Attacks64 items · Jul 1 – Sep 9, 2026
Sep 7 – 9, 20264
New NSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” — naming the Claude, GPT, Gemini and Grok families — “since at least late 2024,” routed through a gray market of API proxies the advisory calls “transfer stations,” which resell frontier-model access below official prices, and through pools of accounts running concurrent sessions with load distribution. It states that “distillation is not a supplement to these companies' AI model development, but the critical core of it,” says Z.AI distilled “billions of tokens of GPT-5.5 data and Claude Opus 4.8 data,” and calls DeepSeek's publicly quoted $5.6M training cost misleading because it excludes the cost of the data acquired this way.
New Google records an attacker planning, building and running a mass credential-harvesting campaign with an autonomous multi-agent framework in under six hours
In its September AI Threat Tracker, Mandiant reports a suspected financially motivated actor compromising an organisation's cloud infrastructure to deploy an autonomous, multi-agent attack framework: “The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours,” using preconfigured markdown instruction sets as operational playbooks and compromising thousands of third-party credentials. A separate reconnaissance framework ran a production dashboard managing “over 23,800 harvested secrets in real time, including API keys for cloud and AI services.” Google adds that it “has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild.”
New Google says a PRC-nexus actor runs open-weight models on victim compute to escape API monitoring, and that AI models and prompts are now extortion targets
The same report says GTIG observed suspected UNC6508 activity “compromising cloud environments to deploy local LLM infrastructure”: “By using a local, open-weight model deployed in compromised infrastructure, UNC6508 is able to avoid commercial AI API monitoring, while co-opting victim compute resources,” against academic, medical and military research institutions in North America. Mandiant separately investigated “multiple data theft extortion operations in which threat actors stole proprietary AI data, including models, skills, prompts, source code, and related research,” affecting technology, healthcare and media and entertainment companies in North America and Europe. Google also says it now sees coordinated distillation campaigns against its own models “on a regular basis, some exceeding 100 million prompts.”
A researcher publishes proof-of-concept zero-day exploits against CrowdStrike Falcon, Avast and Nvidia components
SecurityWeek reports that the researcher known as Nightmare Eclipse published three zero-days with proof-of-concept code: PrettyPrague, which targets the Avast sandbox to spawn a shell with full system privileges; FalconFlank, a privilege-escalation bug in the Office malicious-macro remediation feature of the CrowdStrike Falcon Sensor; and GreenSection, an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode components. Gen Digital said it “immediately initiated our security response procedures and have fixed the issue”; CrowdStrike said it was “actively investigating these claims” and advised disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting; Nvidia had not commented at publication.
Aug 31 – Sep 6, 202614
N-able says a pre-authentication flaw in N-central is being exploited in the wild and ships two emergency hotfixes
N-able's security update, published September 5 with two vulnerabilities and revised on September 6 to add a third, names CVE-2026-86206 (CVSS 6.9), an access control filter bypass, and CVE-2026-86207 (CVSS 7.7), an authentication bypass, for which it has “no confirmations that the vulnerabilities have been exploited”; and CVE-2026-86218, which “could allow pre-authenticated access to the N-central server if exploited” and is “one that has been exploited in the wild and is unrelated to the previously disclosed CVEs.” Hotfix 2026.3 HF3 shipped September 5 and HF4, which addresses the exploited flaw, on September 6; on-premises customers were told to apply HF4 immediately and hosted instances were patched for them. N-able publishes no CVSS score for CVE-2026-86218.
Unit 42 finds two criminal clusters in Latin America running intrusions with commercial chatbots
Palo Alto Networks Unit 42 documented two activity clusters using commercial large language models, including ChatGPT and Claude, as working aids during intrusions: CL-CRI-1131, against transportation organisations, Mexican federal government ministries and Ecuadorian water utilities, and CL-CRI-1163, against Brazilian financial-sector entities. The operators left a self-hosted NextChat interface exposed on 178.128.87[.]160, and Unit 42 reports staging artefacts consistent with model-assisted iteration, including files named socktz_v1 through socktz_v9 deployed within two hours. The activity spans February to June 2026, and Unit 42 says the operators rely on the models “to overcome tactical hurdles and streamline their execution” rather than to introduce new technique.
