Security Roundup: AI-Assisted Intrusions, Exploited Flaws and Industry Moves
Summary
A security newsletter roundup covers stolen AI keys used in intrusions, attacks on PaperCut and Microsoft 365 users, exploited Cisco flaws, spyware, security product updates, and new EU reporting obligations.
Key points
- Anthropic reported criminals reusing stolen customer API keys to fund further intrusions; separate cases involved AI-assisted environment analysis and malware modification.
- GreyNoise traced an AI-assisted campaign exploiting two PaperCut vulnerabilities across at least 440 instances; domain-admin access was confirmed at 12 organizations.
- Microsoft described helpdesk impersonation schemes that use fake passkey or MFA setup lures to steal sessions, register attacker-controlled authentication methods, and access Microsoft 365 data.
- Cisco confirmed active exploitation of a critical email-gateway flaw that can allow unauthenticated root command execution via a crafted email; on-premises customers need fixed software.
- Reports also covered other exploited flaws affecting Cisco Firewall Management Center, GitLab, and JFrog Artifactory, as well as CHOSEN BRICK spyware targeting dissidents, activists, and journalists.
- The EU Cyber Resilience Act’s reporting obligations began September 11, requiring covered manufacturers to submit an early warning within 24 hours for specified serious security incidents.
- The roundup also covered security-focused product launches, acquisitions, and funding, including Splunk updates and investment in embedded-device security.
Article Details
- Event Type
- Cybersecurity news roundup covering cyber intrusions, vulnerability exploitation, product security, security product releases, and industry funding and acquisitions.
- Impact
- Reported activity includes at least 440 compromised PaperCut instances across 395 organizations in 48 countries, with confirmed domain-admin access at 12 organizations. Other incidents include stolen AI API keys reused to fund intrusions, Microsoft 365 account and data access through helpdesk impersonation, and exploitation of vulnerabilities affecting Cisco, GitLab, and Artifactory products. The article also reports spyware targeting dissidents, activists, and journalists.
CVE
CVE-2026-20079exploiting Firewall Management Center, including Cyclops Blink espionage and Qilin ransomware. CVE-2026-20079, CVSS 10.0, allows unauthenticated root access; CVE-2026-20316 exposes static credentials that canCVE-2026-20316Blink espionage and Qilin ransomware. CVE-2026-20079, CVSS 10.0, allows unauthenticated root access; CVE-2026-20316 exposes static credentials that can support further escalation.CVE-2026-42016Wiz caught attackers chaining CVE-2026-42018 and CVE-2026-42016 to obtain an anonymous-user token and elevate it to admin. It also confirmed exploitation of the separate CVE-2026-82329 authentication bypass.CVE-2026-42018Wiz caught attackers chaining CVE-2026-42018 and CVE-2026-42016 to obtain an anonymous-user token and elevate it to admin. It also confirmed exploitation of the separate CVE-2026-82329 authentication bypass.CVE-2026-76461Cisco confirmed exploitation of CVE-2026-76461, CVSS 9.8, which lets an unauthenticated attacker run commands as root by sending a crafted email. Nobody has to open it. Secure Email Cloud customers were affected too;CVE-2026-81578GreyNoise traced an operator using hundreds of AI agents to compromise at least 440 PaperCut instances across 395 identified organizations in 48 countries. The campaign exploited CVE-2026-81578 and CVE-2026-82078.CVE-2026-82078GreyNoise traced an operator using hundreds of AI agents to compromise at least 440 PaperCut instances across 395 identified organizations in 48 countries. The campaign exploited CVE-2026-81578 and CVE-2026-82078.CVE-2026-82329Wiz caught attackers chaining CVE-2026-42018 and CVE-2026-42016 to obtain an anonymous-user token and elevate it to admin. It also confirmed exploitation of the separate CVE-2026-82329 authentication bypass.CVE-2026-85706GitLab patched CVE-2026-85706, CVSS 10.0, an unauthenticated file-read flaw in its repository commits API under certain conditions.
People
Dario AmodeiSaid frontier AI development should slow to allow safety work to catch up.Darwin SalazarAuthor of The Cybersecurity Pulse article.Elon MuskSupported Dario Amodei’s position on slowing AI development.George KurtzCrowdStrike CEO quoted on the need to address ongoing attacks.Mark ZuckerbergSaid AI labs can slow development independently and that Meta held back Muse to work on safety and security.Nikesh AroraPalo Alto Networks CEO quoted on AI development slowdowns and security companies’ API access.Sam AltmanSupported pacing AI development and promised independent evaluators at OpenAI.Stephen GarciaNamed by the article author as having warned about risks from stolen AI keys.
Threat Actors
Cyclops BlinkNamed as an espionage cluster among intrusion clusters exploiting Cisco Firewall Management Center.QilinRansomware actor associated with an intrusion cluster exploiting Cisco Firewall Management Center.ShinyHuntersSuspected affiliates used Claude to understand unfamiliar environments, build collection tools, and steal downstream customer data.
