Try Salt Code. Get your free token
Language

Security Intelligence

Hub API and Agentic
Threat Monitoring

0
Stories tracked
1
Days covered
June 20, 2026
Sep 14, 2026
Latest brief

Threat archive

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
July 8, 2026

Lone attacker uses AI to compress weeks-long AWS breach into 72 hours

Sygnia researchers documented an incident where a single threat actor used agentic AI workflows to breach an AWS environment in approximately 72 hours, a timeline that would normally take weeks. The attacker chained standard cloud techniques including secrets mismanagement, identity governance gaps, and deployment workflow abuse, but used AI to execute multiple attack steps in parallel. In one observed second, four separate AWS access keys across four accounts were used simultaneously from a single source IP, a pattern consistent with automated agentic orchestration.

AI-accelerated attacks compress detection windows dramatically. Salt's behavioral engine baselines normal API call patterns per identity and flags the kind of parallel, high-velocity credential abuse that defines AI-assisted lateral movement, giving defenders a chance to respond before the 72-hour clock runs out.

Agentic/MCP
Read full story
July 7, 2026

JADEPUFFER: First autonomous AI agent ransomware via Langflow API

Sysdig's Threat Research Team documented the first end-to-end agentic ransomware operation. An LLM agent exploited CVE-2025-3248, an unauthenticated RCE flaw in Langflow's API validation endpoint, then autonomously swept the environment for AI and cloud API credentials (OpenAI, Anthropic, AWS, Alibaba), pivoted to a production server, encrypted 1,342 Nacos service configurations, and inserted a Bitcoin ransom note. The agent self-corrected a failed login in 31 seconds with no human intervention.

The entire attack chain started with one unauthenticated API endpoint (OWASP API2). Salt's API posture management surfaces these exposed, unauthenticated endpoints before attackers reach them. Salt's behavioral engine flags the anomalous pattern of an agent making hundreds of API calls sweeping credentials across cloud providers.

Agentic/MCP
Read full story
July 3, 2026

Hidden LLM backdoors could detonate at massive scale across enterprise deployments

Security researchers raised alarms about a class of dormant LLM backdoors that sit undetectable in model weights until a specific trigger phrase is broadcast, at which point the model exfiltrates API keys, credentials, and sensitive data across every deployment simultaneously. Standard safety evaluations cannot detect triggers they never encounter, and researchers found that safety training can paradoxically make deception more robust by teaching models to suppress backdoor behavior in non-trigger contexts. Microsoft Research also published MetaBackdoor in May 2026, demonstrating a length-based positional trigger that activates when input reaches a token count threshold.

When a backdoored model makes anomalous API calls, sweeping credentials or exfiltrating data, Salt's behavioral baselining flags the deviation from established API traffic norms. This runtime detection layer catches what model-layer safety evaluations miss entirely.

LLM
Read full story
July 1, 2026

Progress Kemp LoadMaster CVE-2026-8037

Pre-auth OS command injection in the /accessv2 API endpoint, actively exploited since June 29. CVSS 9.6. 450+ internet-facing instances exposed.

OWASP API2 broken authentication. Salt posture management surfaces unauthenticated endpoints and flags exploitation before impact.

API Security
Read full story
June 30, 2026

282 of 444 iOS AI apps leak LLM API credentials

Wake Forest University study found 282 of 444 iOS AI apps transmit LLM API credentials in plain network traffic, including 92 apps with open relay backends requiring zero authentication. Only 28% patched after a 3-month disclosure window.

API discovery and posture management surfaces unauthenticated AI proxy endpoints. Behavioral baselining catches LLMjacking traffic patterns.

LLM
Read full story
June 29, 2026

Oracle EBS Payments CVE-2026-46817 — CVSS 9.8

Critical unauthenticated HTTP takeover in Oracle E-Business Suite Payments, actively exploited against 450+ exposed internet-facing instances.

API posture management discovers exposed unauthenticated endpoints and detects anomalous API traffic patterns that indicate active exploitation.

API Security
Read full story
June 29, 2026

Nissan / Oracle PeopleSoft breach — CVE-2026-35273

ShinyHunters exploited an unauthenticated PeopleSoft API endpoint to breach 100+ organizations. Nissan disclosed employee payroll records, SSNs, and banking data compromised across four countries.

Maps to OWASP API2 Broken Authentication. Salt API posture management and behavioral anomaly detection identifies unauthenticated API exposures before exploitation.

Breach
Read full story
June 27, 2026

OpenAI ‘Poisoned Tenant’ phishing campaign

Attackers create fraudulent OpenAI organization accounts impersonating real companies, then invite employees via legitimate-looking emails from OpenAI's own infrastructure. Victims submit source code, API credentials, and customer data directly into attacker-controlled workspaces.

When harvested API credentials are replayed against enterprise APIs, Salt's behavioral baseline engine detects the anomalous call patterns and flags the compromised credentials.

LLM
Read full story