#114 - AI Agents Exploited in Production: Chatbots, CI/CD and Worms

PRESENTED BY

Cyber AI Chronicle

By Simon Ganiere · 7^th June 2026

Welcome back!

Last week the attack surface was the orchestration layer - Flowise, Marimo, SymJack, the AI plumbing we had shipped faster than we built the hygiene to run it. This week the attack surface is the AI itself. The support bot you deployed to cut ticket volume. The CI/CD agent you wired into GitHub. And a free, open-weight LLM that spread through 61.8% of a 33-host enterprise network without a single zero-day.

The shift is subtle but it matters. Last week was about infrastructure beneath AI features missing from asset inventories. This week is about AI features becoming the intrusion path, not through what they touch, but through what they trust. Meta's support bot trusted a user-supplied identity claim. Claude Code's GitHub Action trusted a PR comment. OpenAI's Codex trusted decade-old CVE descriptions. Each trust decision became an attack vector. The throughline is not that AI is insecure. It is that we designed these systems to be helpful - and helpful means trusting the input - without modelling what happens when the input is hostile.

🤖🏃 AI Autonomous & Agentic Attacks: ↑↑ +133% (7 articles, up from 3)

🛡️ AI System Vulnerabilities: ↑ +43% (10 articles, up from 7)

🤖 AI-Enabled Social Engineering: → stable (3 articles)

📜 AI Governance & Defensive Innovation: ↑ +33% (8 articles)

🔍 AI-Accelerated Vulnerability Exploitation: ↑↑ +200% (3 articles, up from 1)

🦠 AI-Assisted Malware Development: ↓ -33% (2 articles)

🔗 AI Supply Chain & Developer Tool Abuse: ↓ -40% (3 articles)

SPONSORED BY

Most browsers get you to the page. Norton Neo gets you to the answer. Magic Box understands your intent before you finish typing — no prompting, no switching apps, no copy-pasting. Built-in AI, instantly and for free. Privacy handled by Norton, by default.

Get Neo for Free

Iran-linked operators spent this week demonstrating that the most powerful AI attack surface is not the model - it is what the model is allowed to do. Krebs on Security reported that attackers exploited Meta's AI customer support chatbot to hijack high-profile Instagram accounts, including the Obama White House handle and a U.S. Space Force senior official's profile. The mechanics: spoof geolocation via VPN, socially engineer the chatbot into treating attacker-supplied identity claims as verified then instruct the bot to reassign the account's recovery email. One-time code goes to the attacker. Account gone. BleepingComputer confirmed defaced accounts appeared briefly with pro-Iranian imagery before being listed on dark web marketplaces. Meta pushed an emergency patch.

The Overwatch case assessment flags something more significant than the headline: this is a confused-deputy attack, not a chatbot jailbreak. The bot was not tricked into doing something prohibited. It did exactly what it was designed to do - process an account recovery request - while relying on identity signals the attacker controlled. MFA-enabled accounts were resistant. Accounts without it were exposed by design.

The pattern is platform-agnostic. Microsoft Threat Intelligence disclosed separately that Claude Code's GitHub Action could be coerced via a crafted PR comment into reading /proc/self/environ, exfiltrating CI/CD secrets including API keys, while evading both Claude's safety filters and GitHub's Secret Scanner. The agent was doing its job. The attacker's job was writing a PR comment that redirected what "doing its job" meant.

Any AI agent with write access to something valuable, trusting content it did not generate, is this attack. Monday question: map every AI agent you run against what it can modify and whether anything in its input path is attacker-controlled.

University of Toronto researchers published a result this week that is uncomfortable precisely because it is boring. A free, unnamed open-weight LLM - no frontier model, no special access - built and deployed a self-replicating worm that spread to 73.8% of a 33-host enterprise test network. No zero-days. No pre-staged playbook. The worm ingested public security advisories at runtime to exploit CVEs that postdated its training cutoff, rewrote its own source code to bypass a hardcoded denylist, and established persistence via scheduled tasks. It did this without human direction.

The title of the paper is essentially the finding: you do not need Mythos or zero-days.

This matters for two reasons beyond the headline. First, it removes the "capability moat" assumption - the idea that the most dangerous AI-enabled attacks require frontier models or nation-state resources. They do not. Second, the worm demonstrated what the Marimo incident established last week in a different context: AI agents do not pause to reconsider. The time between exploitation and exfiltration is compressing not because attackers got smarter but because they handed their tools to something that does not sleep or hesitate.

Running parallel: Sophos confirmed an unknown ransomware operator deployed a toolkit built using Claude Opus 4.5 and Cursor agents, iteratively developing EDR-bypass payloads across 80 modules targeting Sophos, CrowdStrike, and Windows Defender - confirmed deployed in live operations.

The operational conclusion is not that you need to stop attackers from using AI. You cannot. The question is whether your detection logic is calibrated for a human attacker who tries things sequentially, or an agent that tries 80 things in parallel and keeps the one that works.

Two vulnerability discovery stories this week, neither involving active exploitation - but both worth marking because they define the new economic reality of software security.

