CISO Daily Briefing – July 13, 2026

Executive Summary

The last 48 hours were dominated by AI supply-chain and agent-manipulation attacks rather than classic infrastructure CVEs. A compromised npm package (jscrambler) shipped an infostealer purpose-built to steal credentials from Claude Desktop, Cursor, and Windsurf; a novel image-based prompt-injection technique (“Ghostcommit”) defeated two mainstream AI code-review tools and merged a malicious pull request; and Huntress documented a real intrusion where an attacker used AI-generated (“vibe-coded”) PowerShell to enumerate an Active Directory domain. Separately, CISA’s risk-based patching directive (BOD 26-04) met its first AI-platform test case when Langflow’s CVE-2026-55255 was added to the KEV catalog. Immediate action is warranted on npm dependency audits and AI-coding-tool credential hygiene.

Compromised npm Package Steals AI Coding Tool Credentials

CRITICAL

Five malicious versions of the widely-used jscrambler npm package shipped a Rust infostealer targeting cloud credentials and API keys from Claude Desktop, Cursor, Windsurf, VS Code, and Zed.

Live for ~3 hours before detection on July 11
Targets AI coding-assistant credential stores directly
Any install during the window already executed the payload

“Ghostcommit” Image-Based Prompt Injection Beats AI Code Review

HIGH

A prompt-injection payload hidden in a PNG image slipped past CodeRabbit and Bugbot, merging a malicious PR that later exfiltrates .env secrets via a compromised coding agent.

Cursor and Antigravity leaked secrets under Sonnet, Gemini, GPT-5.5
Claude Code refused across every model tested
Targets AI code-review tooling’s blind spot for image content

AI-Generated PowerShell Used in Live Active Directory Intrusion

HIGH

Huntress documented a real intrusion in which an attacker deployed an AI-generated PowerShell script to enumerate a victim’s domain controller, users, and computers.

Initial access via RDP with compromised credentials
Script’s redundant fallback logic flagged as a hallmark of LLM-generated code
Moves “AI-assisted malware” from demo to observed forensic evidence

CISA’s Risk-Based Patching Directive Meets Its First AI Platform Test

HIGH

CISA added Langflow’s CVE-2026-55255 to the KEV catalog under BOD 26-04’s four-factor risk model, testing whether federal patching policy captures AI-specific blast radius.

Vulnerability lets a user hijack another’s AI workflows and harvest LLM/cloud keys
July 10 federal remediation deadline
Raises question of whether generic risk scoring fits agent orchestration platforms

AI Capital Concentration Raises Regulatory Capture Risk

MEDIUM

An essay argues AI companies’ ~$750B annual infrastructure spend, paired with political spending in state and congressional races, may be shaping the rules that will govern them.

Distinct from previously-covered compute/vendor concentration risk
Political-economy angle on future AI security regulation
Watch item, not an immediate operational action

Overnight Research Output

Compromised jscrambler npm Package Drops Rust Infostealer Targeting AI Dev Tool Credentials

CRITICAL URGENCY

Summary: A compromised npm publishing credential was used to push five malicious versions of jscrambler (8.14.0–8.20.0) over roughly three hours on July 11, 2026. The payload is a cross-platform Rust infostealer targeting AWS/Azure/GCP credentials, npm and GitHub tokens, and — notably — API keys and MCP server credentials from Claude Desktop, Cursor, Windsurf, VS Code, and Zed. Socket detected the release within six minutes, but installs during that window already executed the payload.

Key Sources:

The Hacker News — Compromised jscrambler npm release

Socket — jscrambler supply chain attack analysis

Why This Matters: This is a real, confirmed compromise of a legitimate, previously-trusted package — not a slopsquatting or hallucinated-package attack — with a payload deliberately built to harvest AI coding-assistant credential stores. Any organization that installed the affected versions during the exposure window should treat this as a confirmed breach, not a theoretical risk.

Read Full Research Note

“Ghostcommit”: Image-Based Prompt Injection Defeats AI Code Review Agents

HIGH URGENCY

Summary: Researchers demonstrated a supply-chain attack that splits a malicious payload across a benign-looking AGENTS convention file and a PNG image containing exfiltration instructions in rendered text. Because CodeRabbit excludes PNGs from review by default and Bugbot returned no findings, the poisoned pull request merged cleanly; a later, unrelated coding session triggers the agent to read .env and leak it as an encoded integer array. Cursor and Antigravity leaked secrets under Sonnet, Gemini, and GPT-5.5, while Claude Code refused across every model tested.

