The First In-the-Wild AI Agent Hijack: How a Markdown File Became Malware
The First In-the-Wild AI Agent Hijack: How a Markdown File Became Malware
In October 2026, Forever Security researchers captured a live, in-the-wild indirect prompt injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. Attackers planted a malicious markdown file named AGENTS.md in a victim's Downloads folder—disguised as engineering notes—which coding agents consumed as trusted project instructions upon launch. The file directed agents to rewrite their own configuration files, enabling follow-on malware installation and credential token theft. The Codex attack chain succeeded in over 90% of lab reproductions. No patch exists because agents behaving this way are functioning as designed.
This incident marks the first documented in-the-wild exploitation of AI agent instruction-file trust, signaling a maturation of agentic AI attack techniques beyond proof-of-concept research. As enterprises rapidly adopt coding agents with broad filesystem and browser access, the attack surface for prompt injection via ambient file drops is expanding faster than defensive tooling or vendor security models can address it.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Aokigahara Infostealer: When One Infected Laptop Hands Attackers Your Cloud, Code, and AI Secrets
In October 2026, Check Point Software researchers disclosed a novel infostealer malware named Aokigahara targeting Windows endpoints with a distinctly modern scope. Beyond harvesting traditional browser credentials, VPN configs, and cryptocurrency wallets, Aokigahara specifically exfiltrates authentication tokens, session data, and configuration files from AI tools including ChatGPT Desktop, Claude, GitHub Copilot, Cursor, Windsurf, Codex, and Gemini CLI. It simultaneously captures SSH private keys, Git credentials, and AWS, Azure, and Google Cloud configuration files. Anti-analysis checks for sandboxes and virtual machines, combined with zip-and-encrypt exfiltration to attacker-controlled servers, make detection and attribution difficult. A single compromised developer endpoint can expose an entire organization's cloud estate, source code repositories, and AI conversation histories containing proprietary data.
Aokigahara represents a structural escalation in infostealer tradecraft. By weaponizing AI-tool session tokens alongside cloud credentials, threat actors gain multi-vector monetization paths: reselling paid AI subscriptions, extorting organizations over leaked proprietary code shared with AI assistants, and pivoting directly into cloud environments. As AI-native development workflows become standard, the attack surface for credential-harvesting campaigns expands dramatically, and defenders must now classify AI authentication artifacts as enterprise secrets equivalent to cloud root credentials.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
How Researchers Smuggled OpenAI's Hidden Reasoning Out in Plain Text—And What It Means for AI Security
In October 2026, security firm Xint disclosed a vulnerability in OpenAI's compaction feature that allowed researchers to extract encrypted hidden reasoning traces from OpenAI's gpt-5.6-sol reasoning model in plain text. By manipulating the compaction step—which condenses long conversations into smaller encrypted context items—researchers instructed the model to embed its own reasoning verbatim into the compacted output, then relayed that item to cheaper models (gpt-4.1 and gpt-4o) to reproduce the text. The technique circumvented protections OpenAI had deployed in August 2026 against cross-model reasoning replay. OpenAI confirmed and patched the issue on October 23, 2026, and awarded Xint a $6,000 bug bounty.
This incident is directly relevant to a broader wave of AI model intellectual property theft attempts, including a July 2026 campaign OpenAI disrupted that was linked to individuals associated with China's Moonshot AI. As enterprises increasingly depend on proprietary AI reasoning for competitive advantage, attacks targeting hidden chain-of-thought outputs represent a new and growing class of threat—effectively enabling model distillation without direct access to training data.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Operation FlashHole: How Lazarus Group Weaponized Mandatory Korean Banking Software and Post-Quantum Crypto to Spy Undetected
Beginning at least July 2025, North Korea's Lazarus Group launched Operation FlashHole, a targeted cyber espionage campaign against South Korean organizations in construction, software, and wire-communication equipment manufacturing. Attackers exploited a vulnerability in Initech's INISAFE CrossWeb EX—a mandatory financial security application—via spear-phishing emails linking to AI-generated fake portfolio and résumé pages hosted on GitHub. The infection chain deployed a layered malware framework including TechHub, TouchHub, Cubridge, ClientHub, and LPEClient entirely in memory, culminating in data exfiltration to a dark web leak site named ULOSE. Notably, the campaign employed ML-KEM-1024, a post-quantum cryptographic algorithm, to protect C2 communications.
