Microsoft disclosed on September 25 that Storm-3168 — the actor behind the JADEPUFFER agentic ransomware Sysdig first documented in July — used two compromised Azure service principals from the same tenant to run a divided reconnaissance-and-destruction operation: roughly 15.5 hours of reconnaissance, then a sub-one-second pivot into a 35-minute destructive phase that attempted more than 100 storage-account deletions, compressing most of them into a 7-minute window, followed by 30+ minutes of credential collection for likely future exfiltration.

The initial access came from a client ID, secret, and tenant ID an employee had pasted into a public GitHub issue; even after the issue was edited, the secret remained retrievable through GitHub's public edit history. Any service principal, workload identity, or CI credential that ever touched a public repository — including through a since-edited comment — carries this same exposure, and most identity and SOC teams sized their detection windows for human-paced attacks, not a sub-second recon-to-destruction pivot.

Google's Threat Intelligence Group reports that in Q2 2026 it observed a threat actor compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential-harvesting campaign against that access in under six hours end to end. Separately, GTIG tracked UNC6780 using tactics designed to get AI coding assistants and LLM-based security scanners to wave through open-source supply-chain compromises, and a Russia-based group running AI models inside automated bots to triage Telegram channels for material of interest to state authorities.

GTIG is explicit that this is not yet end-to-end autonomous exploitation — humans still scope and direct the campaigns — but the agent is now doing enough of the execution that the defender's response window is set by the agent's pace, not the operator's. Any escalation and containment runbook that assumes a human operator pausing between steps is sized for a cycle time that no longer holds for at least one class of attacker.

Citrix confirmed on September 27 that CVE-2026-88771 (unauthenticated command injection, CVSS 9.5) and CVE-2026-88772 (memory overflow enabling RCE or denial of service, CVSS 9.5) in NetScaler ADC and Gateway had been exploited as zero-days — with webshells and anti-forensic cleanup commands deployed against unpatched appliances for several weeks — before bulletin CTX697096 and patched builds (14.1-73.37, 13.1-64.23) became available. CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same week.

Every default NetScaler ADC/Gateway deployment on an affected build is exposed with no authentication required, and Citrix itself warns that applying the patch can erase forensic evidence of an intrusion that already happened — meaning an organization that patches first and investigates later may destroy its own evidence of compromise.