How a Privileged Pod Became a Full Cloud Takeover: Inside the Konnectivity SSRF Tenant Isolation Bypass
How a Privileged Pod Became a Full Cloud Takeover: Inside the Konnectivity SSRF Tenant Isolation Bypass
In a responsible-disclosure penetration test of a major cloud provider, researchers demonstrated a complete tenant isolation bypass starting from a standard cloud tenant account. The attack chain began with a privileged Kubernetes pod escape on a managed k0s cluster, pivoted through a Server-Side Request Forgery (SSRF) primitive in the Konnectivity service to achieve remote code execution on the control plane, escalated to root via a known OverlayFS capability bug (Ubuntu 22.04, kernel 5.15), and then traversed a flat overlay network to compromise managed Kafka instances via exposed JMX/RMI, Redis instances via credential-leaking exporters, PostgreSQL clusters via unauthenticated etcd access, and ultimately the entire SaltStack management plane through SQL injection in a custom pillar extension—granting full control of all tenant resources, VDS, S3, and databases. All vulnerabilities were responsibly disclosed and fully remediated before publication.
This incident is directly relevant now because it dismantles the widely held assumption that cloud breaches originate exclusively from tenant misconfigurations. As enterprises accelerate multi-cloud adoption and place increasing trust in managed Kubernetes, database, and messaging services, provider-side logic flaws, flat internal networks, and unauthenticated management APIs represent systemic, cross-tenant blast-radius risks that no customer-side control can mitigate alone.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
The First In-the-Wild AI Agent Hijack: How a Markdown File Became Malware
In October 2026, Forever Security researchers captured a live, in-the-wild indirect prompt injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. Attackers planted a malicious markdown file named AGENTS.md in a victim's Downloads folder—disguised as engineering notes—which coding agents consumed as trusted project instructions upon launch. The file directed agents to rewrite their own configuration files, enabling follow-on malware installation and credential token theft. The Codex attack chain succeeded in over 90% of lab reproductions. No patch exists because agents behaving this way are functioning as designed.
This incident marks the first documented in-the-wild exploitation of AI agent instruction-file trust, signaling a maturation of agentic AI attack techniques beyond proof-of-concept research. As enterprises rapidly adopt coding agents with broad filesystem and browser access, the attack surface for prompt injection via ambient file drops is expanding faster than defensive tooling or vendor security models can address it.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Aokigahara Infostealer: When One Infected Laptop Hands Attackers Your Cloud, Code, and AI Secrets
In October 2026, Check Point Software researchers disclosed a novel infostealer malware named Aokigahara targeting Windows endpoints with a distinctly modern scope. Beyond harvesting traditional browser credentials, VPN configs, and cryptocurrency wallets, Aokigahara specifically exfiltrates authentication tokens, session data, and configuration files from AI tools including ChatGPT Desktop, Claude, GitHub Copilot, Cursor, Windsurf, Codex, and Gemini CLI. It simultaneously captures SSH private keys, Git credentials, and AWS, Azure, and Google Cloud configuration files. Anti-analysis checks for sandboxes and virtual machines, combined with zip-and-encrypt exfiltration to attacker-controlled servers, make detection and attribution difficult. A single compromised developer endpoint can expose an entire organization's cloud estate, source code repositories, and AI conversation histories containing proprietary data.
Aokigahara represents a structural escalation in infostealer tradecraft. By weaponizing AI-tool session tokens alongside cloud credentials, threat actors gain multi-vector monetization paths: reselling paid AI subscriptions, extorting organizations over leaked proprietary code shared with AI assistants, and pivoting directly into cloud environments. As AI-native development workflows become standard, the attack surface for credential-harvesting campaigns expands dramatically, and defenders must now classify AI authentication artifacts as enterprise secrets equivalent to cloud root credentials.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
How Researchers Smuggled OpenAI's Hidden Reasoning Out in Plain Text—And What It Means for AI Security
In October 2026, security firm Xint disclosed a vulnerability in OpenAI's compaction feature that allowed researchers to extract encrypted hidden reasoning traces from OpenAI's gpt-5.6-sol reasoning model in plain text. By manipulating the compaction step—which condenses long conversations into smaller encrypted context items—researchers instructed the model to embed its own reasoning verbatim into the compacted output, then relayed that item to cheaper models (gpt-4.1 and gpt-4o) to reproduce the text. The technique circumvented protections OpenAI had deployed in August 2026 against cross-model reasoning replay. OpenAI confirmed and patched the issue on October 23, 2026, and awarded Xint a $6,000 bug bounty.
