The Week AI Started Finding the Zero-Days — and Attackers Started Weaponizing Everything Else

This was the week offensive AI stopped being a demo. An agent found a zero-click Zoom RCE in under 24 hours, Rapid7 chained AI into unauthenticated SharePoint RCE, and suspected Chinese operators ran near-autonomous agents against Taiwan’s nuclear and energy sectors. The human side of the ledger stayed brutal: enterprise appliances bled all week (vCenter, NetScaler, SAP, GeoServer, Metabase), the LiteLLM supply-chain incident grew into possibly the largest credential compromise on record, and the Black Hat Kerberos flaws matured from conference slides into weaponized, cross-platform domain-takeover chains.

The Week in Review

AI moved to the offensive side of the exploit-discovery pipeline. The Zoom “Zoomsday” chain (CVE-2026-53413/53414/53415) was found by an agent in under a day with fewer than 20 prompts against public frontier models (A Security); Rapid7’s AI-assisted SharePoint work produced CVE-2026-63520 (THN); and testbnull’s Exchange 0-day writeup explicitly noted AI accelerating and commoditizing this kind of discovery (testbnull). On the other side, near-autonomous agents hit Taiwan’s nuclear safety agency and, per TrendAI, government and energy systems back in July (The Register). A counter-narrative landed too: a Princeton/UK AISI study rated agent-authored research papers “Reject” (The Decoder). The honest read is that agents are excellent bug-finders and engineers, not yet autonomous researchers.

AI agents themselves became the attack surface. GhostJacking hijacked agents via crafted security alerts (Dark Reading); GhostSplice showed malicious MCP servers fragmenting requests to smuggle out SSH keys past guardrails that refused the blunt version (ASSET); Atlassian Rovo leaked Jira/Confluence data from hidden PDF text (The Decoder); Escape.tech’s Cascade talked a production agent into surrendering its full system prompt on the second try (Escape.tech); and an inverse-LM technique reconstructed proprietary prompts from output alone (The Decoder). Treat system prompts, agent tool-permission logic, and MCP servers as untrusted, injectable surfaces.

Edge and enterprise appliances bled continuously again. VMware vCenter (CVE-2026-59310) was exploited across 47 countries for reverse-SSH persistence, and Broadcom then added an auth-bypass (CVE-2026-59309) mid-week (CERT.dk, Broadcom). SAP Commerce Cloud (CVSS 10.0), GeoServer, Citrix NetScaler, Adobe Commerce (exploited within hours) and the still-metastasizing Metabase SQLi all saw in-the-wild activity. The lesson vCenter drove home: patching evicts the vuln, not the reverse-SSH foothold already planted.

Supply chains stayed the softest underbelly. The LiteLLM compromise, reattributed to the SANDCLOCK/TeamPCP campaign via a backdoored Trivy GitHub Action, hit ~2,500 orgs including Nvidia, AWS and Samsung, with terabytes of CI/CD credentials exfiltrated and 95%+ exposed before the malicious LiteLLM packages shipped (SecurityWeek). Alongside it: a self-propagating ChainDrop npm worm, repeated malicious VS Code extensions (XWorm, SaassyCode, Solidity Pro), and Mozilla revoking its Firefox/Thunderbird signing subkey after an accidental commit.

North Korea kept industrializing. Lazarus revived Operation Dream Job with a fresh Windows kernel zero-day (CVE-2026-68820, the same afd.sys bug patched Tuesday), later hiding exploitation behind post-quantum crypto (Check Point, CERT.dk); Kimsuky stood up an offline private-LLM stack for malware generation (THN); and ANY.RUN’s fake DeFi startup knowingly hired Famous Chollima IT workers to capture their tradecraft from the inside (THN).

Developing Stories

• Black Hat Kerberos flaws: matured from PoC to full weaponization. ResetNightmare (CVE-2026-27912) and KerberLoss (CVE-2026-25177) now have a Linux/NetExec domain-takeover walkthrough (cravaterouge).
• Metabase SQLi: finally has a CVE, CVE-2026-72898, after weeks unlabeled; ShinyHunters claimed the spree, LexisNexis and Framework confirmed impact (Horizon3).
• LiteLLM/Trivy: reattributed to SANDCLOCK/TeamPCP; blast radius ~2,500 orgs, most compromised via Trivy well before the LiteLLM packages (SecurityWeek).
• Clop/Windchill: leak site grew to 40+ victims including Shell, Philips, GE; Shell confirmed it’s investigating (BleepingComputer).
• macOS Screen Sharing (CVE-2026-65400): completed the arc from PoC to in-the-wild Monero-miner deployment (BleepingComputer).
• AI watermarking: Anthropic shipped global C2PA marking and a detection API; “watermark removers” flooded the web within days, none verifiable (BleepingComputer).
• France’s DGFiP: confirmed a June VPN intrusion; seller now touts up to 2M records (The Record).