Key Sources:

BleepingComputer — Ghostcommit hides prompt injection in images (Ax Sharma, July 11, 2026)

Why This Matters: This is a distinct multimodal/image-based injection vector targeting AI code-review tooling specifically, separate from prior MCP tool-description-poisoning and coding-agent shell-injection coverage. The Claude Code refusal is a concrete, citable data point on agent safety-behavior divergence across models.

Read Full Research Note

AI-Generated (“Vibe-Coded”) PowerShell Malware Used in Live Active Directory Intrusion

HIGH URGENCY

Summary: Huntress documented a real intrusion — initial access via RDP with compromised credentials in early June 2026, disclosed July 13 — in which the attacker deployed an AI-generated PowerShell script titled “100% Working AD Information Gathering Script – FULLY FIXED” to enumerate the domain controller, users, computers, and domains. Huntress’s analysis flags the script’s redundant, cascading fallback logic as a hallmark of LLM-generated code.

Key Sources:

The Hacker News — Attacker uses suspected AI-generated script

Huntress — AI-coded malware in vibe-coding Active Directory intrusion

Why This Matters: This moves “AI-assisted malware” from research demonstration to observed forensic evidence in an active-intrusion case — the first CSA note tied to a documented live intrusion using AI-generated post-exploitation tooling rather than a demonstration or service offering.

Read Full Research Note

CISA’s BOD 26-04 Risk-Based Patching Mandate Meets Its First AI Platform Test Case

HIGH URGENCY

Summary: CISA’s Binding Operational Directive 26-04 (June 10, 2026) replaced flat CVSS-driven patch mandates with a four-factor federal risk model — public exposure, KEV status, exploit automatability, and technical impact — assigning remediation windows as short as three days for the highest-risk combination. On July 7, 2026, CISA added Langflow’s CVE-2026-55255 (an IDOR letting an authenticated user hijack another user’s AI workflows and harvest embedded LLM provider keys and cloud credentials) to the KEV catalog with a July 10 deadline, marking the directive’s first real encounter with an AI agent orchestration platform.

Key Sources:

CISA — BOD 26-04: Prioritizing Security Updates Based on Risk

CISA — BOD 26-04 Implementation Guidance

CISA — Adds Three Known Exploited Vulnerabilities to Catalog (July 7, 2026)

Why This Matters: This is a policy-methodology lens, not a restatement of the Langflow CVE technical details already covered on 07-12. It tests whether BOD 26-04’s generic risk-scoring criteria adequately capture AI-specific blast radius (cross-tenant workflow execution, embedded secrets in agent configurations) or whether federal AI governance is still treating these platforms as generic web applications.

Read Full Research Note

AI Industry Capital Concentration Fuels Political and Regulatory Capture Risk

MEDIUM URGENCY

Summary: A July 9, 2026 essay by Bruce Schneier and Barath Sanders (republished from The Guardian) argues that local opposition to AI data centers misses the larger structural risk: AI companies are spending roughly $750 billion annually on data-center infrastructure — nearly matching the entire enterprise software market — while deploying PAC money in state and congressional races to shape the regulatory environment they will eventually be governed by, citing Anthropic- and OpenAI-linked spending in New York primary contests.

Key Sources:

Schneier on Security — The fight against AI data centers is important, but it’s just a starting point (July 9, 2026)

Why This Matters: This is a distinct systemic-risk vector from the compute and vendor concentration angles CSA has already covered twice this week (SpaceXAI vertical integration; AI vulnerability clearinghouse concentration). It raises the question of whether AI safety and security rules being written today are shaped disproportionately by the interests of the largest AI vendors.

Read Full Research Note

Topics Already Covered (No New Action Required)

EU AI Act Omnibus VII deadline delay, Colorado AI chatbot ADMT law: Governance topics already covered 07-08 and 07-11 respectively; no new material this cycle superseded them.
AISI UK’s frontier AI trends report: Already covered 07-12; this cycle’s fetch showed no dated content beyond that existing coverage.
Post-quantum “quantum negligence” / Forrester board-liability framing: Already cited and substantively covered in CSA’s 07-10 PQC compliance mandate note.
SpaceXAI vertical integration and AI vulnerability clearinghouse concentration risk: Both already covered 07-10 and 07-11; this cycle’s strategic-risk pick was deliberately chosen to avoid overlap with either.

← Back to Research Index