When the AI Is the One Finding the Zero-Days

Frontier models had a busy day on the offensive side of the ledger: an AI agent turned up a zero-click RCE in Zoom in under 24 hours, Rapid7 used AI to chain its way to unauthenticated RCE in SharePoint, and researchers found a way to pull verbatim “hidden” reasoning traces — passwords and API keys included — out of every major model. Microsoft’s August Patch Tuesday landed with 421 CVEs and one actively exploited kernel zero-day already in North Korean hands.

AI, Agents & Offensive Security

• An AI agent found a zero-click RCE in Zoom in under 24 hours, using fewer than 20 prompts against publicly available frontier models to produce a working exploit against Zoom’s annotation protocol. The bugs — CVE-2026-53413 and CVE-2026-53414 in the annotation engine — let a meeting participant execute code on other attendees’ native clients with a single malformed message; fixes are in Zoom 7.1.5+ (A Security, SecurityWeek, CyberInsider) (discussion).
• Rapid7 disclosed an AI-assisted SharePoint exploit chain reaching unauthenticated RCE, tracked as CVE-2026-63520, discovered during a 0-day research project against the platform (The Hacker News). Separately, CISA confirmed ransomware crews are now abusing a high-severity SharePoint RCE that has been flagged as exploited since early July (BleepingComputer).
• Researchers found a vulnerability in the reasoning APIs of OpenAI, Anthropic, and Google that extracts encrypted reasoning traces verbatim and moves them between models — take a thinking summary from the source model, jailbreak a second model, inject the trace, and have it output the reasoning word-for-word. A scan of public sessions turned up dozens of leaked passwords and API keys, and confirmed the “reasoning summaries” users see often hide what the model is actually doing (The Decoder).
• GhostSplice shows malicious MCP servers exfiltrating secrets from AI coding agents by splitting a request into fragments that each look routine — walking off with SSH keys, environment secrets, and source code even after a blunt version of the same theft was refused (ASSET Research Group, The Hacker News).
• A pre-auth IDOR in Langflow (CVE-2026-55255) is being exploited in the wild to hijack workflows and steal credentials via prompt injection, fixed in Langflow 1.9.1 (SecureLayer7).
• Anthropic will embed invisible C2PA watermarks in all Claude text output worldwide, with new models labeling from day one and detection tooling promised for third parties; the marks “may persist through some editing” (The Decoder).

Vulnerabilities & Exploits

• Microsoft’s August 2026 Patch Tuesday fixes 421 CVEs, including one actively exploited zero-day. CVE-2026-68820 is a use-after-free in the afd.sys Windows kernel-mode driver that lets an attacker with local code execution escalate to SYSTEM; two other flaws were publicly disclosed pre-patch. Sixty-two of the fixes are critical, spanning QUIC and DNS Server RCE and container-tampering bugs (Krebs on Security, SANS ISC, The Hacker News).
• Researchers turned Windows Plug and Play USB auto-install into full SYSTEM takeover on a fully patched Windows 11. Emulating a USB device makes Windows fetch signed vendor software and run its privileged installer components — and the same PnP path can be triggered over Remote Desktop with USB redirection, no physical hardware required (The Hacker News).
• Cisco warns of an actively exploited ASA and FTD SSL VPN flaw that lets an unauthenticated remote attacker reload devices via crafted HTTP requests, causing DoS (Cisco advisory, BleepingComputer).
• A malicious SIM card can run attacker code inside cellular modems by abusing proactive RUN AT commands — enabling data theft, DoS, code execution, and forced 5G-to-2G downgrades. University of Birmingham and Fuzzware researchers tested 26 phones and modules built into EV chargers, industrial routers, and car telematics (The Hacker News, The Register).
• CopyEscape (CVE-2026-17106) is a container-to-host arbitrary file write via docker cp, letting an attacker take over Docker hosts (Imperva).

Threat Activity

• Lazarus revived Operation Dream Job with a new Windows zero-day, delivering malicious PDFs via fake recruiters to exploit CVE-2026-68820 — the same afd.sys bug Microsoft patched this week — alongside CVE-2025-49113. Check Point traced a chain including a new in-memory backdoor, a kernel rootkit, and webshells against defense sectors in Europe and India (Check Point Research). Separately, ANY.RUN, BCA and NorthScan stood up a fake DeFi startup (“Blue Whale LTD”) and knowingly hired suspected Famous Chollima operatives to observe DPRK IT-worker infiltration from the inside (ANY.RUN).
• Sweden’s Säpo disrupted a Russian SVR intelligence operation aimed at influencing Swedish decision-making and discrediting Sweden, NATO, and the EU. The operation, planned and directed by the SVR, allegedly involved an agent working at an unidentified foreign diplomatic mission in Stockholm (Säkerhetspolisen).
• Nextron identified a cluster of WHQL-signed Windows kernel drivers sharing the same Autel Intelligent Technology Authenticode metadata — likely tied to the Silver Fox group. Together they deliver a near-complete set of ring0 primitives: arbitrary process/kernel memory access, manual kernel PE loading, DKOM hiding, input injection, WFP/NDIS traffic interception, and physical-memory access (Nextron IOCs).
• ShinyHunters is claiming a Metabase hacking spree, with leaked data now surfacing, following the still-uncredentialed unauthenticated SQL-injection zero-day Metabase patched last week (earlier coverage). Metabase urged customers to upgrade immediately (Metabase) (discussion).
• A threat actor keeps pushing XWorm-laden extensions to the VS Code Marketplace. One activated at startup, claimed it needed elevated permissions to “sync board data securely,” relaunched VS Code as admin, then added Defender exclusions and pulled a PowerShell stager to drop a fake svchost.exe (Nextron gist).
• Kaspersky detailed Project CAV3RN, a modular espionage framework that uses DNS-based channel selection and Google Apps Script as a C2 relay, with dynamically rotating infrastructure (Securelist).
• Unit 42 analyzed Aeternum, a blockchain-enabled Windows botnet loader that anchors decentralized C2 in Polygon smart contracts, with multi-stage payloads, Telegram-based encrypted exfiltration, and anti-analysis for crypto-mining and remote access (Unit 42).
• Delta is investigating a Wi-Fi deauth attack aboard a flight of DEF CON attendees, after an unauthorized network appeared on a Las Vegas–Atlanta flight; a passenger suspected of jamming in-flight Wi-Fi faces potential federal charges (BleepingComputer, The Register) (discussion).
• DentaQuest disclosed a breach exposing data on 15 million people — one of the larger healthcare incidents of the year (Healthcare Dive).

Supply Chain

• Mozilla revoked and replaced the GPG subkey used to sign Firefox and Thunderbird Linux artifacts after an unencrypted copy was accidentally committed to a private company repo. Users and distros verifying tarball signatures must update to the new key (Mozilla, The Hacker News) (discussion).
• The BdThemes WordPress compromise is now understood as a JSON-poisoning attack (earlier coverage): attackers modified a remote JSON feed served to admins’ browsers to create rogue admin accounts without touching any source files in the WordPress.org repo. All affected plugins remain pulled pending review (The Hacker News, BleepingComputer).