42
Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.
Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.
84
60
60
42
47
42
42
42
57
57
42
42
An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
Unit 42 investigated a ransom attack in which frontier AI agents autonomously breached an enterprise network, compressing weeks of tradecraft into under 10 hours.
Unit 42 incident responders documented an intrusion where a single human operator directed frontier AI agents to breach an enterprise network autonomously as part of a ransom attack. The agents executed more than 50 MITRE ATT&CK techniques in under 10 hours, work that would normally require roughly two weeks of human red-team effort. They breached a public-facing web service, mapped internal microservices, scraped hard-coded secrets from code repositories, harvested root credentials from the secrets manager, and hijacked CI/CD builds to exfiltrate cloud access keys. The attacker also used stolen cloud keys to repurpose the victim's AI endpoints as post-compromise infrastructure and left behind an 80-page AI-generated security audit documenting dozens of exploited findings.
80
60
42
47
42
47
47
42
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.
75
60
60
42
47
57
AI agents carried out every step of this ransomware attack – then left the victim an 80-page security audit
Unit 42 says a human attacker used AI agents to execute a full ransomware intrusion in under 10 hours, leaving the victim an 80-page security audit.
Palo Alto Networks Unit 42 incident responders report a human ransomware operator used frontier AI models and agentic attack frameworks to breach an enterprise in under 10 hours, work that normally takes human operators around two weeks. AI agents performed reconnaissance, breached a public API endpoint to tunnel into the network, scraped code repositories for hard-coded tokens and service passwords, then used them to steal master administrative credentials from the secret-management system for root access. Specialist pivot agents validated access to cloud, identity, CI/CD, container and SaaS environments, and the attacker hijacked CI/CD workflows to steal cloud keys and turn the victim's cloud AI services into post-compromise infrastructure. The agents left an 80-page audit detailing dozens of exploited findings.
78
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.
Marimo addressed CVE-2026-75149, a high-severity code injection flaw allowing attacker-supplied Model Context Protocol (MCP) commands to execute as local subprocesses when a crafted notebook is opened in edit mode, before any cell runs. The issue affects versions prior to 0.23.15, carries CVSS v4 of 8.7 and CVSS v3.1 of 8.8, and requires user interaction but no authentication. Marimo fixed it in version 0.23.15 (released July 23, 2026) via a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and strips ai, mcp, completion, secrets, and server configuration sections. VulnCheck's CNA also disclosed CVE-2026-67618 (CVSS 7.1), involving an attacker-controlled AI base_url that exfiltrates operator API keys, and earlier CVE-2023-39987, a missing auth on /terminal/ws endpoint allowing full PTY shell access.
58
42
60
60
57
57
42
42
42
42
57
57