AIAgentsExploit103of122CISAKEVsinUnderanHour

◆ DEEP DIVES

1. 01

   Commodity AI Exploits 84% of CISA KEVs in Under an Hour — Your Patch Window Just Collapsed to Zero

   The Data That Changes Your Planning Assumptions

   Sequoia-backed cybersecurity startup Buzz published research this week demonstrating that an AI agent — assembled from off-the-shelf Anthropic, OpenAI, and Google models — autonomously exploited 103 of 122 CISA Known Exploited Vulnerabilities without human oversight. Most completed in under an hour. React2Shell, one of 2025's most dangerous flaws, fell in 22 minutes.

   This is not Mythos. This is not a restricted frontier model behind a $100M consortium. This was built with commodity API access anyone can purchase today. Co-founders Niv Hoffman and Yair Saban fed the AI agent CISA's public KEV catalog — the same list designed to help defenders prioritize patching — and the agent treated it as a machine-readable target list.

   "We're now in this gap where attackers are by default early adopters of AI, and defenders by default aren't — they're risk averse, don't want to touch production much, and that definitely needs to change." — Niv Hoffman, Buzz co-founder

   ---

   The Exploitation Speed Asymmetry

   Metric	AI Agent (Buzz)	Human Attacker	Defender (Patch)
   KEV Exploitation Rate	84.4% (103/122)	Variable, skill-dependent	N/A
   Time to Exploit	Under 1 hour (most)	Several days	Days to weeks to patch
   React2Shell	22 minutes	Days	Days to weeks
   Skill Barrier	API key	Advanced skills	Sysadmin + change mgmt
   Scalability	Massively parallel	Limited by headcount	Limited by headcount

   Separately, the Internet Bug Bounty program paused new submissions this week, explicitly citing that AI-assisted research "radically lowered the cost of vulnerability discovery." The economics of offense have collapsed. Chevron CISO Jon Raper put it bluntly: "Finding vulnerabilities isn't the problem — it's remediating them in time."

   ---

   The CISA KEV Catalog Paradox

   CISA built the KEV catalog to help defenders prioritize. It now equally functions as an AI-readable attack playbook. Buzz literally fed it to their agent. This doesn't mean CISA should stop publishing — transparency still helps — but the window between KEV publication and AI-automated exploitation is now measured in minutes, not days.

   What This Means for Your Defense Model

   When patching speed can never match exploitation speed, your defensive strategy must shift from "patch before exploit" to "contain during exploit." Microsegmentation, behavioral detection, and automated containment become survival controls, not aspirational improvements. The risk of deploying AI-assisted defense imperfectly is now demonstrably lower than the risk of defending at human speed.

   Action items

   • Pull your current CISA KEV patch coverage report and identify every unpatched KEV in production by end of day Friday
   • Verify React2Shell remediation across all environments including containers and third-party deployments within 48 hours
   • Accelerate microsegmentation deployment to critical assets this quarter — prioritize identity infrastructure, databases, and CI/CD
   • Deploy automated host isolation and network quarantine playbooks for known KEV exploitation signatures this month
   • Brief the board within two weeks: 'AI has compressed exploitation from days to minutes; our defense model assumes days; we need budget to close this gap'

   Sources:AI agents just exploited 84% of CISA KEVs in under an hour · AI just went 90x on exploit generation · Thousands of Zero-Days Found in Weeks: AI Just Broke Your Vulnerability Management Model · Your threat model just broke: AI now writes sandbox-escape exploit chains autonomously

2. 02

   Salt Typhoon Breached FBI Through a Commercial ISP — Your Telecom Vendor Is Attack Surface

   The Escalation

   The FBI has formally declared a "major incident" after China-linked actors breached FBI systems through a commercial Internet Service Provider, accessing law enforcement sensitive data including returns from legal process and PII of investigation subjects. This means Chinese intelligence now knows — or can infer — who the FBI is surveilling.

   This is a direct escalation of Salt Typhoon's 2024 campaign, which compromised telecom companies' lawful intercept portals and targeted calls and metadata of approximately 40 individuals including political figures. The 2026 breach is worse: the attack vector shifted from targeting telecom companies directly to pivoting through a commercial ISP into federal infrastructure.

   There has been no in-depth public report detailing exactly what happened in the 2024 Salt Typhoon breaches or appropriate countermeasures — an 18-month gap between discovery and systematic defensive guidance.

