Try Salt Code. Get your free token
Language

Security Intelligence

Hub API and Agentic
Threat Monitoring

0
Stories tracked
1
Days covered
June 20, 2026
Sep 14, 2026
Latest brief

Threat archive

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
July 21, 2026

WordPress wp2shell (CVE-2026-63030, CVE-2026-60137): pre-auth RCE actively exploited across 500 million sites

Two chained WordPress Core vulnerabilities disclosed on July 17, 2026 allow an unauthenticated attacker to exploit the REST API batch endpoint at /wp-json/batch/v1 and escalate to remote code execution with no credentials required. Public proof-of-concept exploits appeared within hours of disclosure, and multiple security firms confirmed active in-the-wild exploitation by July 21. WordPress.org pushed forced automatic updates to affected versions (6.9.0 through 7.0.1), but unmanaged and self-hosted sites running outdated core remain exposed.

The attack entry point is an unauthenticated REST API endpoint, a textbook OWASP API2 Broken Authentication violation. Salt's API posture management continuously discovers and profiles unauthenticated API endpoints across enterprise web properties, flagging these exposures before attackers reach them.

API Security
Read full story
July 20, 2026

AI model supply chain backdoor planted for under $100 using 10 tainted training examples

Semgrep security researchers demonstrated that an open-weight LLM can be poisoned with as few as 10 tainted training examples at a cost of under £75, causing the model to generate code with hidden security flaws across prompts it has never encountered. The backdoor is invisible to standard safety evaluations and does not affect normal behavior in non-trigger contexts. Larger models were easier to poison, not harder. Independently, researcher David Kaplan showed a poisoned model silently exfiltrating user data through an email API tool with no visible indication to the user.

When a poisoned model makes anomalous API calls such as unexpected data exfiltration through an email or webhook endpoint, Salt's behavioral baseline engine flags the deviation from established traffic norms. This runtime detection layer catches what model-layer safety evaluations miss entirely.

LLM
Read full story
July 20, 2026

AI connectors change every 9 minutes, silently expanding enterprise attack surface

Security firm PromptArmor tracked 2,517 AI connectors over six weeks and found one changed on average every nine minutes: 931 shifted within the study window, vendors added 1,686 new tools to already-live connectors, and 1,127 tool descriptions (which govern when an agent acts) were rewritten without notifying enterprise customers. The Dropbox connector grew from 8 tools to 24, adding 4 that can delete data. The Zoom connector routes sensitive meeting queries through up to 10 AI subprocessors across 8 model families, far beyond what users originally authorized.

Every new tool added to a connector is a new API call an agent can make on a user's behalf. Salt's agentic API monitoring baselines normal API call patterns per integration and flags newly appearing call types, giving security teams visibility when their authorized attack surface expands without warning.

Agentic/MCP
Read full story
July 20, 2026

Claude for Chrome hijacked by rival extensions, silently reads Gmail and Google Docs

Manifold Security disclosed a high-severity flaw in the Claude for Chrome extension: any other installed browser extension can forge a user click event and silently trigger one of nine built-in tasks, including reading Gmail, Google Docs, and Calendar. The issue escalates to critical when 'Act without asking' mode is enabled, allowing a malicious extension to exfiltrate content from open tabs with zero user interaction. Manifold reported the flaw to Anthropic in May 2026; as of the July 20 disclosure, it remained unpatched across eight subsequent releases.

When hijacked browser agents make unauthorized API calls to Gmail, Drive, or Calendar endpoints, Salt's agentic API monitoring detects the anomalous request patterns, including calls originating from unexpected clients or carrying unusual payloads, before sensitive content leaves the enterprise perimeter.

Agentic/MCP
Read full story
July 19, 2026

ServiceNow CVE-2026-6875: pre-auth RCE actively exploited against Fortune 500 companies

A critical unauthenticated remote code execution vulnerability (CVE-2026-6875, CVSS 9.5) in the ServiceNow AI Platform began seeing active exploitation on July 19, 2026, less than a week after patches were released. The flaw allows attackers to escape ServiceNow's script sandbox and execute arbitrary code via a vulnerable pre-authentication API endpoint (/assessment_thanks.do). Victims identified so far include Fortune 500 companies, critical infrastructure providers, and public sector organizations.

The attack entry point is a pre-authentication API endpoint, a textbook OWASP API2 violation. Salt's API posture management continuously discovers and flags unauthenticated endpoints across enterprise environments, giving security teams visibility before active exploitation begins.

API Security
Read full story
July 16, 2026

Hugging Face breached by autonomous AI agent that executed 17,000 actions

Hugging Face disclosed a production security breach on July 16, 2026, driven end-to-end by an autonomous AI agent framework. The attacker introduced a malicious dataset that exploited a remote-code loader and a template-injection flaw, allowing the agent to escalate privileges, harvest cloud and cluster credentials, and move laterally across internal clusters over a weekend. The intrusion was contained after the attacker had logged over 17,000 individual actions, with no evidence of tampering with public-facing models or datasets.

The attack chain started in a data processing API pipeline and spread via harvested credentials across cloud services. Salt's agentic API monitoring flags anomalous lateral movement patterns, including rapid credential sweeps across cloud providers, long before thousands of attacker actions can accumulate.

Agentic/MCP
Read full story
July 16, 2026

MemGhost: a single email plants persistent false memories in AI agents, steering future sessions

Researchers published a technique called MemGhost (arXiv:2607.05189) in which one carefully crafted email injects persistent false instructions into an AI agent's long-term memory store with no visible sign to the user. Unlike standard prompt injection, which lasts only one conversation, MemGhost payloads persist across sessions, silently steering agent behavior on future tasks until the memory file is manually audited. In tests against agents using AGENTS.md and MEMORY.md style stores, the attack succeeded in over half of all attempts and passed standard spam filters undetected.

AI agents acting on poisoned memory will make API calls that deviate from their established behavioral baseline. Salt's agentic API monitoring flags these anomalies at the API layer, where poisoned instructions eventually materialize as unexpected data requests or unauthorized access patterns, even when the underlying credentials are legitimate.

Agentic/MCP
Read full story
July 14, 2026

Check Point 2026 report: one attacker, 9 government agencies breached, 400M records exposed using AI

Check Point Research's AI Security Report 2026, published July 13, documents a single operator who used Claude Code and GPT-4.1 to breach nine Mexican government agencies. The attacker issued 1,088 prompts that generated more than 5,000 AI-executed commands, ultimately exposing approximately 400 million records. The report identifies AI-accelerated attack timelines as the defining security challenge of 2026, with exploitation windows now measured in minutes rather than weeks.

As agentic AI collapses the time between initial access and full compromise, runtime API behavioral monitoring becomes the critical last line of defense. Salt's behavioral baseline engine detects the anomalous, high-velocity API call patterns that agentic attack frameworks generate, even when the underlying credentials are technically valid.

Agentic/MCP
Read full story