Summary: CVE-2026-42208 (CVSS 9.3) is a pre-authentication SQL injection in LiteLLM, the widely deployed open-source LLM gateway used by enterprises to route requests to OpenAI, Anthropic, AWS Bedrock, and other AI providers. An unauthenticated attacker can send a crafted Authorization header to any LLM API route, reaching a vulnerable query through the proxy’s error-handling path. Successful exploitation grants read/write access to the litellm_credentials table — which typically holds organization-level API keys with five-figure monthly spend caps and IAM credentials, making the effective blast radius equivalent to a full cloud account compromise. First exploitation was recorded approximately 26 hours after the advisory was indexed by NVD, confirming zero-day-speed targeting of AI infrastructure even without a public proof-of-concept.

CISO Action: Patch LiteLLM to the latest release immediately. If patching is not immediately possible, restrict network access to the LiteLLM instance to internal networks only and rotate any API keys stored in the credentials table. Audit LiteLLM deployment architecture to ensure it is not internet-facing without authentication controls in front of it.

Key Sources:

View Full Research Note

Summary: ReversingLabs has attributed a seven-month npm supply chain campaign — comprising 60+ malicious packages and 300+ versions — to North Korea’s Famous Chollima threat actor (Lazarus Group). The forensic pivot is significant: a commit introducing the malicious @validate-sdk/v2 transitive dependency was generated by Anthropic’s Claude Opus LLM. The malware steals .env and .json configuration files, cryptocurrency wallet credentials, and — in the Rust-based payload variant — entire project source trees, while also installing persistent SSH access. This is the first widely documented case of a nation-state actor using a frontier AI model as an active participant in a supply chain compromise workflow, not merely for phishing content generation. AI code review tools trained on adversarial patterns may fail to flag AI-generated malicious commits because they share structural characteristics with legitimate AI-assisted code.

CISO Action: Audit transitive npm dependencies in any cryptocurrency, financial, or developer tool projects. Enable package-lock enforcement and dependency review in CI. Do not assume AI-powered SCA tools will catch AI-generated malicious packages without additional behavioral analysis.

Key Sources:

View Full Research Note

Summary: Google patched a maximum-severity (CVSS 10.0) vulnerability in Gemini CLI allowing an unauthenticated external attacker to execute arbitrary commands on host systems before the agent’s sandbox initialized, by forcing malicious content to load as Gemini configuration during headless CI/CD execution. Concurrently, Cursor IDE was found vulnerable to CVE-2026-26268, a git hook injection flaw enabling arbitrary code execution. Together with the TeamPCP and Cline supply chain attacks documented in prior intelligence cycles, these incidents confirm a maturing attacker focus on AI developer tools as a pivot point for CI/CD pipeline compromise. When an AI coding agent running in a GitHub Action holds repository write access and cloud credentials, its compromise is equivalent to owning the build system.

CISO Action: Audit the permission scope of AI coding agents deployed in CI/CD pipelines. Apply least-privilege principles to GitHub Actions: no AI agent runner should hold write access to the main branch or production cloud credentials unless strictly required. Update Gemini CLI and Cursor IDE to patched versions. Review GitHub Actions security hardening guidance.

Key Sources:

View Full Research Note