Summary: On November 11, an operator used ScreenConnect’s Run Command feature to push attacker-controlled clients and the SCKit toolkit to at least 288 endpoints across 48 organizations. Huntress attributes initial access to the third-party RMM+ extension (v1.0.31–1.0.32), which accepted a blank shared key. ConnectWise has not confirmed this vector and has disabled third-party extensions while it investigates. SCKit’s RelayTrap component waits for a technician to connect and then tries to spread across the technician’s sessions. That propagation has not succeeded in any observed case, and client 26.6.5+ blocks the CVE-2026-84869 exploit it depends on. Affected hosts were already running current releases, so patching the core product alone would not have prevented this intrusion.

Key Sources:

Read Full Research Note

Summary: Darktrace demonstrated that an attacker with a developer’s Claude Console credentials and a foothold on the host can relaunch Claude Code as a persistent, remotely tasked agent. Memory stores carry the commands and the Files API carries the stolen data. Every request goes to api.anthropic.com, which organizations using the agent must already allow, so domain-based egress controls cannot separate it from legitimate use. This is not a platform vulnerability. Darktrace has not seen it in the wild, and it requires a prior endpoint compromise. It follows the pattern of Microsoft’s SesameOp, but uses the agent itself instead of custom malware to carry out the tasking.

Key Sources:

Read Full Research Note

Summary: Trust based on declared agent identity is failing from both directions. New telemetry reported by Help Net Security describes a credential-stuffing operation that posed as a popular AI agent and sent 414,210 visits to one marketplace in a week. HUMAN found that many requests claiming to be ChatGPT, Mistral or Perplexity bots did not come from those operators. Agentic browsers such as Atlas and Comet send standard desktop Chrome user-agent strings. Agent traffic already reaches account, authentication and checkout pages, where mistaken identity leads directly to fraud.

Key Sources:

Read Full Research Note

Summary: On November 4, the OCC issued Bulletin 2026-54, its first examiner resource that addresses generative and agentic “Super Intelligence” directly. It covers 16 components across six pillars and uses a four-tier risk scale. The framework is nonbinding, but it shows what examiners will ask about. Control intensity depends on consequence, reversibility and autonomy, so an autonomous payment agent is Tier 1 however well it tests. A misbehaving agent is treated as a resilience event that calls for circuit breakers, rate limits and kill switches. Agent credentials should be governed like privileged users, and vendors face scrutiny over the scope of their agents’ authority, incident definitions and notice of new AI features.

Key Sources:

Read Full Research Note