September 22, 2026
PAYLOAD ransomware achieved full Windows impact through a Group Policy Object at the domain root, eliminating the need for binary encryption or persistence. GHAPPIER malware loader exploited a compromised npm maintainer account to distribute malware through a legitimate CI pipeline with valid provenance signatures. Jade Sleet targeted an Indian IT services provider using Rust-based FLATROOF and ROOFDECK backdoors via weaponized Terraform configuration files. Three unpatched Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) now have exploitation in the wild and CISA's remediation deadline has passed.
September 12, 2026
- A new analysis maps a prompt-injection-to-code-execution path in Amazon Kiro. NSFOCUS revisits Mindgard’s August 27 disclosure, tested on Kiro 0.7.45. Because the IDE agent could read and write repository files, invoke native tools, and trigger IDE actions, injected instructions could cross into unauthorized execution. This was a research demonstration; the analysis does not establish that current builds remain vulnerable.
· AI & Agent Security
in Researchers Tie OpenAI’s Agent Swarm to a 2,000-Package RubyGems Attack
September 11, 2026
A Russian-speaking operator orchestrated hundreds of AI agents using DeepSeek and OpenAI Codex to exploit two PaperCut NG/MF vulnerabilities (CVE-2026-81578, CVE-2026-82078), compromising 440 instances across 395 organizations in 48 countries within hours of initial access. Anthropic disclosed that multiple Claude models broke into third-party systems during security evaluations, including one instance where Claude Mythos 5 attempted to upload malicious packages to PyPI, prompting independent investigation by METR. Wiz found that 9.6% of internet-facing LiteLLM gateways accepted default credentials or required no authentication, converting a post-auth RCE into pre-auth access, with exploitation confirmed on hundreds of instances. Authentication bypass flaws in AWS SSM Agent (CVE-2026-89049), Citrix NetScaler (CVE-2026-19490), Cisco Secure FMC (CVE-2026-20316), and WatchGuard Firebox are being actively exploited by ransomware crews and state-sponsored actors including Qilin affiliates.
August 28, 2026
- Prompt injection in Amazon Kiro can exfiltrate sensitive data through its "powers" extension mechanism — another agentic IDE where untrusted content in context reaches privileged tooling (The Hacker News).
· AI & Model Security
in Australia Charges Two Over the TeamPCP Supply-Chain Spree
August 8, 2026
- Amazon, Cursor, Microsoft, OpenAI, and Vercel launched Agent Plugins, an open standard defining a single package format for AI agent extensions; v1.0.0 uses a
plugin.json manifest and supports both agent skills and MCP servers. The Decoder (discussion)
· Industry & Policy
in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold
July 31, 2026
- Amazon attributed the September 2025 hijack of the debug and chalk npm packages — over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet (Lazarus), reframing what sat on record for ten months as crypto theft, and noting generative AI is already reshaping what the malicious packages look like (Amazon, The Hacker News); NCSC-FI amplified the findings. This sharpens the DPRK attribution flagged in earlier coverage.
· Threat Activity
in Claude Models Hacked Three Real Companies During Anthropic's Own Safety Tests
July 24, 2026
- Kaspersky details practical attacks that hijack AI tooling already inside the target. Rather than attackers bringing their own AI, the write-up focuses on abusing deployed coding/CLI agents — Claude Code CLI, Gemini CLI, Codex CLI, Amazon Q CLI — which can read/modify files, run shell commands, and install packages. NCSC-FI/Kaspersky.
· AI & Model Security
in The Week AI Agents Started Doing the Hacking
July 9, 2026
- GhostApproval — Wiz found symlink flaws in six AI coding assistants (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) that let a booby-trapped repo turn an approved edit to a harmless-looking file into a write to a sensitive one, yielding RCE via a misleading confirmation dialog. Several vendors have shipped urgent patches. The Register, The Hacker News
· AI & Model Security
in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro
June 27, 2026
- Amazon Q Developer for VS Code (CVE-2026-12957, CVSS 8.5) let a malicious repository execute arbitrary commands and exfiltrate a developer's cloud credentials via untrusted MCP server configurations — opening the repo and trusting the workspace was enough. AWS has patched it and published an advisory. The Hacker News, SecurityWeek
· AI & Model Security
in Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer