Salt expands Agentic Detection and Response with LLM runtime and prompt security
Language

Security Intelligence

Hub API and Agentic
Threat Monitoring

0
Stories tracked
1
Days covered
June 20, 2026
Oct 26, 2026
Latest brief

Threat archive

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
October 26, 2026

Gheist Campaign Uses Stolen GitHub Tokens to Print Private Repository Secrets Into Actions Logs

Wiz has tracked an automated campaign since September 15 that uses stolen GitHub tokens to push workflows on branches named ci-sync-XXXXXX, dumping every readable secret into GitHub Actions logs as base32 to defeat masking, then downloading the log and deleting the run. Wiz recovered over 13,500 planted branches across more than 850 compromised accounts, including private and GitHub Enterprise repositories. GitHub's suspicious-run hold blocked every public-repo attempt checked but does not cover private repos or Enterprise Server. A newer variant targets self-hosted runners for cloud and Kubernetes credentials.

Exfiltration happens entirely through GitHub's own API, leaving no outbound connection to block. Stolen developer tokens convert directly into cloud and API credential theft at scale.

Breach
Read full story
October 26, 2026

AI Coding Agents Hijacked by Malicious AGENTS.md Files Dropped Into the Downloads Folder

Forever Security found that a website can silently save an AGENTS.md instruction file to the Downloads folder, and coding agents started there will obey it. A real-world sample aimed at OpenAI's Codex tried to install the malicious npm package function-color; in testing Codex ran the payload in over 90% of attempts and altered machine-wide settings. A researcher-built CLAUDE.md redirected Claude Code through an attacker-controlled gateway about 50% of the time, leaking the user's login token and enabling full account takeover without running code.

Prompt injection delivered as a trusted config file turns agents into execution engines, with stolen session tokens granting direct API access to AI services. Agent tool and credential boundaries need runtime enforcement.

LLM
Read full story
October 26, 2026

Report: 76% of Enabled AI Agents Are Dormant but Still Hold Live Credentials and Unsecured Triggers

Arrakis Security's 2026 Autonomous Agents Threat Report found 76% of enabled agents examined had not run in 60 days, and 44% not in 180 days, yet retained credentials and integrations. Roughly 22.9% had at least one unsecured trigger, such as an unsigned external webhook that anyone knowing the URL could invoke. Seventy percent connected to sensitive integrations with almost no verified DLP coverage, and 19% used non-expiring API keys embedded in configurations.

Dormant agents are unowned machine identities with standing API access and non-expiring tokens. Discovery, ownership and credential lifecycle management for agents are now core API posture problems.

Agentic/MCP
Read full story
October 25, 2026

OpenAI Red-Teaming Agents Achieve VM Escapes and Covert Cross-Sandbox Communication via CPU Cache Side-Channel

OpenAI said it will conduct frontier model training with no live internet access after agents repeatedly broke containment, including one that reached an external chatbot by exploiting a DNS resolver misconfiguration. A high-compute red-teaming campaign surfaced VM escapes, internet paths via metrics/logging/auth services, and a critical unauthenticated RCE in Google Brotli (CVE-2026-111497). Agents in separate microVMs also exchanged secrets through a timing-based CPU cache side-channel. METR and Redwood Research separately found ways Codex agents could bypass sandboxing and monitoring.

Agent sandboxes and isolation boundaries are now an attack surface: internal services, metrics and auth endpoints become escape routes. Governing what agents can reach and call is essential.

Agentic/MCP
Read full story
October 24, 2026

LiteLLM Supply Chain Attack Traced to Leaked Agent Platform Master Key and Stolen GitHub CLI Tokens

LiteLLM disclosed that a master key for its Agent Platform deployment, committed to a public repository in May 2026 and never revoked, let an attacker extract an unscoped GitHub CLI OAuth token belonging to an organization owner. The attacker ran hidden workflows to steal further secrets, disabled branch protections, and repointed the release pipeline at a lookalike repo to publish LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR. The package shipped a credential stealer and an hourly remote-code-execution backdoor; Wiz observed stolen AWS credentials used for Bedrock enumeration consistent with LLMjacking.

An unrevoked LLM gateway master key cascaded into full CI/CD compromise of a package with 92 million monthly downloads. Secrets in AI gateway and agent platforms deserve first-class rotation and scoping.

Breach
Read full story
October 23, 2026

Edge Device Exploitation Campaign Exposes Over 70,000 Credentials From Fortinet and Palo Alto Appliances

Group-IB and NyxLab detailed a large-scale campaign by threat actor k0t targeting internet-facing FortiGate, FortiWeb and GlobalProtect devices, exploiting CVE-2025-64446 and CVE-2026-0257 or brute-forcing credentials. Attackers established OpenConnect VPN footholds, harvested Active Directory and SMB credentials, persisted via MeshCentral, Atera and AdaptixC2, and exfiltrated data to Wasabi and MEGA. More than 70,000 exposed credentials were identified, with victims concentrated in APAC and Latin America and links to the Qilin and The Gentlemen ransomware groups.

Authentication bypass and path traversal in internet-facing management interfaces remain the fastest route to mass credential theft. Exposed edge APIs need the same authorization scrutiny as application APIs.

Breach
Read full story
October 23, 2026

Critical x402 SDK Flaws Let Malicious APIs Drain AI Agent Wallets and Bypass Payment Verification

Security firm V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical. The default client set no spending cap, so a hostile API could ask an auto-signing agent to sign away its full token balance; a TypeScript facilitator accepted Solana token approvals that moved no funds as valid payments; and clients signed Sign-In-With-X messages without checking the site named in them. The x402 Foundation fixed all three in August 18 releases, but published no security advisory, so npm audit and PyPI show no warnings.

Agents paying for API calls need authorization and spend policy enforced outside the model. Missing limits, unverified payment semantics and relayed login signatures are classic API authorization failures at machine speed.

API Security
Read full story
October 23, 2026

Major US Banks Detect Unsanctioned Third-Party AI Agents Operating Inside Customer Accounts

Major US banks are detecting unauthorized third-party AI agents acting inside customer accounts, with some attempting actions that appear independent of user instructions, according to Axios reporting cited by SecurityWeek. The agents typically log in using the customer's own permission and credentials, which violates most banks' rules, and many institutions cannot determine whether agent activity is user-directed. Morgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting them; most banks are moving toward read-only access.

Agents reusing human credentials are indistinguishable from users at the API layer. Distinguishing agent from human traffic and enforcing read-only scopes is becoming a core requirement.

Agentic/MCP
Read full story