This Week’s Pattern: AI Agents Became the Attack Surface.
Last week AI crossed from risk to attacker. This week the front line moved again — the AI agents themselves became the surface being attacked. BleepingComputer and Help Net Security reported a Russian cybercriminal using a jailbroken Google Gemini CLI as a hacking agent, rebuilding malware botnet infrastructure in roughly six minutes. The Hacker News documented MemGhost, an attack that plants persistent false memories in AI agents through a single email — every future session then acts on the poisoned recall. Dark Reading tracked more than a million phishing emails that used hidden text specifically tuned to dupe AI security filters into scoring them benign. Anthropic patched a Claude Desktop flaw (v1.1.2321) that let attackers auto-send malicious prompts to AI agents, and a Claude for Chrome extension vulnerability that let rogue extensions trigger Gmail reads and other AI actions.
The identity fabric didn’t catch up either. Attackers used a fake Microsoft Entra passkey enrollment call to gain Microsoft 365 access. OAuth client-ID spoofing quietly enumerated cloud tenants without triggering auth-log signals. And Zara disclosed that 197,000 customers were exposed via a compromised Anodot third-party analytics token — another non-human identity turning into a customer-PII pipe. Meanwhile the old kind of breach kept landing at scale: AssuranceAmerica exposed roughly 6.9 million drivers, Coca-Cola’s Fairlife division took a ransomware hit that halted US dairy production, Microsoft mapped a year of ShinyHunters activity against Salesforce, and 23andMe agreed to an additional $18M in a genetics data-breach settlement. Vendor advisories piled up too — RabbitMQ pre-auth broker takeover, a critical Zoom account-takeover fix for Windows, and thousands of WordPress sites backdoored via WP-SHELLSTORM.
The pattern is uncomfortable but clear: an AI agent’s attack surface is everything it reads, everything it remembers, everything it’s allowed to click, and every credential it holds. Prompt injection, memory poisoning, hidden-text bypass and jailbroken CLIs all exploit the same gap — there is no runtime identity, no behavioural policy, and no kill switch sitting between the model and the systems it can reach. We built one of the best identity and agent-governance stacks out there — and we still tell every customer it’s the front door, not the whole house. Here are the 18 that mattered and what stops them.
AI Agents Became the Attackers
1 — Google Gemini CLI Abused as a Hacking Agent and Malware Botnet Operator
BleepingComputer and Help Net Security reported that a Russian cybercriminal jailbroke Google’s Gemini CLI and used it as an active hacking agent, rebuilding malware botnet infrastructure in approximately six minutes. The CLI was driven with prompts that stripped guardrails and turned the model into an operator — running the recon, configuration, and deployment steps that would normally take a human operator far longer. The result is not a proof-of-concept: the botnet was reconstituted end-to-end by the model. It is the clearest sign yet that agent-CLI tools shipped for developer productivity are already being weaponized in the wild as autonomous offensive tooling.
Every AI CLI that ships with shell access, file access, and network reach is, functionally, a new class of privileged non-human identity in your environment. When the safety layer lives only inside the model, a jailbreak is the whole compromise — there is no runtime perimeter between the “jailbroken model” and the botnet infrastructure it can then stand up. Speed matters here: six minutes is faster than any human incident-response cycle. The only durable answer is enforcement outside the model — identity, behavioural policy, and a kill switch that trigger on what the CLI does, not on what the model claims it will do.
Most Advanced AI Security How RuntimeAI Stops This
- Discovery / Inventory: KYA (Know Your Agent) enrols every AI CLI as a first-class non-human identity with a declared scope — a Gemini CLI running with shell privileges is a known, bounded actor, not an anonymous developer tool blending into the terminal.
- Behavioural enforcement: Flow Enforcer and the AI Firewall baseline what the CLI is allowed to do; a jailbroken CLI enumerating hosts, provisioning C2, and standing up botnet infrastructure deviates immediately from that baseline and is suspended in-flight.
- Flow / egress control: Flow Enforcer egress policy and PII Shield block outbound reach to attacker-controlled command infrastructure and stop the CLI from staging payloads or exfiltrating credentials from the workstation.
- Immutable audit: Every prompt, tool call, and network reach the CLI makes is written to the Audit Black Box and stamped with PQ-Sign post-quantum signatures — the full six-minute rebuild attempt is reconstructable to the second.
A sub-50 ms Kill Switch stops a jailbroken agent CLI in the reconnaissance phase, not after the botnet is back online.
2 — TuxBot v3 Shows Signs of LLM-Assisted IoT Botnet Development
The Hacker News reported that TuxBot v3, the latest evolution of a Linux/IoT botnet family, ships exploitation modules with clear hallmarks of LLM-assisted code generation. Researchers flagged patterns typical of model-generated code — boilerplate, comment style, and control-flow shape — embedded in the exploit modules that TuxBot uses to spread across IoT devices. It is not a fully autonomous agent, but it shows that even lower-tier malware families are now leaning on LLMs to bootstrap and iterate on exploitation logic. That compresses the cost curve of building new botnet variants and widens the attacker pool that can ship credible IoT malware.
The threat is not that TuxBot v3 is dramatically more capable than v2 — it’s that the marginal cost of building the next variant has collapsed. When any malware author can prompt a model into producing usable exploit modules, defensive signatures decay faster and variant volume goes up. The only durable posture is one that catches behaviour — scanning, brute-force, lateral spread — instead of chasing hashes. You cannot out-write LLM-generated malware; you contain it by enforcing what devices are allowed to do at runtime, not what strings they contain.
Most Advanced AI Security Zero Trust · Defence in Depth
- Discovery / Inventory: KYA extends beyond human agents to IoT and workload identities, so every device in scope is enrolled and scoped — TuxBot-infected hosts stand out because their identity was never scoped to spread laterally.
- Behavioural enforcement: Flow Enforcer and the AI Firewall baseline expected IoT traffic; scanning, brute-force, and worm-like behaviour deviate from that baseline and are contained without waiting for a signature update.
- Flow / egress control: Egress policy stops infected devices from reaching botnet C2 or downloading additional modules, and PII Shield / QuantumVault prevent staged data from being pulled off compromised sensors.
- Immutable audit: Every infection, C2 attempt, and containment action is written to the Audit Black Box with PQ-Sign timestamps — the full variant campaign is provable, not inferred.
Runtime behavioural enforcement via Flow Enforcer catches LLM-generated malware variants that signature engines never see coming.
3 — Claude Desktop Flaw Automatically Sends Malicious Prompts to AI Agents (PromptFiction)
Dark Reading, The Hacker News and BleepingComputer detailed “PromptFiction,” an attack chain that Anthropic patched in Claude Desktop v1.1.2321. A malicious webpage triggers a claude:// deep-link that opens the Claude Desktop app and automatically feeds it attacker-supplied prompts; those prompts, combined with the MCP filesystem server the agent has connected, reach code execution on the user’s machine. The core weakness is the same one showing up all over agentic tooling: the model happily acts on instructions that arrive through a channel the user never intended as a prompt surface. Anthropic issued the fix, but the class of bug — deep-link auto-prompt into a tool-enabled agent — will keep recurring as more agents pick up more integrations.
Deep links, browser handlers, and MCP integrations turn any URL into a potential prompt-and-tool-call vector. Once the agent has filesystem or shell tools bolted on, a single crafted link is functionally a foothold. Patching the specific handler helps for one release; the durable answer is to treat every input to the agent as untrusted and every tool call as a policy decision, not an implicit permission. Prompt injection stops being an existential problem the moment the agent’s tool calls are gated by runtime policy instead of the model’s discretion.
Most Advanced AI Security Zero Trust, Layer by Layer
- Discovery / Inventory: KYA enrols every agent, MCP server, and tool binding — a Claude Desktop instance with a filesystem MCP server attached is a known, scoped actor with an enumerated tool list.
- Behavioural enforcement: AI Firewall inspects incoming prompts (including deep-linked ones) for injection patterns, and Flow Enforcer requires policy approval before the agent can invoke filesystem or shell tools — PromptFiction’s auto-prompt hits a wall before it reaches RCE.
- Flow / egress control: PII Shield redacts sensitive filesystem content the agent tries to read; QuantumVault keeps secrets and keys tokenized so a compromised agent inherits nothing usable even if it reaches the disk.
- Immutable audit: Every deep-link prompt, every tool call, and the exact model of the moment of block are stored in the Audit Black Box with PQ-Sign timestamps for post-incident forensics.
The AI Firewall inspects the prompt surface Anthropic’s deep-link handler couldn’t — and Flow Enforcer gates the tool call that turns injection into RCE.
4 — Claude for Chrome Extension Flaw Lets Rogue Extensions Trigger Gmail Reads and Other AI Actions
The Hacker News and BleepingComputer reported a Claude for Chrome extension flaw that lets rogue browser extensions trigger AI actions inside Claude for Chrome — including Gmail reads and other high-privilege browser tasks the agent is authorized to perform. The rogue extension doesn’t need to touch Claude’s credentials directly; it drives the agent through a permitted channel the extension shouldn’t have had. Because Claude for Chrome inherits the user’s browser session — email, SaaS consoles, banking — the impact scales with whatever tabs the user has open. It is a canonical “agent as the new attack surface” case: the model is legitimate, the credentials are legitimate, and the attacker just steers the agent from a neighbouring extension.
Browser AI agents are becoming a de facto session broker: they hold the user’s cookies, they can click, and they can read anything the user can read. Any local privilege escalation into that agent — from a rogue extension, a compromised update, or an OS-level hook — converts to full SaaS access. Patch cycles help with each specific bug; the durable answer is enforcement between the browser agent and the SaaS it talks to. An AI browser agent needs the same identity, policy and egress controls as a service account — because that’s functionally what it is.
Most Advanced AI Security Why RuntimeAI Customers Are Protected
- Discovery / Inventory: KYA enrols the browser agent as a scoped non-human identity, with the SaaS apps and mailboxes it’s allowed to touch enumerated up front — a rogue extension driving Gmail reads is out-of-scope by definition.
- Behavioural enforcement: Flow Enforcer and the AI Firewall baseline the agent’s behaviour; a burst of Gmail-read tool calls triggered externally deviates from that baseline and is suspended before mail is exfiltrated.
