Executive Summary
In June 2026, Gartner analysts highlighted four critical cybersecurity threats where attackers currently have the upper hand: deepfakes, software supply chain risks, prompt injections, and AI application compromises. These threats exploit vulnerabilities in enterprise defenses, leading to significant security breaches and operational disruptions. Organizations are urged to enhance their security postures by implementing additional controls and stronger policies to mitigate these emerging risks.
The urgency to address these threats is underscored by the rapid evolution of attack techniques and the increasing sophistication of threat actors. Enterprises must proactively adapt their security strategies to counteract these advanced threats and protect their assets effectively.
Why This Matters Now
The rapid advancement of AI technologies has introduced new attack vectors, such as deepfakes and prompt injections, which traditional security measures are ill-equipped to handle. Organizations must urgently update their defenses to address these evolving threats and prevent potential breaches.
Attack Path Analysis
The attack began with the adversary compromising the software supply chain by injecting malicious code into a widely used open-source AI framework. This allowed them to escalate privileges within the compromised AI applications, gaining unauthorized access to sensitive data. The attacker then moved laterally across the organization's cloud infrastructure, exploiting weak segmentation controls to access additional systems. They established command and control by embedding covert channels within the AI application's communication protocols. Sensitive data was exfiltrated through these channels, bypassing traditional security measures. Finally, the attacker manipulated the AI models to produce biased outputs, causing reputational damage and operational disruptions.
Kill Chain Progression
Initial Compromise
Description
The adversary compromised the software supply chain by injecting malicious code into a widely used open-source AI framework.
Related CVEs
CVE-2025-11445
CVSS 6.3Supply chain attack targeting Kilo Code AI Agent users via prompt injection embedded in upstream dependencies.
Affected Products:
Kilo Code AI Agent – All versions prior to October 2, 2025
Exploit Status:
exploited in the wildCVE-2026-45374
CVSS 9.6Insecure defaults in DeepSeek-TUI allowed sub-agents to gain unapproved shell access, executing malicious commands hidden in project files.
Affected Products:
DeepSeek DeepSeek-TUI – All versions prior to May 15, 2026
Exploit Status:
exploited in the wildCVE-2025-68143
CVSS 8.8Path traversal vulnerability in Anthropic's MCP Git server allowed unauthorized file access via prompt injection.
Affected Products:
Anthropic MCP Git Server – All versions prior to late 2025
Exploit Status:
exploited in the wildCVE-2025-68144
CVSS 7.1Argument injection vulnerability in Anthropic's MCP Git server enabled remote code execution via prompt injection.
Affected Products:
Anthropic MCP Git Server – All versions prior to late 2025
Exploit Status:
exploited in the wildCVE-2025-68145
CVSS 9.1Path traversal vulnerability in Anthropic's MCP Git server allowed unauthorized file overwrite via prompt injection.
Affected Products:
Anthropic MCP Git Server – All versions prior to late 2025
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Generate Content: Audio-Visual Content
Supply Chain Compromise
Compromise Software Dependencies and Development Tools
Compromise Software Supply Chain
Compromise Hardware Supply Chain
Obtain Capabilities: Artificial Intelligence
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Implement strong authentication mechanisms
Control ID: Identity and Access Management
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical exposure to deepfake social engineering attacks bypassing voice/facial recognition systems, with prompt injection risks threatening AI-powered trading and customer service applications.
Computer Software/Engineering
Severe software supply chain vulnerabilities from automated worms like Shai-Hulud targeting repositories, plus AI application compromises from 2,130 AI-related CVEs disclosed in 2025.
Health Care / Life Sciences
High-risk deepfake attacks against patient authentication systems and AI diagnostic tools vulnerable to prompt injection, compromising HIPAA compliance and patient data integrity.
Government Administration
Advanced persistent threats using deepfakes for social engineering against officials, while AI agents face indirect prompt injection attacks through poisoned web content and documents.
Sources
- 4 Critical Threats Where Attackers Have the Advantagehttps://www.darkreading.com/vulnerabilities-threats/4-critical-threats-attackers-advantageVerified
- Kilo Code AI Agent Supply Chain Attackhttps://vulnerablemcp.info/vuln/kilo-code-supply-chain-attack.htmlVerified
- DeepSeek-TUI Flaw Enabled RCE via Agent Prompt Injectionhttps://helixar.ai/press/deepseek-tui-insecure-defaults-rce-prompt-injection/Verified
- Anthropic MCP Git Server Vulnerability Exposed by Prompt Injection (2026)https://aviatrix.ai/threat-research-center/anthropic-2026-mcp-git-server-vulnerability-prompt-injection/Verified
- NX Breach: The Supply Chain Attack Powered by AI Agentshttps://www.deepwatch.com/labs/nx-breach-a-story-of-supply-chain-compromise-and-ai-agent-betrayal/Verified
- Cline CLI Supply Chain Attack via Prompt Injection - February 2026https://github.com/vectara/awesome-agent-failures/blob/main/docs/case-studies/cline-supply-chain-attack.mdVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix CNSF may not prevent the initial compromise, it would likely limit the attacker's ability to exploit the compromised framework to access other workloads.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation would likely limit the attacker's ability to escalate privileges by enforcing strict identity-based access controls.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security would likely limit the attacker's lateral movement by enforcing strict segmentation and monitoring internal traffic.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control would likely limit the attacker's ability to establish and maintain covert channels by providing comprehensive monitoring and control over cloud communications.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement would likely limit data exfiltration by enforcing strict outbound traffic policies and monitoring egress points.
While Aviatrix CNSF may not prevent the manipulation of AI models, it would likely limit the attacker's ability to propagate biased outputs by restricting unauthorized access and controlling data flows.
Impact at a Glance
Affected Business Functions
- Software Development
- IT Operations
- Data Security
- Supply Chain Management
Estimated downtime: 14 days
Estimated loss: $5,000,000
Intellectual property, source code, and sensitive customer data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the cloud infrastructure.
- • Enhance software supply chain security by requiring Software Bill of Materials (SBOMs) and conducting regular code audits.
- • Deploy Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing data exfiltration.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to unusual activities within AI applications.
- • Establish Multicloud Visibility & Control to maintain oversight and enforce policies across all cloud environments.