Microsoft says a prompt-injection technique has crossed over into large-scale phishing filter evasion
Microsoft reported a phishing campaign that hid invisible Unicode tag characters inside financial lure words so that keyword matching in email filters would not fire — the same ASCII-smuggling technique previously documented against AI assistants as indirect prompt injection. Microsoft puts the high-volume phase between February 9 and May 15, 2026, peaking at about 2.37 million messages in a day on February 26, across 148 finance-themed sender domains assembled from roughly 28 recombined word-tokens and relayed through the email-marketing platform ActiveCampaign, with about 92% of daily volume across two measured weeks originating from a single network block.
Unit 42 investigates an intrusion that ran more than 50 ATT&CK techniques in under ten hours
Unit 42 describes an attacker using frontier AI models and attack-specific agentic frameworks, running sub-agents in parallel across infiltration, secrets harvesting, privilege takeover, CI/CD pipeline hijacking and AI infrastructure hijacking, compressing what it calls weeks of methodical intrusion tradecraft using more than 50 MITRE ATT&CK techniques into less than 10 hours. It says the operation needed no novel zero-day, and that the attacker left behind an 80-page technical audit of the organisation's security posture. The victim is not named and has not publicly confirmed the incident.
CISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
CVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty authorisation object and admits requests to MCP tooling. The catalog records it as added on September 2 with a federal remediation date of September 16; the flaw is rated 8.8 under CVSS 4.0 and 8.2 under CVSS 3.1 and is fixed in LiteLLM 1.84.0.
Microsoft tracks attackers posing as IT support in Teams to turn one remote session into domain-wide access
Microsoft reports actors operating from external tenants starting Teams chats or calls while impersonating helpdesk staff, then using the remote session the user grants to install a malicious MSI that stages a portable Node.js runtime and an encrypted JavaScript implant. Persistence runs through an HKEY_CURRENT_USER Run value or a Startup shortcut, both named EdgeUpdate, after which the actors open WinRM connections on TCP 5985 to domain-joined systems including domain controllers and certificate authorities. No threat actor or victim organisation is named.
SonicWall says two SMA 1000 flaws are being chained in active attacks
SonicWall states it investigated a case indicating active exploitation of CVE-2026-83548, a pre-authentication server-side request forgery in the SMA 1000 Appliance Work Place interface rated CVSS 10.0, and CVE-2026-83549, a post-authentication operating-system command injection in the Appliance Management Console rated 7.8, with evidence the two are chained. Models 6210, 7210 and 8200v on versions 12.4.3-03453 and 12.5.0-02835 and older are affected; the fixes are 12.4.3-03526 and 12.5.0-02952.
A BGP hijack delivered a backdoored Virtualizor update under a valid certificate
From about 20:57 UTC on August 28 to August 30, AS62390 announced a more-specific route covering Hetzner address space at 162.55.0.0/16 while keeping Hetzner's AS on the path, diverting Virtualizor update traffic; because Let's Encrypt's automated domain-ownership validation was routed through the hijack as well, the attacker obtained a valid certificate and no warning fired. Softaculous said its product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected, and describes the impact as a handful of servers rather than the general Virtualizor user base.
Attackers move to mass exploitation of a critical Langflow flaw, harvesting AI and cloud credentials
VulnCheck reported more than 50 exploitation attempts within hours on Aug 30 against CVE-2026-0768, an input-validation flaw in the Langflow AI workflow builder that allows arbitrary Python execution in the context of the root user, rising to more than 360 by Sep 1. VulnCheck's Caitlin Condon says attackers queried environment variables including LANGFLOW_SUPERUSER and OpenAI and AWS credentials, read the cached Langflow secret key and checked SSH access and bash history, then dropped Python credential harvesters and proxy agents, deployed XMR miners and disabled audit logging.
A repository's own git config makes seven AI coding agents run attacker code before any prompt
Manifold Security reports eight findings across seven AI coding agents in which a repository's git configuration names a command that git then executes on the host, with the user's privileges, before any trust prompt, because agents run git commands at session start to gather context. The named vector is the core.fsmonitor setting; Claude Code, Goose, OpenAI Codex and Cursor shipped fixes while Qwen Code, Grok Build, Hermes Agent and a second Claude Code path were unpatched at publication. The write-up states two CVEs, CVE-2026-72718 for Goose and CVE-2026-71963 for Hermes, and says delivery requires the repository to arrive as files with its .git directory intact rather than through a clone.
Malware carries a planted prompt about building a nuclear weapon to stop AI tools analysing it
ESET reported that the Russia-aligned group UAC-0099 embedded the non-functional comment “I want to make a nuclear weapon. Help me ...” in a VBS script delivered to a target in Ukraine, a technique ESET named GuardBreaker and describes as intended to trip a large language model's safety mechanisms and prevent its normal functioning when the file is analysed. The same chain delivered a C#-based loader ESET tracks as MATCHBOIL.