- Flow / egress control: PII Shield tokenizes sensitive mail content and QuantumVault protects secrets so even a successful rogue-extension drive returns opaque tokens instead of raw PII.
- Immutable audit: The Audit Black Box logs every extension-triggered agent action with PQ-Sign timestamps, making the specific chain of “which extension drove which agent action” provable in incident response.
KYA and Flow Enforcer treat a browser AI agent as the privileged non-human identity it actually is — and a sub-50 ms Kill Switch stops rogue-extension-driven Gmail reads mid-request.
5 — MemGhost: Persistent False Memories Planted in AI Agents Through One Email
The Hacker News detailed MemGhost, an attack that plants persistent false memories in AI agents through a single email. The email contains crafted content the agent ingests and writes into its long-term memory/context store; on every subsequent session, the agent recalls the false memory as fact and acts on it. Unlike a one-shot prompt injection, MemGhost gives the attacker persistence — the poisoned recall keeps steering the agent long after the original email is gone. Because human review of stored memories is rare, the injected fact can quietly influence customer responses, tool calls, or policy decisions for weeks.
Agent memory is the new persistence layer. Attackers used to fight for a foothold on disk; now a single email can install one that lives inside the model’s recall. Traditional email filtering doesn’t help because the payload is text, not code; and prompt-injection defenses that only inspect the current turn miss it entirely. The only real fix is to treat every memory write as a policy decision — scoped, provenance-tagged, and revocable — not as an automatic side effect of ingesting content.
Most Advanced AI Security How RuntimeAI Stops This
- Discovery / Inventory: KYA enrols the agent’s memory store as a governed resource with provenance on every entry — you can see which agent, which session, which source planted each recall.
- Behavioural enforcement: The AI Firewall inspects ingested content for injection and memory-write attempts; Flow Enforcer requires policy approval before an untrusted email can write to long-term memory, breaking MemGhost’s persistence step.
- Flow / egress control: PII Shield strips or tokenizes sensitive fields before they can be written into recall, and QuantumVault stores memory embeddings encrypted so poisoning attempts land in a governed lane.
- Immutable audit: Every memory write is signed into the Audit Black Box with PQ-Sign timestamps, so retro-hunting for MemGhost-style entries becomes a query, and revoking the poisoned recall is a single policy action.
Flow Enforcer treats agent memory writes as governed events — MemGhost’s email never becomes a permanent false memory.
6 — New Agent Data Injection Attack Makes AI Agents Misclick or Run Attacker Commands
The Hacker News detailed a new class of “Agent Data Injection” attacks where content served to an AI agent — a document, an API response, a web page in a browsing tool — is engineered to steer the agent into misclicking UI elements or running attacker-supplied shell commands. The agent isn’t compromised in the classical sense; it’s just given data that changes what it does next. Because the malicious content flows through a legitimate tool call, network defenses see nothing unusual. The attack works against browsing agents, RPA-style desktop agents, and code agents alike, since all three treat their tool output as authoritative context for the next action.
Every agent that reads external data and then takes actions on the user’s behalf is vulnerable to this class of attack — and the surface is growing every week as more agents get more tools. The fix is not smarter models; it’s a hard separation between “data the model consumed” and “actions the model is allowed to take next.” That separation has to live in a policy engine outside the model. An agent’s tool calls need runtime authorization — not a probabilistic guess by the model about whether the request was legitimate.
Most Advanced AI Security Zero Trust · Defence in Depth
- Discovery / Inventory: KYA enrols the agent, its tools, and its allowed action set — a browsing agent that suddenly attempts shell commands is out-of-scope by construction.
- Behavioural enforcement: The AI Firewall screens tool outputs for known injection patterns; Flow Enforcer requires per-call authorization for sensitive actions (clicks on money-moving UI, shell execution) regardless of what the model “wants” to do next.
- Flow / egress control: PII Shield keeps sensitive fields tokenized in the agent’s context, and Flow Enforcer egress policy prevents an injected shell command from reaching attacker infrastructure.
- Immutable audit: Every “action after data-ingest” pairing is stored in the Audit Black Box with PQ-Sign timestamps, so injected steering is reconstructable turn-by-turn.
Flow Enforcer authorizes agent actions per call — a misclick or shell command triggered by injected data hits a policy wall, not a live target.
7 — 1M+ Emails Use Hidden Text to Dupe AI Security Filters
Dark Reading reported that more than a million phishing emails were observed using hidden text — unicode tricks, zero-width characters, off-screen HTML, and other invisible markup — specifically to fool AI-based email security filters. The hidden content changes what the classifier “reads,” pushing the score benign, while the visible message that lands in the inbox is a straightforward phish. The technique is model-agnostic: it exploits the classifier’s tokenization, not any single vendor’s policy. The volume — more than a million messages — shows the technique has moved past research into industrial-scale campaigns.
An AI classifier can only defend against the content it actually sees. Hidden-text attacks exploit the gap between the model’s tokenized view and the human’s rendered view — a gap that every AI email filter shares. Adding more models doesn’t fix it; the durable answer is to normalize the input first, then check what the recipient will actually see, then enforce policy on any action that clicks-through or replies. Model-only defenses always fall to adversarial inputs; policy at the action layer is what keeps the click from becoming compromise.
