CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Top concern today is GitSpawn, a git-configuration flaw that lets Claude Code, Codex, Cursor, and four other CLI coding agents silently run attacker code the moment they open a repository — four of eight disclosed variants remain unpatched. Unit 42 also documented active campaigns using Claude and GPT-4.1 to accelerate exfiltration tooling against government, water-utility, and financial targets across Mexico, Ecuador, and Brazil. A critical authentication-bypass/SSRF chain (CVSS 9.1) hit Grafana’s MCP server, and GPUThor now defeats on-die ECC on widely deployed NVIDIA workstation GPUs in about a minute. Separately, the EU Cyber Resilience Act’s 24-hour reporting duty takes effect September 11 — eight days away.
Overnight Research Output
GitSpawn: How a Git Config File Hijacks AI Coding Agents
CRITICAL
Summary: Manifold Security disclosed GitSpawn, a class of flaws in which a repository’s own .git/config file forces AI coding agents to run attacker-chosen commands the moment the agent inspects the repo — no malicious dependency or prompt injection required. Eight findings span seven agents (Claude Code, Codex, Cursor, Grok Build, Goose, Hermes Agent, Qwen Code); four remain unpatched. Execution happens inside Git’s own machinery, so it bypasses every sandbox and confirmation dialog agents apply to model-initiated commands, and on several tools fires before the user even accepts a workspace-trust prompt.
Key Sources:
git clone (ZIP downloads, USB transfers, shared drives) as untrusted before opening it in an agent.
Active AI-Enabled Data Exfiltration Campaigns Target Government and Financial Sectors in Latin America
CRITICAL
Summary: Palo Alto Networks’ Unit 42 disclosed two operationally distinct, AI-augmented intrusion clusters active in Latin America since at least February 2026. Trend Micro independently corroborates the activity under separate cluster names, tracing initial access to exploited public-facing JBoss servers and resume-themed phishing rather than any AI-driven exploitation. Both vendors stress that organizations with current patching and monitored perimeters resisted compromise despite the attackers’ AI tooling — foundational hygiene remains the primary control even as attacker development cycles accelerate.
Key Sources:
Critical Authentication Bypass and SSRF in Grafana MCP Server (CVE-2026-19516)
HIGH
Summary: Pillar Security chained a missing-authentication flaw with an SSRF bug in Grafana’s official MCP server — used by AI agents to query dashboards and alerts — into a single working exploit. An attacker needed no real credential, only a plausibly formatted session identifier, to invoke tools with the server’s full Grafana service-account privileges and redirect outbound requests toward internal services and cloud metadata endpoints. The affected image had roughly 1.9 million Docker Hub downloads before disclosure.
Key Sources:
--server-auth-token stay exposed. This is the latest in a pattern of MCP servers built on “trusted internal network” assumptions.
The EU Cyber Resilience Act’s Reporting-Before-Readiness Gap: What CISOs Must Do Before September 11
HIGH
Summary: Article 14 of the EU Cyber Resilience Act becomes enforceable September 11, 2026, requiring manufacturers of connected products sold into the EU to report actively exploited vulnerabilities within 24 hours. That obligation lands more than a year before the Act’s secure-by-design engineering requirements take effect in December 2027 — companies must disclose problems before they’re required to have built controls against them. An ENISA survey of 194 organizations found most lack the process maturity to meet the 24-hour threshold.
Key Sources:
The Hacker News — The EU Will Make You Report What It Won’t Yet Make You Prevent
European Commission — Cyber Resilience Act: Reporting Obligations
GPUThor and the Hidden Systemic Risk of GPU Hardware Monoculture in AI Infrastructure
HIGH
Summary: University of Toronto researchers disclosed GPUThor, which defeats the ECC protection NVIDIA recommended as the definitive fix for the earlier GPUHammer attack. By hammering memory rows in a pattern that evades on-chip refresh defenses, it produces double- and triple-bit errors precise enough to corrupt page tables and escalate an unprivileged CUDA workload to host root. Because these GPU families underpin a large share of shared multi-tenant AI training and inference infrastructure, this is a hardware-monoculture risk story that sits beneath every AI deployment running on them.
Key Sources:
The Hacker News — New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
BleepingComputer — New GPUThor Attack Defeats NVIDIA ECC Protection for Root Access
Notable News & Signals
NVIDIA NemoClaw Local-Model Poisoning (CVE-2026-65105) — Windows/WSL Still Unpatched
A DNS-rebinding flaw lets any malicious webpage rewrite a local Ollama model’s chat template via NemoClaw’s unauthenticated 0.0.0.0 binding, persistently poisoning every future response. Patched for macOS/Linux in v0.0.35 on August 25; Windows/WSL remains exposed. Held back from a full research note this cycle in favor of fresher Sept 2-3 items — worth revisiting if the Windows fix continues to lag.
Topics Already Covered (No New Action Required)
- Hugging Face “rogue AI agent swarm” incident: Already covered by CSA research notes published 9/1 and 9/2; recurring headline mentions this cycle add no new material.
- TeamPCP / Shai-Hulud software supply-chain worm: Covered by the 9/1 CSA research note; today’s “469 credential locations” update (GitGuardian) is an incremental data point on the same campaign, not a new topic.
- Deadbugz MCP metadata-poisoning campaign: Already covered by the 9/2 CSA research note on Pillar Security’s findings.
- NIST SP 1353 / AI CSF governance mapping: Already covered by the 9/1 CSA research note.
- IETF agent identity standards: Already covered by the 9/2 CSA research note.
- AI-assisted PLC exploit porting: Already covered by the 9/2 CSA research note.
- Chip-smuggling / export-control supply chain risk (Apex Logistics): Already covered by the 9/2 CSA research note.