Frontier Ready Daily
Machine-speed agentic cybersecurity — the top news for enterprises building toward it.
In this issue
The lead item is a measured intrusion timeline. Kaspersky reports that once operators handed a compromised education network to the CyberStrikeAI agent, it set up persistence within two minutes, carried out lateral movement, credential dumping and a database export in under an hour, and reached domain administrator within three to four days of deployment. The other five items: coding agents that install deprecated, unpatchable MCP servers from model memory even after npm warns them; Google's account of stolen cloud AI access resold through "LLM Mixers," with bills reaching $1 million; a suspected agentic loop in a 3AM ransomware attack on a UK school estate; Red Hat shipping fixed kernels for CVE-2026-98432 27 days after the upstream fix while Ubuntu's fixes remain opt-in; and HackerOne platform data showing bug-bounty submissions growing faster than valid findings.
Today’s Items
An AI agent reached persistence two minutes after deployment and domain administrator within three to four days in attacks on education networks
On 2 November 2026 Kaspersky described intrusions at education organizations in several African and Latin American countries using CyberStrikeAI, an open-source penetration-testing framework written in Go. In the incident it reconstructed, an operator spent nearly a day on manual access through a compromised SQL Server and then paused for two weeks. Once the operator deployed the agent, it established persistence within two minutes and mapped the domain over five hours. After a pause of several days, it completed lateral movement over SMB and WMI, credential dumping and a database export in under an hour. Kaspersky did not attribute the activity to a known group, but notes Chinese-language script comments and C2 restarts during UTC+8 business hours. Help Net Security reported the findings alongside CrowdStrike's ARTEX campaign, which this feed covered on 30 October.
The component classes are internet-facing database servers and Active Directory. The agent's techniques were conventional: scheduled-task persistence, LSASS dumping through comsvcs.dll, Kerberoasting, DCSync and WMIExec-style lateral movement. Kaspersky's own assessment is that AI "does not yet create fundamentally new detection challenges", and that what changes is speed. CSA reads this as the agent compressing each active phase to minutes or hours, so the long gaps in the timeline are the operator's choices. A SOC that relies on catching a slow human operator during discovery will see that phase finish in a single shift.
Security operations owner: validate. Confirm that alerts for shells spawned by `sqlservr.exe`, comsvcs.dll MiniDump use, bursts of LDAP and TGS requests, and remote scheduled-task creation reach a responder within the hour rather than the next business day. Replay this sequence in a purple-team exercise and record the time from first alert to containment. Urgency: validate.
Coding agents keep installing archived MCP reference servers that their maintainers will not patch, even after npm marks them deprecated
On 3 November 2026 Glow Labs published research it calls MCPhantom, based on real coding-agent session transcripts from Claude Code, Cursor, Codex CLI and Claude Cowork running Anthropic, OpenAI and xAI models. In sessions where a deprecated `@modelcontextprotocol` reference server was installed or suggested, the agent supplied the package name from its training data 98% of the time, and the user asked for it by name only 2% of the time. In one GitHub case the agent chose the archived reference server over GitHub's own maintained server. In another, the agent looked up the package on npm, received "This package is deprecated," and installed it anyway without telling the user. Glow found four high-severity flaws in the archived servers, including prompt-injection-driven code execution in the Puppeteer server, and none will be fixed. Npm's removal rules do not cover these packages. The GitHub server alone had 185,239 downloads last week and six owners.
The component class is the developer endpoint and its agent runtime, where `npx` fetches and runs an MCP server at the agent's request. Glow notes that EDR sees a trusted Node process doing routine work and SCA sees no manifest. The flaws carry no CVEs, so vulnerability feeds will not flag them, and software inventory never records the install. The deprecation warning, the only control in the chain that fired, was ignored by the agent that received it.
Endpoint and developer platform security owner: validate. Search developer machines and repositories for MCP configuration files that reference deprecated `@modelcontextprotocol` servers, and switch to the service owner's maintained server where one exists. Approve one server per service and make npm deprecation status a blocking criterion. Where your agent harness supports pre-execution hooks, use them to deny installs of unapproved MCP packages. Urgency: validate.
Stolen cloud AI access is resold through "LLM Mixers," and Google says single incidents exceeded $100,000 a day and reached $1 million before access was cut
On 2 November 2026 Google Threat Intelligence Group and Mandiant described LLMjacking incidents across financial services, retail, technology and transportation in three regions. The post separates the break-in from the payoff. One group steals service-account keys, GitHub tokens or session tokens. "LLM Mixers" such as Jet Night and newapi.pro pool the stolen access and resell it, with Jet Night offering unlimited use for about $60 a month against a legitimate rate of $100 to $250. Victims' AI services were often switched off when they were compromised, and attackers used the stolen keys to switch them on. Attackers tested keys with `max_tokens=1` requests to stay below volume alerts. They also used a fake portal to collect active tokens, which let them bypass MFA. This feed covered Wiz's 30-minute first-use figure for October's platform breaches on 1 November; Google adds the resale market, the gateway privilege-escalation flaw and the re-enablement path.
The component classes are the cloud model service (Bedrock, Azure AI and Vertex), the model gateway in front of it, and the service-account keys that reach both. An estate that never adopted a cloud AI service is still exposed if its IAM permits the service to be enabled. CSA notes that Google says Vertex data-access logs are off by default, so model invocations may not be logged until someone turns them on.
Cloud security owner: validate. Treat the enabling of any cloud LLM service, and any change to model invocation logging, as a high-severity event, and confirm the alert works in AWS, Azure and GCP. Deny AI-service permissions to principals that do not need them, set per-model spending caps, and patch LiteLLM or any other gateway you run against CVE-2026-40217. Urgency: validate.