Operation FlashHole signals a dangerous convergence of nation-state sophistication and quantum-resistant tradecraft. As Lazarus iterates across successive campaigns—SyncHole, Double Barrel, FlashHole—the group systematically targets trusted, widely-installed domestic software as its initial access vector, making traditional perimeter defenses insufficient and elevating the urgency for zero trust segmentation, encrypted east-west traffic inspection, and anomaly-based detection across enterprise cloud environments.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Broccoli2Shell (CVE-2026-111497): What the Microsoft .NET Brotli RCE Means for Your Cloud Workloads
In October 2026, Microsoft issued emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library dubbed Broccoli2Shell (also tracked as HTTP2Shell and Node2Shell). The flaw allows unauthenticated remote attackers to trigger crashes, memory leaks, or achieve remote code execution by sending maliciously crafted Brotli-compressed streams to any application using ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs. Proof-of-concept exploit code was publicly available on GitHub at time of disclosure, significantly lowering the bar for exploitation across enterprise cloud-hosted and on-premises .NET workloads.
The public availability of PoC exploit code for a critical RCE vulnerability in a foundational compression library used across millions of .NET applications signals a narrow remediation window for security teams. Organizations with internet-facing APIs, microservices, or cloud-native applications built on .NET are at elevated risk, and the attack surface is amplified by the broad adoption of HTTP/2 and Brotli compression in modern cloud environments.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
PHP's Second Emergency Patch in Five Days: Inside the Critical Brotli RCE Flaw Threatening Windows Deployments
In October 2026, PHP issued emergency Windows package rebuilds for versions 8.2 through 8.5 to address CVE-2026-111497, a critical memory-corruption remote code execution flaw in the bundled Brotli compression library (versions prior to 1.2.1). The vulnerability is reachable through PHP's cURL extension when automatic HTTP response decompression is enabled—a default behavior in the widely-used Guzzle HTTP client library. Rated 9.2 (Critical) on CVSS 4.0 by Google, the flaw allows a malicious server to deliver a crafted compressed response that corrupts process memory, potentially executing arbitrary code. The rebuilt packages arrive just five days after emergency patches for two separate PHP2Shell RCE flaws, underscoring a compounding supply-chain risk for Windows-hosted PHP environments.
This incident illustrates the compounding risk of software supply chains where third-party compression libraries bundled inside language runtimes become silent attack surfaces. With Guzzle enabling automatic Brotli decompression by default and PHP shipping SBOMs only post-facto, organizations relying on PHP-based web applications—particularly in regulated industries—face renewed urgency around dependency visibility and patch velocity.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
How 'Gheist' Turned Stolen GitHub Tokens Into a Cloud Secrets Vault Raid
In an ongoing supply-chain campaign first tracked September 15, 2026, a threat actor dubbed 'Gheist' leveraged stolen GitHub personal access tokens—sourced from infostealer malware and prior supply-chain breaches—to create malicious 'ci-sync-' branches across more than 850 compromised GitHub accounts and 13,500 repositories. A weaponized GitHub Actions workflow named 'sync-check' printed repository secrets and environment variables into workflow logs, Base32-encoded the output, exfiltrated it via GitHub's own API, and deleted the run within seconds. Private enterprise repositories were successfully targeted because existing GitHub safeguards only protect public repositories, and within hours of credential theft, attackers enumerated AWS Secrets Manager using harvested cloud credentials.
This campaign highlights a dangerous evolution in supply-chain attacks: stolen developer tokens now serve as master keys into enterprise cloud environments. Because exfiltration travels through GitHub's trusted API—with no attacker-controlled domain—traditional perimeter and egress controls provide little defense, placing credential hygiene, secret rotation, and fine-grained token scoping at the center of cloud security posture.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign
In October 2026, security firm Forever Security uncovered a novel prompt-injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. A malicious AGENTS.md instruction file was discovered in a developer's Downloads folder, directing the AI agent to install the MALFEX-campaign npm package "function-color," which chains to a downloader and executes a Windows payload. Browsers can silently deposit files into Downloads without user interaction, meaning a single malicious webpage visit can plant attacker-controlled instructions that any subsequently launched coding agent will obey autonomously—achieving code execution or account takeover with no patch available from the AI vendors.
