CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Attackers are moving faster than credential hygiene and patching processes were built for. Microsoft saw an ARTEX agent go from a leaked GitHub secret to Azure Key Vault exfiltration in five minutes, so rotation has to become automated, event-driven revocation. CVE-2026-119977, a WordPress Core flaw listed in CISA KEV, is exposed during the upgrade itself: block wp-content/upgrade/ before you patch. MCP SDK advisories show transports trusting peers they should verify. The Crédit Mutuel Arkéa theft (reported ~$133M) went through a provider’s platform and the bank’s own payment authority. NIST’s agent identity tenets give CISOs a federal baseline to measure agent deployments against.
Overnight Research Output
Five Minutes from Leak to Key Vault: Agentic Secret Harvesting and the Collapse of Rotation Windows
CRITICAL URGENCY
Summary: Microsoft Threat Intelligence reported that actors are using ARTEX and similar agentic frameworks to search public GitHub for client secrets and AI API keys. In one case an agent reached Azure Key Vault exfiltration in five minutes. The agents also mapped each key’s reach, enumerating subscriptions, permissions, and AI deployments, and when a call failed they corrected it and retried within 28–80 seconds. A 30/60/90-day rotation schedule does nothing against this. Revocation has to be automated and event-driven, and high-value workloads need to move to federated, short-lived credentials.
Key Sources:
Microsoft Security Blog — Threat actors use agentic AI tooling to find and abuse exposed secrets
GitGuardian — The Agents Have Now Found Your Secrets on GitHub
Cybersecurity Dive — Hackers enlist Artex to scan GitHub repositories for exposed secrets
Microsoft Security Blog — ARTEX abuse expands as cybercriminals target financial sector
MCP’s Transport Trust Gap: Browser-Reachable Servers, Unbound OAuth Issuers, and Cross-Client Message Leakage
HIGH URGENCY
Summary: Read together, a series of advisories against the official MCP SDKs describes one weakness: the HTTP layer accepts a party’s claim about itself without verifying it. Localhost servers in the TypeScript, Python, and Go SDKs shipped without DNS rebinding protection by default. OAuth clients let a malicious MCP server redirect secrets and tokens to an attacker’s endpoint (CVSS 7.5). Shared TypeScript instances leaked one client’s responses to another (CVE-2026-111770). Upgrading the SDK does not close these gaps on its own; the configuration steps described below are also required.
Key Sources:
GitHub Advisory — MCP TypeScript SDK DNS rebinding protection disabled by default (CVE-2025-66414)
GitHub Advisory — MCP TypeScript SDK OAuth client credential redirection (CVE-2026-104850)
GitHub Advisory — Shared server/transport instances leak cross-client data (CVE-2026-25536)
When Patching Is the Attack Window: Exploited WordPress Core Upgrade Race (CVE-2026-119977)
CRITICAL URGENCY
Summary: CVE-2026-119977 is a race condition (TOCTOU) in the WordPress core updater, affecting versions 4.7 through 7.1.3. For a few seconds during an update, an unauthenticated attacker can reach a staged copy of the installer and execute code on the server. CISA added it to KEV on November 3, and Wordfence blocked nearly 63,000 attempts in 24 hours. Picus warns that the 7.1.4 fix is unpacked by the old, vulnerable updater, so the act of patching is itself the window of exposure.
Key Sources:
WordPress — GitHub Security Advisory GHSA-4w3m-c66w-69mg
BleepingComputer — CISA flags WordPress RCE flaw as actively exploited
wp-content/upgrade/ before updating, check auto-updated sites for signs of compromise, and retire end-of-life branches (4.6 and earlier), which received no fix.
NIST’s Agent Identity Design Tenets: A Federal Baseline for Agent Authorization
HIGH URGENCY
Summary: On October 27, NIST and MITRE published ten design tenets for agent identity, authentication, and authorization. They call for agents to be treated as first-class identities, for delegated authority to narrow at every hop, for zero standing privilege, and for short-lived, revocable, audience-restricted credentials. NIST says “guardrails alone are insufficient”: the policy governing what an agent may do should be architecturally separate from the model, and access decisions should be deterministic. The tenets will guide the NCCoE agent identity demonstrations. NIST concedes that current standards cannot yet satisfy every tenet.