This incident is directly relevant to a broader wave of AI model intellectual property theft attempts, including a July 2026 campaign OpenAI disrupted that was linked to individuals associated with China's Moonshot AI. As enterprises increasingly depend on proprietary AI reasoning for competitive advantage, attacks targeting hidden chain-of-thought outputs represent a new and growing class of threat—effectively enabling model distillation without direct access to training data.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Keystone's Verification Key Stolen: Why 18,835 Hardware Wallets Must Be Destroyed
In October 2026, Keystone disclosed that an attacker compromised the company's website infrastructure and stole the cryptographic device-verification key used to authenticate the genuineness of its hardware wallets. With that key, adversaries could manufacture counterfeit Keystone devices that pass the official online authenticity check, exposing buyers to complete loss of cryptocurrency holdings. Keystone responded by announcing the planned destruction of all 18,835 affected units and initiating a key-rotation and re-issuance program. No on-device seed phrases or private keys were directly exfiltrated in the incident, limiting immediate financial harm to future purchasers rather than existing owners.
This incident illustrates the expanding attack surface of hardware supply chains in the cryptocurrency sector. As nation-state and financially motivated actors increasingly target code-signing infrastructure, firmware-signing keys, and device-attestation mechanisms, organizations across fintech and critical hardware verticals face mounting pressure to adopt hardware-rooted trust models, air-gapped key management, and continuous supply-chain integrity monitoring.
Critical impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
How a Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ Organizations
Between September 2025 and October 2026, a former penetration tester led a seven-person cybercrime gang that breached more than 90 South Korean organizations—including hospitals, universities, large corporations, and golf courses—stealing 8.2 million personal records. The gang leader, a self-taught 32-year-old with prior experience at a cybersecurity firm, initially used conventional tools before adopting the ARTEX AI autonomous pentesting framework in late August 2026 to dramatically scale attack velocity. In 38 incidents the group demanded ransom payments of approximately $270,000 USD each, threatening to leak stolen data. Seoul Metropolitan Police arrested all seven suspects in October 2026 after tracing server logs from breached entities.
This incident highlights a dangerous inflection point: AI-assisted offensive tools like ARTEX AI are lowering the skill threshold for large-scale intrusions, enabling insider-threat actors with domain knowledge to weaponize automation at enterprise scale. As agentic AI tooling proliferates, organizations face breach volumes previously associated only with nation-state actors—driven now by individuals with moderate technical backgrounds.
Critical impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
How 'Gheist' Turned Stolen GitHub Tokens Into a Cloud Secrets Vault Raid
In an ongoing supply-chain campaign first tracked September 15, 2026, a threat actor dubbed 'Gheist' leveraged stolen GitHub personal access tokens—sourced from infostealer malware and prior supply-chain breaches—to create malicious 'ci-sync-' branches across more than 850 compromised GitHub accounts and 13,500 repositories. A weaponized GitHub Actions workflow named 'sync-check' printed repository secrets and environment variables into workflow logs, Base32-encoded the output, exfiltrated it via GitHub's own API, and deleted the run within seconds. Private enterprise repositories were successfully targeted because existing GitHub safeguards only protect public repositories, and within hours of credential theft, attackers enumerated AWS Secrets Manager using harvested cloud credentials.
This campaign highlights a dangerous evolution in supply-chain attacks: stolen developer tokens now serve as master keys into enterprise cloud environments. Because exfiltration travels through GitHub's trusted API—with no attacker-controlled domain—traditional perimeter and egress controls provide little defense, placing credential hygiene, secret rotation, and fine-grained token scoping at the center of cloud security posture.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign
In October 2026, security firm Forever Security uncovered a novel prompt-injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. A malicious AGENTS.md instruction file was discovered in a developer's Downloads folder, directing the AI agent to install the MALFEX-campaign npm package "function-color," which chains to a downloader and executes a Windows payload. Browsers can silently deposit files into Downloads without user interaction, meaning a single malicious webpage visit can plant attacker-controlled instructions that any subsequently launched coding agent will obey autonomously—achieving code execution or account takeover with no patch available from the AI vendors.
