The Week AI Agents Got Weaponized From Both Ends

Every day this week produced a new way to turn an AI coding agent into either a victim or a weapon — poisoned repos, hidden prompt payloads, and hallucinated packages hitting the agents, while autonomous agents ported real kernel exploits and stood up C2 in minutes. Underneath that, the old ground kept shifting too: a 15-year kernel bug, forgotten Secure Boot shims, a record 622-CVE Patch Tuesday with live AD and SharePoint zero-days, and Russian intelligence turned into the target of the EU and UK’s first joint cyber sanctions.

The Week in Review

AI agents became a two-way attack surface, and the exploits got concrete. The recurring story of the week wasn’t “AI is risky” — it was working PoCs against the agents developers already run. Wiz’s GhostApproval symlink flaws hit six coding assistants (Claude Code, Cursor, Amazon Q, Antigravity, Windsurf, Augment), turning an approved edit into RCE via a misleading confirmation dialog (source). Ghostcommit buried prompt injection in PNGs that AI reviewers never open, then talked an agent into dumping .env secrets (source); MemGhost planted persistent false memories via a single email (source); HalluSquatting weaponized the fake package names models reliably invent (source); and US Navy researchers pushed indirect prompt injection all the way down to the binary level, fooling Ghidra/Cline-backed RE agents into misreporting what a program does (source). Cursor ships an unpatched auto-execute-from-poisoned-repo flaw that Mindgard went full-disclosure on after seven months (source), and Grok Build CLI was quietly uploading entire private repos to an xAI cloud bucket (source). The agent is now part of your supply chain — treat its filesystem access, memory, and telemetry accordingly.

And the same agents are getting genuinely good at offense. Bishop Fox drove Claude through senior-level SonicWall firmware RE with mostly supervisory input (source); an autonomous agent ported an Android epoll UAF to a hardened Pixel 10 and escalated into vold (source); and a jailbroken Gemini reportedly stood up a working credential/crypto-stealing C2 in about six minutes (source). Microsoft is now warning that AI-driven vuln discovery will keep inflating Patch Tuesdays — and it delivered, with a record 622 CVEs credited partly to AI-assisted discovery.

Endpoint evasion pushed down to ring 0 — and CET spoofing came back. Two independent CET-compatible callstack-spoofing releases landed (@_MrTiz’s thread-pool trampoline PoC and BingusLdr), reopening a telemetry-evasion technique defenders assumed Intel CET had closed (source). Alongside them: the WHQL-signed Valkyrie-bot kernel rootkit surviving userland cleanup, GodDamn/PoisonX BYOVD EDR-killing, Lazarus using CVE-2024-21338 with no BYOVD needed (the driver already ships on Windows), and iPurple’s run on COM hijacking and AMSI-provider persistence — with detection playbooks for both.

Identity-first intrusion kept beating exploitation. The week’s most successful intruders didn’t burn zero-days. Entra ID passkey enrollment vishing (Okta’s O-UNC-066) walked M365 users into standing up durable attacker auth (source); Helix and Forg365 paired device-code phishing with AiTM; Microsoft’s year-long ShinyHunters/Salesforce retro showed tenant compromise purely through OAuth trust abuse (source); and two actors are using OAuth client-ID spoofing to validate stolen Entra creds without generating a sign-in event (source). Huntress clocked 81M login attempts where the 78 accounts that fell all had MFA — just misconfigured. Entra makes passkeys the default September 1; plan accordingly.

Edge, firmware, and the boot chain bled all week. GhostLock (CVE-2026-43499), a 15-year Linux kernel UAF, anchored a public browser-to-kernel chain to root Android 17; “Copy Fail” (CVE-2026-31431) gave every post-2017 distro a local-root PoC with no fixed kernels shipped; Binarly’s six U-Boot FIT signature-verification bugs broke root-of-trust across 50+ releases; ESET revived Secure Boot bootkits with 11 forgotten Microsoft-signed shims; and Dell BIOS passwords fell to reversible XOR in SPI flash (CVE-2026-40639). Progress confirmed its emergency ShareFile shutdown was a live zero-day.