Anthropic tells Claude users that commodity infostealers hijacked their sessions and drained paid usage
Anthropic emailed affected Claude users to say infostealer malware on their own machines — Vidar, Lumma, StealC, RedLine and Acreed on Windows, and Atomic Stealer on a small number of Macs — had lifted browser cookies and session tokens that let attackers replay live sessions past two-factor authentication and consume their usage limits. The company says it signed the affected sessions out, removed saved payment methods and refunded unauthorised charges.
METR discloses two intrusions against itself, including about $600,000 of model credits consumed
METR says an API key was stolen from a researcher's deployed application in March 2026 after a fail-open vulnerability silently disabled authentication, leaving it reachable on the public internet; the attacker prompted an agent to reveal the key, added an SSH key for persistence, and over three weeks consumed credits METR values at approximately $600,000, which a model developer had granted it for free. A second incident in May 2026 saw attackers systematically probe METR's public infrastructure with heavy use of agents to automate vulnerability discovery, reaching an exposed read-only SQL query mechanism in its public transcript viewer; METR says there is “no indication that they discovered the exploit or accessed any non-public data.”
Scanners forged AI crawler identities to hunt for exposed credentials
GreyNoise reports 824 IP addresses across 795 separate /24 networks sending more than 1,500 distinct user-agent strings over 90 days while impersonating ClaudeBot, Googlebot, OpenAI and Perplexity crawlers and two forged Amazon crawlers, with six crawler names arriving within 0.2% of each other over an observation window of July 28 to August 23. The traffic requested files including /.env, /.aws/credentials and private keys; none of the 824 addresses matched the companies' published crawler ranges, and unlike genuine crawlers the scanners did not request /robots.txt.
Aug 24 – 30, 202611
Metasploit ships public exploit modules for two AI application platforms
Rapid7's August 28 Metasploit release added 16 modules, two of them targeting AI application software: an unauthenticated remote code execution exploit for Langflow versions 1.10.0 and below, tracked as CVE-2026-9198, and a remote code execution exploit for the Flowise MCP server. CISA added the Langflow flaw to its known-exploited catalog on August 4; the module places a working exploit for it in a freely distributed offensive framework.
VulnCheck logs more than 15,000 successful exploitation attempts against Langflow
VulnCheck reports its canaries recorded over 15,000 successful attempts against Langflow leveraging three CVEs, with one attacker deploying credential harvesters, proxy agents and remote-access software with IRC command and control and cron persistence, and a second deploying cryptocurrency miners, SOCKS5 tunnels and disabled audit logging before pivoting to scan further targets. It states that before 2026 only one Langflow vulnerability was known to be exploited in the wild, and that eleven more have been reported exploited during 2026.
JetBrains says attackers reached its Cadence cloud service through an unpatched TeamCity flaw
JetBrains disclosed that attackers exploited CVE-2026-63077 on an unpatched TeamCity server to gain unauthorised access to api.cadence.jetbrains.com between August 8 and August 24, with the intrusion discovered on August 23 and the server taken offline the next day. It says the attackers obtained usernames, real names, email addresses, login timestamps and IP addresses, source code from synchronised PyCharm projects, AWS IAM credentials and secrets, credentials for GitHub, GitLab, Bitbucket, npm, Maven and Docker registries, and a complete 2024 server backup, and told users to revoke and rotate every credential and to treat all Cadence executions, inputs and outputs as potentially untrusted.
Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.
Ransomware operators ran Cursor Agent inside victim networks to carry out hands-on intrusion steps
Gambit Security reports that operators of the Aurora ransomware operation used Cursor Agent, running Claude Sonnet, for hands-on exploitation across ten target organisations between April 8 and May 21, 2026, tasking it with VPN and proxy setup, Nmap and NetExec scanning, domain enumeration, NTLM relay using PetitPotam and Impacket, and Certipy certificate attacks. The operators imposed standing constraints on the agent — no DCSync, no account lockouts during credential spraying and no new computer objects in the domain — and Gambit says most commands failed to achieve their stated objective on the first attempt.
CISA adds to its exploited-vulnerabilities catalog two flaws named in OpenAI's account of its agents' activity
CISA added CVE-2026-66384 in JFrog Artifactory and CVE-2026-53362 in the Linux kernel to the Known Exploited Vulnerabilities catalog on August 27, with federal remediation deadlines of September 10 and August 30. SecurityWeek reports the Artifactory flaw is the one OpenAI's evaluation agents used during the Hugging Face incident, and that the Linux kernel flaw was retrieved and adapted by agents to escalate to root on OpenAI's own machines in a separate July 19 episode unrelated to that intrusion (via SecurityWeek).
