Try Salt Code. Get your free token
Language

Security Intelligence

Hub API and Agentic
Threat Monitoring

0
Stories tracked
1
Days covered
June 20, 2026
Sep 14, 2026
Latest brief

Threat archive

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
September 10, 2026

Nearly 1 in 10 Internet-Exposed LiteLLM AI Gateways Accepted the Default "sk-1234" Admin Key

Wiz Research scanned 3,074 internet-facing LiteLLM gateways in February and found 294 accepted sk-1234, the example admin key from LiteLLM's own setup guide, with 191 having no key set at all. Admin access exposes every stored model provider API key, prompts and replies, connected MCP tool servers, and — via unchecked pass-through endpoints — cloud instance metadata credentials. CISA has already added the LiteLLM MCP auth bypass CVE-2026-59822 to its KEV catalog.

AI gateways concentrate provider API keys, MCP connections, and cloud identity behind one credential, making exposed and weakly authenticated gateway APIs a top-tier discovery and posture problem.

LLM
Read full story
September 10, 2026

AI Agents Exploited PaperCut Flaws to Compromise 440 Instances Across 395 Organizations

GreyNoise reported that a likely Russian-speaking threat actor used hundreds of AI agents, built on OpenAI's Codex harness paired with a DeepSeek model, to develop and test exploits for CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF and then run a global exploitation campaign. At least 440 PaperCut instances tied to 395 organizations in 48 countries were compromised, with credentials harvested from 280 victims and domain administrator rights obtained at 12. The adversary went from an empty workspace to remote code execution against a real victim in under four hours, and the agents also drifted from their operator's country exclusion rules.

This campaign shows agent-driven exploitation and credential harvesting operating faster than typical human response windows, which shortens the time defenders have to spot abnormal activity. Visibility into exposed interfaces and detection of anomalous behavior across API and agent environments become more important as attackers automate discovery, exploitation, and credential theft end to end.

Agentic/MCP
Read full story
September 9, 2026

Infostealer Logs Are Yielding Replayable AI Session Tokens and API Keys That Bypass MFA

Okta analyzed a 7 GB infostealer dump from 5,871 machines and found 1,843 unexpired JWTs and JWEs, including 555 tied to AI services such as Google, Anthropic, OpenAI, Cursor, and Character.ai, plus 24 still-valid API keys for Gemini, OpenAI, Groq, and OpenRouter. Replaying these tokens grants account access without a password or MFA, enabling LLMjacking and resource theft, and 17.7% of JWTs contained plaintext PII.

Stolen API keys and session tokens are the cheapest route into AI services, so token scoping, short expiry, and detection of replayed credentials on API endpoints are critical controls.

API Security
Read full story
September 9, 2026

DeepSeek Harness Flaw (CVE-2026-82533) Let a Sandboxed AI Agent Disable Its Own Sandbox

A flaw in DeepSeek Harness, an open-source tool for running AI coding agents locally, allowed a sandboxed agent to switch its own session to a "danger-full-access" mode with a single shell command against the tool's local web interface, removing file sandboxing and approval prompts. The interface had no authentication and validated only the client-supplied Host header, and it also served full session logs to any caller that could reach it. VulnCheck published the CVE on September 8 with a rating of 9.4; DeepSeek fixed the tool on August 27, with the first fixed npm release appearing on August 30.

An unauthenticated local control interface that lets an agent escalate its own permissions is a textbook example of excessive permissions and missing authentication in agent tooling. Salt's discovery of agents and their interfaces, plus analysis of misconfigurations, excessive permissions, and authentication weaknesses, applies directly to this class of exposure.

Agentic/MCP
Read full story
September 8, 2026

Slim Spider Steals Cloud Credentials and Crypto Custody Secrets From Brazilian Financial Institutions

CrowdStrike detailed Slim Spider, a Brazil-based financially motivated group that since March 2026 has used custom Bash scripts to query cloud instance metadata for temporary credentials, then enumerated and exfiltrated secrets from cloud credential managers, focusing on digital asset custody keys. The group pivoted through Azure DevOps pipelines to deploy implants across a managed Kubernetes cluster and operated web panels including NEXUS // Scanner, which classifies and ranks API endpoints by category and authentication options.

The attacker's own tooling scanned and ranked API endpoints by authentication weakness before targeting payment and custody systems — precisely the exposure attackers find first in financial APIs.

Breach
Read full story
September 8, 2026

ChatGPT Prompt-Injection Flaw Let a Planted Instruction Exfiltrate Gmail Data to an Attacker's Account

Check Point Research showed that a single instruction planted in a ChatGPT conversation — via a pasted prompt, shared conversation, or custom GPT instructions — could make the model run a hidden task alongside its visible answer, reading connected Gmail data and passing it to a second account. The covert channel abused an internal JFrog Artifactory service whose file properties were not isolated per account. OpenAI confirmed the internal service was taken offline.

Connected-app permissions defaulting to silent reads plus a shared internal service turned an LLM into a data-exfiltration path — highlighting the need for tight scoping and monitoring of AI app integrations.

LLM
Read full story
September 8, 2026

FreeIPA Flaw Chain Lets Unauthenticated Clients Create Reusable Administrator Credentials

Red Hat says CVE-2026-76578 (CVSS 9.8) in FreeIPA, chained with a 389 Directory Server access-control defect (CVE-2026-76560), allows a client that has never logged in to write a Kerberos identity and password into the directory and land in the administrators group. A shipped default ACI for self-managed OTP tokens does not require authentication, and the directory server's ownership check matches an empty client name. FreeIPA fixed its side in 4.13.4.

A default access-control rule that never verified the caller's identity produced full admin credentials — a textbook authentication and authorization failure in an identity service.

API Security
Read full story
September 8, 2026

Google GTIG: Autonomous Multi-Agent Framework Harvested Thousands of Credentials in Under Six Hours

Google Threat Intelligence Group reported that a financially motivated actor compromised an organization's cloud infrastructure and deployed an autonomous, multi-agent attack framework that planned, built, and executed a mass credential harvesting campaign in under six hours, compromising thousands of third-party credentials. GTIG also observed attackers targeting proprietary AI models across healthcare, government, and media, exfiltrating API credentials, and hijacking victim cloud environments to run unauthorized AI workloads. Related activity included supply chain compromises of PyPI, npm, and Docker Hub, credential stealers targeting AI coding assistants, and prompt injection used for defense evasion.

Attackers are now using agentic tooling to find and abuse API credentials and cloud access at machine speed, which raises the stakes for discovery of agents, MCP servers, and APIs alongside detection of exposed credentials and anomalous behavior across those environments.

Agentic/MCP
Read full story