A 3AM ransomware affiliate issued slightly varied commands at 40- to 100-second intervals across a UK school estate, which Bitdefender reads as a suspected agentic loop
On 3 November 2026 BleepingComputer reported Bitdefender's investigation of a 3AM ransomware attack on an unnamed UK school estate between 10 and 19 September. The attacker came in from an unmanaged host. It extracted and decrypted credentials from three Veeam backup servers, dumped LSASS, created two backdoor domain admin accounts named "library" and "svc_bkpmon," and set up two-way trusts between three previously separate Active Directory domains. It then encrypted about 37 of nearly 50 machines. Repeated, slightly modified commands arriving every 40 to 100 seconds led Bitdefender to suspect an automated agentic loop. It could not access the attacker's machine to confirm this.
The component classes are the backup server and the domain trust configuration. Backup consoles store privileged credentials and are frequently excluded from tight monitoring. Joining separate domains with new trusts turned one compromised estate into three. The evidence of AI assistance is behavioural and unconfirmed. Even so, a machine-regular cadence of retried, mutated commands is a pattern a human operator does not usually produce, so it can serve as a detection signal regardless of who or what is typing.
Identity and infrastructure security owner: validate. Alert on creation of new domain trusts and new domain-admin accounts, and treat either as an incident. Confirm that backup-server credentials are stored encrypted with keys held off the backup host, and that system-state backups cannot be deleted by a domain admin alone. Ask your detection team whether they can flag repeated near-identical commands at regular intervals from one session. Urgency: validate.
Red Hat shipped fixed kernels for CVE-2026-98432 27 days after the upstream fix, while Ubuntu's fixes still do not install by default
On 1 November 2026 Red Hat released fixed kernels for CVE-2026-98432, the remote IPv4 TCP use-after-free for which Anthropic reported an AI-written root exploit on 27 October. Red Hat first rated the flaw Moderate at 5.9 and has since raised it to Critical at 9.8. Its fix arrived 27 days after the 5 October upstream fix. On 2 November Canonical placed fixes for Ubuntu 22.04, 24.04 and 26.04 LTS in its opt-in `-proposed` channel. Cloud, FIPS and real-time variants are still in progress, and 20.04 and older releases are pending. As of this issue, a supported Ubuntu host that takes only regular updates is 29 days past the upstream fix with no installable kernel. On 1 November this feed reported that the interval had passed 25 days for both distributions.
The component class is the Linux server and container-host fleet, especially Ubuntu-based cloud images, which usually draw on the cloud kernel variant that is still in progress. Red Hat's initial Moderate rating shows that a vendor's own severity rating can lag the risk, so a patch SLA keyed to vendor severity would have put this flaw in a slower queue. Red Hat warns that its interim nftables filter applies only to the host where it is loaded and cannot stop container-to-container traffic on that host.
Infrastructure and platform security owner: escalate. Install and reboot into the fixed RHEL kernels now. For Ubuntu hosts facing untrusted networks, decide explicitly whether to take the `-proposed` kernel after testing or keep the IP-options filter in place, and record which applies to each fleet. Track the regular-channel release for cloud and FIPS variants. Urgency: escalate.
Bug-bounty submissions have grown 2.8 times since January 2025 against 1.9 times for valid reports, HackerOne says
On 3 November 2026 HackerOne's CEO Kara Sprague gave Help Net Security platform figures that carry a denominator. Since January 2025 submissions have grown 2.8 times and valid reports 1.9 times, so by CSA's arithmetic valid findings have fallen from 100% to about 68% of their earlier share of submissions. She said she "can't give you a reliable split" between AI-generated and human reports. The same interview cites survey data that 58% of security leaders say business priorities delay fixes for critical and high-severity findings.
The component class is the external vulnerability intake pipeline: bounty programmes, disclosure inboxes and the triage staff behind them. If volume grows faster than validity, triage work grows faster than the number of real findings it produces. If 70% of leaders are right that valid findings already outpace remediation, the extra triage effort also lands on a backlog that is not shrinking. No figure here is independently confirmed. A third-party count of submissions against validated reports across platforms would confirm it.
Vulnerability management owner: monitor. Track your own ratio of submissions to validated findings, and of validated findings to findings fixed, by quarter, so you have your own denominator rather than relying on a platform's. Urgency: monitor.
Rolling Watchlist
- OpenAI reward-hacking postmortem — downstream response — No change. No ruling in the Texas matter and no comparable eval-to-production escape disclosed by another lab. _(opened 2026-08-27)_
- VM/hypervisor containment hardening for cyber-capable agents — No change. _(opened 2026-08-27)_
- Claude Code Auto Mode prompt-injection ASR discrepancy — No change. No Anthropic patch or public response. MCPhantom (item 2) shows Claude Code among the harnesses that install archived MCP servers, but it is a separate failure class. _(opened 2026-08-27)_
- AI defensive-triage guardrail evasion — No change. No new campaign this issue used refusals to blind security triage. _(opened 2026-08-31)_
- AI account session hijacking at scale — Partial movement. Google (item 3) documents a fake portal that collected active access tokens and bypassed MFA, plus stolen session tokens used to reach cloud AI services. That is session theft against cloud AI accounts, though not against AI provider consumer accounts specifically. No provider has shipped device-bound or short-lived session tokens. _(opened 2026-08-31)_
Opened this issue
- Unmaintained agent components installed from model memory _(agentic_surface)_ — Glow reports that agents choose archived MCP reference servers from training data and ignore deprecation warnings (item 2). Watching for agent harnesses that refuse or warn on deprecated servers, for npm or the MCP project changing how archived packages are handled, and for the first exploitation of an unpatched reference server.