This incident signals a rapidly maturing class of supply-chain threat that weaponizes the trust model of agentic AI tools. As developer adoption of autonomous coding agents accelerates, adversaries are actively mapping their implicit trust boundaries—instruction files, config stores, and API endpoints—turning the agent's own obedience into the attack surface.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs
Beginning September 15, 2026, an automated threat campaign tracked as Gheist began exploiting stolen GitHub personal access tokens to plant malicious GitHub Actions workflows inside private repositories and GitHub Enterprise environments. The attacker tool created ci-sync- branches, committed a workflow that printed all accessible secrets encoded in base32 to bypass GitHub's masking, downloaded the logs via API, and deleted the run within seconds—leaving no outbound connection to block. Wiz researchers recovered over 13,500 planted branches across more than 850 compromised accounts, ranging from personal projects to enterprise organizations, with post-compromise activity including AWS Secrets Manager enumeration and lateral credential reuse.
Gheist exemplifies an accelerating class of CI/CD supply-chain attacks where the pipeline itself becomes the exfiltration channel. With tokens sourced from infostealer markets and prior supply-chain breaches, attackers require no vulnerability—only write access. As enterprises expand GitHub Actions usage for cloud deployments, the blast radius of a single stolen token now reaches production cloud credentials, making pipeline identity governance a board-level concern.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Everything's an RCE: PHP2Shell, LiteLLM Supply Chain, and Rogue AI Agents Define a Record-Breaking Threat Week
In the week of October 26, 2026, a convergence of critical remote code execution vulnerabilities, supply chain compromises, and AI-driven attacks created an unprecedented threat landscape. PHP2Shell (CVE-2026-109618/109619) triggered millions of exploitation attempts, while a leaked LiteLLM master key enabled a malicious Python package that harvested credentials across developer environments. Agentic AI platforms were weaponized by four newly identified threat actor groups using Claude Code to exfiltrate healthcare and government data. CISA added Plex2Shell flaws to its KEV catalog, and ransomware attacks surged 50% quarter-over-quarter, underscoring systemic exposure across web infrastructure, open-source dependencies, and AI tooling.
This week's events reflect a structural acceleration in attacker capabilities: AI is now operationally embedded in offensive campaigns, the exploitation window for high-severity CVEs has shrunk to three days, and supply chain trust is being exploited through leaked keys and poisoned packages. Organizations relying on legacy patch cadences or perimeter-only defenses are increasingly unable to contain threats that propagate laterally through cloud and AI workloads before detection occurs.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Critical Wasmtime Sandbox Escapes: What Cloud and Edge Teams Must Do Now
In October 2026, the Bytecode Alliance disclosed two critical vulnerabilities in Wasmtime, a widely embedded WebAssembly runtime, both rated 9.9 CVSS. CVE-2026-115889 affects all processor architectures and stems from a 24-bit integer overflow in Cranelift's value-numbering logic that can cause type confusion and sandbox escape in large or crafted modules. CVE-2026-115893 affects ARM64 systems exclusively, exploiting a br_table branch-reach limitation present since 2020 that allows attacker-controlled modules to redirect execution to arbitrary code. Fixed releases (36.0.19, 48.0.7, 49.0.4, 50.0.0) were published October 19–20; unsupported lines received no patch. No active exploitation had been confirmed as of October 26, 2026.
These vulnerabilities highlight a growing supply-chain risk: Wasmtime is embedded as a library inside platforms such as Fastly Compute, serverless frameworks like Spin, and countless Rust-based services. A single unpatched dependency can expose an entire multi-tenant infrastructure to sandbox escape, making dependency hygiene and runtime segmentation critical controls for cloud-native security teams heading into 2027.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
When Your AI Coding Agent Becomes the Attacker: The AGENTS.md Hijacking Threat
In October 2026, researchers at Forever Security discovered a novel AI agent hijacking technique exploiting markdown instruction files such as AGENTS.md and CLAUDE.md placed in a user's ~/Downloads folder. Attackers can silently drop a malicious instruction file via a web page download—without user interaction—targeting popular browsers like Chrome, Edge, and Firefox. When a developer launches an AI coding agent such as OpenAI Codex, Claude Code, or Cursor CLI from that directory, the agent automatically ingests and executes the malicious instructions. Demonstrated impacts include installation of rogue npm packages, OAuth token theft, and remote code execution, with success rates of up to 90% in controlled tests.
This attack class represents a fundamentally new supply-chain risk for AI-augmented development pipelines. As agentic AI tools become standard in developer workflows, the attack surface expands well beyond traditional code and dependency vulnerabilities—any trusted file the agent reads becomes a potential attack vector, demanding new policies around working directory hygiene and egress control.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
