CVE-2026-55040 (CVSS 9.1, authentication bypass) and CVE-2026-63520 (CVSS 8.1, .NET deserialization RCE) chain together into unauthenticated remote code execution against on-premises Microsoft SharePoint Server, per Rapid7’s advisory. Fixes are referenced in Rapid7’s disclosure; confirm patch deployment against your own SharePoint Server versions today rather than assuming coverage from a general patch cycle.

LiteLLM v1.82.7–v1.82.8 are compromised releases carrying credential-stealing code and should be treated as known-malicious. If either version is present anywhere in your environment, treat it as an active compromise, not a routine upgrade decision: rotate credentials, do not simply “roll forward” to the next release without a security review.

The intelligence scan also surfaced non-AI-relevant vulnerability activity this cycle — including reports of VMware vCenter exploitation, high-severity Adobe ColdFusion flaws, and a botnet campaign — that were set aside because they lack a distinct AI-security angle relevant to this briefing’s scope. If any of these affect your environment, route them through your standard vulnerability management process; they are noted here for awareness only and are not analyzed further in this briefing.

The defining shift this cycle is tooling, not a new threat actor: AI agents are now materially accelerating exploit development, evidenced by the SharePoint chain being built with substantial AI-agent assistance, and by OpenAI’s GPT-5.6-Cyber tier deliberately unlocking near-complete task automation on offensive security workflows for paying, vetted customers. Reasoning-trace theft is a new technique for credential and IP exfiltration specifically from AI agent logs and trajectories rather than from traditional endpoints or networks, and should be added to threat models for any AI-agent-facing infrastructure.

LiteLLM functions as a control-plane component for AI infrastructure — it routes and often holds provider API keys and service-account-style credentials for many organizations’ model traffic. The Trivy-linked compromise turns this into a non-human-identity exposure event: any API key or token that transited a compromised LiteLLM instance should be treated as potentially exposed. Separately, reasoning-trace theft can leak credentials embedded in agent trajectories that are published to public logs, dashboards, or repositories — an identity-exposure path specific to agentic AI tooling rather than traditional IAM systems.

Four of this cycle’s five priority items are AI-native: cross-model reasoning-trace theft, a supply-chain compromise of the leading open-source LLM gateway, an AI-agent-assisted exploit chain reaching unauthenticated RCE, and a commercially-gated jump in offensive-security task automation. Read together with the EO 14409 framework opacity, the pattern is that AI capability, AI infrastructure, and AI governance are all moving faster than most enterprise AI risk programs are built to track. Enterprises running agentic coding tools, LLM gateways, or public-facing agent logging should treat this as the top AI-security theme of the week, not five unrelated stories.

The LiteLLM compromise is a textbook vendor-concentration risk: a single stolen token from a security scanner (Trivy) cascaded into malicious releases of shared AI infrastructure used by an estimated 2,100+ organizations. Any team that depends on LiteLLM — directly or through a vendor’s AI product built on it — should ask that vendor directly whether they were exposed. More broadly, this incident is a reminder to review trust relationships granted to CI/CD scanning and security tooling, since that access is itself now an attack path into downstream supply chains.

The EO 14409 frontier-AI review framework is the material regulatory development this cycle: the government has finalized classified capability-review criteria for frontier models but will not disclose them, which enterprises cannot factor into vendor risk assessments today. EU AI Act coverage (Article 50 transparency, the Digital Omnibus deadline deferral, and GPAI/AI Office enforcement) produced no new development this cycle beyond CSA’s existing July 29–August 3 coverage.

Confirmed, high confidence: the LiteLLM/Trivy supply-chain compromise (CloudSEK analysis, Kaspersky, The Hacker News) and the SharePoint exploit chain (Rapid7-disclosed, named CVEs). Confirmed, high confidence, peer-reviewed: the reasoning-trace theft technique (arXiv preprint, independently corroborated by Simon Willison and Cyber Security News). Confirmed but incomplete, medium confidence: the EO 14409 framework’s existence and finalization date are confirmed by the White House itself; its contents, thresholds, and which vendors have been briefed remain classified and unknown — this is a known unknown that should be re-checked as reporting develops. Analytical synthesis, medium confidence: the “dual-use AI capability diffusion” pattern connecting reasoning-trace theft, GPT-5.6-Cyber, and the SharePoint chain is CSA’s own cross-incident interpretation rather than a single reported fact, and should be revisited as each underlying story develops independently.

What would change these assessments: confirmation (or denial) from a named enterprise of internal exposure to LiteLLM or the SharePoint chain; disclosure of any part of the EO 14409 framework’s contents; or a documented real-world attack attributable to GPT-5.6-Cyber-class capability.