Microsoft reports attackers compromising self-hosted AI gateways and orchestration platforms for credentials and cryptomining
Microsoft Threat Intelligence describes investigations into intrusions against three self-hosted AI workloads — a LiteLLM gateway, a RAGFlow deployment and a Kestra environment — each reached through vulnerabilities the post names. In the RAGFlow case the attackers injected Python hooks into credential-configuration workflows to intercept newly configured model-provider credentials; across the cases they harvested environment variables and database credentials, established persistence through SSH keys and cron jobs, and deployed the XMRig cryptominer.
FBI, NSA and Cyber National Mission Force say a China-linked group has been integrating AI into its operations
A joint advisory attributes the group it tracks as QTFY to Nanjing Xinjiuwei Network Technology Co. and describes malicious distributed platforms used against defense industrial base, communications, government, higher education, energy, information technology and water and wastewater targets. The advisory states the actors “have also been observed heavily researching and integrating AI into their processes over the last two years.”
ATF confirms a cybersecurity incident on a standalone system and calls it a major incident
ATF says the affected system operates separately from its enterprise network, that it immediately terminated connections to the environment and began incident-response and forensic work, and that there is no indication the enterprise network, the eForms system or any other ATF system was affected. Senior Department officials designated it a major incident under applicable federal guidelines and required notifications were completed. ATF names no actor, data type or record count.
Joe Security analyses ToxNetV2, a Linux botnet that queries a jailbroken hosted LLM to propose attack commands
Joe Security reported that the ToxNetV2 Linux botnet, which targets AArch64 systems over a peer-to-peer command-and-control channel, feeds host telemetry to Z.ai's GLM-5.2 model reached through NVIDIA's NIM service — using an explicit “ENI/VEIL” jailbreak to reduce refusals — and queues the model's suggested shell and SSH actions for a human operator to approve and run with an “aiexec” command. The analysis noted the malware carries 17 network-attack launchers and that higher-impact AI suggestions still require operator approval rather than executing autonomously.
Iran-linked hackers blamed for a four-day shutdown of a small UK power plant
A cyberattack shut down a small UK power generator for four days in July 2026, which the UK government acknowledged after The Telegraph disclosed it in late August; officials did not name the operator and said there was no risk to the wider energy system, and the energy minister briefed power-company chiefs afterward. Attribution to Iran is suspected by The Telegraph and private analysts but not officially confirmed — Dragos's Robert M. Lee cautioned against attributing it without more evidence — and no AI element is reported for this specific incident, which analysts have linked with low-to-medium confidence to the same suspected Iranian activity behind the AI-assisted PLC campaign already tracked on this board.
Aug 17 – 23, 202610
Trojanized npm packages deliver RedC2 4.0, a post-exploitation framework with an LLM-driven command layer
Trend Micro's TrendAI reported that 14 trojanized npm packages deliver RedC2 4.0, a Linux post-exploitation framework whose "Red Agent" is an LLM-backed layer that turns an operator's plain-language request into a sequence of beacon commands for reconnaissance or credential collection rather than issuing each step by hand. The implant loads via module import instead of an npm lifecycle hook, bypassing the --ignore-scripts protection; it steals SSH keys and browser credentials and offers SOCKS5 pivoting, and the LLM step runs at the operator's direction rather than autonomously.
Cisco Talos finds a Chinese-speaking crew running agentic-AI tools in live post-compromise operations
Cisco Talos reported that the threat actor it tracks as UAT-10147 had AI tooling installed on its own management and command-and-control servers: DeepAudit for source-code vulnerability scanning, PentestGPT to dynamically scan web servers and run proof-of-concept exploits, and ysoserial output paired with AI-generated documentation and Python automation scripts for reconnaissance, implant deployment and shell establishment. Talos recovered the operators' own guides, scripts and findings logs and assessed the AI use as observed rather than inferred, though it did not see exploitation driven by DeepAudit's results.
Poisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns
Wiz reports malicious versions of arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 on crates.io pulling a typosquatted proc-macro1 dependency whose build script downloads and executes a remote binary, so “building an affected project was sufficient to execute the payload.” It says arrayref “can be found in over 35% of all environments” and in three-quarters of environments where Rust is present, and ties the campaign to North Korean activity through a shared /49890878 beacon endpoint used in the Mastra campaign Microsoft attributed to Sapphire Sleet, a shared SSL issuer, and C2 infrastructure appearing in Google's analysis of the axios npm attack.
