Agentic AI Muscles Into the Offensive Toolkit

Offensive AI tooling had a busy day: PortSwigger shipped an agentic Burp Suite tester, researchers claimed the first fully AI-written iOS jailbreak, and Microsoft launched an autonomous attacker/defender security model. Meanwhile a stack of fresh public exploits landed — a pre-auth vBulletin RCE, an exploited Arista VeloCloud zero-day, and an n8n sandbox escape.

New Tools & Releases

• PortSwigger introduced Burp AT, an agentic-AI layer built on Burp Suite to drive offensive security testing — autonomous exploration and testing workflows aimed squarely at web app pentesters (PortSwigger).
• Researchers released Relaxin, billed as the first fully AI-written iOS jailbreak for Root SPTM devices (A15+), with SPTM support reportedly added in weeks and “0 lines of human-written code” — a rebrand of Dopamine and, if it holds up, the first time AI agents have reversed and bypassed a major Apple memory-protection architecture this cleanly (@0x0SojalSec). Skeptics in the thread note the project builds heavily on the existing Dopamine codebase.

Vulnerabilities & Exploits

• A public exploit for vBulletin CVE-2026-61511 (CVSS 9.8) shows how an unauthenticated request can reach PHP’s eval() and execute code on unpatched forums, requiring no account or user interaction; vBulletin 6.2.1 and earlier and 6.1.6 and earlier are listed as affected (The Hacker News, SSD advisory).
• Arista patched a VeloCloud Orchestrator zero-day that was exploited in attacks — a reminder that SD-WAN orchestration planes remain high-value initial-access targets (BleepingComputer).
• n8n patched a high-severity expression-sandbox escape (affecting <2.31.5 and 2.32.0–2.32.1) that let an authenticated workflow editor run OS commands as the n8n process; Security Joes found it while probing the February fix for CVE-2026-27577 (The Hacker News).
• FastJson is under active zero-day exploitation against US firms, this time via fastjson2’s default polymorphic parsing — attacker-controlled @type can trigger remote class loading or SSRF even with autoType disabled (BleepingComputer, PoC lab); this follows last week’s fastjson 1.x RCE coverage (earlier coverage).
• CertiGhost (CVE-2026-54121) continues to draw attention as BleepingComputer wrote up the PoC (earlier coverage): in a default AD CS setup, a low-privileged user can create a rogue machine account, coax the CA into issuing a DC-identity certificate, authenticate via PKINIT, and pivot to full domain compromise (BleepingComputer, technical notes).

Cloud & Identity

• NetSPI detailed abusing third-party Azure VM extensions (Salt Minion) to achieve command execution on VMs — a useful post-exploitation and cloud-pentest technique against Azure compute (NetSPI).

AI & Model Security

• Microsoft launched MAI-Cyber-1-Flash, a compact security model that scores 96% on the CyberGym benchmark inside its MDASH multi-agent harness, acting as both attacker and defender; Microsoft claims ~50% cost savings by routing only the hardest ~10% of tasks to GPT-5.4 (The Decoder) (discussion).
• The Cloud Security Alliance published an initial CISO post-mortem of the Hugging Face autonomous-AI intrusion — 17,000+ logged actions, privilege escalation, credential theft, and lateral movement — with guidance on detecting and governing agentic-AI risk (CSA); MIT Technology Review pushed back on the “unprecedented” framing (MIT Tech Review), continuing last week’s thread (earlier coverage) (discussion).
• Moonshot released full weights and the technical report for Kimi K3, a 2.8T-parameter MoE with native vision and a 1M-token context, alongside open-sourced attention kernels and MoE infrastructure; independent tests still flag major gaps in cyber and math, possibly pointing to distillation (The Decoder, weights) (earlier coverage).
• Google Search briefly indexed public Claude share links because the pages lacked a noindex tag, exposing shared conversations — some reportedly containing crypto keys and legal questions — before Anthropic added a robots.txt block; OpenAI made the same error last year (The Decoder, Hackread) (discussion).
• A Chrome extension dubbed BrainDrain, with ~100k users, silently harvests users’ AI prompts across nine platforms without ever being opened (malext.io report).
• Anthropic’s Claude Opus 5 was benchmarked as a cost-effective vulnerability-search tool nearing Mythos 5 on bug finding but falling short on exploit development, with offensive capabilities deliberately restricted (SecurityWeek).
• NVIDIA and 37 members (including CrowdStrike, IBM, Palantir, Microsoft and Hugging Face) launched the Open Secure AI Alliance and open-sourced its NOOA framework, aimed at giving defenders open tooling to test, audit and protect models and agents (The Hacker News, SecurityWeek).

Threat Activity

• JUMPSEC dissected a BlueNoroff (DPRK/Lazarus) ClickFix malware kit that abuses hijacked Telegram accounts and fake meetings to target high-value victims, deploying sophisticated Windows and macOS payloads over infrastructure tied to Cloudzy/RouterHosting (JUMPSEC).
• Coca-Cola confirmed data theft at dairy subsidiary Fairlife in a ransomware attack, with the Anubis crew claiming credit and threatening to leak (BleepingComputer).
• ShinyHunters claimed the Ernst & Young breach — saying it obtained credentials via a supply-chain attack — as the same group was tied to the DentaQuest breach potentially affecting over 15 million people (BleepingComputer, SecurityWeek).
• Operation BlueDash used Microsoft Teams “secure document” lures and a counterfeit Microsoft Store “Teams update” page to deploy legitimate RMM tools (Level RMM, ScreenConnect) for hands-on access (The Hacker News).
• MedusaHVNC launches real browsers on hidden Windows desktops for covert, persistent remote access and browser/data hijacking — a MaaS operation built around evading detection (SecurityWeek).
• The Dysphoria DDoS botnet has spread to ~200k devices and added blockchain-based C2 and victim relays after the JackSkid disruption (BleepingComputer).
• Zscaler ThreatLabz flagged an East Asia-linked actor deploying previously unreported TELESHIM, MIXEDKEY, and BINDCLOAK malware against Middle East governments, using Telegram for C2 (The Hacker News).

Detection & Research

• A deep dive into Windows HyperGuard (SKPG) maps what it actually protects inside ntoskrnl — including Alt Syscall handlers and key kernel symbols hashed and monitored from the Secure Kernel — with useful notes on enforcement and potential bypass surfaces for evasion researchers (FluxSec).

Industry & Policy

• GitHub added a three-day Dependabot cooldown before opening PRs, and PyPI now rejects file uploads to releases older than 14 days — time-based defenses meant to blunt fast-moving supply-chain package poisoning (The Hacker News, SecurityWeek).
• Google introduced its own two-word cybercrime threat-actor naming taxonomy, diverging from industry conventions — adding, critics note, yet another naming layer to reconcile across CTI reports (The Register).