Threat Library

This item is a blog post by Simon Willison discussing best practices for reviewing and verifying changes made by AI coding agents, not a security vulnerability or threat report. There is no indication of prompt injection, tool poisoning, or any exploitable weakness in agents or protocols.

Kaspersky discovered a malware family targeting Android-based vehicle head unit firmware developed by DoFun, which propagates via built-in firmware updaters. The malware deploys a multi-stage downloader used to conduct ad fraud and enlist infected devices into a proxy botnet.

Check Point Research disclosed a technique abusing Microsoft Defender's own legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems, including deletion of security software at boot. Because BTR.sys is Microsoft-signed and no external or malicious driver is introduced, the technique bypasses driver-signature enforcement and many endpoint protections, affecting Windows 7 through Windows 11 25H2.

Researchers identified 14 trojanized npm packages disguised as calendar and streak-tracking utilities that covertly deploy an AI-powered Linux backdoor called RedC2 4.0. The malware extracts and executes a bundled binary as a detached background process, giving attackers persistent, AI-assisted command-and-control capability on infected hosts.

Microsoft has identified that games crashing or failing to launch after installing the August 2026 Windows updates may be caused by conflicts with RGB lighting peripheral software rather than a security vulnerability. This is a functional compatibility bug affecting gaming systems, not a cybersecurity threat.

Over 9,300 AWS access keys publicly exposed between August 2022 and August 2026 remain active and valid, granting attackers full control over corporate AWS accounts. These leaked credentials likely originate from hardcoded secrets in public repositories, misconfigured applications, or logging errors, posing an ongoing risk of account takeover, data theft, and resource abuse.

A new malware loader named SynkLoader is being distributed through Microsoft Teams phishing campaigns, using a fake lock screen overlay to harvest user credentials. The campaign leverages the trust employees place in Teams notifications and internal communication tools to deliver the loader and steal login credentials.

CISA has added CVE-2026-73570, an OS command injection vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. Federal Civilian Executive Branch agencies are required under BOD 26-04 to remediate this vulnerability on an expedited timeline, and CISA urges all organizations to prioritize patching.

A critical vulnerability in Submariner, a multi-cluster Kubernetes networking tool, allows a malicious spoke cluster to advertise arbitrary and unvalidated network subnets to peer clusters. This enables the attacker to hijack traffic intended for legitimate destinations, rerouting it through an attacker-controlled tunnel for interception, disruption, or man-in-the-middle attacks across the federated cluster mesh.

A critical vulnerability (CVE-2026-16926) affects IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1, allowing remote attackers to overwrite arbitrary files due to improper input sanitization. With a CVSS score of 9.1, this flaw poses significant risk to enterprise Unix/virtualization environments running on IBM Power hardware.

A critical stack-based buffer overflow exists in the mycli binary of TRENDnet TEW-755AP wireless access points, triggered by unsanitized input in the SSID parameter. The vulnerability is remotely exploitable and a public exploit is available, making it an immediate risk for exposed devices. CVSS 9.9 reflects the potential for full device compromise without authentication.

The search-v2-operator, commonly deployed in Kubernetes/OpenShift environments (e.g., Red Hat Advanced Cluster Management), is provisioned with a ClusterRole granting effectively cluster-admin level permissions. This over-privileged configuration allows the operator or any workload/service account leveraging it to impersonate users, forge RBAC bindings, approve CSRs, and manage ManifestWork objects, enabling full cluster takeover.

A critical stack-based buffer overflow vulnerability exists in TRENDnet TEW-823DRU routers (firmware 1.1.02b01) due to unsafe use of strcpy on the wan_l2tp_password parameter in /cgi-bin/wan.cgi. The flaw is remotely exploitable without complex prerequisites, and public exploit code is already available, making it an immediate risk for internet-exposed or compromised-network devices.

CVE-2026-73570 is an unauthenticated OS command injection vulnerability in Synacor Zimbra Collaboration Suite that can be triggered via specially crafted SMTP requests, leading to arbitrary command execution as the Zimbra user. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with an unusually short remediation window, indicating active exploitation in the wild. Organizations running ZCS mail servers should treat this as an imminent compromise risk.

The CKAN MCP Server's earlier SSRF fix only blocked the literal hostname 'localhost' and dotted IPv4/bracketed IPv6 loopback literals, but missed alternate hostname aliases like 'ip6-localhost' and 'ip6-loopback' that resolve to loopback addresses. A remote caller invoking CKAN tools (e.g. ckan_package_search, sparql_query) with a crafted server_url/base_url parameter could bypass the filter and force the server to make requests to internal or loopback network locations. This is a moderate-severity SSRF bypass affecting a specific tool integration, not a novel or high-impact agentic exploitation technique.

Infracost, a cost-analysis tool used alongside AI coding agents and CI/CD pipelines, could be tricked into sending a configured Terraform Cloud or registry token to an attacker-controlled host. This happens because the tool derives the destination hostname from untrusted Terraform input (e.g., in a pull request) rather than validating it against the trusted host configuration. The issue is fixed in version 0.10.45.

Infracost's template functions used by AI coding agents and CI/CD pipelines fail to properly resolve intermediate directory symlinks, allowing a malicious repository to trick the tool into reading arbitrary files accessible to the CI runner, including secrets. The leaked content can then be surfaced in the Infracost dashboard or pull request comments, creating a data exfiltration path. This is a classic path traversal/symlink vulnerability in a tool commonly invoked by AI agents and CI automation, fixed in version 0.10.45.

Omnigent, an open-source AI agent orchestration framework, fails to validate the os_env.cwd field in uploaded agent bundles, allowing an authenticated user to supply an absolute or traversal path. When the runner has no configured workspace root, this attacker-controlled path becomes the trusted root for file and shell tools, letting an agent read, write, or execute outside its intended sandbox and potentially exfiltrate host secrets.

Omnigent, an open-source AI agent orchestration framework, contains a shell-command parser that fails to recognize certain command syntax (combined flags, timing wrappers, command substitution, background operators). This causes the framework's git/gh write allowlist and workspace confinement policies to silently abstain rather than block, letting an agent push to unauthorized repositories or branches or escape its intended working directory. A prompt-injected or otherwise manipulated coding agent could exploit this gap to perform unauthorized writes outside its granted scope.

Omnigent, an open-source AI agent orchestration framework, fails to validate the dotted Python path an authenticated user supplies for a tool callable when uploading an agent bundle. This allows a low-privilege authenticated user to point a tool at dangerous built-ins like subprocess.check_output, achieving arbitrary command execution with the runner's permissions. The result is full compromise of the runner process, including credentials, environment variables, workspace data, and internal service access.