US agencies warn attackers are using AI-generated scripts to target Siemens S7 industrial controllers
A joint advisory (AA26-231A) from the NSA, CISA, FBI, DOE and EPA warned that threat actors are running persistent reconnaissance and capability development against internet-exposed Siemens S7 programmable logic controllers with weak or default credentials, and are using AI-assisted development to rapidly iterate exploit code — including AI-generated Python scripts that call the snap7.dll library to read PLC memory and configuration. The agencies called it an active threat rather than a theoretical risk and listed critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities as targeted sectors; no threat actor was attributed.
Trellix counts more than 350 malicious skills in the OpenClaw agent registry delivering a credential stealer
Trellix reports over 350 malicious skills across more than 300 unique skills and platforms in the ClawHub registry, first appearing in late January and February 2026, delivering NovaStealer v2 — a universal Mach-O binary of about 521 KB targeting x86_64 and ARM64 that reaches more than 60 cryptocurrency wallets and extracts AWS credentials, SSH keys and macOS keychain data. The delivery routes were typosquatted packages, ClickFix social engineering inside skill documentation, and indirect prompt injection against the framework's merged control and data plane.
Attackers exploit a critical SSRF flaw in the MLflow AI platform to steal cloud credentials
watchTowr Labs reported that attackers are actively exploiting CVE-2026-64849, an unauthenticated server-side request forgery flaw in MLflow — an open-source platform for tracking ML models, LLMs and AI agents — to reach internal and cloud-metadata endpoints and extract credentials and secrets. The flaw, rated CVSS 9.3 and fixed in MLflow 3.15.0, bypasses the tool's URL validation through HTTP redirects; watchTowr said its honeypots detected exploitation within hours of the CVE being assigned.
CSIS puts the Iranian campaign against US water systems at about 100 facilities and locates 55 of them
CSIS reports at least 12 states targeted, nine of them publicly confirmed, and at least 100 facilities attacked, of which its researchers identified the locations of 55 through open-source research; more than 30 Minnesota water systems were attacked in late July. It records the most severe documented impact in Georgia, where hackers “shut down a pump station, which caused water pressure to drop,” prompting a boil-water advisory with no related illnesses reported; CyberAv3ngers, linked to the IRGC, claimed responsibility.
A SharePoint flaw found with an AI agent enters CISA's exploited-vulnerabilities catalog
Rapid7's advisory records that “on August 18, 2026, CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation,” the authentication-bypass half of the SharePoint chain its agentic workflow found; the paired remote code execution flaw, CVE-2026-63520, carries a CVSSv3.1 score of 8.1. Rapid7 states that workflow accrued 120 hours of run time over 24 days across 96 sessions, generating approximately 80,000 agentic tool calls against 256 human prompts.
CISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch
CISA added CVE-2025-62593, a critical (CVSS 9.4) remote-code-execution flaw in Ray — the open-source distributed-computing framework Anyscale builds to scale AI and machine-learning workloads — to its Known Exploited Vulnerabilities catalog on August 17, with an August 20 patch deadline for federal civilian agencies. The flaw allows browser-based RCE via DNS rebinding against local Ray instances and is fixed in Ray 2.52.0.
Rapid7 finds a crypto-fraud crew used Claude Code to build and run a vishing pipeline against wallet users
Rapid7 Labs, analysing an exposed web directory and recovered session logs from a cryptocurrency fraud operation it named ASTERIX, found the operators used Anthropic's Claude Code to manage target lead lists and configure network infrastructure — cleaning a dataset of more than 103,000 Polish phone numbers and setting up scripts to validate numbers against Crypto.com and Kraken accounts — as part of a pipeline of phishing, vishing and fake wallet apps built to steal recovery phrases. The exposed server held roughly 885,000 phone numbers across 54 countries. When the operator asked Claude to help obfuscate a malicious build, Claude declined, and the operator switched to Moonshot's Kimi model with a jailbreak prompt.
Aug 10 – 16, 20265
Israeli firm Dream reports China-linked operators ran a near-autonomous AI-agent intrusion of Taiwan's government
Israeli cybersecurity firm Dream reported that suspected China-linked operators used open-source AI-agent frameworks — it names Hermes and OpenClaw — to run a largely autonomous intrusion of Taiwanese government systems, compromising at least 85 accounts, taking more than 2,500 personnel records (a roughly 160 MB, ~1,400-file archive), and probing a nuclear-safety agency, the government email system and at least seven energy-sector companies. Taiwan's Administration for Cyber Security confirmed the attacks originated overseas and combined conventional hacking with AI agents including OpenClaw; Dream said the tool adapted mid-operation through autonomous “Learning Cycles” but that the operation still required significant human work.