Developing Stories

• ShareFile zero-day: From last week’s “power down your Storage Zone Controllers” to confirmed active exploitation — patched as of Patch Tuesday. Treat any exposed controller as potentially compromised. source
• Russian router/camera espionage → sanctions: Dutch AIVD/MIVD exposed FSB Center 16 abusing exposed cameras and routers to watch NATO arms shipments; the week ended with the first joint EU/UK cyber sanctions and formal attribution of the December 2025 Poland grid wiper to the FSB, plus CISA advisory AA26-194a. source
• Chat Control 2.0: Survived the EU Parliament on a procedural technicality (314 against, 276 for, but 360 needed) and now advances to Council — message-scanning back on the table. source
• The Gentlemen / Qilin lineage: Unit 42 profiled The Gentlemen as a high-tempo Qilin offshoot leaning on zero-days and BYOVD; Qilin still leads 2026 by volume (708 attacks). source
• DeadLock ransomware: Running hot — 20+ victims across the week, including Finland’s Enedo Power and Sweden’s Carrier Transport AB. source
• Ryuk / AlphV prosecutions: Ryuk affiliate Karen Vardanyan pleaded guilty ($15M in US extortion); a third US security pro (DigitalMint’s Martino, 70 months) jailed for aiding BlackCat. source

Tools & PoCs Worth Grabbing

• CET callstack-spoofing PoC (@_MrTiz) — thread-pool trampoline + shadow-stack reconciliation to forge clean call stacks under enforced Intel CET. source
• BingusLdr — Crystal Palace DLL loader implementing the CET-compatible stack-spoof, with write-up. source
• SindriKit 1.4.0 — in-memory COFF/BOF execution engine with dynamic symbol resolution and auto x64 trampolines. source
• Nimcrypt — Nim x64 Sliver loader: runtime AMSI bypass, in-memory AES-256, indirect syscalls. source
• Passive AD enumeration via native ADSI/COM — directory recon with no .NET, PowerShell, or managed runtime to trip telemetry. source
• klist2ccache — remote TGT dumping + ccache conversion, with Credential Guard detection. source
• CaddySmith — generates Caddy redirector configs straight from Cobalt Strike/Sliver profiles. source
• Caeruleus — Praetorian’s single-binary BLE scan/enum/fuzz/assessment tool. source
• Thumper — decoy-credential tripwire against the Shai-Hulud/IronWorm npm worm. source
• cve-2026-20896-gitea-poc — checker for the actively-exploited Gitea Docker auth bypass. source
• LIEF 1.0.0 — binary-parsing library, new runtime API and C++23 components. source
• On the defensive side: iPurpleTeam AMSI-provider and Windows-service abuse playbooks, and a CISA-KEV → Sigma auto-generation pipeline. source

Under Active Exploitation

• Microsoft Patch Tuesday — record 622 CVEs, with a live Active Directory flaw and a SharePoint Server flaw both under active attack; patch/reboot those two first. source
• ShareFile — actively-exploited high-severity Storage Zone Controller zero-day, now patched. source
• Gitea Docker auth bypass (CVE-2026-20896) — exploited in the wild, 6,200+ exposed instances; a CI/CD supply-chain foothold. source
• Joomla CVE-2026-48939 (iCagenda) & CVE-2026-56291 (Balbooa Forms) — both CVSS 10.0, added to KEV after zero-day file-upload exploitation. source
• Adobe ColdFusion CVE-2026-48282 + Langflow auth bypass — added to KEV; Langflow is the same flaw the JADEPUFFER operator abused. source
• Cisco IOS (FSB Center 16) — exploited router flaw added to KEV alongside the AA26-194a advisory. source
• “Copy Fail” (CVE-2026-31431) — Linux LPE with public PoC and no fixed vendor kernels yet; apply interim mitigation. source
• LegacyHive — public Windows User Profile Service LPE PoC, reportedly effective on builds patched through July 2026. source
• Cursor IDE — unpatched arbitrary-code-execution from poisoned repos, full disclosure after seven months. source

Nordic Notes

Finland issued a wanted notice for Aleksanteri Kivimäki, the Vastaamo psychotherapy-breach hacker, now believed abroad (source). IKEA Norway disclosed a breach exposing 45,000+ records via a third-party GitHub dev system (source), NCSC-FI/Check Point clocked attacks on Finnish orgs up 35% YoY in June, and CERT-SE issued its own advisory on the malicious npm packages tied to the AsyncAPI GitHub Actions compromise (source). NCSC-FI also amplified Socket’s “Muck and Load” Go-module malware-lure network.