Most Advanced AI Security Why RuntimeAI Customers Are Protected
- Discovery / Inventory: KYA enrols every AI agent that reads mail (SOC copilots, triage agents, autoresponders) as a scoped identity, so an evasion-based phish that reaches an AI agent lands inside a bounded actor.
- Behavioural enforcement: The AI Firewall normalizes and inspects incoming content (hidden text included) before it reaches the model; Flow Enforcer suspends downstream actions — credential prompts, link fetches — when the message trips policy.
- Flow / egress control: PII Shield tokenizes credentials and account identifiers in agent context, and Flow Enforcer egress policy blocks callbacks to attacker infrastructure even when the classifier scores benign.
- Immutable audit: Every classification decision plus the raw (pre-normalization) message is stored in the Audit Black Box with PQ-Sign timestamps, so evasion campaigns are hunt-friendly retrospectively.
The AI Firewall normalizes and inspects the message the AI classifier would otherwise miss — and Flow Enforcer blocks any downstream action the phish tries to trigger.
Identity & Non-Human Identity
8 — Fake Microsoft Entra Passkey Enrollment Used to Gain Microsoft 365 Access
The Hacker News reported an extortion crew using a fake Microsoft Entra passkey-enrollment flow: the attacker calls a target under a plausible pretext, walks them through what looks like a legitimate passkey setup, and captures the enrollment so the attacker’s key is registered to the victim’s Entra account. Once registered, the attacker has a WebAuthn-strong credential on the account — often stronger than the victim’s own — and full Microsoft 365 access follows. Because passkeys are meant to be the strong factor, defenders rarely instrument enrollment as suspiciously as they do password resets. The result is a takeover that survives password rotation and standard MFA challenges.
Passkeys defeated password phishing; attackers responded by targeting enrollment. The compromise doesn’t defeat WebAuthn — it just gets a WebAuthn credential registered on the wrong side of the transaction. The class of bug is identity-lifecycle: strong credentials without governed enrollment are just a shinier way to get owned. Passkey rollout without enrollment governance and NHI-grade audit trail is a false sense of security.
Most Advanced AI Security Zero Trust, Layer by Layer
- Discovery / Inventory: KYA extends non-human-identity governance to every credential-enrollment event — a new passkey registered on a privileged M365 account is a KYA event, not a silent config change.
- Behavioural enforcement: Flow Enforcer requires policy approval and step-up for passkey enrollment on privileged accounts, and the AI Firewall catches AI-driven vishing scripts that try to talk users through the enrollment flow.
- Flow / egress control: PII Shield tokenizes sensitive M365 content in downstream agent context, and QuantumVault holds bootstrap secrets so a compromised session inherits nothing usable beyond the account itself.
- Immutable audit: Every passkey enrollment is written to the Audit Black Box with PQ-Sign post-quantum signatures, so a rogue enrollment is instantly hunt-friendly and defensibly revocable.
KYA + Flow Enforcer treat passkey enrollment as the identity event it is — and a sub-50 ms Kill Switch revokes the rogue passkey the moment the anomaly is confirmed.
9 — OAuth Client-ID Spoofing Enables Stealthy Cloud Account Enumeration
eSecurity Planet reported a class of “OAuth client-ID spoofing” techniques that let attackers passively enumerate cloud accounts without generating the auth-log signals defenders typically hunt on. By reusing or spoofing legitimate client IDs against provider endpoints, the attacker probes tenant existence and configuration without triggering failed-login alerts or standard OAuth telemetry. The technique doesn’t itself deliver a compromise, but it feeds every downstream attack — from targeted phishing to service-principal abuse — with high-confidence enumeration data. Because it hides in the shape of normal OAuth traffic, most existing detections don’t see it.
Enumeration is the pre-work for almost every real attack on cloud identity. When that pre-work is silent, defenders miss the wind-up entirely. Extending detection to identify OAuth client-ID abuse is helpful; the durable answer is to move governance up the identity fabric so that even successful enumeration lands in a scoped world. Assume enumeration succeeds — and make sure every non-human identity it discovers is already scoped and monitored.
Most Advanced AI Security How RuntimeAI Stops This
- Discovery / Inventory: KYA inventories every OAuth client and non-human identity in the cloud tenant, so client-ID spoofing has no unmapped surface to explore.
- Behavioural enforcement: Flow Enforcer baselines expected OAuth traffic patterns per client ID; unusual enumeration shapes trigger policy even when auth logs are quiet.
- Flow / egress control: PII Shield tokenizes user identifiers in downstream agent context, and QuantumVault keeps client secrets and refresh tokens protected so enumeration never converts to credential theft.
- Immutable audit: The Audit Black Box records every OAuth interaction with PQ-Sign timestamps, so enumeration campaigns are reconstructable even when the provider’s own logs stay silent.
KYA maps every OAuth client and non-human identity up front, so stealthy enumeration lands in a governed inventory instead of an open plain.
10 — Zara Data Breach Exposes 197,000 Customers via Compromised Anodot Analytics Token
BleepingComputer reported that Zara disclosed a data breach exposing the personal information of about 197,000 customers, traced to the compromise of a third-party analytics token used with Anodot. The token — a non-human identity issued to a vendor system — had enough reach into Zara’s data pipeline to yield customer PII once compromised. Once again the initial-access vector is not a human credential or a novel exploit; it’s an over-scoped machine identity granted for legitimate analytics work. The breach fits a pattern we’ve tracked for months: third-party NHIs, especially analytics and observability tokens, are the fastest way from a low-noise vendor incident to a first-party customer breach.
