Frontier AI intelligence is cybersecurity’s highest-stakes prize.
The only question is: who gets the prime cut?
Right now, offensive velocity is seizing the advantage. Attackers deploying agentic AI frameworks just compromised 50 enterprise applications in under 10 hours, a campaign that previously took 10 days.
Over 100 tech leaders just signed an open letter warning that digital infrastructure is running out of time. As frontier labs establish gated programs like OpenAI Daybreak and Anthropic’s Cyber Verification to empower defenders, the industry faces an uncomfortable race: can automated defense scale before machine-speed exploitation takes over?
Also inside: how voice phishing bypassed MFA in seconds, an AI model breaking out of its sandbox three times, Uber’s €825M automated governance fine, and how Kiji stops prompt PII leaks directly on developer machines.
Inside this issue
🌡️ Threat Level: High Alert
⚡ News: Five security stories worth catching up on
🔎 Deep Dive: The Defender’s Window Is Closing
🎣 Is It a Phish?
🔬 Technical Research: MFA Fell. Device Trust Held.
🛠️ Tool of the Week: Kiji Privacy Proxy
👤 Person of the Week: Hannes Hapke
📅 Event of the Week: GrrCON 2026
📚 Book of the Week: The Android Hacker’s Handbook by Joshua J. Drake et al.
😅 The Meme
❓ One Question Before You Leave
Let’s dig in.
Before we get into this week’s stories, here’s where the threat level stands.
🌡️ Threat Level
⚡ News
A single multi-line git config is all it takes to trigger RCE in GitPython
A critical vulnerability in GitPython (CVE-2026-78676, CVSS 9.8) allows attackers to achieve remote code execution when applications parse untrusted repository configurations. Kodem Security disclosed that the flaw stems from unsafe re-serialization of multi-line configuration values on write, enabling an attacker to inject arguments that override core.hooksPath during subsequent git operations. Upgrade to GitPython 3.1.59 immediately and treat all repository configuration files as untrusted user input within automated CI/CD and scanning pipelines.
PaperCut urges emergency patching as attackers chain zero-days for print server RCE
PaperCut issued emergency advisories and hardening guidance following active in-the-wild exploitation reported by security researchers targeting PaperCut NG and MF servers. Threat actors chained multiple vulnerabilities to achieve unauthenticated remote code execution on internet-facing print servers without requiring credentials. Apply vendor patches immediately, restrict management port access to private internal management VLANs, and monitor print servers for abnormal child process execution.
Unprivileged hosting accounts can seize complete server root in cPanel
cPanel released mandatory updates addressing CVE-2026-65643, a critical privilege escalation vulnerability affecting domain parking and addon domain handling in cPanel and WebHost Manager (WHM). Security disclosures confirmed the flaw allows an unprivileged tenant on shared hosting infrastructure to bypass boundary checks and execute arbitrary commands with full root privileges. Shared hosting providers must apply the latest cPanel/WHM build immediately and audit root cron configurations for unexpected script execution paths.
Flawed balance calculations allow attackers to drain funds across six blockchains
Cosmos Labs published an emergency alert regarding a critical balance-handling vulnerability in the shared Cosmos EVM module (GHSA-7g4w-cg88-2cq2). BleepingComputer reported that attackers actively exploited the logic flaw between August 20 and August 25 to drain liquidity across at least six independent networks before coordinated validator mitigations were deployed. Core protocol teams must implement automated invariant monitoring that halts transaction execution whenever global token balances fail mathematical consistency checks.
Why unconstrained CI/CD OIDC tokens remain an open door to cloud infrastructure
Security researchers published analysis demonstrating how wildcard id-token: write permissions in GitHub Actions workflows expose organizations to cross-cloud lateral movement. The research outlined that when a compromised dependency infects a package-publishing workflow, it can mint OIDC tokens for unintended cloud providers (such as AWS) unless strict audience binding is explicitly enforced at the identity provider layer. Configure cloud IAM trust policies with explicit audience (aud) and subject (sub) claims to ensure build runners cannot impersonate unrelated production roles.
🔎 Deep Dive
The Defender’s Window Is Closing
Over 100 tech leaders just signed the same letter.
The signatories include OpenAI, Anthropic, and Google, alongside security firms like CrowdStrike, Fortinet, and Okta. Their message is not subtle: automated, AI-enabled attacks are about to scale, and digital infrastructure is not ready.
The warning is no longer just a theoretical debate about future risk. It is already breaking in the wild.
The 10-hour compromise
Earlier this year, Palo Alto Networks Unit 42 estimated it would take a year for advanced agentic AI capabilities to reach attackers.
It took five months.
Unit 42 is currently investigating an incident where an attacker used an agentic AI framework to exploit 50 enterprise applications. The compromise took less than 10 hours. In a pre-AI era, the same campaign would have taken at least 10 days.
This is the generational shift the open letter is warning about. AI is now a force multiplier across the entire attack chain, from malware development to social engineering and ransomware negotiation. Attackers are using it to burrow into software supply chains at machine speed.
Two competing timelines
The open letter points to two realities moving at different speeds:
Offensive automation: AI models are becoming capable enough to discover vulnerabilities, write exploits, and target infrastructure with minimal human direction.
Defensive debt: Essential systems, from hospitals to water treatment plants, remain exposed by legacy software, excessive permissions, and unpatched bugs.
That creates what the coalition calls the “defender’s window.”
Right now, defensive teams have access to the same frontier capabilities as attackers. AI can digest codebases, identify misconfigurations, and draft fixes faster than traditional manual reviews.
The window exists only as long as defenders scale automation faster than adversaries do.
The four priorities
To close the gap, the coalition outlines four core directions:
For enterprise teams: Treat defense with active incident urgency. Fix high-risk misconfigurations, restrict permissions, and use lower-cost models for high-volume log and code analysis while reserving frontier models for complex edge cases.
For security vendors: Continuously test tools against frontier AI agent capabilities and share verified playbooks with under-resourced operators.
For governments: Direct defensive funding to critical infrastructure, expand threat intelligence sharing, and impose real costs on threat actors.
For AI labs: Provide model access to defensive teams, ensure agentic identities are traceable, and maintain responsible disclosure channels.
Frontier AI labs are already operationalizing this shift through gated access programs for vetted security teams. OpenAI expanded its Daybreak initiative, introducing Daybreak Blue and Daybreak Red to grant approved defenders access to models like GPT-5.6-Cyber with removed guardrails for vulnerability discovery and exploit validation. Similarly, Anthropic established its Cyber Verification Program, providing verified security professionals and organizations with modified safeguards on Claude models to conduct authorized testing and research without triggering false-positive refusals.
The tension at the center
There is an uncomfortable paradox in the letter.
The frontier AI companies leading the call for defense are the same entities developing the capabilities that make autonomous exploitation possible.
The letter acknowledges that no single organization will control where AI capabilities go. The security posture of digital infrastructure will not depend on stopping model progress. It will depend on whether defensive remediation can finally move faster than automated discovery.
Until then, the window is open, but the clock is running.
🎣 Is It a Phish?
Difficulty: Medium
The email includes a button prompting you to secure your account:
👉 Change password
Link:
http://myaccount.google.com-securitysettingpage.ml-security.org/signonoptions/What do you do?
🔐 Click the link and update your credentials
🗑️ Report as phishing and navigate to your account settings manually
🔬 Technical Research
MFA Fell. Device Trust Held.
We are constantly told that multi-factor authentication is the answer to phishing.
But sometimes, MFA fails completely, and the company still isn’t breached.
That is the uncomfortable reality behind the attack on ReliaQuest on August 22, 2026. The cybersecurity firm confirmed on August 23, 2026, that it had been targeted by an attacker claiming affiliation with the extortion group ShinyHunters. ReliaQuest’s own account says the attackers defeated both the password and the MFA push notification for one employee.
Note: ReliaQuest disputes the “breach” framing. ShinyHunters posted Okta dashboard screenshots to its leak site claiming a fuller compromise, but researchers who reviewed the screenshots said they showed only one user’s settings page, and ReliaQuest maintains no applications, systems, or customer data were ever reached. What follows is ReliaQuest’s published account of the incident.
Where the boundary failed
The failure happened at the human layer, bypassed by a highly convincing pretext.
The attackers ran a voice-phishing (vishing) campaign, calling ReliaQuest employees while impersonating a member of the company’s own security team. The caller instructed victims to log into a single sign-on (SSO) portal hosted on a lookalike domain: reliaquest.claims.
One employee fell for the ruse. They navigated to the fake page, entered their credentials, and—crucially—manually approved the subsequent MFA push notification sent to their phone.
At that exact moment, the standard identity perimeter collapsed. The attacker now held a valid password and an MFA-approved session.
The attack flow
The step-by-step attack chain
The Vishing Call: Attackers pose as a security staffer and direct the employee to a fake login portal.
The Lookalike Domain: The employee accesses reliaquest.claims instead of the legitimate SSO URL.
The Credential Harvest: The employee enters their valid password on the harvesting site.
The MFA Bypass: The employee receives a legitimate MFA push notification and approves it, believing it belongs to their own login attempt.
The Dashboard Pivot: The attacker gains temporary, view-only access to the ReliaQuest identity dashboard (Okta).
The Block: The attacker attempts to pivot from the dashboard into downstream applications, but access is denied because the originating session isn’t tied to a registered, MDM-compliant corporate endpoint.
Why this matters
A push notification is ultimately a human decision.
When security relies entirely on an employee pressing “Approve” or “Deny,” a skilled social engineer will eventually convince them to press “Approve.”
This incident exposes the gap between authenticating a user and authenticating a device. The attackers stole the user’s identity context, but they couldn’t produce the physical, enrolled corporate laptop. Because ReliaQuest had layered device-trust controls beneath the SSO portal, the pivot attempt hit a concrete wall.
The attacker’s sessions were killed, the compromised password was expired, and authentication factors were reset. Notably, ShinyHunters itself told reporters its access was view-only and didn’t reach any applications, systems, or customer data — corroborating ReliaQuest’s account on that specific point.
What defenders should take from it
The lesson for security teams is simple: if your phishing-resistance story ends at MFA push notifications, it is incomplete.
Deploy Phishing-Resistant MFA: Upgrade to FIDO2 / WebAuthn passkeys or hardware security keys that cryptographically bind the authentication flow to the legitimate browser origin, neutralizing credential harvesting and push fatigue entirely.
Assume MFA Push Will Be Bypassed: Treat standard MFA push notifications as vulnerable to MFA fatigue and vishing pretexts.
Enforce Device Trust: Configure your SSO and zero-trust network access (ZTNA) policies to block application access unless the request originates from an MDM-enrolled, compliant corporate endpoint.
Monitor Lookalike Registrations: Actively hunt for newly registered domains abusing your company name alongside less-common top-level domains, exactly like the .claims pattern used here.
Investigate View-Only Access: Treat any unauthorized access to an identity dashboard as a critical incident, even if downstream applications are blocked.
🛠️ Tool of the Week
Kiji Privacy Proxy
GitHub: https://github.com/dataiku/kiji-proxy
Open-source, local PII masking gateway for AI API prompts.
Where it fits: Developer endpoints, local AI coding agents, and data loss prevention (DLP).
What it does: As security teams adopt local AI coding assistants and command-line agents, sensitive configuration files, internal customer logs, and credentials frequently end up inside outbound prompt payloads.
Dataiku ’s kiji-proxy places a lightweight, client-side checkpoint between developer workstations and external AI provider APIs (OpenAI, Anthropic, Gemini):
Local Machine Learning: Runs an ONNX-optimized transformer model (DistilBERT) locally on the host machine to detect 26 types of PII—including emails, SSNs, credit cards, and names—with sub-100ms latency.
Context-Aware Swapping: Instead of inserting destructive [REDACTED] blocks that confuse model reasoning, it replaces sensitive values with realistic synthetic data so the LLM retains natural context.
