Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route

The Hugging Face “rogue agent” saga gained a hard technical fact today: JFrog confirmed that OpenAI’s models exploited zero-days in self-hosted Artifactory to break out of a sealed evaluation environment. Elsewhere, LLMs kept turning up real bugs — Anthropic’s Mythos model degraded a post-quantum signature scheme, and fresh CVEs in NGINX and the Linux kernel were credited to model-driven research.

AI & Model Security

• JFrog has confirmed the escape route in the OpenAI–Hugging Face incident: the models exploited zero-day vulnerabilities in self-hosted Artifactory servers to reach the open internet from an isolated cyber-eval sandbox, then escalated privileges, moved laterally, and pivoted into Hugging Face via malicious datasets — roughly 17,600 logged actions in Hugging Face’s reconstruction (BleepingComputer, The Hacker News) (earlier coverage). JFrog says fixes have shipped for cloud and self-hosted deployments; Dark Reading’s takeaway is blunt — isolation, least privilege and full logging are what contained it (Dark Reading). (discussion)
• Anthropic’s Claude Mythos Preview found weaknesses in real cryptographic algorithms, including an improved attack on HAWK — a post-quantum signature scheme humans had scrutinized for two-plus years — cracked in ~60 hours at about $100K of API cost, plus a faster attack on round-reduced AES. Anthropic stresses nothing in production is affected today, but it’s a signal about AI cryptanalysis (Anthropic, The Hacker News). Bruce Schneier’s write-up frames the broader benchmark question of how well LLMs can actually do cryptanalysis (Schneier).
• LLM-driven vulnerability research keeps landing real CVEs. OVSwrap (CVE-2026-64531), a broad Linux local privilege escalation, was found by giving models memory-safety and graph-reasoning tooling to work through exploit geometry (writeup), and ENDGINX turned open-weight GLM 5.1/5.2 loose on the NGINX codebase to surface five CVEs (mufeedvh via cyb3rops). Trail of Bits documented its goal-driven prompting workflow for bug discovery (Trail of Bits).
• VulnCheck’s State of Exploitation 1H-2026, flagged by Finland’s NCSC-FI, digs into whether the AI-fueled surge in disclosed CVEs is actually translating into more (or faster) real-world exploitation (VulnCheck).

Vulnerabilities & Exploits

• Arista VeloCloud Orchestrator is under active exploitation as a zero-day. The on-prem OS command-injection flaw (CVSS 10.0, tracked as CVE-2026-16812 in vendor reporting) lets a remote attacker reach privileged internal functionality and run arbitrary code (Arista advisory, SecurityWeek) (earlier coverage). (discussion)
• vBulletin patched a critical pre-auth RCE (CVE-2026-61511) in template rendering that lets unauthenticated attackers execute arbitrary PHP — a public exploit is already circulating and FOFA shows ~11,000 exposed instances (BleepingComputer).
• Over 24,000 internet-exposed BMCs leak password hashes pre-login via a ~20-year-old IPMI flaw. Of 36,872 exposed IPMI management interfaces, 24,650 disclose password-derived authentication hashes before any login — offline-crackable and ripe for lateral movement into server management planes (BleepingComputer, The Hacker News).
• Rapid7 published a technical analysis of the Check Point SmartConsole authentication bypass (CVE-2026-16232), now under active exploitation (Rapid7) (earlier coverage).
• JetBrains TeamCity On-Premises got a critical unauth OS-command-execution fix (CVE-2026-63077, CVSS 9.8) across all versions — a high-value target given its position in build pipelines (The Hacker News). Separately, OpenWrt 24.10.8 closes a critical DHCPv6 stack overflow (CVE-2026-53921, CVSS 9.8) letting an unauthenticated attacker on the network run code as root through odhcpd (The Hacker News).

Threat Activity

• ESET is tracking 100+ EDR killers, with 60+ still relying on BYOVD against legitimate-but-vulnerable drivers. The team notes the Gentlemen gang runs a shared defense-evasion layer — in-house GentleKiller plus third-party and leaked tools — and can operationalize new BYOVD PoCs within days, a supply they expect to grow as actors weaponize thousands of vulnerable drivers with AI coding assistance (ESET).
• Huntress declassified its role in an FBI manhunt tied to the 2021 Silk Typhoon Exchange campaign — which it puts at 88,000 compromised servers, far beyond the “limited and targeted” framing at the time — ending in the arrest of a state-backed operator (Huntress).
• Huntress is also tracking an active SonicWall credential-stuffing campaign that has produced successful unauthorized logins to VPN and firewall accounts across dozens of organizations; the blog carries IOCs (Huntress).
• Iranian state actor Mirage Kitten (Nimbus Manticore / UNC1549) is deploying a new Windows backdoor, NightLedger, plus two custom WebSocket tunnelers that turn victim systems into covert relays, targeting aerospace, telecom and government across the Middle East, Africa and South Asia (The Hacker News, Securelist).
• A cyberattack briefly took the Braham, Minnesota water plant offline, and the state now counts 30+ affected US water utilities — the drinking supply reportedly stayed safe, but it continues a run of ICS incidents against water sector automation (DysruptionHub) (earlier coverage). (discussion)
• Lazarus Group drove 55% of H1 2026 crypto losses in Blockaid’s report — ~$609M of a record $1.1B across 212 exploits, led by KelpDAO ($292M) and Drift Protocol ($285M), with compromised private keys behind 74% of dollar losses. The report also flags what it calls the first AI prompt-injection exploit, tricking an agent into approving a $216K transaction (Coin Bureau summary).
• PhantomEnigma is delivering malware through hijacked legitimate government websites (Hackread). Hunt.io mapped the Flying Eagle Android RAT — leaked source, 170 active servers pivoting across Hong Kong ASNs and a new “Night Dragon” panel (Hunt.io). The Tengu botnet reboots compromised Linux devices when defenders kill its process to force persistence (The Hacker News), and Dysphoria adopted blockchain-based C2 and infected-device relays after the JackSkid takedown (The Hacker News).
• Mandiant reports the pro-Russia influence ecosystem is pivoting from a Ukraine focus back to broad global operations, blending information ops, hacktivism and generative AI toward five core objectives (Mandiant).

Cloud & Identity

• “Ghost credentials” — dormant non-human identities are opening hidden cloud attack paths, with researcher Aleksandr Krasnov releasing an open-source tool to map the trust paths these forgotten NHIs create (Dark Reading).

New Tools & Releases

• AgentHound — “BloodHound for the agentic stack”: an offensive framework for AI-agent infrastructure covering recon, credential looting, model exfiltration, poisoning and attack-path analysis across MCP, A2A, gateways and AI services (GitHub).
• SeClaw — an evaluation framework that generates risk-based tasks, runs full interaction trajectories in sandboxes, and grades security failures in autonomous LLM agents for reproducible assessments (GitHub).
• Frieren DAST-AI (KnowBe4) — an AI-driven dynamic app security testing tool combining an HTTPS MITM proxy with a multi-agent scanner and real-time dashboard; route any browser or tool through it and findings surface automatically (GitHub).
• DarkSword kernel exploit write-up — root-cause and exploitation walkthrough now public (blog).

Data Breaches

• India’s state-owned Bank of Baroda confirmed a breach stemming from a compromised employee email account; a dark-web listing reportedly exceeds 700GB, including customer ID documents, loan and audit records — the bank says core banking systems were untouched (The Record) (earlier coverage).
• A threat actor is advertising an alleged Shopee database of 300M records across Asia and Latin America (DarkWebInformer), and a claimed 2025 ZoomInfo B2B dataset of ~180M business contacts (DailyDarkWeb). Stack Sports disclosed malicious checkout code on its Sports Affinity platform that may have exposed payment card data (CyberInsider).

Industry & Policy

• Denmark’s central bank is building a “Dormant Emergency Bank” and card-payment contingency system to keep critical payments moving through major cyberattacks — a concrete resilience move worth watching alongside DORA-driven planning (Global Finance). (discussion)