Hacktron disclosed on September 13, 2026 that its researchers chained a libheif image-processing memory-corruption bug in OpenAI's Discourse-based help forum with a "Sign in with OpenAI" SSO weakness that shared credentials between the public forum and internal staff ChatGPT/Codex accounts. Claude Opus 4.8 had failed across several sessions to produce a working exploit under ASLR; within three hours of Claude Opus 5's July 24 release, the team had one, confirmed remote code execution by July 25 05:00 UTC, and reached a pull request inside OpenAI's internal code monorepo by 15:30 UTC the same day. OpenAI confirmed a fix roughly 14 hours after the report and paid a $6,500 bounty on September 1.

Any enterprise running community, support or help-desk forum software that shares single sign-on with internal SaaS tools inherits the blast radius of that forum's image-upload pipeline. A memory-corruption bug in a third-party image library, reachable through the same identity provider guarding your GitHub, Slack and email access, turns a public-facing forum into a path to internal source code — and the gating factor on how fast that path gets exploited is now model capability, not researcher skill.

GTIG reported on September 8, 2026 that a financially motivated actor compromised an organization's cloud infrastructure, then used an autonomous multi-agent framework — an AI coding chatbot following preconfigured markdown playbooks — to plan, build and execute a mass credential-harvesting campaign that compromised thousands of third-party credentials in under six hours, routing attack traffic through the victim's own legitimate cloud IP space to blend in with normal usage.

The compressed cycle here sits in cloud IAM and credential-issuance infrastructure: an attacker who lands inside one cloud tenant can now fan out credential harvesting across a downstream identity fabric before a human-paced SOC finishes triaging the initial alert.

In the same September 8 report, GTIG detailed UNC6780 publishing trojanized forks of legitimate MCP server packages — including one impersonating `tiktoken_mcp` — to PyPI, and injecting malicious code into GitHub repositories such as `azure-functions-mcp-extension`. Its DUSTMAKER malware harvested CI/CD OIDC tokens from GitHub Actions runner memory and used them to publish malicious packages carrying valid, cryptographically signed SLSA Build 3 provenance attestations, letting the packages pass the automated trust checks AI coding agents rely on before installing a dependency.

This defeats the exact control class — cryptographic build provenance — that CI/CD pipelines and AI coding agents increasingly trust in place of manual review. Any agent runtime or dependency pipeline that treats a valid SLSA attestation as sufficient grounds to auto-install a package inherited this gap the moment its CI/CD tokens became reachable.

Hush Security published research on September 18, 2026 analyzing roughly 82,000 public MCP configuration files spanning Claude Code, Cursor, VS Code, Windsurf, Gemini, OpenAI Codex and other coding-agent tooling. Twelve percent of credential slots contained a hardcoded secret rather than a reference; 24% of those secrets were both broad-scope and non-expiring; and tracing Git history on a 7,681-file subset found 1,394 secrets still live in the current file plus 243 more that remained fully readable in earlier commits despite having been "removed."

MCP configuration files are becoming the default credential store for the identity and delegation fabric agents depend on, and this exposure sits upstream of any individual agent's runtime controls — a secret leaked in a committed MCP config compromises every connected service (GitHub, Slack, Notion, databases) regardless of how well the agent itself is sandboxed, and most secret scanners are not tuned to find it.