November 2, 2026
AI Moves Inside the Intrusion Loop
Google Threat Intelligence and Mandiant report multiple threat actors weaponizing open-source agentic pentest frameworks (ARTEX, Hexstrike, CAIRN, PentAGI) in live attacks, marking a shift to machine-speed intrusions with LLM-driven autonomous exploitation. GOLD OGRE's Aur0ra ransomware operations used Cursor-built AI frameworks to test EDR agents and conduct post-exploitation, while VOLTA-AUTODOXER employs OpenRouter models as a triage analyst to rank victim monetization. CVE-2026-112816 (CVSS 10.0) in LXD and MicroCloud allows unauthenticated authentication via certificate chain spoofing, and Ivanti Connect Secure flaws (CVE-2026-111357, CVE-2026-118527, CVE-2026-104935) enable unauthenticated root access tied to the UTA0576 campaign targeting AD credentials and BitLocker keys. A trojanized Claude Code extension via Cursor's marketplace exposed roughly 5,000 developers over an 11-hour window, though the reverse SSH tunnel payload required admin privileges that limited impact.