed to sit behind an emulated Cradlepoint cellular edge, which presents its own HTTP admin plane, just as a real site would. On the web side, it mostly drew the same commodity exploitation as everything else: CGI path traversal such as /cgi-bin/../../bin/sh, PHPUnit remote-code-execution probes, and grabs at /config.json and /.git/config. A thin, more interesting layer sat on top: our detection tagged a handful of sessions as vendor-specific admin reconnaissance, including cradlepoint-admin-recon and even teltonika-admin-recon, someone fishing for a different cellular-router brand's console entirely. But the genuinely operational activity showed up only on nodes designed to emulate DNP3, where 88 to 96 percent of events were protocol commands dominated by one pattern:
This is DNP3 data-link address enumeration, the operational equivalent of a subnet scan. It walks destination addresses from 0 upward to find which outstations answer, it is completely invisible to anything that does not speak the protocol, and it appeared only on the nodes we built to emulate DNP3. It came from a much smaller population than the web noise hitting the gateway — and when we finally attributed that population, the answer turned out to be the most useful thing in this post.
The methodical walk from dst=0 upward looks exactly like targeting. It mostly is not. We recovered the source address for every industrial-protocol command on the fleet by joining each command back to its session record — 138,809 commands resolving to 1,347 distinct sources — and then ran live ARIN whois on every /24 carrying a hundred or more, sixty networks covering 97.2% of the traffic.
82.4% of every industrial-protocol command our fleet has ever recorded comes from two named commercial scanning organisations: Palo Alto Networks at 75.1% (205.210.31.0/24, 198.235.24.0/24, 147.185.132.0/22 — that is Xpanse, their attack-surface-management product) and Censys at 6.1%. You can check that yourself in about ten seconds: whois 205.210.31.0/24.
We built this analysis twice on the assumption that the sweep was adversarial — once in an earlier draft of this post, and once on a slide for our Black Hat talk — before doing the attribution and finding otherwise. We caught both in review, which is the only reason you are reading this version and not that one. It is worth saying plainly rather than quietly fixing: if you are not attributing your OT telemetry, most of what is alarming you is a vendor taking inventory. Subtract the scanners and the population genuinely touching industrial protocols is small — 34,629 commands from 1,210 addresses across four months.
So the contrast still holds, with a sharper edge on it: the HTML admin plane gets treated as generic internet furniture, the protocol draws a much smaller and more literate population, and even most of that is measurement rather than malice.
One more first-party number, because it is the one we get asked about most. Across three separate log engines and every industrial protocol we run — DNP3, Modbus, BACnet, EtherNet/IP, IEC-104 — we have never recorded a single write, control or restart command. Not one. To be precise about the window, because it matters: that is three capture periods between 9 April and 2 August 2026 — 9–18 April, 4–12 July, and 23 July onward — roughly thirty days of logs, not four continuous months. Our nodes rotate and several cap at 20,000 session files, so the gaps are storage, not quiet. What we have recorded is identification: function codes that mean "tell me what you are", and they dominate every window we have looked at.
The plant floor is reachable, it answers, and on our sensors almost everything talking to it is taking inventory rather than touching anything.
That is a statement about our decoys, not about the world — and the distinction matters a great deal right now. Over the weekend of 26–27 July, a coordinated attack disrupted operational technology at more than thirty Minnesota water and wastewater utilities. In Braham, population about 1,700, operating controls were locked out and the treatment plant went offline for roughly two hours before crews restored it by manual override. Other towns contained it by pulling cellular modems off the network. FBI and CISA had already expanded advisory AA26-097A on 22 July to cover Iranian-affiliated actors exploiting internet-exposed PLCs, and preliminary US assessments link the Minnesota campaign to that activity — though attribution remains under federal investigation and may move. Adversaries are demonstrably willing and able to take OT offline.
So read our zero for exactly what it is. On our decoys, in this window, the traffic is mostly mapping — and mapping is what pre-positioning looks like before it becomes something else. Volt Typhoon sat inside a Massachusetts light and water department for more than 300 days doing nothing but collecting. A quiet sensor is not a safe one. It is the argument for instrumenting the front door now, while what is reaching it is still mostly reconnaissance.
The textbook fix for implicit trust is to stop trusting by location, through segmentation, message validation, and zero-trust internal design. Those are the right long-term investments and they are also slow, expensive, and disruptive to retrofit onto a live operational network. This is where deception earns its place, not as a replacement for segmentation but as the fast, low-cost layer you can put down while the harder work is underway.
The economics are the point. A decoy has no real job, so it generates no normal traffic and very few false positives, and the single alert it does raise carries a clear meaning: someone is moving where they should not be. Decoys can be stood up in minutes rather than months, they do not require re-architecting a running plant, and a handful placed along the likely paths into and across a converged network give defenders exactly what implicit trust takes away, which is a reason to notice an internal message that only looks legitimate.