Malware
Vendors
Anthropic🧾 Stolen keys fund attacks: Anthropic says criminals reused victims’ API keys to carry out more intrusions.Cisco📬 Cisco’s email-to-root bug: Cisco confirms attackers are exploiting a CVSS 9.8 gateway flaw through crafted emails.DigiCertDigiCert gives AI agents an identity you can revokeGitLabGitLab’s file-read flaw puts deployment secrets within reachGoogleWiz investigations now follow you into Google SecOpsGreyNoise🖨️ PaperCut’s AI attack swarm: GreyNoise traced 400+ compromised print-management instances; attackers reached domain admin at 12 organizations.HarveyHarvey buys Guardrails AI, bringing agent security into legal AIMicrosoft📱 Microsoft fake passkey rollout attacks: Helpdesk impersonators use setup lures to steal sessions or trick users into authorizing access.NCSCThe NCSC, FBI, and AIVD detailed CHOSEN BRICK, spyware targeting dissidents, activists, and journalists. Attackers build trust over messaging apps, then send fake software or even MRI results. The Windows malware usesSecureSkySecureSky buys Soveren to follow the sensitive dataSplunkHowdy 👋🏽 - I hope you’re having an excellent week! Lots happening over the past several days with Splunk’s annual conference, nasty vulns in widely used software, and AI frontier labs giving the rest of the worldwatchTowRIt entered KEV September 11, and watchTowr observed probes after disclosure.WizWiz caught attackers chaining CVE-2026-42018 and CVE-2026-42016 to obtain an anonymous-user token and elevate it to admin. It also confirmed exploitation of the separate CVE-2026-82329 authentication bypass.ZscalerZscaler’s new AI SOC connects investigations to containment
Products
Agent LaunchpadAI in your own environment: Cisco AI POD for Splunk and self-managed AI Assistant are available now, including for air-gapped deployments. Agent Launchpad, for building custom agents, follows later this year.Agentic SOCZscaler launched Agentic SOC, now available globally.AI AssistantAI in your own environment: Cisco AI POD for Splunk and self-managed AI Assistant are available now, including for air-gapped deployments. Agent Launchpad, for building custom agents, follows later this year.AI Passportcombining agent discovery with signed identities, ownership, scoped permissions, and revocation. Its AI Passport lets another organization verify an agent without sharing the same identity provider.AI Trust ManagerDigiCert made AI Trust Manager generally available, combining agent discovery with signed identities, ownership, scoped permissions, and revocation. Its AI Passport lets another organization verify an agent withoutAIUC-1Its AIUC-1 standard covers risks including prompt injection, data leakage, hallucinations, and unauthorized actions. Evaluations examine both the agent’s behavior and the controls around it. That evidence can helpAWS CloudWatch LakeQuery data where it sits: Federated Search is expanding to AWS CloudWatch Lake and Databricks.Blue AgentWiz expanded its Google Security Operations integration with Blue Agent investigation findings and two-way synchronization of case status, severity, and comments. The available content pack includes rules, dashboards,Cisco AI POD for SplunkAI in your own environment: Cisco AI POD for Splunk and self-managed AI Assistant are available now, including for air-gapped deployments. Agent Launchpad, for building custom agents, follows later this year.Cisco Cloud ControlSee what agents are doing: Agent Observability now extends into Observability Cloud and Cisco Cloud Control.Cisco Firewall Management CenterCisco Secure Email CloudClaudeSuspected ShinyHunters affiliates used Claude to understand unfamiliar environments, build collection tools, and steal downstream customer data.DatabricksQuery data where it sits: Federated Search is expanding to AWS CloudWatch Lake and Databricks.Google Security OperationsWiz expanded its Google Security Operations integration with Blue Agent investigation findings and two-way synchronization of case status, severity, and comments. The available content pack includes rules, dashboards,Guardrails AIHarvey buys Guardrails AI, bringing agent security into legal AIIntel TDXDDRop let researchers read protected VM data and fake the proof that a VM was trustworthy, defeating protections in Intel TDX’s default integrity mode.JFrog ArtifactoryArtifactory’s anonymous user turns out to be an administratorMicrosoft 365Fake passkey setup opens the door to Microsoft 365Microsoft Exchange ServerCollect: SharePoint, OneDrive, and Exchange data, generally below 1,000 files or emails an hour, continuing for hours or days.Microsoft GraphStay in: Register an attacker-controlled authentication method, then enumerate the tenant through Microsoft Graph.Microsoft OneDriveCollect: SharePoint, OneDrive, and Exchange data, generally below 1,000 files or emails an hour, continuing for hours or days.Microsoft SharePointCollect: SharePoint, OneDrive, and Exchange data, generally below 1,000 files or emails an hour, continuing for hours or days.Observability CloudSee what agents are doing: Agent Observability now extends into Observability Cloud and Cisco Cloud Control.PaperCut MFPaperCut NGSnowglobejailbreaks, and policy violations. It also tackles reliability problems such as hallucinations. Its Snowglobe product simulates users to find ways agents can fail before they go into production.SplunkHowdy 👋🏽 - I hope you’re having an excellent week! Lots happening over the past several days with Splunk’s annual conference, nasty vulns in widely used software, and AI frontier labs giving the rest of the world