   ---

   Why This Changes Your Threat Model

   The attack chain is deceptively simple and broadly applicable:

   1. Compromise a commercial ISP (which has network-level access to customers)
   2. Pivot from ISP infrastructure into customer networks
   3. Access sensitive data through trusted connectivity

   Your ISP is not just a service provider — it is a network-adjacent trust relationship with visibility into your traffic. If Chinese APTs can use that position to pivot into the FBI, they can use it to pivot into any customer on that ISP's infrastructure. This applies to every organization with dedicated circuits, MPLS connections, or co-location relationships with connectivity providers.

   Simultaneously: Forest Blizzard's SOHO Campaign Scales

   In a related development, Microsoft Threat Intelligence confirmed that Forest Blizzard (Fancy Bear/GRU) and sub-group Storm-2754 have compromised 5,000+ SOHO routers across 200 organizations since August 2025. They hijack DNS via dnsmasq to conduct adversary-in-the-middle attacks against Outlook Web Access users, with confirmed data interception from three African government organizations. The FBI's Operation Masquerade disrupted the U.S. segment, but the adversary will adapt.

   Two major nation-state actors — China and Russia — are simultaneously exploiting the connectivity infrastructure layer as an attack vector. The common thread: your security stack sits above the network layer these actors are targeting.

   Action items

   • Request security attestations and incident disclosure statements from all connectivity providers within 30 days — specifically ask about compromise detection capabilities and law enforcement cooperation segmentation
   • If your organization processes CALEA compliance or lawful intercept requests, segregate those systems from general infrastructure this week
   • Enforce DNS-over-HTTPS on all managed endpoints via MDM/GPO immediately to bypass SOHO router DNS hijacking
   • Issue SOHO router hygiene guidance to all remote workers this week: reset DNS, update firmware, change default credentials

   Sources:Salt Typhoon breached FBI via your ISP's infrastructure · EvilToken is phishing your M365 execs with dynamic device codes · APT28 was hiding in your remote workers' routers

3. 03

   12+ Critical CVEs in AI/ML Tools Your Teams Deployed Without Security Review

   The AI Tool Vulnerability Landscape This Week

   A wave of critical vulnerabilities in AI/ML infrastructure surfaced this week — not in frontier models, but in the agent frameworks, proxy gateways, inference engines, and developer CLIs your teams spun up without security review. SANS declared that for the first time in RSAC keynote history, every one of the five most dangerous new attack techniques carries an AI dimension.

   CVE	Product	CVSS	Vulnerability	Auth Required?
   CVE-2026-34162	FastGPT	10.0	Unauthenticated HTTP proxy — full request forwarding	No
   CVE-2026-35022	Claude Code CLI / Agent SDK	9.8	OS command injection → credential theft	No
   CVE-2026-34159	llama.cpp	9.8	RCE via unbounded deserialization	No
   CVE-2026-34612	Kestra	9.9	SQL injection to RCE	No
   CVE-2026-35030	LiteLLM	9.1	Auth bypass inheriting legitimate user identity	No
   6 CVEs	PraisonAI	9.0–10.0	Multiple critical vulnerabilities	Varies

   The pattern is unmistakable: these tools were designed for rapid experimentation and deployed to production without security maturity. Most require zero authentication for exploitation. A compromised Flowise instance (12K+ internet-exposed) isn't just one box — it's a pivot into LLM API keys, vector databases, and backend data sources the agent interacts with.

   ---

   Developer Toolchain Under Simultaneous Attack

   The attack surface extends beyond AI-specific tools into the developer toolchain itself:

   • Ruby LSP (CVE-2026-34060, CVSS 9.8): Arbitrary code execution via malicious .vscode/settings.json — cloning a repo is enough to get compromised
   • Nektos Act (CVE-2026-34041, CVSS 9.8): Environment injection in the most popular local GitHub Actions runner
   • Vite (CVE-2025-30208): File access bypass now under active exploitation on ISC honeypots — targeting standard web ports (80/443), not Vite's default 5173, indicating attackers are hunting production instances behind reverse proxies

   The Vite exploitation detail is particularly telling: attackers aren't scanning for development tools on expected ports — they're looking for Vite instances accidentally deployed behind production reverse proxies. Your dev tools in production are being actively hunted.