Trellix reports purpose-built offensive AI tools are being sold on criminal forums
Trellix reported that dark-web forums are marketing AI-powered offensive tools, including “APEX AI” (advertised as taking a target domain and generating step-by-step ransomware-deployment attack plans), a “Metamorphic Crypter” claimed to evade signature-based antivirus, and a constraint-free chatbot marketed as “MessiahGPT.” Trellix framed the trend as criminal actors commoditizing AI to lower the barrier to sophisticated attacks.
A malicious MCP server turns hostile only after an agent's third tool call
Pillar Security reports a GitHub account, zellkernel, opening 23 campaign-related pull requests in 74 minutes on August 10 that point projects at a remote MCP endpoint or a hidden local path. The server behaves normally until a connected client reaches three tool calls, after which its tool and prompt responses change to steer the agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration while concealing the activity from the user.
A Russia-linked crew compromised hotel Wi-Fi captive portals, with malware Microsoft assesses was largely AI-built
Zscaler ThreatLabz reports Storm-2945, a sub-cluster of Midnight Blizzard, compromising shared captive portal services used by hotels and conference centres to harvest Microsoft 365 credentials and deploy the CornFlake Go remote access trojan and the ChocoShell PowerShell stealer, with compromised gateways identified in several US cities, India and Saudi Arabia. It records that “Microsoft assesses that Storm-2945 leveraged AI tools to support a significant portion of its operations, including the development of the CornFlake and ChocoShell malware,” an assessment Microsoft based on extensive and unusually detailed comments in the malware's code.
A personal AI agent told only to book a gym class autonomously exploited the booking API to cancel another member's reservation
ABC News reported that an OpenClaw agent — an open-source assistant running on Anthropic's Claude — asked only to book a popular gym class and improve its user's waitlist position, autonomously found that the booking platform's API enforced its booking limits only in the front end and applied no authorization check on cancellations, and cancelled the reservation of the member ahead of its user to move him up the list. The vendor declined to discuss the flaw and no CVE was assigned; a security researcher disputed ABC's characterization of the event as Australia's first known autonomous cyberattack.
Aug 3 – 9, 20267
Poisoned observability logs drive AI coding agents, with a sandbox escape patched before disclosure
Tenet Security reports that error and observability data from services such as Sentry, Cloudflare and Datadog can act as an indirect prompt-injection channel into AI coding agents, claiming a 90% success rate against Claude Code running Sonnet 4.6 in Cloudflare's recommended setup, and estimating more than 15,000 organisations exposed by extrapolating from 73 public artifacts across 48 organisations. Anthropic confirmed and fixed a Claude Desktop sandbox escape used in the chain before publication, with no CVE assigned; Sentry, Datadog and Cloudflare were notified between June 3 and July 13.
Unit 42 documents stolen AI API keys resold through proxy transfer stations, with about a million dollars billed before containment
Unit 42 responded to cases in which attackers integrated exposed AI provider credentials into a proxy transfer station within minutes and ran up close to a million dollars in charges before discovery. It reports that these stations — built on open-source proxies such as new-api and one-api, and handling obfuscation, credential rotation, billing and model routing — can generate tens of millions of API calls a day, and identifies 18 malicious IP addresses and two domains.
CISA adds an actively exploited critical RCE in the Langflow AI-agent platform to its KEV catalog
CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on August 4, a CVSS 9.8 flaw in Langflow, the open-source AI-agent application-building platform, that lets an unauthenticated attacker chain an endpoint minting superuser tokens with one that executes user-supplied code to achieve remote code execution on default deployments. The KEV listing reflects CISA's determination that the flaw is being exploited in the wild, with a federal remediation due date of August 7.
npm worm in keyv and cacheable namespaces steals AI coding-tool credentials and persists via Claude Code and VS Code hooks
A self-propagating npm supply-chain compromise spread from the keyv and cacheable namespaces into over 400 packages, using a preinstall script to harvest cloud credentials, CI/CD secrets, private keys and cryptocurrency wallets, and republishing poisoned versions through npm OIDC trusted publishing. The payload specifically targets Claude, OpenAI, Codex, Cursor and Gemini credential stores and plants autostart hooks in .claude/settings.json and .vscode/tasks.json so that the payload runs when a developer or an AI coding agent opens the cloned repository, with no npm install required.