Tools & PoCs Worth Grabbing

• SharpDCSync — C# DCSync without Mimikatz, lower-signature DC credential extraction (Red Teaming Army).
• Bring Your Own EDR — Akamai’s method for flipping a trusted commercial EDR into a delivery/persistence implant (Akamai).
• NoiseHound — re-ranks BloodHound paths by expected detection cost across audit/EDR/SIEM tiers (GitHub).
• TrustMeBro — Authenticode signature manipulation across 19 file types (signature stealing, SIP hijacking) (GitHub).
• Dark Agent COFF loader — a rare macOS/Linux COFF-loading implant (minorimpact.dev).
• ctxdebug — MCP platform wiring WinDbg/IDA/x64dbg into 160+ AI-accessible RE tools (GitHub).
• VsockDrop — unprivileged io_uring/vsock kernel LPE on recent 6.x, no user namespaces (writeup).
• DEF CON 34 — all slides and videos mirrored for offline review (media.defcon.org).

Under Active Exploitation

• CVE-2026-59310 — VMware vCenter Syslog directory-traversal RCE, reverse-SSH persistence across 47 countries (CERT.dk).
• CVE-2026-72898 — Metabase pre-auth SQLi to admin; ShinyHunters spree (Horizon3).
• CVE-2026-58231 — SAP Commerce Cloud Data Hub Adapter, CVSS 10.0 unauth RCE (BleepingComputer).
• CVE-2026-71362 — Adobe Commerce/Magento account takeover, exploited within hours; lab available (BleepingComputer).
• CVE-2026-68820 — afd.sys Windows kernel UAF to SYSTEM; Lazarus zero-day, patched Tuesday (Krebs).
• CVE-2026-55040 + CVE-2026-63520 — SharePoint JWT auth-bypass chained to RCE, exploited post-Patch-Tuesday (BleepingComputer).
• GeoServer — unpatched SQLi-to-RCE zero-day under active exploitation (SecurityWeek).
• CVE-2026-12569 — PTC Artifactory RCE, indicators aligned to Cl0p/Hazy Scorpius (Unit 42).
• CVE-2026-55255 — Langflow pre-auth IDOR, workflow hijack via prompt injection (SecureLayer7).
• CVE-2026-65400 — macOS Screen Sharing, now deploying Monero miners (BleepingComputer).

Also worth flagging: ShieldBreak, a public PoC that defeats Microsoft’s patch for the Defender RoguePlanet flaw (CVE-2026-50656) to grant SYSTEM on fully-patched Windows 11. Beaumont has hunting KQL ready (BleepingComputer).

Wild Speculation

The forecast record stands at 12 predictions still open, none settled yet.

Every trust anchor broke in the same seven days, and nobody framed it as one story. TrustMeBro turns Authenticode signing into a manipulation primitive across 19 file types; Mozilla revoked a Firefox/Thunderbird signing subkey after an accidental commit; Akamai’s Bring Your Own EDR converts a trusted commercial agent into a delivery vehicle; and Anthropic’s C2PA watermarking was neutered by removers within days. Code signing, browser trust, endpoint trust, AI provenance: four independent attestation systems, all shown to be forgeable or unprovable in one issue. Attestation is now an attack surface, not a control, and red teams should treat “signed,” “trusted vendor,” and “watermarked” as claims to defeat.

Disclosure is arriving downstream of the breach, consistently. vCenter (CVE-2026-59310) taught it explicitly: patching evicts the vuln, not the reverse-SSH foothold already planted across 47 countries. The LiteLLM/Trivy reattribution made it structural: 95%+ of ~2,500 orgs were compromised via the backdoored Trivy action before the malicious packages ever shipped. Metabase ran unlabeled for weeks while ShinyHunters worked the spree. Patch-day dashboards are measuring the wrong event; the interesting artifact is persistence that outlives remediation, and that’s where hunting budget should go.

The AI story is a pincer, and its two arms explain each other. Frontier models found Zoomsday in under a day and chained CVE-2026-63520; at the same time Kimsuky stood up an offline private-LLM malware stack. Once agents are proven bug-finders, adversaries want the same capability without frontier guardrails or telemetry. And those guardrails are already porous: GhostSplice fragmented requests to smuggle SSH keys past filters that refused the blunt ask, while Cascade and inverse-LM prompt reconstruction show the “proprietary agent logic” moat evaporating. Agentic tooling is both the best new offensive engine and the softest new target.

Predictions:

• A second enterprise-appliance vendor discloses in-the-wild implant persistence surviving its own patch (à la vCenter reverse-SSH) within 6 weeks.
• ShieldBreak or the KerberLoss/ResetNightmare NetExec chain appears in a public C2 or commercial framework within 5 weeks.
• Another named org confirms SANDCLOCK/TeamPCP (LiteLLM/Trivy) impact within 4 weeks, as CI/CD credential replay continues.
• A fresh malicious-MCP-server or agent prompt-injection exfil disclosure lands within 3 weeks; this class is compounding weekly.