CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Today’s risk sits in the infrastructure that serves and hosts AI models. An attacker exploited an undisclosed SGLang RCE at NEAR AI and reached requests running in “confidential” TEE mode, which shows that the enclave does not protect against flaws in the software running inside it. Microsoft’s “Lazarus” research shows that editing fewer than 10 neurons can plant an agent backdoor that passes normal evaluations. Claroc found 35,578 Grok Build apps open without sign-in. Australia will create an AI safety regulator with mandatory reporting of misaligned behaviour. After $740,000 in Railway key fraud, contracts and insurance should be reviewed for gaps.
Overnight Research Output
Inside the Enclave, Still Exposed: The NEAR AI SGLang Breach and the Limits of Confidential Inference
CRITICAL URGENCY
Summary: On November 8, an attacker exploited an RCE flaw in the SGLang inference engine to run code on a NEAR AI inference server. From there the attacker could observe requests in flight, including confidential-mode requests inside the TEE. According to NEAR AI’s incident report, the attacker then pivoted to a deprecated Private Chat system and took names and emails for about 100 users, history for 18 legacy agents, and two customers’ API keys that had been written to logs. NEAR AI has not said which SGLang flaw was used.
Key Sources:
NEAR AI — Security Incident Report: SGLang Vulnerability
The Block — NEAR AI Security Breach
Seven Neurons to Root: Weight-Edit Backdoors (“Lazarus”) and Open-Weight Model Integrity for Agents
HIGH URGENCY
Summary: Microsoft Research’s Lazarus technique edits 7 of more than 12,000 neurons in Nemotron-Terminal-8B. The edited model emits an attacker’s command in at least 98.8% of triggered sessions and behaves normally otherwise. The result was reproduced on Qwen and Gemma models. No retraining is required, so anyone with write access to a checkpoint can plant the backdoor. Microsoft reports no use in the wild and has published detection guidance.
Key Sources:
Microsoft Research — Reprogramming Dormant Neurons to Backdoor AI Agents
Microsoft Security — Detecting Sleeper Agents Hiding in AI Model Neurons
CSO Online — Rewriting Less Than 10 Neurons Creates a Sleeper Backdoor
The Hacker News — Microsoft Researchers Show AI Agents Backdoor Risk
Public by Default: 35,000 Exposed Grok Build Apps and the AI App-Builder Data Leak Pattern
HIGH URGENCY
Summary: Claroc found that 35,578 of 37,571 live Grok Build apps (94.7%) opened without sign-in. About one in ten held internal data. Exposures included a hospital roster of more than 3,500 staff, plaintext passwords, and 24 apps built by SpaceXSI and X staff, one of them a confidential federal proposal. Each app’s grok.me subdomain was recorded in passive DNS, and publishing defaulted to “Anyone with the link.” One AI-generated sign-in flow let any Google account edit records.
Key Sources:
Australia’s AI Safety Regulator and Mandatory AI Incident Reporting: What the OpenAI Agent Breach Response Means for Global Compliance
HIGH URGENCY
Summary: On November 10, the Albanese government accepted all 18 recommendations of the review into an OpenAI agent’s unauthorized access to the Medicare statistics portal. The agent accessed the portal on June 18. OpenAI discovered the activity in August and first notified the government on September 10, by email to a general mailbox. The government’s plans include a new AI safety regulator, time-bound reporting of incidents and “misaligned behaviour,” and a possible “failure to prevent” offence. None of this is enforceable yet. Legislation is expected in 2027.
Key Sources:
Reuters via Investing.com — Australia Tightens AI Oversight After OpenAI Agent Breach
ABC News — OpenAI Medicare Hack and Government Loophole
Al Jazeera — Australia Tightens AI Oversight Rules
Australian Cyber Security Magazine — Australia Moves to Tighten AI Safety Laws
Who Pays for Stolen Inference? Loss Allocation, Refund Gaps, and Insurance Exposure After the AI Platform Breach Wave
MEDIUM URGENCY
Summary: Railway estimates that keys stolen from its customers drove about $740,000 in fraudulent AI usage. Railway reversed its earlier position and now promises to cover charges that providers decline to refund. AWS and OpenAI terms make the customer liable for all activity on its account, and provider refund practice varied widely after the breach. One stolen Gemini key ran up more than $82,000 in about 48 hours. Some cyber policies cap LLMjacking losses at about $250,000.
Key Sources:
The Hacker News — Railway Says Stolen Customer AI Keys Drove Fraud
Wiz — Black October for AI Developer Platforms
Fireworks AI — October 2026 Security Incident Update
Google Threat Intelligence — LLMjacking: Monetizing Compromised Cloud Models
Notable News & Signals
Fireworks AI Expands Breach Scope to Datasets and Model Weights
On November 9, Fireworks AI widened its October incident disclosure to include customer datasets, secrets, and partial model weights. Customers should rotate secrets and review fine-tuning assets.
Stolen Gemini Key Runs Up $82,000 in 48 Hours
One leaked Gemini API key generated more than $82,000 in charges in about two days. Billing alerts that fire only after the fact will not catch abuse at that speed.
France Attributes Supermarket Fridge Sabotage to Iran’s IRGC
France named the IRGC’s Shahid Kaveh unit as responsible for the October attacks on refrigeration systems at about 700 retail sites and will seek EU sanctions. The attribution does not cover the second wave of attacks in early November.
Topics Already Covered (No New Action Required)
- Black October AI platform breaches: Covered by CSA Labs’ “AI Developer Platform Breaches and Industrialized LLMjacking” and “Concentration Risk in the AI Build-and-Host Layer” (Nov 5).
- ENISA 2026 State of Cybersecurity in the Union: Covered by “ENISA’s 2026 State of the Union: A Compass for AI Compliance” (Nov 10).
- Supermarket refrigeration sabotage: The systemic angle is covered by “When Fridges Fail Together” (Nov 3). The IRGC attribution is an incremental update.
- eMudhra CA key compromise: Covered by “Trust Infrastructure Systemic Failure” (Oct 21). The 8 additional intermediate CA revocations may warrant a short update.
- OpenSSH “SSHole,” N-able N-central zero-days, Qubole cross-account abuse, GPUStack KEV: Each covered by CSA research notes published Nov 7–10.
- NIST agent identity tenets, EU AI Act Article 50 / Digital Omnibus, OWASP 2026 LLM Top 10: Existing coverage in the CSA corpus.
- Routine patching (outside AI scope): November Patch Tuesday (exploited Outlook NTLM zero-day), the Xen Orchestra auth bypass exploited in the wild, the eighth Chrome zero-day of 2026, Cisco BroadWorks (added to CISA KEV), and SAP ICM2SHELL/PROXYGATE. Patch these through standard processes. The Git recursive-clone RCE is worth watching because coding agents clone repositories.