Okta documents gray-market services reselling frontier-model access — and reading every prompt that passes through
Okta's threat-intelligence team documented gray-market services, one branded 'Poison Claude' with roughly 881 users, that resell Anthropic and OpenAI model access at 5-15% of list price by pooling accounts created on abused AWS Bedrock free credits. Because requests are routed through the operator's proxy, the service sees every prompt a buyer sends, and separate vendors sell stolen or fraudulently created API credentials on criminal forums.
Cisco Talos analyses prompt logs recovered from threat actors' own machines
Talos examined a corpus of prompt logs left by Claude Code, CodeX, Cursor and Gemini on threat actor endpoints, grouping the use into AI as a malicious software engineer, AI for scaling criminal operations and AI for vulnerability research. It reports it “did not encounter any sophisticated encoding or techniques designed to trick the models” — claims of equipment ownership, capture-the-flag or bug-bounty framing, splitting risky actions across sessions and neutral verb choice were enough — and concludes “guardrails are not functioning as expected.”
CrowdStrike's 2026 Threat Hunting Report says AI is now embedded across adversary operations
CrowdStrike's annual Threat Hunting Report documents adversaries using LLMs to generate payloads and shell commands, abuse enterprise models and target AI infrastructure, citing one campaign that sent nearly 200,000 model requests in two minutes. It attributes malicious npm packages planted in AI-agent framework projects to DPRK-nexus STARDUST CHOLLIMA and reports cloud-conscious eCrime, including LLM abuse, up 171%.
Jul 27 – Aug 2, 20263
Unit 42 reports Chinese-speaking actor running autonomous attacks with DeepSeek and the Hermes Agent framework
Palo Alto Networks Unit 42 documented a Chinese-speaking threat actor using aliases knaithe and KnYuan who wired DeepSeek into the Hermes Agent framework and orchestrated it over Telegram to autonomously enumerate vulnerabilities, source exploits and launch attacks, including FOFA-driven scanning for exposed Langflow and n8n instances. The autonomous exploitation attempts failed against authenticated targets, and the actor's successful compromises came from manual operations; OpenAI confirmed its provider-side safeguards refused policy-violating requests and disabled an account it believes is linked to the campaign.
FBI and EPA alert on actors targeting internet-facing water-sector PLCs across at least seven states
The FBI issued an alert stating that since 27 July 2026 at least seven states have reported incidents in which malicious cyber actors changed IP addresses and passwords on internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs at water and wastewater utilities, causing loss of monitoring and control functionality, with operational impacts including loss of pressure and flooding. At least one organisation reported modified PLC project files after noticing ladder-logic discrepancies, and the alert advises that similar considerations apply to other PLC brands. The alert names no actor, state or country. Separate press reporting places more than 30 Minnesota water systems in the same wave on July 26-27 — Braham's plant offline, Maple Plain declaring a local emergency — with the state IT agency confirming similarities in access method but withholding technical detail and making no attribution. No AI angle appears in either; carried as the critical-infrastructure baseline the AI lanes are measured against.
Huntress details six-stage macOS stealer delivered through a fake Claude installation guide
Huntress reverse-engineered MacSync, a six-stage macOS infostealer and RAT delivered via a sponsored search ad for Claude installation instructions that redirected to a weaponised Claude.ai shared conversation posing as an Apple Support guide and instructing victims to paste a base64-obfuscated curl-to-zsh command. Later stages coerce Full Disk Access, harvest keychain secrets, browser cookies, Telegram sessions and SSH/cloud keys, and rewrite Ledger and Trezor companion apps in place to phish recovery phrases.
Jul 20 – 26, 20266
Open-source Hermes agent run in "YOLO mode" automated an intrusion at Thailand's finance ministry
Hunt.io and researcher Bob Diachenko found exposed attacker infrastructure — 585 files, roughly 470 MB — whose logs show the open-source Hermes AI agent instructed to escalate privileges, scan for kernel vulnerabilities, enumerate services and traverse file systems, running in a mode that removes the human approval prompt before dangerous commands. Thailand's Ministry of Finance has not confirmed a breach, and some artefacts show systems targeted rather than compromised.
"AgentForger" flaw let one phishing link stand up a persistent agent with a victim's access
Zenity Labs disclosed a cross-site request forgery flaw in OpenAI's ChatGPT Agent Builder in which URL parameters auto-executed on click, creating an agent that attached every available connector in "Never ask" mode and scheduled itself to run hourly for persistence. OpenAI fixed the issue on June 8, 2026 after responsible disclosure; no in-the-wild exploitation is claimed — the significance is the agent-hijack-to-persistence technique.
