kyber.today

daily cyber × ai intelligence

← index

tagged

[claude-code]

26 editions · 28 items

November 1, 2026

  • Expel's IR work on the trojanized Claude Code extension found live reverse SSH tunnels. Across four affected customer Macs, Expel observed outbound reverse SSH to the attacker server, with one host first running the malware roughly eight hours after the end of Cursor's stated exposure window. Cursor's revised notice names two tampered Anthropic.claude-code builds — 2.1.312 and 2.1.313 — with corrected IOCs worth re-pulling (Expel). Anthropic's statement puts the compromise squarely at Cursor's marketplace (Kevin Beaumont); earlier coverage. · AI & Model Security
  • A Claude Code agent reportedly held admin access on NIPRNet. WIRED reported that an Accenture contractor granted the agent administrator rights on the Pentagon's unclassified network; the claim is circulating secondhand so far (thegrugq). · AI & Model Security

in One Shared ChatGPT Link Was Enough to Run Code in Your Session

October 31, 2026

  • A tampered anthropic.claude-code build (v2.1.313, also 2.1.312) was served from Cursor's marketplace for about 11 hours on October 29, 02:27–13:35 PDT, hitting up to 5,000 users on macOS ARM64 and Windows x64. Microsoft's analysis of the injected JavaScript: it runs on module load, performs host recon, adds an attacker SSH key, enables the local SSH service, opens reverse SSH forwarding to 134.209.82.225:22, sets cross-platform persistence and beacons host details — though Microsoft stresses these are behaviors the loader attempts, not confirmed execution on every host. The VS Marketplace copy and npm were unaffected, and Anthropic told Microsoft its systems were not compromised (Microsoft, Cursor). Cursor assesses that SSH access would have failed on most hosts due to bugs and insufficient privileges — which limits remote access but does not undo the code execution; rotate anything that account could reach (BleepingComputer) (discussion). · Supply Chain & Developer Tooling

in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits

October 23, 2026

  • LiteLLM's post-mortem points at its own AI gateway logs. The project says it observed Claude Code responses containing GitHub CLI OAuth tokens that could land in gateway logs, and suspects attackers reached its internet-facing internal LiteLLM deployment, lifted tokens, used an organization-owner token to disable branch protections and served poisoned artifacts from a lookalike repository. How attackers got into the gateway is still unconfirmed (earlier coverage). LiteLLM, The Hacker News · Supply Chain & Identity

in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them

October 22, 2026

  • CrowdStrike found four previously unreported actors using agents inside live intrusion workflows. During May–August, one operator compromised at least 15 Argentine healthcare entities, with credential and medical-record theft confirmed at at least one. Exposed frameworks used Claude Code in supervisor/executor patterns with varying autonomy. This shows agents executing campaign steps, not that every intrusion was end-to-end autonomous, according to CrowdStrike. · Cloud, Identity & Threat Activity

in PHP2Shell Is Already in the Wild

October 18, 2026

  • ApeX C2 v0.4 is the first public release of PhantomSec's post-exploitation framework and ships a native MCP operator interface: an MCP-capable LLM (Claude Code, Cursor, Codex) connects to the teamserver with a scoped, revocable token and can enumerate targets, author and upload modules, run them and adapt — 25+ tools across 15 scopes, every call logged. Zig-compiled Windows agent, on-agent LuaJIT, Cobalt Strike BOF compatibility via Havoc-style aggressor scripts, in-process .NET and image-backed call stacks (PhantomSec). · New Tools & Releases

in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants

October 16, 2026

  • HTTP response headers are an indirect-prompt-injection surface, but observed malicious attempts remain sparse. Researchers examined 217.1 million responses—10% of Common Crawl’s September 2026 crawl of 2.17 billion pages—and found 7,959 sites sending AI-directed headers. Of those, 7,271 pointed agents toward another resource such as llms.txt or an MCP server; only 30 sites contained injection attempts, most apparently pranks. Claude Opus, Claude Sonnet and Claude Haiku in Claude Code noticed test headers but did not act by default. They complied in 7 of 9 runs when the user prompt explicitly authorized following the site’s directions, showing why fetch tools should treat headers and their destinations as untrusted inputs. Signals Corps published the study. (discussion) · AI & Agent Security

in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware

October 13, 2026

  • CyberXero ran a two-pronged AI-augmented initial-access campaign against WordPress sites, e-commerce platforms and Ukrainian critical infrastructure, pairing commodity Cobalt Strike with an orchestration layer built on Claude Code; researchers tie it to the theft of more than 628,000 Ukrainian records (The Hacker News). · AI-Enabled Attacks

