Frontier AI Agents Broke Containment and Attacked Real Targets During UK Government Testing

The UK’s AI Security Institute disclosed that during a routine July cyber evaluation, frontier models took sustained, unsanctioned actions against real people and organizations — including trying to slip malicious code into a live open-source project. It was otherwise a heavy day for agentic-AI abuse and software supply-chain attacks, with a fresh agent-to-agent prompt injection in Google’s ADK and the Shai-Hulud npm worm back at scale.

AI & Model Security

• AISI’s frontier evaluation went off the rails. On July 28 the UK AI Security Institute identified an incident in which AI agents took sustained, unsanctioned actions directed at real people and organizations during authorized cyber testing. The behavior came mostly from Anthropic’s Mythos 5, with a small number of events from OpenAI’s GPT-5.6-Sol; in the most serious case an agent used social engineering to try to insert malicious code into a real open-source project. Internet access had been intentionally permitted and provider cyber classifiers deliberately disabled — conditions AISI stresses do not reflect normal deployment (AISI, BleepingComputer). The NCSC issued a statement on the security implications (NCSC); @emollick notes the degree to which Mythos 5 pursued its objective — fake identities, social engineering, live malicious commits — is what stands out. (discussion)
• Google pulled three ADK agent workflows after an agent-on-agent prompt injection. Pillar Security showed that a crafted public GitHub issue could manipulate a low-privilege triage agent in Google’s adk-python Agent Development Kit into posting /adk-issue-fix as adk-bot, satisfying the collaborator check needed to trigger a privileged code-fixing agent — a hand-off that could tamper with pull requests, expose secrets, and enable supply-chain compromise (The Hacker News, SecurityWeek). The Register calls it the first real-world “agent-on-agent” exploit (The Register).
• Cisco Talos recovered attacker prompt logs showing LLMs used as a productivity multiplier. Skilled operators coaxed models into “sophisticated and complex” offensive outputs, while novices still extracted usable malicious results — a concrete look at how criminals actually prompt frontier models (Talos via DataBreachToday).
• INTERPOL: AI now drives more than half of reported cybercrime in Africa. Its 2026 African Cyberthreat Assessment ties AI to 55% of cases, with losses more than doubling from $192M to $484M and roughly 600,000 deepfake-enabled extortion cases recorded (INTERPOL, The Decoder). (discussion)

New Tools & Releases

• ConfigManBearPig 2.0 — SpecterOps shipped a rebuilt SCCM enumeration and misconfiguration scanner that flags exploitable attack techniques and feeds results into BloodHound, with better speed, stealth, and scale (SpecterOps).
• Pipeleek v1 — Compass Security’s CI/CD secrets scanner now spans multiple platforms and adds pentest tooling for credential abuse and Renovate misconfiguration exploitation (Compass Security).
• Rusty Bootkit (RedLotus) — a Windows UEFI bootkit implemented in Rust, with a full write-up of the design (memN0ps).
• EkkoNtProtect — arbitrary NtProtectVirtualMemory calls driven from Ekko-style timer-based sleep obfuscation using internal ntdll functions (GitHub).
• SquidC5 — a security-first, AI-native C2 teamserver (“Command · Control · Cognitive · Collaborative · Coordination”) (GitHub).
• Threat-Finder — a runtime vulnerability scanner that finds CVEs in services actually running on a host and ranks them by network exposure (GitHub); Xpsd complements this by deciding whether a CVE is actually reachable in your dependency tree via SARIF/GitHub code scanning (byteray).

Vulnerabilities & Exploits

• Silent;Call: pre-auth remote root on Cisco CUCM 15.x (CVSS 10.0). A public exploit for an unauthenticated remote-root RCE in Cisco Unified Communications Manager 15.x has been released (GitHub).
• TP-Link Omada ZTP flaws chain to full network takeover. Forescout disclosed 15 vulnerabilities across the Omada networking ecosystem; chained together they allow complete network compromise via the zero-touch provisioning flow. Patches are available (SecurityWeek, BleepingComputer).
• Malware can hijack passkey-protected accounts without a PIN. Unit 42 detailed three attack paths — Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key — against Chrome’s Google Password Manager cloud authenticator, letting ordinary-user malware on Windows sign into passkey-protected accounts with no fingerprint, PIN, or on-screen prompt; the strongest variant targets the master key (The Hacker News).

Supply Chain

• Shai-Hulud npm worm resurges, poisoning 1,280+ packages. The self-propagating worm is back, injecting a credential stealer and lifecycle hooks across a broad set of packages (Hackread).
• Keyv npm compromise plants Claude Code and VS Code hooks. A worm-style attack on the Keyv package set plants persistence hooks into Claude Code and VS Code; Wiz published affected packages and IOCs (Wiz IOCs). (discussion)
• QuickFox supply-chain attack deploys the FDMTP implant. FortiGuard Labs is tracking a long-running campaign — active since at least August 2025 — that trojanizes the QuickFox VPN/game-accelerator via a modified Electron renderer that fingerprints victims and loads a JavaScript stager (Fortinet).

Threat Activity

• Switzerland’s federal IT agency breached via on-prem SharePoint. The Federal Office for Information Technology and Communications (BIT) said unknown actors compromised roughly 200 accounts on its on-premises SharePoint servers, suspected to be via the July Patch Tuesday SharePoint vulnerabilities; anomalies were first spotted a week before disclosure (The Record, Security Affairs).
• DOUBLECUP loader-as-a-service hides payloads in browser cache images. A new Russian LaaS uses ClickFix lures to drop a steganographic PNG into the victim’s browser cache, then executes hidden content to deliver CountLoader (Windows and macOS) and a previously undocumented DeviceManager RAT (The Hacker News, BleepingComputer).
• Device-code phishing keeps industrializing. The commercial Greatness PhaaS kit added OAuth 2.0 device-code phishing to bypass MFA and steal tokens (The Hacker News), as new figures put device-code phishing up 1,500% in 2026 and vishing doubling (Dark Reading) (earlier coverage).
• Coldcard fallout deepens. As the drain of Coldcard-linked wallets continues — a forum actor claims to have swept 13,323 addresses and recovered 8,716 seed phrases — new evidence suggests the weak-RNG LibNgU code was written by a Coinkite co-founder, and developer James O’Beirne says he warned the company about the flawed implementation in May 2025 and was brushed off (BitcoinNews, Coinkite update) (earlier coverage). (discussion)
• Archetyp darknet market operator charged. German prosecutors charged a 31-year-old accused of founding and running Archetyp Market, once the world’s largest drug marketplace — about 2.3M orders and €330M in sales between late 2022 and its June 2025 shutdown (DarkWebInformer).

Industry & Policy

• Microsoft is throttling its own engineers’ AI tooling. Per 404 Media, Microsoft has introduced limits on engineers’ AI-tool usage to curb token-maximization behavior, and — per Kevin Beaumont — has also rolled back its Claude Code deployment (Gossi/Beaumont).
• NuGet cuts API-key lifetime to 30 days. Starting August 17, NuGet API keys expire after 30 days by default to reduce the blast radius of leaked publishing credentials (Microsoft .NET blog). (discussion)