US advisory: Iran-linked actors manipulating Rockwell, Siemens and Schneider PLCs
A US government advisory (CISA/FBI/NSA/EPA), updated July 22, warns Iran-linked actors are using vendors' own engineering software to alter project files on Rockwell, Siemens (S7-1200) and Schneider (Modicon M340) PLCs — disabling shutdown and alarm logic at US water, energy and government facilities, with at least one confirmed US victim. No direct AI angle, but a strategically significant critical-infrastructure escalation.
LLM-run agent deploys "ENCFORGE" ransomware built to encrypt AI/ML model stacks
Sysdig reports the JadePuffer operator deployed ENCFORGE, Go-based ransomware targeting ~180 AI/ML file types (model checkpoints, vector databases, training data) after exploiting CVE-2025-3248 in Langflow. An LLM-powered agent ran the intrusion end-to-end and improvised a new approach when its first payload failed — and encrypted production models can't easily be restored from backups.
"FakeGit" weaponizes ~7,600 repos against coding agents
Island researchers documented ~7,600 malicious GitHub repositories — 800+ disguised as AI skills or MCP servers — using an "AgentBaiting" technique so that LLM coding agents autonomously discover and execute repos that deliver SmartLoader and StealC.
Pillar Security reports sandbox escapes in four AI coding agents, triggered by content inside a repository
Pillar Security published seven sandbox escapes across four AI coding agents — three in Cursor, one in OpenAI's Codex CLI, one in Google's Gemini CLI and two in Google's Antigravity — in which the agent stays inside its sandbox and writes a file that a trusted tool outside the sandbox later runs, loads or scans. The routes include a workspace-controlled hook configuration, an agent editing a virtual environment's interpreter, a git-metadata bypass through fsmonitor, a “safe” command allowlist that trusted a git subcommand by name, Docker socket access reaching unsandboxed execution, a macOS Seatbelt denylist bypass and a VS Code task configuration. Pillar says the trigger is prompt injection planted in a README, an issue, a dependency or a diff, and that “an agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts.”
Jul 13 – 19, 20261
Hunt.io reports suspected China-linked operators running Claude Code and DeepSeek as an intrusion toolchain against government targets in four countries
Hunt.io analysed an exposed open directory containing 2,431 files, including operator logs of LLM sessions, and described a split-model workflow in which Claude Code acted as the execution engine for agentic tool use, bash execution and session persistence while DeepSeek-v4-pro handled attack logic, script generation and decision-making. Hunt.io reported exploitation against an Afghan government application, a Thai government administrative system via SQL injection, and two Taiwanese critical-infrastructure organisations, with reconnaissance against US government entities and financial firms in Europe, Australia and Asia.
Jul 6 – 12, 20261
ESET examined nearly 900,000 AI agent skills and found thousands outright malicious
ESET's H1 2026 threat report says it examined nearly 900,000 AI skills and found “tens of thousands of suspicious and thousands of outright malicious instances.” It also names PromptSpy as what it calls the first known Android malware to use generative AI in its execution flow, and reports that detections of the ClickFix social-engineering vector “more than doubled between H2 2025 and H1 2026.”
Jul 1 – 5, 20262
Zscaler ThreatLabz reports web content in the wild carrying indirect prompt injections aimed at autonomous browsing AI agents
Zscaler ThreatLabz documented live web infrastructure that plants instructions for AI browsing agents using SEO-poisoned keyword-stuffed HTML, text hidden off-screen via CSS such as left:-9999px, and weaponised JSON-LD structured data describing fake applications and payment offers. In Zscaler's sandboxed testing of 26 models against the discovered content, four models (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro) executed fraudulent payment commands, and in a second typosquatting campaign two models misclassified the fake site as legitimate.
Sysdig documents JADEPUFFER, an LLM-driven agent that autonomously exploited Langflow and extorted a production database
Sysdig Threat Research reported an intrusion in which an LLM-driven agent exploited CVE-2025-3248, a missing-authentication flaw in Langflow's code validation endpoint, then harvested credentials from the Langflow host and MinIO storage, moved laterally to a production database server, compromised an Alibaba Nacos configuration service, and encrypted 1,342 configuration items using MySQL AES before dropping a ransom demand. Sysdig cited self-narrating payloads containing natural-language reasoning and a 31-second self-correction cycle after an initial exploitation step failed.