CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Today’s risk centres on unattended AI infrastructure. Symantec’s Skynet LLMjacking agent turns unauthenticated model endpoints, gateways, and MCP servers into attack engines that the victim pays for, so authenticate every inference endpoint now. The x402 agent-payment SDKs shipped critical fixes for uncapped spending with no advisory, so SCA tools show clean results while pinned agents stay exposed. Anthropic found 94 configuration combinations that silently disable controls, a gap per-setting benchmarks miss. EN 18286 gives only narrow AI Act QMS coverage, and cross-hosting of frontier models means “multi-model” no longer delivers infrastructure resilience.
Overnight Research Output
Skynet-Mode LLMjacking: Exposed Model Endpoints as Autonomous Attack Engines
HIGH URGENCY
Summary: On 21 October, Symantec’s Threat Hunter Team published the full instruction set of an offensive agent its operators call “Skynet”. It scans for model endpoints that accept OpenAI-style requests without authentication (or with a stolen key), then hands planning for scanning, exploitation, credential theft, and cryptomining to the hijacked model. The honeypot logged more than 127,000 requests from tens of thousands of addresses, Help Net Security reports. Tool calls were never executed, so this is evidence of intent, but the remedy is configuration: authenticate every model endpoint, gateway, and MCP server, and restrict their network exposure.
Key Sources:
x402 Agent-Payment SDK Flaws: Uncapped Spending and Silent Security Fixes
HIGH URGENCY
Summary: V12’s review of the Linux Foundation’s x402 protocol code found that, before the August fixes, the default client enforced no spending limit: it took the first payment option a server offered, and the server alone set the amount, token, and recipient. Other critical flaws allowed a complete payment bypass in the TypeScript Solana facilitator and cross-site Sign-In-With-X login as the agent’s wallet. The Hacker News notes that no security advisory existed as of 23 October, so npm audit and PyPI listings did not flag vulnerable versions. Patched SDKs now cap each payment at $1 in recognised stablecoins by default.
Key Sources:
Silent Security Downgrades: What 94 Misconfiguration Traps in Open Source Mean for Hardening
MEDIUM URGENCY
Summary: Anthropic’s research used Claude across more than five million lines of code. It inventoried over 17,000 configuration options, 3,842 of them security-relevant, and reported 493 attack-surface issues. Failures included hostname deny rules that never match when reverse DNS is off, client-certificate requirements bypassed by a second setting, and roughly 4,500 lines of excluded post-quantum code in OpenSSH that unauthenticated clients could still reach (fixed in OpenSSH 10.5/10.6). Help Net Security reports that all 11 authenticated-only projects had code reachable before authentication.
Key Sources:
Anthropic — Attack surface reduction research
Help Net Security — Anthropic attack surface reduction in open source
EN 18286 Becomes the First AI Act Harmonised Standard: What Presumption of Conformity Does and Does Not Buy
MEDIUM URGENCY
Summary: Commission Implementing Decision (EU) 2026/2274 placed EN 18286:2026 in the Official Journal on 14 October, and the Commission announced it on 19 October. Nemko and Modulos note that the presumption covers the provider’s management system rather than the AI system, and that some Annex ZA rows carry conditions or exclusions. The standard sits on top of ISO 9001 or ISO/IEC 42001 and does not replace them. With Annex III obligations applying from 2 December 2027, its value today is as an auditable QMS blueprint, not a compliance finish line.
Key Sources:
Nemko — EU AI Act cites new harmonised QMS standard
ActuIA — First harmonised standard covers only the quality system
Every Model on Every Cloud: Cross-Hosting and the Collapse of Model Diversity as a Resilience Strategy
MEDIUM URGENCY
Summary: On 23 October, Google Cloud opened a private preview of GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, billed through Marketplace and counting toward cloud commitments. OpenAI models are already on Amazon Bedrock, and Claude is on AWS, Google Cloud, and Microsoft Foundry. Cross-hosting spreads infrastructure risk, but model weights, safety training, usage policy, and regulatory exposure are the same on every cloud. The June 2026 suspension of Fable 5 and Mythos 5 removed those models from every channel at once. Research also shows that errors from different LLMs are substantially correlated.
Key Sources:
Google Cloud — Bringing OpenAI models to customers
Help Net Security — Google Cloud OpenAI models private preview
Notable News & Signals
Node2Shell: Brotli Decoder RCE Demonstrated on Official Node.js Build
Imperva ran code on stock Node.js 24.22.0 via crafted Brotli data (CVE-2026-111497). The decoder flaw also reaches Bun, Python Brotli packages, and Envoy, so each needs its own update.
Pillow 13.0.0 Fixes EPS/Ghostscript Argument Injection
CVE-2026-112900 lets an attacker-controlled filename inject Ghostscript options. Pillow is pulled into most Python ML and upload pipelines, and only 13.0.0 is fixed.
eMudhra emSign CA Certificate Security Incident
A CA key compromise is forcing trust-store changes. Python ecosystem maintainers have published guidance for affected users.
k0t Campaign Mass-Exploits FortiGate and GlobalProtect Edge Devices
Group-IB and NyxLab tie the actor to Qilin and The Gentlemen as an initial access broker, using OpenConnect, RMM tools, and AdaptixC2 for persistence.
BlackX UEFI Bootkit Bypasses Secure Boot Where Revocations Are Missing
A BlackLotus successor abusing Baton Drop hit Central Asian diplomats. Patched Windows hosts stay exposed until DBX revocations are applied. Attribution to APT41 is medium confidence.
Anthropic Donates Agent Skills to the Agentic AI Foundation
Agent Skills joins MCP under neutral foundation stewardship, which is a signal for how agent-ecosystem standards will be governed.
Topics Already Covered (No New Action Required)
- PHP2Shell (CVE-2026-109618/109619) and follow-on CVE-2026-115560: Covered by “PHP2Shell: Exploitation Before Disclosure for an AI-Found Flaw” (23 Oct). Exploitation attempts are widespread (Mirai/Potassium), but no successful compromise has been confirmed.
- LiteLLM 1.107.0 compromise and leaked master key: Covered by “LiteLLM 1.107.0: When Model-Gateway Logs Become the Credential Store” (23 Oct) and “The Unrevoked Key” (24 Oct).
- ARTEX / Storm-0940 agentic intrusions: Covered by the ARTEX notes (9–12 Oct), “ConnectWise Cloud Backup” (17 Oct), and “Fingerprinting Agent-Operated Intrusions” (22 Oct).
- Coding agents disabling misalignment monitoring: Covered by “Agents That Disable Their Own Oversight” (23 Oct) and “When Agents Turn Off the Watchers” (24 Oct).
- Phantom ransomware AI kill chain; Railway secrets and inference-provider campaigns: Covered on 23–24 Oct, including “Inference Providers as the Prize”.
- DeepSeek FASCSA order, MOFCOM No. 48, Colorado ADMT hearing, EU AI Office fining procedure: All covered between 18 and 24 Oct. The AI Office consultation closes 9 November.
- AI-driven vulnerability volume: Covered by “Patch Volume Saturation” (15 Oct).