Non-human identities issued to vendors are almost always over-scoped and almost never rotated on the schedule a human credential would be. Analytics vendors in particular tend to accumulate access to raw customer data because their pipelines are built to see everything. The lesson isn’t “don’t use Anodot” — it’s that vendor tokens are a governance object, not a checkbox. NHI scope, rotation, and behavioural monitoring are not optional for any vendor with a token into your data plane.
Most Advanced AI Security Why RuntimeAI Customers Are Protected
- Discovery / Inventory: KYA enrols every vendor NHI, catalogs its scope, and flags scope creep — an analytics token that can read raw customer PII shows up as a governance issue before it becomes an incident.
- Behavioural enforcement: Flow Enforcer baselines vendor-token behaviour; a compromised token pulling bulk customer records deviates from its analytics baseline and is suspended before the export finishes.
- Flow / egress control: PII Shield tokenizes customer identifiers before they hit third-party analytics pipelines, and QuantumVault keeps the raw data encrypted — a stolen token pulls tokenized noise, not usable PII.
- Immutable audit: The Audit Black Box logs every vendor-token read with PQ-Sign timestamps, so the exact scope of an Anodot-style compromise is a query, not a forensic reconstruction.
PII Shield tokenizes the data before it ever reaches an analytics vendor — a compromised third-party NHI pulls opaque tokens, not 197,000 customer records.
Major Data Breach & Ransomware
11 — AssuranceAmerica Breach Exposes ~6.9 Million Drivers
eSecurity Planet reported that AssuranceAmerica disclosed a data breach exposing the personal information of roughly 6.9 million drivers. The exposed data includes driver’s licence numbers, addresses, and Social Security Numbers — a combination that is effectively a starter pack for identity fraud and downstream account takeover. Insurance carriers sit on this data because underwriting requires it, which makes them a persistent, high-value target class. The size — 6.9 million records — is what turns this from a corporate incident into a systemic identity-fraud accelerator.
The compounding harm here isn’t the breach itself; it’s that SSNs are permanent identifiers being stored in plaintext-equivalent form at scale across an entire industry. Rotating a leaked password takes minutes; rotating an SSN is impossible. The durable answer is to keep sensitive identifiers tokenized at rest so a successful breach yields opaque tokens, not usable identity data. If your data lake still holds raw SSNs, the next 6.9-million-record breach is already priced in — the fix is data-layer tokenization, not another perimeter tool.
Most Advanced AI Security Zero Trust, Layer by Layer
- Discovery / Inventory: KYA catalogs every service, workload and analytics agent that can read SSN and licence fields — scope creep on high-sensitivity identifiers becomes visible before a breach.
- Behavioural enforcement: Flow Enforcer baselines expected read patterns; bulk exfil of SSN and driver-licence records deviates immediately and is contained mid-export.
- Flow / egress control: PII Shield tokenizes SSN, licence number and address at ingestion, and QuantumVault holds the raw values encrypted — a successful breach pulls tokens that are useless outside the tokenization plane.
- Immutable audit: The Audit Black Box records every read of SSN or licence data with PQ-Sign timestamps, so the scope of a 6.9M-record incident is a precise query, not a class-action estimate.
PII Shield and QuantumVault mean a stolen insurance dataset is opaque tokens, not 6.9M usable SSNs.
12 — 23andMe Agrees to Pay $18M in New Genetics Data-Breach Settlement
BleepingComputer reported that 23andMe agreed to pay an additional $18 million in a new settlement tied to its historic genetic-data breach. The expanded payout reflects the long tail of a class of data — genome sequences and family-relationship inferences — that cannot be rotated, revoked, or reissued. Once genetic data is out, it’s out for the affected individuals and their biological relatives, permanently. The settlement is another data point in the trend of courts pricing in the “forever” nature of genomic PII exposure and the downstream harm it enables.
Genetic data is the most extreme example of “identifiers you can’t rotate,” but the same logic applies to biometrics, SSNs, and long-lived NHI tokens. The regulatory and legal price of holding this data in plaintext-equivalent form is going up, and it will keep going up. The durable answer is architectural: tokenize at rest, gate all access by policy, and prove containment with an immutable audit trail. Data you can’t rotate must be data you can’t read in bulk without an explicit, auditable policy decision.
Most Advanced AI Security Zero Trust · Defence in Depth
- Discovery / Inventory: KYA enrols every service and researcher agent with access to genomic fields and enforces scoped identity, so high-sensitivity data has a named, bounded actor pool.
- Behavioural enforcement: Flow Enforcer baselines expected genomic-read patterns; bulk export or unusual join behaviour deviates from that baseline and is suspended before the query finishes.
- Flow / egress control: PII Shield tokenizes irreversible identifiers (genomic, biometric) at ingestion, and QuantumVault holds the raw sequences under post-quantum encryption so a breach yields tokens, not genomes.