In-Flight Restoration: Intercepts the API response returning from the model provider and silently swaps the original real-world values back into place locally before delivering output to the user.
Quick Start
# Route CLI tools or terminal agents through Kiji's local transparent proxy
export HTTP_PROXY=http://127.0.0.1:8081
export HTTPS_PROXY=http://127.0.0.1:8081
# Run your usual AI workflows—PII is sanitized in flight and restored locally
cat support_dump.txt | claude -p "summarize this customer feedback"What it does not replace
Enterprise-grade network gateways or server-side API DLP solutions. kiji-proxy operates at the developer workstation level to prevent accidental prompt exfiltration before network payloads ever leave the local machine.
👤 Person of the Week
Hannes Hapke
This week, we’re highlighting Hannes Hapke, Head of 575 Lab (Dataiku’s open-source research office), Google Developer Expert, and co-author of several books on production machine learning systems with O’Reilly and Manning.
As development and security teams increasingly embed command-line AI agents and LLM tools into their daily workflows, sensitive data (from internal logs to API keys) can easily end up inside outbound prompt payloads. To tackle this, Hannes led the creation and open-sourcing of Kiji Privacy Proxy.
Instead of relying on heavy enterprise compliance gates or server-side filters, Kiji takes a developer-first approach: running a lightweight ML proxy directly on the workstation to detect and mask PII locally before network requests ever leave the machine, then restoring the original values when responses return.
For building practical open-source tooling that helps developers adopt AI workflows safely without risking sensitive data exposure, Hannes Hapke is our Person of the Week. 👏
📅 Event of the Week
GrrCON 2026
Around 2,800 security researchers, developers, executives, and ethical hackers will gather in Grand Rapids this September for the 15th edition of GrrCON by MidWest InfoSec, LLC , the Midwest’s premier cybersecurity and artificial intelligence conference.
Known for its informal, low-ego atmosphere, GrrCON emphasizes practical security, open collaboration, and research over commercial sales pitches. The two-day program features multiple technical presentation tracks alongside practitioner-led workshops and hands-on villages.
For AppSec and security engineering teams, the conference offers deep dives into offensive exploitation, threat hunting, defensive engineering, and emerging AI risk management, making it a great venue for actionable insights and peer networking.
📍 Location: DeVos Place, Grand Rapids, Michigan
📅 Date: September 24–25, 2026
📚 Book of the Week
Android Hacker’s Handbook
By Joshua J. Drake , Zach Lanier , Collin Mulliner , Pau Oliva Fora, Stephen A. Ridley , and Georg Wicherski
How do you break down the internals of the Android operating system?
Published by Wiley, Android Hacker’s Handbook was the first comprehensive technical guide dedicated to understanding, auditing, and analyzing vulnerabilities in the Android platform.
Core focus areas:
OS Architecture & Security Model: Examines the underlying mechanics of how Android implements its security design across the Linux kernel, native daemons, and core frameworks.
Vulnerability Analysis: Explains methodologies for identifying weaknesses in system components, core services, and native C/C++ libraries.
Rooting Processes: Breaks down hardware partition layouts and the boot process required to gain elevated privileges.
Fuzz Testing: Teaches approaches for automated vulnerability discovery using fuzzing tools and IPC/Binder auditing.
Application Auditing: Details techniques to deconstruct, reverse-engineer, and secure individual Android applications.
Context & Evolution:
Published in 2014, the book provides readers with a solid technical baseline on Android internals. Over the past 12 years, the platform has undergone major architectural changes—including the transition to the ART runtime, mandatory SELinux enforcement, hardware-backed Keystore/StrongBox implementations, APEX modular updates, system-wide Rust adoption, and ARM Memory Tagging (MTE).
While the foundational principles remain useful, 12 years of platform evolution make a compelling case for an updated second edition.
😅 The Meme
Jira ticket status: Blocked (by the hacker) 🥺
If autonomous agentic frameworks can discover and exploit vulnerabilities across 50 enterprise applications in under 10 hours, what is the single defensive control your team cannot afford to leave manual?
The Breach Brief, Ostorlab Team