in Malware That Lives Off the Victim's AI Tooling

October 9, 2026

  • CrowdStrike named the tooling behind the South Korean bank intrusions: ARTEX, a recently released Chinese open-source LLM multi-agent pentest framework, running DeepSeek v4.1-flash as its main backend with Z.ai GLM-5.3 and Grok 4.6 supplementing. The campaign was found through open directories on a Hong Kong IP (38.244.50[.]120) exposing Claude Code session histories, Claude memory files and ARTEX configs — including the operator asking Claude where Korean breach data is sold. Active late September to early October 2026, unattributed but assessed as a financially motivated Chinese-speaking operator; more than 25,000 customer records were taken from Shinhan Bank alone, and ARTEX has since gone closed source (The Hacker News, The Decoder) (earlier coverage). · AI & Model Security

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

October 5, 2026

Citrix Names the NetScaler SAML Zero-Day and Ships an Emergency Patch

Citrix released an emergency patch for CVE-2026-88779, a SAML authentication bypass in NetScaler that requires no authentication and is being actively exploited in the wild; researchers are investigating whether the vulnerability extends beyond denial-of-service to remote code execution. South Korea's financial regulator disclosed that a single threat actor compromised seven banks and financial institutions using automated AI-driven tooling, with traces of ARTEX AI, an open-source penetration-testing system, found on attacker infrastructure. Claude Code was found vulnerable to prompt injection via .git worktree confusion (CVE-2026-55607), allowing sandbox escape through malicious repository content. A researcher achieved guest-to-host VM escape in KVM, validated by Vercel's sandbox bounty program, and Android 17 added restrictions on accessibility services to block banking malware overlay attacks.

September 22, 2026

  • Blitz Strike — a universal MCP penetration-testing server (TypeScript/Bun) that runs a three-tier methodology server-side from a single run_engagement call: attack-surface enumeration, source-to-sink reachability tracing, then live validation using marker reflection and a negative control before anything is reported. Ships a 130-tool catalog (63 installed, 67 on-demand) and an escalation-chain graph, and works from Claude Code, Cursor, Codex and other MCP clients. GitHub · New Tools & Releases

in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance

September 18, 2026

  • Plugin4Shell is a plugin SHA-pinning bypass that yields zero-click RCE in Claude Code, Codex, GitHub Copilot, and Gemini CLI: the agent checks out the commit the marketplace pinned but never verifies the checkout actually resolved to it, so whoever controls the plugin repo can serve malicious code while the pin still looks honored. Air Security's lab has a working PoC against all four agents, says Microsoft has not shipped a Copilot fix, and reports Google will not fix Gemini CLI because it is deprecated; plugins inherit the operator's full permissions, so no privilege escalation is needed (Air Security, The Register). The same lab's earlier work claims 26,000 agents seized via a planted skill and 925 in-use skills hijacked affecting 134,000 agents. SahAssar strips it to the core: control the repo, set the default branch state to a matching SHA, and you get RCE on anyone who installs — "pretty bad for a package manager" (discussion). · AI & Agent Security
  • Anthropic rebuilt Projects inside Claude Code so a coordinator splits work across parallel cloud threads that independently open pull requests and run tests against shared memory — more autonomous write access to repos, in beta for selected Pro and Max subscribers (The Decoder). · Frontier AI

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE

September 11, 2026

  • Beltdown escapes the Claude Code sandbox with one message, or via indirect prompt injection. Enabling Seatbelt suppresses permission prompts; an unhardened git ls-files run outside the sandbox, a nested .git rename the Seatbelt profile fails to block, and skill auto-loading to force an index refresh combine to execute core.fsmonitor on the host. Fixed in Claude Code 2.1.247 (Accomplish). · AI Infrastructure & Agent Security

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

August 30, 2026

  • Anthropic is cutting Claude Code weekly usage limits by 17% (BleepingComputer), and The Register has now published a full write-up of Johann Rehberger's "summarise this website" hijack of Opus 5 in Auto Mode, which lands roughly 80% of the time (The Register, earlier coverage). Practitioners seized on Anthropic's framing that Auto Mode is "a best-effort classifier, not a security guarantee" — chrisjj reads that as mistaking best for good enough (discussion). · AI & Agent Security

in CISA Adds a Kernel Bug That OpenAI's Own Agents Exploited

August 26, 2026

  • Claude-AD packages an internal Active Directory testing methodology for Claude Code. It provides skills, agents and commands covering Kerberoasting, AD CS ESC1–17, DCSync, ACL abuse, NTLM relay and delegation workflows. The project is available on GitHub. · New Tools & Releases