   ---

   The Governance Gap

   Nearly 50% of organizations cannot fully track AI and non-human identities accessing critical systems, despite 87% claiming AI readiness. New tools are emerging — StepSecurity's dev-machine-guard scans developer machines for AI agents and MCP servers, Knostic's AgentSonar provides network-level shadow AI detection — but adoption lags the threat by months.

   If you don't know which AI tools your engineers are running, you have blind spots with CVSS 10.0 exposure.

   Action items

   • Inventory all AI/ML tools across the organization this week — survey engineering, data science, and business analyst teams for FastGPT, llama.cpp, Claude Code CLI, LiteLLM, PraisonAI, and Flowise deployments
   • Scan external attack surface for any internet-exposed Flowise, FastGPT, or AI agent builder instances immediately
   • Deploy Elastic's supply-chain-monitor for PyPI/npm dependencies and evaluate StepSecurity dev-machine-guard for developer endpoint AI agent inventory this month
   • Search proxy and load balancer configs for backend targets on port 5173 (Vite) this week — patch CVE-2025-30208 across all environments
   • Establish mandatory security vetting for AI tool deployment — no AI framework goes to production without AppSec review

   Sources:Your security scanner may be the weapon: TeamPCP's Trivy supply chain attack · Flowise CVSS 10.0 under active exploit + Iran targeting AI infrastructure · Your threat model just broke: AI now writes sandbox-escape exploit chains autonomously · AI Agents Now Merge PRs in Your GitHub Repos

4. 04

   EvilToken and ClickFix: Two New Campaigns Exploiting Features You Intentionally Enabled

   EvilToken: Device Code Phishing Solved Its Scalability Problem

   Microsoft Defender researchers tracked a large-scale device code phishing campaign powered by the EvilToken Phishing-as-a-Service toolkit. The critical innovation: attackers use Railway.com to spin up ephemeral Node.js polling nodes that generate device codes dynamically at the moment of click, solving the fundamental 15-minute expiration limitation that previously made device code phishing impractical at scale.

   Phishing emails are role-tailored — invoices for finance, RFPs for procurement, manufacturing workflows for operations — boosting interaction rates. Post-authentication, attackers use Microsoft Graph API to enumerate organizational structures and zero in on financial and executive accounts for email exfiltration. This is targeted intelligence collection, not spray-and-pray.

   Why Default-Enabled Device Code Flows Are the Problem

   M365 device code authentication flows are enabled by default in most Entra ID tenants. Most organizations never touch this setting because device code auth is a legitimate feature for headless devices and kiosks. EvilToken weaponizes this gap between feature intent and security exposure.

   ---

   ClickFix: Enterprise-Grade Evasion in a MaaS Package

   Netskope Threat Labs identified a ClickFix campaign using a fake CAPTCHA prompting execution of a PowerShell command that downloads a Node.js-based RAT. The sophistication is notable:

   • Bundles its own Node.js runtime — doesn't depend on victim having Node installed
   • Installs in a "LogicOptimizer" folder with Registry persistence
   • Routes all C2 through Tor
   • Scans for 30+ security products before deploying payloads
   • Dynamically loads infostealer modules into memory only — never touching disk
   • Uses gRPC-based C2 with real-time Telegram alerts to affiliates on successful crypto wallet thefts

   An OPSEC failure by the operators exposed the admin panel, revealing the full C2 architecture. But the operational model — fileless payloads, Tor routing, 30+ AV evasion — means your disk-based AV and signature-based detection will miss this entirely.

   ---

   The Common Thread

   Both campaigns exploit features you intentionally enabled: device code flows for device registration, PowerShell for administration. The attack surface expanded because the feature surface expanded. Your SOC needs detection rules tuned for these specific behavioral patterns, not just signatures.

   Action items

   • Create a Conditional Access policy in Entra ID blocking device code authentication for all users except explicitly approved device registration scenarios — do this today
   • Review Entra ID sign-in logs for anomalous device code tokens issued in the past 90 days — look for Railway.com infrastructure or unusual polling patterns
   • Deploy behavioral detection rules for ClickFix indicators: msiexec spawning Node.js child processes, Tor connections from non-browser processes, Registry persistence under 'LogicOptimizer' paths
   • Audit Grafana instances for enabled AI/LLM features and restrict image source domains this week

   Sources:EvilToken is phishing your M365 execs with dynamic device codes · EvilToken is phishing your M365 execs with dynamic device codes