CISO Daily Briefing – 2026-10-10

Executive Summary

AI was both attacker tooling and attack surface this week. A financially motivated operator used the open-source agentic pentest tool ARTEX with commercial LLMs to steal data from South Korean financial firms, and the Shai-Hulud worm compromised the tensorlake npm SDK used for AI agent infrastructure. Attackers also hijacked three ccTLD registries to obtain rogue Google certificates. On governance, PCI SSC now expects human approval of agent actions touching cardholder data, while Google’s OSS VRP suspension shows AI report floods straining vulnerability triage.

ARTEX: AI Pentest Tool Used on Korean Banks

CRITICAL

An unattributed, financially motivated operator used the open-source agentic pentest tool ARTEX with commercial LLMs, including Claude Code, to exfiltrate data from South Korean financial firms.

Offensive agentic tooling is now in criminal use by a single low-resourced operator
Exposure came from operator OPSEC failure, not defender detection
Add detection for AI-driven reconnaissance and use provider abuse telemetry

Tensorlake npm Worm Hits AI Agent SDKs

HIGH

Malicious tensorlake version 0.5.144, published 8 October and flagged by Socket within about 11 minutes, runs through a preinstall hook, harvests CI, Kubernetes and Vault credentials, resolves C2 via an Ethereum contract with GitHub fallback, and self-propagates.

Targets an SDK for agent sandboxes, putting agent-platform secrets in scope
Rotate credentials on any host that installed 0.5.144
Block preinstall scripts in CI where feasible

ccTLD Hijacks Yield Rogue Google Certs

HIGH

Attackers compromised operators of .gh, .sl and .as and altered authoritative DNS to pass domain validation, obtaining at least 12 certificates (22-27 September) for Google and YouTube names.

11 certificates from Let’s Encrypt, one from ZeroSSL
Cloud and agent workloads relying on DNS-based validation are exposed
Review certificate pinning and revocation checking outside browsers

PCI SSC: Human Approval for AI Agents

HIGH

PCI SSC guidance reported 9 October states AI use does not bypass PCI DSS, expects a named human to accept responsibility for AI output, calls for defining which agent actions need human approval, and requires access limits enforced by independent controls such as identity policy and network isolation.

Advisory; existing PCI requirements take precedence
Expect assessors to use it as a reference point
Map to agent identity and least-agency controls

Google OSS VRP Paused by AI Report Flood

HIGH

Google paused its OSS VRP on 1 October through at least Q1 2027 because most automated submissions were invalid or hallucinated.

Extends a pattern of maintainers and bounty programs swamped by AI reports
Options include proof-of-exploit requirements and funded triage
Plan for slower disclosure of open-source flaws

Overnight Research Output

ARTEX and AI-Orchestrated Intrusions: Korean Financial Sector Campaign

CRITICAL

Summary: An unattributed, financially motivated operator used the open-source agentic pentest tool ARTEX with commercial LLMs, including Claude Code, to exfiltrate data from South Korean financial firms. The campaign surfaced only because the operator left open directories exposing session histories and configs.

Key Sources:

The Hacker News — ARTEX AI Pentesting Tool Used in Data Theft

iTnews — CrowdStrike says China-based suspect used AI tools in South Korean bank hacks

Cyber Magazine — CrowdStrike on South Korea bank AI cyber attack

Why This Matters: Machine-speed reconnaissance is now available to individuals, and defenders cannot count on attacker mistakes. Earlier CSA notes on autonomous offensive agents predate ARTEX.

Read Full Research Note

Tensorlake npm Compromise: Shai-Hulud Worm Targets AI Agent Infrastructure SDKs

HIGH URGENCY

Summary: Malicious tensorlake version 0.5.144, published 8 October and flagged by Socket within about 11 minutes, runs through a preinstall hook, harvests CI, Kubernetes and Vault credentials, resolves C2 via an Ethereum contract with GitHub fallback, and self-propagates.

Key Sources:

Socket — Tensorlake Compromise

The Hacker News — Tensorlake npm Package Compromised

Why This Matters: This is the Shai-Hulud/ChainDrop resurgence aimed at AI agent infrastructure with blockchain-based C2, which prior CSA supply-chain coverage does not address.

Read Full Research Note

ccTLD Registry Compromise and Rogue Google Certificates: Trust-Chain Exposure

HIGH URGENCY

Summary: Attackers compromised operators of .gh, .sl and .as and altered authoritative DNS to pass domain validation, obtaining at least 12 certificates (22-27 September) for Google and YouTube names. Chrome blocked them via CRLSets; non-Chrome clients and agents rely on revocation.

Key Sources:

BleepingComputer — Hackers hijack Google domains after breaching ccTLD registries

The Hacker News — Attackers Hijack .gh, .sl and .as

iTnews — Attackers hijack ccTLDs to fake certs for Google

Why This Matters: Registry-level DNS compromise is a certificate-issuance risk that CSA has not yet covered, relevant to infrastructure, cryptography and machine/agent identity trust.

Read Full Research Note

PCI SSC AI Security Guidance: Human Approval and Accountability for Agent Actions

HIGH URGENCY

Summary: PCI SSC guidance reported 9 October states AI use does not bypass PCI DSS, expects a named human to accept responsibility for AI output, calls for defining which agent actions need human approval, and requires access limits enforced by independent controls such as identity policy and network isolation.

Key Sources:

Help Net Security — PCI SSC guidance on AI in payment environments

PCI SSC Blog — AI Principles: Securing the Use of AI in Payment Environments

Why This Matters: It is a concrete, auditable control for regulated CISOs deploying agents that touch cardholder data.

Read Full Research Note

When AI Floods the Disclosure Pipeline: Google’s OSS VRP Suspension

HIGH URGENCY

Summary: Google paused its OSS VRP on 1 October through at least Q1 2027 because most automated submissions were invalid or hallucinated. Real vulnerabilities in critical dependencies risk going unreported or untriaged as AI-assisted discovery scales.

Key Sources:

BleepingComputer — Google halts open-source bug bounty program amid AI spam surge

SC Media — Google pauses open-source bug bounty program

ITdaily — Google pauses OSS VRP

Why This Matters: Disclosure channels for open-source components are a shared dependency, and CSA’s AI vulnerability discovery work does not cover the downstream triage collapse.

Read Full Research Note

Notable News & Signals

Edge-device activity continues

Citrix NetScaler flaws, a Cisco SD-WAN authentication bypass and FBI action against Flax Typhoon continued, with little AI-specific angle.

Source: intelligence scan (no article-level link available)

Topics Already Covered (No New Action Required)

OpenAI GPT-6.1 Astra shelving: Covered by a CSA research note published 30 September.

← Back to Research Index