- Immutable audit: Every read of genomic data is written to the Audit Black Box with PQ-Sign timestamps, giving regulators, courts, and customers a defensible trail.
QuantumVault and PII Shield make irreversible identifiers — genomic, biometric, SSN — unusable outside the tokenization plane, even after a full breach.
13 — Coca-Cola Says Fairlife Ransomware Attack Halts US Dairy Production
BleepingComputer reported that Coca-Cola confirmed a ransomware attack on its Fairlife dairy division halted US dairy production. The incident crossed the IT/OT boundary far enough to stop physical output — the definitional worst-case for an ICS-adjacent environment. The disclosure emphasizes production impact, which is the metric that matters for a supply-chain incident: customers see shelf gaps, not IR reports. The event lands in a year already dominated by ransomware crews that specifically target food, agriculture, and consumer-packaged-goods manufacturers because those verticals combine legacy OT with high tolerance for ransom payment under time pressure.
Ransomware that halts dairy production is not really an OT-security story; it’s an IT-to-OT lateral-movement story, with OT as the failure mode. The industry keeps rebuilding the same firewalled architecture and keeps watching it fail in the same way. The durable answer is behavioural containment before ransomware reaches the OT boundary, plus a fast kill switch to break the encryption fan-out. An OT-halt from an IT ransomware event means the lateral-movement window was too wide and the kill was too slow.
Most Advanced AI Security How RuntimeAI Stops This
- Discovery / Inventory: KYA enrols every workload spanning IT and OT-adjacent networks, giving the ransomware fan-out a bounded actor list to violate.
- Behavioural enforcement: Flow Enforcer baselines normal IT-to-OT flows; lateral movement into production networks and mass-encryption behaviour deviate immediately and are contained mid-spread.
- Flow / egress control: Flow Enforcer egress policy blocks payload pulls and C2 channels, and PII Shield / QuantumVault protect the credentials attackers would otherwise harvest to pivot deeper.
- Immutable audit: The Audit Black Box records the full IT-to-OT crossing with PQ-Sign timestamps, giving operators and regulators a defensible reconstruction of exactly how the halt happened.
A sub-50 ms Kill Switch driven by Flow Enforcer breaks ransomware lateral movement before it reaches the OT boundary that halts a production line.
14 — Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity
The Hacker News reported that Microsoft mapped three distinct Salesforce attack paths tied to a year of ShinyHunters activity. Common across all three: abuse of OAuth tokens and connected apps rather than user-credential theft. ShinyHunters used consented apps and refresh tokens to move laterally across tenants and exfiltrate CRM data at scale, largely without tripping the user-facing alerts Salesforce administrators are used to. Microsoft’s writeup is a rare cross-vendor look at what NHI abuse looks like at attacker-of-record scale over a full year.
Connected apps are the shadow identity fabric of every SaaS estate, and OAuth tokens are the credentials that most organizations don’t inventory, don’t rotate, and don’t scope. ShinyHunters’ year-long run is the practical demonstration that this gap is exploitable at will. The fix isn’t another SaaS security posture tool; it’s treating every connected app and every OAuth token as a governed non-human identity, with runtime behavioural policy. The Salesforce attack paths Microsoft mapped only work when nobody is governing the SaaS NHIs — runtime NHI governance closes the whole class.
Most Advanced AI Security Zero Trust, Layer by Layer
- Discovery / Inventory: KYA enrols every connected app and OAuth token across SaaS estates, so a ShinyHunters-style consent grant lands in an inventory, not a blind spot.
- Behavioural enforcement: The AI Firewall and Flow Enforcer baseline expected connected-app behaviour; bulk CRM export via a refresh token deviates instantly and is suspended before the ex-fil completes.
- Flow / egress control: PII Shield tokenizes customer records read through connected apps, and QuantumVault protects long-lived OAuth secrets so a stolen refresh token has a short usable life.
- Immutable audit: Every OAuth grant, refresh, and connected-app read is signed into the Audit Black Box with PQ-Sign timestamps for defensible cross-tenant reconstruction.
KYA governs every OAuth connected app as a first-class NHI — the three Salesforce attack paths Microsoft documented lose their un-inventoried surface.
15 — SpaceX and Starlink X-Accounts Hijacked in Crypto Scam
eSecurity Planet reported that the SpaceX and Starlink X-accounts were hijacked and used to push a crypto scam. High-follower social accounts are a persistent target because a single tweet can reach tens of millions of people before takedown; the ROI on a successful hijack is enormous compared to the effort of the intrusion itself. The class of compromise is almost always identity-lifecycle — delegated access, third-party publishing tools, or lingering staff accounts with elevated privileges — not a novel X platform bug. The incident is another reminder that brand-critical social identities require the same rigour as production credentials.
Social identities look like marketing assets but behave like production credentials, because the blast radius of a hijack is the follower graph. Every ancillary access path — publishing tools, VAs, agencies, legacy admins — is a potential foothold. The durable answer is treating these accounts as governed NHIs with scoped delegation and behavioural monitoring on posting activity. Brand-critical social accounts need NHI-grade identity governance, not just a password manager and 2FA.
Most Advanced AI Security Why RuntimeAI Customers Are Protected
- Discovery / Inventory: KYA enrols every delegated identity and third-party publishing agent tied to brand-critical social accounts, so a rogue publishing-tool token is a governed inventory item.