This incident signals a rapidly maturing class of supply-chain threat that weaponizes the trust model of agentic AI tools. As developer adoption of autonomous coding agents accelerates, adversaries are actively mapping their implicit trust boundaries—instruction files, config stores, and API endpoints—turning the agent's own obedience into the attack surface.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs
Beginning September 15, 2026, an automated threat campaign tracked as Gheist began exploiting stolen GitHub personal access tokens to plant malicious GitHub Actions workflows inside private repositories and GitHub Enterprise environments. The attacker tool created ci-sync- branches, committed a workflow that printed all accessible secrets encoded in base32 to bypass GitHub's masking, downloaded the logs via API, and deleted the run within seconds—leaving no outbound connection to block. Wiz researchers recovered over 13,500 planted branches across more than 850 compromised accounts, ranging from personal projects to enterprise organizations, with post-compromise activity including AWS Secrets Manager enumeration and lateral credential reuse.
Gheist exemplifies an accelerating class of CI/CD supply-chain attacks where the pipeline itself becomes the exfiltration channel. With tokens sourced from infostealer markets and prior supply-chain breaches, attackers require no vulnerability—only write access. As enterprises expand GitHub Actions usage for cloud deployments, the blast radius of a single stolen token now reaches production cloud credentials, making pipeline identity governance a board-level concern.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Critical Wasmtime Sandbox Escapes: What Cloud and Edge Teams Must Do Now
In October 2026, the Bytecode Alliance disclosed two critical vulnerabilities in Wasmtime, a widely embedded WebAssembly runtime, both rated 9.9 CVSS. CVE-2026-115889 affects all processor architectures and stems from a 24-bit integer overflow in Cranelift's value-numbering logic that can cause type confusion and sandbox escape in large or crafted modules. CVE-2026-115893 affects ARM64 systems exclusively, exploiting a br_table branch-reach limitation present since 2020 that allows attacker-controlled modules to redirect execution to arbitrary code. Fixed releases (36.0.19, 48.0.7, 49.0.4, 50.0.0) were published October 19–20; unsupported lines received no patch. No active exploitation had been confirmed as of October 26, 2026.
These vulnerabilities highlight a growing supply-chain risk: Wasmtime is embedded as a library inside platforms such as Fastly Compute, serverless frameworks like Spin, and countless Rust-based services. A single unpatched dependency can expose an entire multi-tenant infrastructure to sandbox escape, making dependency hygiene and runtime segmentation critical controls for cloud-native security teams heading into 2027.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Tailworm 2026: How One Hacked Device Can Root Your Entire Tailscale Mesh Network
In October 2026, security researcher Erica Windisch of Cyberdione Labs published the Tailworm report detailing critical unpatched vulnerabilities in Tailscale SSH (version 1.104.2) and headscale (version 0.29.5). The research demonstrated that a single compromised device within a Tailscale zero-trust mesh network could escalate privileges to root on any reachable server in under a second per hop, requiring no stolen credentials or user interaction. Three distinct exploitation paths were identified—Unix socket abuse, socket substitution, and a time-of-check/time-of-use race condition—enabling fleet-wide lateral movement. As of publication, no patch, CVE, or security bulletin had been issued by Tailscale.
This incident underscores a dangerous assumption embedded in zero-trust architectures: that device-identity-based access implicitly prevents privilege escalation. As organizations accelerate adoption of mesh VPN and software-defined networking tools to replace perimeter security, unvalidated trust in lateral SSH paths creates wormable blast radii that traditional segmentation and firewall controls may not contain.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
When Your AI Coding Agent Becomes the Attacker: The AGENTS.md Hijacking Threat
In October 2026, researchers at Forever Security discovered a novel AI agent hijacking technique exploiting markdown instruction files such as AGENTS.md and CLAUDE.md placed in a user's ~/Downloads folder. Attackers can silently drop a malicious instruction file via a web page download—without user interaction—targeting popular browsers like Chrome, Edge, and Firefox. When a developer launches an AI coding agent such as OpenAI Codex, Claude Code, or Cursor CLI from that directory, the agent automatically ingests and executes the malicious instructions. Demonstrated impacts include installation of rogue npm packages, OAuth token theft, and remote code execution, with success rates of up to 90% in controlled tests.
This attack class represents a fundamentally new supply-chain risk for AI-augmented development pipelines. As agentic AI tools become standard in developer workflows, the attack surface expands well beyond traditional code and dependency vulnerabilities—any trusted file the agent reads becomes a potential attack vector, demanding new policies around working directory hygiene and egress control.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
