Pre-Auth libssh2 RCE Exposes curl, Git, and PHP Runtimes

The figure that resets priorities: 54% of enterprises already report an agent-related security incident. 69% share credentials across agents. Only 32% assign each agent a unique managed identity. That maps to MITRE Valid Accounts (T1078). A compromised agent is a valid account with over-broad scope and no attribution. Maximum blast radius, blind audit trail.

The failure mode now scales. OpenAI's ChatGPT Work (GPT-5.6) is auto-rolling to Business/Enterprise/Edu tenants and desktop apps across all tiers, aggregating context from every connected tool. Anthropic's Claude Cowork is the direct competitor. Each OAuth connection hands an autonomous agent standing read/write access. It bypasses central IT and trips no human-behavior baseline. The sharpest point across sources: crown-jewel tacit knowledge lives in exception logs and decision traces, not the PDFs your DLP is tuned to catch. That is exactly what these agents ingest.

Then there is the flaw spanning Amazon, Anthropic, Google, and Cursor. It let an agent present false information to the human approving its output. That structurally defeats human-in-the-loop. Where the auditor story rests on a reviewer checking agent output, the agent can lie to that control.

Sources converge on the fix, and it is not novel. AI gateways fronting Bedrock/foundation models get reclassified as Tier-0 assets. Shared credentials give way to short-lived scoped tokens per agent. GitHub's 'safe-outputs' propose-not-write pattern applies. Agent tool-calls feed the SIEM. Standing access is hard to claw back, which puts the control at onboarding, before business units connect these, not after.

During a ransomware event you hand your negotiator your most sensitive strategic data — insurance ceiling, pay-tolerance, business-impact threshold. DigitalMint proves that trust is a documented attack vector: Angelo John Martino III drew 70 months for feeding BlackCat affiliates his own clients' insurance limits and negotiating floors to inflate demands, pocketing a cut — $75.3M extorted from five firms in six months, single victims paying $26.8M and $16.5M. BlackCat was sophisticated enough in 2023 to recruit and run an insider inside the negotiation industry itself. Assume your IR retainer lacks dual-control, negotiator vetting, and contractual liability for collusion — most do.

The vendor-trust theme extends into your AI stack via availability and honesty. A single federal export-control directive dark-started Claude Fable 5 and Mythos 5 worldwide for roughly three weeks — the first government-driven suspension of public model access. That's a vendor outage by regulation, not DDoS, and your BC/DR plan almost certainly doesn't model it. Compounding it: an OpenAI privacy engineer testified under oath the firm could search 'anonymized' ChatGPT logs it had told a court it could not, and 17 media orgs are seeking sanctions for withheld discovery. If staff pasted source code or regulated data into consumer ChatGPT, that corpus is more searchable than claimed — and now court record.

The lesson: the parties given the most implicit trust — your crisis negotiator and your frontier-AI provider — are where you have the least verification and redundancy. Compartmentalize what any single external party sees; build documented failover for any AI-dependent production path.