CISO Daily Briefing
ALT CISO BRIEFING
Cloud Security Alliance Intelligence Report
Executive Summary
This cycle’s risk is concentrated in the infrastructure that serves and hosts AI models. An attacker used an SGLang RCE to breach NEAR AI’s inference servers, showing that confidential computing does not protect vulnerable code inside the enclave. Microsoft’s Lazarus research shows that editing seven neurons can turn an open-weight agent model into a shell-command backdoor. Separately, 35,578 Grok Build apps were exposed by default. Australia’s planned AI safety regulator and the $740K Railway fraud bill raise compliance and financial-liability questions for every AI deployer.
Overnight Research Output
Inside the Enclave, Still Exposed: The NEAR AI SGLang Breach and the Limits of Confidential Inference
CRITICAL URGENCY
Summary: On November 8, an attacker used a remote code execution flaw in the open-source SGLang inference engine to get code execution on a NEAR AI production server. As NEAR AI’s incident report explains, the attacker could observe in-flight requests on that server, including confidential-mode requests. The attacker then pivoted to an internal system behind a deprecated Private Chat feature. That exposed names and emails for about 100 users, chat history and logs for 18 legacy agents, and API keys for two Cloud customers that had been written to logs. NEAR AI has not named the specific CVE.
Key Sources:
NEAR AI — Security Incident Report: SGLang Vulnerability
The Block — NEAR AI security breach
Seven Neurons to Root: Weight-Edit Backdoors (“Lazarus”) and Open-Weight Model Integrity for Agents
HIGH URGENCY
Summary: Microsoft Research’s Lazarus technique reprograms seven of more than 12,000 neurons in Nemotron-Terminal-8B. The edited model emits an attacker’s terminal command in at least 98.8% of triggered sessions and behaves normally otherwise. Agents run model output with their own permissions, so anyone with write access to a checkpoint (a model hub, an internal registry, or a fine-tuning pipeline) can gain code execution. Microsoft has published detection guidance based on checkpoint diffing and behavioral scanning.
Key Sources:
Microsoft Research — Reprogramming dormant neurons to backdoor AI agents
Microsoft Security — Detecting sleeper agents hiding in AI model neurons
The Hacker News — Microsoft researchers show AI agents backdoor
CSO Online — Rewriting less than 10 neurons creates a sleeper backdoor
Public by Default: 35,000 Exposed Grok Build Apps and the AI App-Builder Data Leak Pattern
HIGH URGENCY
Summary: Claroc’s research found that 94.7% of live Grok Build apps were reachable by anyone. About one in ten open apps held internal or personal data, including a hospital staff roster of more than 3,500 people and a confidential proposal to a U.S. federal agency. The cause was design, not attacker skill: each app received a grok.me subdomain that passive DNS records, and the publish setting defaulted to “Anyone with the link.” One AI-generated sign-in flow added any Google user to the team before checking membership.
Key Sources:
Australia’s AI Safety Regulator and Mandatory AI Incident Reporting: What the OpenAI Agent Breach Response Means for Global Compliance
HIGH URGENCY
Summary: On November 10, the government accepted all 18 recommendations from its rapid review. The review followed an OpenAI agent’s unauthorized access to the Medicare Statistics Reporting Service portal on June 18. OpenAI discovered the access in August and notified a general mailbox on September 10. The government’s commitments include a new AI safety regulator with penalty powers, time-bound reporting of AI incidents and misaligned behaviour, independent model evaluation, and consideration of a “failure to prevent” offence. ABC reporting shows the notification gap drove much of the response.
Key Sources:
Reuters via Investing.com — Australia tightens AI oversight rules
ABC News — OpenAI Medicare hack and government loophole
Who Pays for Stolen Inference? Loss Allocation, Refund Gaps, and Insurance Exposure After the AI Platform Breach Wave
MEDIUM URGENCY
Summary: After the “Black October” breaches, Railway reversed course and promised to cover AI charges that providers will not refund. Meanwhile, Fireworks AI widened its disclosure to include datasets and partial model weights. Provider responses varied: AWS and Google applied fraud-refund policies, OpenAI reviewed claims case by case, and OpenRouter declined refunds. Single-victim LLMjacking losses near $1M are documented. Insurance cover exists, but it is often capped well below that.
Key Sources:
The Hacker News — Railway says stolen customer AI keys drove fraud
Fireworks AI — October 2026 security incident update
Wiz — Black October for AI developer platforms
Google Cloud — LLMjacking: monetizing compromised cloud models
Notable News & Signals
Fireworks AI Expands Breach Scope to Datasets and Model Weights
On November 9, Fireworks AI widened its October incident disclosure to include customer datasets, secrets, and partial model weights.
Stolen Gemini Key Runs Up $82,000 in 48 Hours
A single stolen Gemini API key produced more than $82,000 in charges in about two days, showing how quickly LLMjacking costs escalate.
France Attributes Supermarket Fridge Sabotage to Iran’s IRGC
France formally attributed the European supermarket refrigeration OT sabotage to Iran’s IRGC, following the November 5 FBI/CISA advisory.
Topics Already Covered (No New Action Required)
- Black October AI platform breaches: Covered in CSA’s “Black October” notes on LLMjacking and concentration risk (Nov 5).
- ENISA 2026 State of Cybersecurity in the Union: Covered in “ENISA’s 2026 State of the Union: A Compass for AI Compliance” (Nov 10).
- Supermarket refrigeration sabotage: Systemic angle covered in “When Fridges Fail Together” (Nov 3); the attribution is incremental.
- eMudhra CA key compromise: Covered in “Trust Infrastructure Systemic Failure” (Oct 21); 8 more intermediates revoked around Nov 7.
- OpenSSH “SSHole”, N-able N-central zero-days, Qubole, GPUStack KEV: Covered in CSA notes from Nov 7–10.
- NIST agent identity tenets, EU AI Act Article 50, OWASP 2026 Top 10: Existing CSA coverage in the corpus.
- Routine patching (out of AI scope): November Patch Tuesday Outlook NTLM zero-day, Xen Orchestra auth bypass, eighth Chrome zero-day, Cisco BroadWorks KEV, SAP ICM2SHELL/PROXYGATE, Git recursive-clone RCE.