High-signal AI/security/automation notes.
Bitsight’s October 2026 study of 16 underground forums finds AI tradecraft up 45% while ransomware talk fell 49%, with MCP and agent mentions up 67% and a BYOK scanner called MONST3R-AI that bills its scans to stolen OpenAI, Anthropic and Google keys. The same week, Fireworks AI disclosed compromised internal credentials reaching customer evaluation secrets.
NVD published CVE-2026-96620 on 16 October 2026: a CVSS 9.2 argument injection in the Python Claude Agent SDK where a dash-leading resume value is parsed as its own CLI flag, letting an attacker inject --mcp-config and spawn a stdio MCP server outside the SDK’s permission controls. The fix shipped 92 days earlier — and the engineer who wrote it disagrees with the severity.
VulnCheck published eleven Coder CVEs in 8.6 seconds on 17 October 2026, with identifiers spanning 2024, 2025 and 2026. Every one is a retroactive number for a Coder repository advisory that shipped without a CVE. We swept all 37 of Coder’s advisories against the GitHub global database and OSV and found a clean cutoff: all 28 published through 2 July resolve; all 9 published from 10 August onward return 404 in both. One of the nine is critical. A Coder 2.35.0 deployment scans completely clean in OSV while a vendor-published high-severity credential-theft advisory names it.
GitGuardian’s 13 October update closes the books on GhostAction’s October burst: 30,000+ repositories across 3,000 users and orgs via roughly 1,900 compromised accounts, a payload that evolved through three versions in a single day, and a platform intervention — GitHub blocking the malicious workflow from 9 October — that left the follow-up waves on 10 and 12 October firing blanks.
INFUSE (arXiv 2610.20776, 14 October 2026) pairs 40 long-horizon terminal-agent tasks with 56 injection attacks across five threat categories and runs 19 models through 41,824 trajectories. Mean attack success is 19.6%, refusal never exceeds 1.0%, and chat-trained guardrails leave 44% of attacks working, while prompt hardening cuts success to 14.3% with uneven utility costs. We read the full paper first-hand.
CVE-2026-57496 is a critical path traversal in the NetLicensing MCP server where product_number ../token survives into httpx, normalizes onto the /token endpoint, and returns admin API keys through the serializer that never redacts them. CVE-2026-109382 is the same shape in WordPress: an MCP post-listing tool with no capability check serving every draft to subscribers. Both fixed; both read first-hand.
CVE-2026-49410 lets any web page log a victim’s OpenHuman into the attacker’s account with one <img> tag; CVE-2026-108372 lets any web page read LoopX’s control-plane state and private Markdown through a wildcard CORS header. Both published 16 October 2026, both found by the same automated security reviewer — whose reports include a section on what it failed to break.
VulnCheck published 122 CVEs to NVD between 18:17:38.950 and 18:17:56.980 on 16 October 2026. Twenty of them, across sixteen self-hosted AI products, are the same defect: the AI feature holds provider keys, chat transcripts and system prompts, and nobody wrote the authorisation check. We read the source for EFAK, 99AI, LangChat, DataBuff and StaffDeck first-hand — and measured that all twenty records are indexed in OSV and GitHub with no package coordinate at all.
Symantec’s Threat Hunter Team reports the Aoki infostealer now harvests Claude, Codex, Cursor, Copilot, and Gemini credentials plus AWS keys — cash-in-grade material that buys both API quota and a route into the developer’s environment. A second family, a second vendor, the same target as Warden.
CVE-2026-111322 (CVSS 9.8, CWE-306) in coleam00/Archon: the default SQLite install never arms the /api/* auth gate, and the server binds 0.0.0.0:3090, so any network caller can drive the AI coding agent, start workflow runs, inject conversation messages, and approve paused actions. No fixed release at time of writing.
CVE-2026-77474, published to NVD at 17:17:50Z on 16 October 2026, is a 7.1 uncontrolled-resource-consumption flaw in destructive_command_guard — the Rust PreToolUse hook that blocks destructive shell commands before AI coding agents run them. Roughly thirty nested dollar-paren sequences hang the scanner. Because agents fail open on a hung hook, the destructive command in the same payload then runs. The fix shipped in fifteen hours; the CVE took another ninety-four days, and the package has no ecosystem coordinate any scanner resolves.
CVE-2026-95182 and CVE-2026-95183, published seconds apart on 16 October 2026 against DeepSeek Harness at commit c291e796: a CWE-426 untrusted search path lets a poisoned model plant the executable the MCP client will run, and a CWE-1427 compaction flaw preserves injected instructions verbatim across session boundaries. Third dsh briefing in three weeks.
Eye Security proposes a three-day minimum release age for npm and PyPI, committed beside a lockfile: a hard package-manager constraint that coding agents inherit and cannot talk their way out of. The rationale runs through Shai-Hulud, Lightning, chalk, and durabletask — plus an honest account of what the gate cannot stop.
Hunt.io reconstructed the PaperCut AI-swarm campaign from the attacker’s own open directories: a Codex-plus-DeepSeek workbench run by up to 25 concurrent subagents, a second XML-RPC RCE chain that survives the Tapestry patch, and a post-exploitation pipeline stretching from LSA collectors to packaged domain-admin kits across 45 countries.
Previdian confirms active exploitation of Langflow CVE-2026-105740 with first sensor hits on 19 September 2026, sixteen days before NVD publication. Nearly 2,000 honeypot attempts, credential-stuffing past auto_login, secret exfiltration, and a multi-CVE scanner IP. Still absent from CISA KEV, with EPSS at 0.6%.
QwenPaw issue #8153 documents a real intrusion: an exposed management interface, a stdio MCP driver named rce-poc-*, twenty SSH keys in root’s authorized_keys, and a systemd miner with a 17-day dwell. The maintainer closed it as insecure deployment, not a vulnerability. We verified the interface first-hand.
CVE-2026-47218 reached NVD on 15 October 2026 at CVSS 4.0 9.3: runwasi’s Wasmtime shim accepted a precompiled native-code artifact handed to it as an OCI image layer and deserialized it, skipping WebAssembly validation entirely. The fix, shipped four months earlier, adds one boolean. GHSA-cc25-vq59-rcjx was published 17 June; the CVE arrived 120 days later, and neither identifier resolves in the GitHub global advisory database or OSV at time of writing.
CVE-2026-111391, published to NVD at 12:16Z on 16 October 2026, is a 9.2 code injection in SGLang’s debug dumper: a filter expression evaluated with eval() and an empty __builtins__, with re.search left in the namespace. A community fix arrived 48 minutes after the report and was closed unmerged 15 hours later in an anti-queue-flooding sweep. The affected range ends at 0.5.22 — released the same day, still vulnerable. We read every line at the tag.
CVE-2026-111392, published to NVD at 18:17:38Z on 16 October 2026, lets a caller declare the prefix-cache identity of an image on SGLang’s native /generate endpoint. Send image B under image A’s declared hash and the model answers from A’s cached KV — across tenants, with a normal completion and no error. The adjacent field in the same dataclass already has a trust flag. This one does not, and at the time of writing the unconditional code is still on main.
Signals Corps read the HTTP response headers of 217,097,223 pages from Common Crawl’s September 2026 archive and found 7,959 sites sending text addressed to AI agents. 7,271 are pointers to llms.txt files and MCP servers, 139 record whether the client was judged a bot, and 30 are injection attempts. The sharper result is the tool survey: whether any of it reaches your model depends entirely on which fetch tool your agent uses, and a shell with curl -i passes all of it.