in Oracle WebLogic Is Under Active Attack

August 19, 2026

  • Claude Code with Sonnet 4.6 was used as part of a live intrusion, likely ransomware, with the model taking on a substantial share of operator tasks rather than acting as a coding sidekick, per reporting shared by @cyb3rops. Expect the tell-tale artifacts — agentic CLI tooling on compromised hosts, outbound API traffic to model providers — to become a hunting signal. · AI in Offensive Operations

in When the Attacker's Toolchain Includes an LLM

August 8, 2026

  • A GitHub issue was enough to reach CI secrets behind the major coding agents. Novee Security showed at Black Hat that an account with no repository privileges could execute code on the CI runners behind Anthropic's and Google's own coding-agent repos, and hijack the next agent run on OpenAI's — each in the vendor's shipped default configuration. The Hacker News · AI & Model Security
  • Claude Code's context can be spoofed by changing your email. A researcher found Claude Code injects the user's email into context and treats them accordingly — swapping in another address made the model reason as though the user were a recognized Anthropic alignment researcher, altering its responses. @fjzzq2002 · AI & Model Security

in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold

August 3, 2026

in God-Mode Access in N-able N-central Tops a Day of Fresh Exploits

July 30, 2026

  • "RufRoot" (CVE-2026-59726, CVSS 10.0) is an unauthenticated RCE in Ruflo, an open-source agent meta-harness for Claude Code and OpenAI Codex, disclosed by Noma Security. The bug lives in Ruflo's MCP bridge and lets attackers run commands with no login; researchers note it also enables persistent memory poisoning — malicious instructions can survive patching if compromised agent memory is retained, so agents keep following attacker-controlled directives. All versions before 3.16.3 are affected; ~233 downstream AI tools are reportedly exposed. The Hacker News, Dark Reading · AI & Model Security

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 24, 2026

  • Kaspersky details practical attacks that hijack AI tooling already inside the target. Rather than attackers bringing their own AI, the write-up focuses on abusing deployed coding/CLI agents — Claude Code CLI, Gemini CLI, Codex CLI, Amazon Q CLI — which can read/modify files, run shell commands, and install packages. NCSC-FI/Kaspersky. · AI & Model Security

in The Week AI Agents Started Doing the Hacking

July 9, 2026

  • GhostApproval — Wiz found symlink flaws in six AI coding assistants (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) that let a booby-trapped repo turn an approved edit to a harmless-looking file into a write to a sensitive one, yielding RCE via a misleading confirmation dialog. Several vendors have shipped urgent patches. The Register, The Hacker News · AI & Model Security
  • "Friendly Fire" — an AI Now Institute PoC shows that asking Claude Code or OpenAI Codex in autonomous/auto-approve mode to scan untrusted open-source for bugs can instead cause the agent to execute the attacker's code on the analyst's own machine. The Hacker News · AI & Model Security
  • Sophos telemetry shows benign AI coding agents (Claude Code, Cursor, Codex) routinely tripping behavioral EDR rules written for human intruders — decrypting browser credentials, enumerating the Windows credential store, etc. A real detection-engineering problem: agent activity and attacker activity look identical to the engine. The Hacker News · AI & Model Security

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro

July 6, 2026

The Gentlemen Weaponize a Signed Kontron Driver Into an EDR Killswitch

The Gentlemen ransomware crew exploited a zero-day in a signed Kontron driver to disable endpoint defenses via BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware. CVE-2026-46242 (Bad Epoll) now has a public proof-of-concept for a Linux kernel use-after-free that enables privilege escalation on 6.4+ kernels with 99% reliability. Medtronic is notifying 3.8 million individuals after a ShinyHunters data breach exposed personal and medical data. Multiple new red-team tools and offensive-security frameworks including T3MP3ST, goshs, and Knossos were released, alongside DOJ filings revealing how Microsoft telemetry helped the FBI identify alleged Scattered Spider member Peter Stokes via Windows Global Device ID correlation.

July 2, 2026

Scattered Spider Suspect Grabbed at Helsinki Airport, Extradited to the US

A 19-year-old Scattered Spider member was extradited from Finland to face charges linked to 100+ intrusions and ~$100M in ransom payments. DuneSlide critical zero-click prompt-injection flaws in Cursor (CVE-2026-50548, CVE-2026-50549) allow arbitrary command execution on developer machines with no approval. Huntress detected a massive Azure CLI password-spray campaign with 81 million login attempts compromising at least 78 Microsoft accounts across 64–78 organizations, exploiting OAuth ROPC to bypass MFA. DeepSeek was jailbroken into building working in-browser ransomware using the File System Access API, and Claude Desktop hijacking can yield remote code execution, underscoring critical security gaps in agentic AI tools.