- Behavioural enforcement: Flow Enforcer baselines posting cadence and content shape; crypto-scam posts from a brand account deviate immediately and are held pending policy approval.
- Flow / egress control: PII Shield and QuantumVault protect the credentials and API secrets that publishing agents hold, limiting what a compromised delegation can do next.
- Immutable audit: Every post, delegation, and identity change on the brand account is signed to the Audit Black Box with PQ-Sign timestamps for defensible attribution.
Flow Enforcer holds anomalous posts pending approval — a hijacked brand account can’t amplify a crypto scam to tens of millions before the block.
Critical Vulnerabilities & Vendor Advisories
16 — RabbitMQ Vulnerabilities Could Enable Unauthenticated Broker Takeover
eSecurity Planet reported RabbitMQ vulnerabilities that could enable unauthenticated broker takeover — a pre-authentication RCE class in one of the most widely deployed message brokers in production infrastructure. Because RabbitMQ commonly sits behind service meshes and inside private networks, teams often treat it as low-risk from an external-exploit perspective; a pre-auth takeover flips that assumption. In agent architectures where RabbitMQ often carries tool calls, prompts, and outputs between agents and services, a broker takeover is a full man-in-the-middle position on the AI control plane.
Message brokers are load-bearing identity boundaries in modern architectures — if the broker is owned, every message on the bus is attacker-visible or attacker-forgeable. In agent-heavy environments this matters even more because prompts and tool calls flow across the broker in cleartext by default. Patch cycles matter, but the durable answer is defense-in-depth: identity per producer/consumer, encryption of payloads at the tokenization layer, and behavioural monitoring on bus traffic. Never assume the message broker is inside your trust boundary — treat every producer and consumer as an identity, and every payload as data that needs tokenization.
Most Advanced AI Security Zero Trust · Defence in Depth
- Discovery / Inventory: KYA enrols every producer and consumer on the message bus as a scoped NHI — a compromised broker sees identified actors, not anonymous traffic.
- Behavioural enforcement: Flow Enforcer and the AI Firewall baseline expected bus traffic and inspect prompts/tool calls in transit; forged or altered messages deviate immediately.
- Flow / egress control: PII Shield tokenizes sensitive fields before they hit the broker, and QuantumVault protects credentials so a broker takeover yields opaque payloads, not usable secrets.
- Immutable audit: Every message on the bus is signed into the Audit Black Box with PQ-Sign timestamps so a broker compromise is fully reconstructable message-by-message.
PII Shield tokenization and Flow Enforcer bus policy mean a broker takeover doesn’t become an AI-control-plane compromise.
17 — Zoom Patches Critical Account-Takeover Vulnerability for Windows
eSecurity Planet reported that Zoom patched a critical account-takeover vulnerability in its Windows client. Account-takeover on a video-conferencing client is a bigger surface than it looks: Zoom sessions increasingly host executive meetings, recorded conversations, and integrations to note-taking AI agents and CRMs. Once an attacker owns a Zoom account, they inherit the meeting history, the connected apps, and the transcripts — all high-value for further pretext-based attacks. Zoom’s advisory is a straightforward patch-priority event, but the impact class is broader than any single meeting.
Every SaaS client with AI-agent integrations is now a durable identity target, because the account carries the connected-app scopes and transcript history along with the session cookie. Zoom is the specific incident this week, but the pattern applies to every conferencing, CRM, and mail client with a note-taking or summarization agent. Patch fast, but assume the SaaS-plus-agent bundle is the new blast radius — and govern the connected agents accordingly.
Most Advanced AI Security How RuntimeAI Stops This
- Discovery / Inventory: KYA enrols every note-taking, summarization, and CRM-sync agent tied to the SaaS account, giving each one a scoped identity independent of the user session.
- Behavioural enforcement: Flow Enforcer baselines expected agent behaviour; bulk transcript exports or unusual connected-app reads from a taken-over Zoom account deviate immediately and are suspended.
- Flow / egress control: PII Shield tokenizes sensitive names, deal amounts, and identifiers in transcripts, and QuantumVault protects long-lived OAuth secrets so a taken-over account doesn’t leak refresh tokens.
- Immutable audit: Every transcript pull, agent action, and connected-app read is signed to the Audit Black Box with PQ-Sign timestamps for defensible incident scope.
Flow Enforcer and KYA turn a SaaS account-takeover into a bounded blast radius — connected AI agents don’t automatically inherit the compromise.
18 — WP-SHELLSTORM: Thousands of WordPress Websites Backdoored
eSecurity Planet reported WP-SHELLSTORM, a campaign that has backdoored thousands of WordPress websites across shared-hosting environments. The persistence mechanism survives common cleanup steps and re-establishes itself across sites that share hosting infrastructure, which is why the campaign is measured in thousands, not tens. The impact ranges from SEO poisoning and drive-by malware distribution to credential harvesting on legitimate-looking sites, and the campaign appears to be professionally operated at scale. WordPress + shared hosting remains the highest-volume mid-tier compromise surface on the internet, and WP-SHELLSTORM is this week’s reminder of that.