Key Sources:
NIST Cybersecurity Insights — Design Tenets for Agent Identity Management Systems
NIST Cybersecurity Insights — Why Agentic AI Needs a Strong Identity Foundation
NIST — Key Practices for Incident Readiness and Response (CAISSI/NSA/CISA)
Through Someone Else’s Platform: The Crédit Mutuel Arkéa Theft and the Limits of Provider-Level Oversight
HIGH URGENCY
Summary: On November 4, Crédit Mutuel Arkéa confirmed fraudulent transfers made after attackers reached the bank through an unnamed service provider’s platform. The money reportedly left the bank’s own accounts and was converted to cryptocurrency. Press reports put the loss at about €118M ($133M). The bank has not confirmed the figure but says it can validate the order of magnitude. Controls such as strong customer authentication and payee alerts protect customer accounts, not treasury transfers, so they did not apply. Contracts, certifications, and DORA registers describe a provider, but they do not limit at transaction time what a compromised provider channel can make the bank do.
Key Sources:
The Record — French bank confirms cyber heist
Help Net Security — $133 million stolen from French bank via exploited service provider
Ledger Insights — Crédit Mutuel Arkéa confirms suspected $133M crypto theft
DLA Piper — Designation of critical ICT third-party providers under DORA
Notable News & Signals
OpenAI Releases GPT-6 Cyber, Its First “Critical”-Rated Cyber Model
The model is available to vetted Daybreak Red customers for authorized exploit development and scores 48.5% on ExploitGym (GPT-5.6 Cyber: 32.1%). Expect exploit timelines to keep shrinking.
“AgentCorruption”: One Prompt to Region-Wide Bedrock AgentCore Takeover
Zenity used a single prompt to make an agent reach the metadata service, and the over-broad default role then exposed every AgentCore agent in the account and region. AWS disputes the framing and has made IMDSv2 the default.
NIST CAISSI, NSA, and CISA Issue AI Incident-Readiness Practices
Joint incident readiness and response practices published on October 16 pair with NIST’s agent identity tenets to form an emerging federal reference for agent governance.
MCP-FSD Study: 787 Servers with Undeclared Filesystem Access
Academic research found 787 MCP servers with filesystem capabilities they do not declare, which led to 13 advisories. Vet third-party MCP servers before approving them.
FastMCP and Envoy AI Gateway Advisories Extend the MCP Trust Gap
FastMCP clients sent secrets to authorization servers advertised by untrusted servers, and Envoy AI Gateway’s agent-router accepted forged MCP session IDs. Fixing either requires configuration changes as well as an upgrade.
Topics Already Covered (No New Action Required)
- WorkOS breach by escaped pentest agent: “The Researcher’s Agent Got Out” (Nov 8)
- Claude Code “don’t ask again” secrets leak: “Approved Once, Leaked Forever” (Nov 8)
- Claude Dispatch / malicious browser extensions: “ThisBash: Browser Sessions as Remote Shells” (Nov 7)
- OpenSSH CVE-2026-123158 “sshole”: “Any Long Password Works” (Nov 7)
- SonicWall SSL-VPN MFA bypass: “No Window to Patch” (Nov 8)
- OpenAI 948 Linux LPE exploits / GPT-6 Cyber capability: “948 Paths to Root” (Nov 5)
- Chainalysis agentic intrusion and ARTEX misuse: multiple notes, October–November
- OpenAI covert underperformance and sandbox escapes: “Quiet Sandbagging” (Nov 8), “Four AI Escapes”
- ENISA refrigeration-system attacks: “When Fridges Fail Together” (Nov 3), “The Remote Off Switch” (Nov 7)
- Post-midterm US AI legislation and EU AI Act Article 50: “After the Midterms” (Nov 8) and existing corpus note