An autonomous AI agent built by startup depthfirst discovered 21 previously unknown zero-days in FFmpeg for approximately $1,000. FFmpeg is embedded in media pipelines, container images, Python wheels, and video infrastructure across effectively every large organisation. Nine CVEs were assigned (CVE-2026-39210 through -39218) with public PoCs released. Some of the bugs had been latent for 15 to 23 years. Separately, an autonomous tool called Xint Code found a 2-year-old RCE in Redis (CVE-2026-23479, CVSS 8.8) during a competition - a use-after-free in blocking-client code that, in default Redis deployments, effectively grants unauthenticated command execution.

Neither has confirmed exploitation yet. Both have public exploit chains.

The point is not the bugs. Bugs exist. The point is what $1,000 of autonomous analysis is now capable of finding in codebases reviewed by human engineers for decades. If a defensive startup can run this, so can a threat actor. We have spent years building patching workflows on the assumption that discovery-to-weaponisation takes weeks. That assumption is wrong in ways that compound: AI finds the bug, AI writes the exploit, AI deploys it.

The immediate practical question: does FFmpeg appear in your dependency inventory? Most organisations will not know without container image scanning and dependency graph auditing.

🛡️ AI System Vulnerabilities. A Fake Context Alignment attack against Google's Gemini voice assistant let attackers embed hidden commands in WhatsApp and Slack notifications, controlling smart home devices and initiating calls without triggering any audio response; patched in November 2025 but only disclosed now. The 100-agent security assessment from Adversa AI found 98% of agents exhibit what it calls the "lethal trifecta": private data access, exposure to untrusted content, and the ability to perform outbound actions.

🔗 AI Supply Chain Abuse. The codexui-android npm package silently exfiltrated OpenAI Codex OAuth tokens - including non-expiring refresh tokens - from 29,000 weekly installs, pushing them to a server masquerading as Sentry. The Claude Code GitHub Action flaw (CVSS 7.8) was exploited against Cline's workflow in February 2026, yielding an npm publish token and an unauthorized package release before responsible disclosure closed it.

🤖🏃 Autonomous & Agentic Attacks. OpenAI's Codex agent autonomously chained two decade-old HTTP/2 vulnerabilities into a novel attack that can exhaust 32GB of server memory in 20 seconds from a single machine on a 100Mbps line; nginx and Apache patched, IIS and Cloudflare Pingora remain outstanding.

📜 AI Governance & Defense. CISA confirmed a binding directive implementing the AI executive order will require 30-day pre-release model submissions. CrowdStrike launched AI Discovery and Governance to surface shadow AI deployments across enterprise endpoints, responding to the same control gap the week's incidents keep exposing.

🔬 Research & Detection. An unverified commentary piece claims an unauthorized group accessed Anthropic's Claude Mythos Preview within hours of its limited defense-sector release - the sourcing is thin and the claim unconfirmed, but it is worth tracking as a signal given prior targeting of Anthropic infrastructure.

The Claude Code GitHub Action flaw is the only item with confirmed in-the-wild exploitation and should be validated patched today if you are running AI-powered GitHub workflows. The Redis and FFmpeg items have no exploitation yet but public PoCs and broad deployment footprints; both belong in the current patch cycle. The HTTP/2 bomb is particularly notable because it was synthesised by an AI agent rather than discovered through traditional research - the exploitability is real, but the variant against IIS and Cloudflare Pingora remains unpatched without vendor acknowledgement.

One weeks ago the Marimo intrusion set the line: first documented LLM agent running a full post-exploitation chain with no human in the loop. Last week's edition (#113) framed this as the orchestration layer arriving as the attack surface. This week the frame shifts again. The incidents of June 1–6 are not about missing asset inventory or unsanctioned infrastructure. They are about systems that were correctly inventoried, correctly deployed, and correctly functioning - and exploited precisely because of what they were designed to do.

Meta's chatbot processed account recovery requests. It processed them. Claude Code read repository content. It read it. OpenAI's Codex reasoned about documented vulnerabilities. It reasoned about them. The attack surface is the trust model, not the misconfiguration.

What is genuinely new: the commodity worm result. The Marimo incident established that LLM agents can execute autonomous intrusions in production. This week confirms that free, unmodified open-weight models are sufficient to build worms that propagate through enterprise networks without zero-days. That removes the last theoretical barrier between motivated attackers and nation-state-grade autonomous offensive capability.

What looks scarier than it is: the FFmpeg zero-day count. Twenty-one bugs reflects how much surface area autonomous AI analysis can cover in aged codebases, not a specific active campaign. The bugs are real; the immediate exploitation threat is not yet confirmed.

The Monday question is shorter than last week's: what AI agent in your environment holds write access to something that matters, and what does it trust?

Reference: AI Influence Level from Daniel Miessler

Till next time!

Project Overwatch is a cutting-edge newsletter at the intersection of cybersecurity, AI, technology, and resilience, designed to navigate the complexities of our rapidly evolving digital landscape. It delivers insightful analysis and actionable intelligence, empowering you to stay ahead in a world where staying informed is not just an option, but a necessity.