Try Salt Code. Get your free token
Language

Security Intelligence

Hub API and Agentic
Threat Monitoring

0
Stories tracked
1
Days covered
June 20, 2026
Sep 14, 2026
Latest brief

Threat archive

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
June 26, 2026

Amazon Q MCP flaw (CVE-2026-12957) enabled cloud credential theft by opening a malicious repo

Wiz Research disclosed a high-severity vulnerability (CVSS 8.5) in Amazon Q Developer: the AI coding tool auto-loaded MCP configurations from workspace directories without user consent, meaning a developer who simply opened a malicious Git repository could trigger arbitrary code execution and cloud credential exfiltration silently. A single malicious .amazonq/mcp.json file was sufficient to pipe AWS credentials to an attacker-controlled server with zero user interaction. Amazon patched the flaw on May 12, 2026; public disclosure followed on June 26.

MCP servers are rapidly becoming a primary lateral movement surface in developer environments. Salt's agentic API monitoring covers the API calls MCP-enabled tools make on behalf of developers, flagging anomalous outbound data flows and unauthorized credential-adjacent API activity before exfiltration completes.

Agentic/MCP
Read full story
June 25, 2026

Cisco Unified CM CVE-2026-20230 actively exploited

Unauthenticated SSRF via HTTP API with a confirmed root privilege escalation path. Actively exploited in the wild as of June 24.

Maps to OWASP API2 and API8. Salt API posture management identifies the unauthenticated HTTP API surface before attackers reach it.

API Security
Read full story
June 20, 2026

Vodafone fined €30M for GDPR API data leak

Vodafone received a €30M GDPR fine after customer personal data was exposed via an inadequately secured API. Regulators cited failure to implement proper access controls on a customer-facing data API.

API governance and posture management prevents this category of violation by identifying APIs that expose personal data without adequate authentication before regulators do.

Breach
Read full story
June 20, 2026

ServiceNow API misconfiguration exposes customer data

A misconfigured ServiceNow API allowed unauthenticated access to sensitive customer records. The exposure affected multiple enterprise customers who had enabled public API access without proper authentication controls.

Salt's API posture management continuously scans for unauthenticated endpoints and misconfigurations. This exposure would be flagged in the discovery phase before data leaves the system.

Breach
Read full story
June 20, 2026

Step Finance AI agent API abuse — $27-30M losses

AI agent API abuse targeting Step Finance's DeFi platform resulted in $27-30M in losses. Agents exploited API rate limits and transaction sequencing vulnerabilities.

Agentic API abuse is a new threat vector Salt monitors: behavioral baselining detects when AI agents deviate from normal usage patterns, flagging abuse before financial damage occurs.

Agentic/MCP
Read full story