Cybercriminal

LLM-Assisted Intrusions Hit Latin American Orgs via NextChat

ATLAS OWASP HIGH ▲ 7.2 Palo Alto Unit 42 Sep 06, 2026

Unit 42 has identified two active intrusion campaigns targeting Latin American organisations in the transportation and financial sectors, with threat actors demonstrably leveraging commercial LLMs — including self-hosted NextChat instances — to orchestrate and refine attack execution. The campaigns share overlapping SOCKS5 relay infrastructure and exhibit iterative, AI-assisted scripting behaviour, suggesting independent but parallel adoption of LLM tooling by distinct threat groups. This represents a concrete operational example of adversaries using AI to lower the skill floor for multi-stage network intrusion and data exfiltration.

OpenAI Launches Daybreak to Bring AI to Critical Infrastructure Defenders

FIRST LOOK ATLAS OWASP LOW ▲ 7.2 SecurityWeek Sep 05, 2026

OpenAI's Daybreak initiative commits $1 billion to provide subsidised frontier AI capabilities, training, and technical assistance specifically to critical infrastructure defenders. This directly addresses the resource asymmetry gap where well-funded adversaries have increasingly leveraged AI tooling while under-resourced defenders in sectors like energy, water, and transport have lacked comparable access. Key unknowns around eligibility criteria, cost structures, and delivery timelines mean operational benefit remains contingent on programme execution details not yet disclosed.

GPT-6 Astra Tops ExploitBench With Perfect Security Score

ATLAS OWASP HIGH ▲ 6.2 Simon Willison Sep 04, 2026

OpenAI's GPT-6 Astra achieves 100% on ExploitBench and 99.2% on binary reverse engineering benchmarks, significantly outperforming its predecessor GPT-5.6 Sol on security-relevant tasks. The model's exceptional capability at offensive security benchmarks raises dual-use concerns, as frontier models with near-perfect exploit generation ability represent a meaningful capability uplift for threat actors. The article also notes the model's strong long-context performance, which has implications for processing large codebases or security artifacts.

OpenLeash Adds Human-in-the-Loop Checks for Risky AI Agent Actions

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.2 SecurityWeek Sep 03, 2026

OpenLeash has released a security tool that intercepts potentially dangerous AI agent actions in real time, automatically blocking clear threats and escalating ambiguous actions to a human reviewer for approval. This directly closes the excessive-agency gap — one of the most pressing risks in agentic AI deployments — by inserting a verifiable human control point before consequential actions execute. Residual maturity questions remain around policy definition, latency tolerance in high-throughput agent workflows, and integration breadth across diverse agent frameworks.

CVE-2026-19592: Git Config Flaw Lets Attackers Run Code in Codex

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Sep 03, 2026

Manifold Security disclosed GitSpawn, a class of eight vulnerabilities across seven AI coding agents — including Claude Code, Codex, Cursor, Qwen Code, and Grok Build — in which a malicious `.git/config` file using the `core.fsmonitor` directive causes agents to execute attacker-controlled commands at session startup, outside any sandbox or approval prompt. The attack requires the target to open a repository with its `.git` directory intact, achievable via archives, USB drives, or shared folders rather than standard git clones. Four agents remained unpatched at publication, with OpenAI issuing three CVEs for Codex on the same day the research dropped.

CrowdStrike Launches Agentic Identity Provider for AI Agents

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.8 CrowdStrike Blog Sep 03, 2026

CrowdStrike has announced an Agentic Identity Provider, extending its identity security platform to issue, manage, and govern credentials and authentication specifically for AI agents operating within enterprise environments. This closes a meaningful gap for defenders by bringing structured identity lifecycle management to non-human AI principals — a surface that has historically lacked the same controls applied to human users and service accounts. Residual maturity questions remain around cross-platform agent interoperability, coverage of third-party agent frameworks, and the operational tooling organisations will need to inventory and classify agents before policies can be applied.

OpenAI Launches Astra with Critical Cyber Capability Controls

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 Wired Security Sep 02, 2026

OpenAI has announced Astra, its first AI model assessed to meet the company's 'critical' cybersecurity capability threshold — meaning it can autonomously discover and exploit previously unknown vulnerabilities in real-world software. The release introduces meaningful defensive advances including a staged early-access programme (Daybreak Blue), a new misalignment monitor, and a multi-week safety pause process that gives defenders structured lead time to harden environments before broad availability. Residual gaps remain around the reliability of the misalignment monitor, the maturity of jailbreak resistance at scale, and the absence of cross-industry incident-sharing protocols for models at this capability level.

