Sorted by exploitation status and enterprise deployment likelihood. Focus on items with active exploitation or CISA KEV status first.

Credential-Focused Attackers Targeting AI Toolchains and Browser Sessions

Two distinct attack chains disclosed today share a structural pattern: both target credentials that provide access to enterprise AI systems and cloud infrastructure, not just traditional endpoints. The Djinn Stealer (deployed via SimpleHelp) explicitly enumerates and exfiltrates credentials from AI development tools — IDE configs, coding assistant tokens, and API keys stored in developer environments. BioShocking targets session-layer credentials accessible through AI browser agents — SSO tokens, OAuth sessions, and enterprise SaaS credentials held in active browser contexts.

ShinyHunters continues to demonstrate the mass-breach potential of single zero-days in widely-deployed enterprise infrastructure. The group’s simultaneous exploitation of two CVSS 9.8 Oracle vulnerabilities across 100+ organizations signals operational maturity and a shift toward targeting HR/payroll data for extortion leverage.

• Attacker focus shifting from endpoint malware to credential harvesting from AI tool contexts
• Remote management tools (SimpleHelp, similar RMM) remain high-value initial access vectors
• ShinyHunters demonstrating simultaneous multi-CVE Oracle campaigns — not opportunistic, coordinated
• AI browser agents represent a new credential theft surface without established detection signatures

AI Browser Agent Session Tokens: A New NHI Risk Category

BioShocking reveals a previously underappreciated NHI risk surface: AI browser agents that operate with ambient access to enterprise SaaS sessions and OAuth tokens. Unlike traditional service accounts or API keys, these AI agent sessions exist as user-context browser credentials — they are not typically inventoried by NHI or secrets management tools, but they carry access equivalent to the authenticated user’s enterprise permissions. When an AI browser assistant is authorized to act on behalf of a user in enterprise SaaS, that delegation scope becomes accessible to any webpage the agent processes.

Recommended immediate controls: audit which AI browser extensions have enterprise SSO delegation, review OAuth grant scopes for AI browser agents, and consider requiring explicit per-session scope grants rather than persistent authorization for AI browser tools.

• AI browser agent OAuth grants are rarely inventoried by PAM or CASB tooling
• Session scope limits (restrict agents to read-only or scoped domains) are the primary near-term compensating control
• MFA and conditional access policies do not protect against BioShocking — the agent is already authenticated

NIST Mathematical Proof: Static AI Guardrails Are Fundamentally Bypassable

On June 9, NIST senior scientist Apostol Vassilev published a mathematical proof in IEEE Security and Privacy demonstrating that any finite set of behavioral guardrails applied to an AI system will always be bypassable — as a consequence of Gödelian incompleteness, there will always exist an adversarial prompt that causes the system to violate its rules. The proof does not say guardrails are useless; it says they cannot provide universal, static protection. For CISOs overseeing AI governance programs: any compliance posture that relies on one-time guardrail certification is assuming a security property that mathematics says cannot hold. ISO 42001 and the NIST AI RMF increasingly require continuous monitoring models — this proof provides the theoretical grounding for why.

Read Full Research Note

AI Dev Toolchain Under Systematic Attack: MCP, Fake Skills, Repo Poisoning

Three structurally related attacks disclosed this week reveal that AI development toolchains are now a primary target. First, Wiz Research disclosed CVE-2026-12957 in Amazon Q Developer’s VS Code extension: a malicious MCP config in a workspace file causes the extension to silently execute code and harvest cloud credentials with zero user interaction. Second, a fake AI agent skill on OpenClaw’s ClawHub marketplace bypassed security scans by using a mutable external URL — benign at scan time, malicious after approval — propagating to an estimated 26,000 agents. Third, Mozilla 0DIN researchers demonstrated that AI coding agents can be manipulated via seemingly clean GitHub repos to establish persistent shells, with payloads invisible to automated and human reviewers alike. The convergence point: attackers are exploiting the ambient trust developers grant to AI assistant actions.

Read Full Whitepaper

Remote Management Tools and Agent Skill Marketplaces as Supply Chain Vectors

Both the SimpleHelp exploitation and the fake AI agent skill campaign illustrate how trusted third-party tools create systemic supply chain exposure. SimpleHelp is used by MSPs and IT teams as a legitimate remote support platform — enterprises that depend on MSPs for managed services may face indirect exposure even without direct SimpleHelp deployment. The fake ClawHub skill story is a direct AI supply chain attack: a marketplace that enterprises rely on to extend their AI agent capabilities accepted and distributed a malicious payload because its vetting scanned a snapshot rather than the live-resolved content.

• Assess whether your MSP or IT support providers use SimpleHelp — ask for patch confirmation
• Review policies governing which AI agent skills/plugins employees can install from marketplaces
• Treat AI skill marketplaces as equivalent to third-party software repositories: require review before deployment to production environments

NIST Incompleteness Proof Changes AI Governance Compliance Calculus

The NIST mathematical proof has direct regulatory implications that CISOs should flag to legal and compliance teams. Current enterprise AI governance programs often pursue “guardrail certification” — a one-time assessment that behavioral controls are in place — as a compliance milestone. ISO 42001 and NIST AI RMF both already include provisions requiring ongoing monitoring, but many compliance programs treat initial certification as the primary deliverable. The incompleteness proof provides a formal technical basis for regulators, auditors, and standard-setters to require continuous assurance rather than point-in-time certification. Organizations planning AI compliance programs should assume this direction and build continuous monitoring architectures now rather than retrofit them later.

Additionally, the Oracle PeopleSoft breach affecting 100+ organizations — including insurance regulators (NAIC) — may trigger state-level breach notification obligations across multiple jurisdictions simultaneously, given that PeopleSoft typically holds employee PII at scale.

ShinyHunters Breaches Cross Sector Boundaries via Shared ERP Infrastructure

The Oracle PeopleSoft campaign is notable precisely because the 100+ victim organizations span manufacturing (Nissan), insurance regulation (NAIC), higher education, and financial services — with no direct sector link. The common denominator is shared ERP software, not shared sector exposure. This is the defining characteristic of modern mass-breach events: attackers target a widely-deployed platform and harvest data from the entire deployment base, regardless of vertical. The lesson for sector-specific threat models is that enterprise software stack choices create cross-sector peer risk groups that don’t map to traditional ISAC boundaries.

• Organizations running Oracle PeopleSoft or E-Business Suite share a risk profile with Nissan and NAIC, regardless of sector
• BleepingComputer reports universities also targeted in the same campaign
• ShinyHunters’ extortion model relies on PII volume — payroll and HR systems are high-priority targets

All claims in this briefing are sourced from publicly available reporting. Confidence levels reflect source corroboration and directness: High = primary source or multiple independent confirmations; Medium = single secondary source or incomplete disclosure; Low = preliminary or unconfirmed reporting.