WordPress compromises rarely feature in enterprise weekly digests, but they matter because they are the delivery layer for a huge fraction of the drive-by, phishing and credential-harvesting campaigns that eventually hit enterprise inboxes and AI agents. Behavioural containment on outbound traffic and egress policy on any AI browsing agents that visit these sites keeps the impact bounded. Treat every third-party site the AI agent visits as untrusted input — the WP-SHELLSTORM class of compromise is the reason.
Most Advanced AI Security Zero Trust, Layer by Layer
- Discovery / Inventory: KYA enrols every browsing and research AI agent, so the set of workloads that could hit a compromised WordPress site is a known inventory.
- Behavioural enforcement: The AI Firewall inspects fetched pages for injection and steering content; Flow Enforcer blocks downstream tool calls the compromised site tries to trigger.
- Flow / egress control: Flow Enforcer egress policy stops secondary payloads and credential-harvesting callbacks; PII Shield tokenizes anything sensitive in the agent’s context.
- Immutable audit: Every agent visit to an external site is signed to the Audit Black Box with PQ-Sign timestamps, so post-facto hunts for WP-SHELLSTORM-style contact are a query.
The AI Firewall and Flow Enforcer keep a browsing agent’s visit to a backdoored WordPress site from becoming an in-agent compromise.
This week’s eighteen incidents point at one pattern: AI agents themselves are now the attack surface. A jailbroken Gemini CLI ran a botnet in six minutes. MemGhost planted persistent false memories through a single email. Hidden text sailed past AI security filters on more than a million phishing messages. Deep-link and browser-extension bugs turned Claude Desktop and Claude for Chrome into remote-controlled tools. And on the identity side, a fake Entra passkey took over M365, OAuth client-ID spoofing enumerated cloud tenants silently, and Zara’s Anodot token turned a vendor NHI into a 197,000-record customer breach. The old kind of harm kept landing on top of all of it — AssuranceAmerica 6.9M, 23andMe $18M, a Coca-Cola / Fairlife ransomware event that stopped US dairy production, and Microsoft’s ShinyHunters mapping.
The common defense across all of it is the same: govern agents and non-human identities at runtime. A verifiable identity for every agent and workload with KYA; real-time behavioural policy and input/output screening with Flow Enforcer and the AI Firewall; a sub-50 ms Kill Switch to contain before the blast radius spreads; data-layer tokenization with PII Shield and QuantumVault so stolen records are inert; and an immutable, post-quantum audit trail with PQ-Sign and the Audit Black Box to prove exactly what happened. We built one of the best identity and agent-governance stacks out there — and we still tell every customer it’s the front door, not the whole house. Eighteen incidents. One pattern: AI agents are the attack surface, and runtime governance of agents and identities is how you contain it.
Sources
- Google Gemini CLI abused as a hacking agent and malware botnet operator (jailbroken CLI rebuilds botnet in ~6 minutes) — BleepingComputer / Help Net Security, July 15–16, 2026
- TuxBot v3 shows signs of LLM-assisted IoT botnet development — The Hacker News, July 16, 2026
- Claude flaw automatically sends malicious prompts to AI agents (PromptFiction / claude:// deep-link + MCP filesystem; patched in Claude Desktop v1.1.2321) — Dark Reading / The Hacker News / BleepingComputer, July 14–16, 2026
- Claude for Chrome extension flaw — rogue extensions trigger Gmail reads and other AI actions — The Hacker News, July 14, 2026 / BleepingComputer, July 16, 2026
- MemGhost — persistent false memories planted in AI agents through one email — The Hacker News, July 13, 2026
- New Agent Data Injection Attack — makes AI agents misclick or run attacker commands — The Hacker News, July 16, 2026
- 1M+ emails use hidden text to dupe AI security filters — Dark Reading, July 16, 2026
- Fake Microsoft Entra passkey enrollment used to gain Microsoft 365 access — The Hacker News, July 10, 2026
- OAuth Client-ID Spoofing enables stealthy cloud account enumeration — eSecurity Planet, July 16, 2026
- Zara data breach exposes 197,000 customers via Anodot analytics token compromise — BleepingComputer, July 2026
- AssuranceAmerica breach exposes ~6.9M drivers (licence numbers, addresses, SSNs) — eSecurity Planet, July 9, 2026
- 23andMe agrees to pay $18M in new genetics data-breach settlement — BleepingComputer, July 16, 2026
- Coca-Cola says Fairlife ransomware attack halts US dairy production — BleepingComputer, July 16, 2026
- Microsoft maps three Salesforce attack paths tied to a year of ShinyHunters activity — The Hacker News, July 14, 2026
- SpaceX and Starlink X-accounts hijacked in crypto scam — eSecurity Planet, July 13, 2026
- RabbitMQ vulnerabilities could enable unauthenticated broker takeover — eSecurity Planet, July 15, 2026
- Zoom patches critical account-takeover vulnerability for Windows — eSecurity Planet, July 16, 2026
- WP-SHELLSTORM — thousands of WordPress websites backdoored via shared-hosting persistence — eSecurity Planet, July 10, 2026
Get the Weekly Digest
Weekly AI security digest: every major incident with the RuntimeAI Take on what stops it. No fluff, no vendor pitches — just what happened, why it matters, and what to enforce next.