Sevii Launches Autonomous ADR Agents for AI-Speed Attack Defense

FIRST LOOK ATLAS OWASP HIGH ▲ 6.8 SecurityWeek Sep 02, 2026

Sevii has expanded its Active Defense and Response (ADR) platform with AI agents capable of autonomously investigating, containing, and remediating AI-driven attacks within minutes. This closes a critical response-time gap that human-speed security operations struggle to address when facing AI-accelerated attack chains. Residual questions remain around the maturity of autonomous remediation decision-making, integration depth with existing SOC tooling, and the operational trust organisations must develop before delegating containment actions to agents.

Palo Alto Networks Acquires AI Agent Platform Console

FIRST LOOK ATLAS OWASP LOW ▲ 5.8 SecurityWeek Sep 02, 2026

Palo Alto Networks has acquired Console, an AI agent platform, signalling a strategic move to embed agentic AI orchestration natively within its enterprise security stack. For defenders, this closes a coordination gap by bringing AI agent management under a unified security operations umbrella rather than requiring separate tooling. The full defensive value will depend on integration depth, how Console's agent controls surface within existing Palo Alto workflows, and how quickly enterprise customers can operationalise the combined capability.

OpenAI Launches Astra with Advanced Autonomous Cybersecurity Skills

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 TechCrunch AI Sep 02, 2026

OpenAI's forthcoming Astra model is the first the company has designated as crossing its 'critical cybersecurity threshold,' capable of autonomously discovering and exploiting zero-day vulnerabilities without human guidance. For defenders, this signals a meaningful advance in automated vulnerability discovery tooling, with controlled access tiers and chain-of-thought monitoring establishing an early blueprint for deploying high-capability offensive AI safely. Significant maturity gaps remain around independent third-party validation, access governance transparency, and operational integration frameworks for red-team and defensive security workflows.

UAC-0099 GuardBreaker Trips LLM Safety to Block Malware Analysis

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Sep 01, 2026

Russia-aligned threat actor UAC-0099 has deployed a technique called GuardBreaker that embeds nuclear weapon prompts inside malicious VBS scripts to deliberately trigger LLM safety guardrails and prevent AI-assisted malware analysis. This represents a maturing offensive tradecraft where adversarial prompt injection is weaponised not to extract information but to induce refusal states in AI security tooling. The technique mirrors similar tactics observed in the TeamPCP supply chain campaigns, signalling that LLM-first security pipelines are becoming a recognised and actively exploited weak point.

Rogue LLM Endpoint Hijacks Coding Agent Sessions via Free API

ATLAS OWASP HIGH ▲ 9.0 SANS Internet Storm Center Sep 01, 2026

A researcher's internet-exposed LLM honeypot was discovered by scanners, relabeled as a DeepSeek-compatible endpoint, and incorporated into 'free' AI backend infrastructure — ultimately receiving a full 224 KB coding-agent session including filesystem listings, tool manifests, and private file contents. The incident demonstrates that a malicious rogue model endpoint occupies a privileged position in an agent's control plane, capable of issuing tool-call responses that the agent may execute locally without further verification. This represents a novel supply-chain-style threat where the adversary is not a compromised trusted service but a counterfeit reasoning backend actively solicited by users chasing free API access.

Hugging Face Incident Exposes AI Agent Identity Risks

ATLAS OWASP HIGH ▲ 7.2 SecurityWeek Sep 01, 2026

The Hugging Face security incident highlights a systemic gap in how organisations manage access privileges for autonomous AI agents, which can accumulate excessive permissions comparable to highly privileged human identities. Security leaders are urged to apply rigorous identity and access management controls to AI agents rather than treating them as passive tools. The lesson underscores the broader industry risk of unchecked agentic AI operating within sensitive infrastructure.

Aurora Ransomware Operators Weaponise Cursor AI for Attacks

ATLAS OWASP HIGH ▲ 7.5 The Hacker News Sep 01, 2026

The Aurora ransomware group has been observed leveraging Cursor, an agentic AI coding assistant, to plan and execute ransomware attacks against more than 20 organisations across nine countries. Exposed infrastructure revealed the operators used Cursor to draft attack plans in Russian, including full Active Directory Certificate Services exploitation strategies, representing a concrete case of AI-assisted threat actor tradecraft. The encryptors target both Windows and Linux/ESXi environments and are written in Zig, with the group employing social engineering, lateral movement, and log-clearing to evade detection.

Almanac (YC S26) Launches Agentic AI with Self-Updating Company Wiki

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 HN AI Security Sep 01, 2026

Almanac is a persistent AI agent that connects to company tools, maintains a self-updating internal wiki, and executes multi-step work tasks autonomously via its own browser and login sessions. For defenders and security-conscious organisations, it introduces a structured, auditable knowledge graph of internal operations — every wiki entry links back to its source, providing a traceable record of AI-driven decisions and actions. Residual gaps centre on the maturity of access governance, wiki poisoning safeguards, and the breadth of autonomous action the agent can take before human confirmation is required.

Cybercriminal

Stay ahead of the threat.