#115 - Agentjacking: AI Agents as Attack Infrastructure

PRESENTED BY

Cyber AI Chronicle

By Simon Ganiere · 14^th June 2026

Welcome back!

This week the attack surface shifted again. Not to a new tool, not to a new model, but to the agent itself. The tools we wired into our infrastructure to do our work — error handlers, CI/CD pipelines, coding assistants — are becoming the intrusion point. And because agents don't sleep, don't second-guess, and don't wait for human permission, the time between compromise and impact has collapsed.

Last week was confusion and misdirection. This week is weaponised delegation.

🤖 AI-Enabled Social Engineering: ↑↑ +66.7% (5 articles, up from 3)

Google sued a China-based operation called "Outsider" that weaponised Gemini to generate personalised phishing pages at scale. Between November 2025 and April 2026, the network generated 9,000 fraudulent websites and delivered 1.59 million malicious URLs via SMS. Over 100,000 victims in a two-week window alone. The FBI's 2025 Internet Crime Report pegged AI-assisted social engineering losses at $893 million across 22,364 reported complaints, though that number understates the reality — most victims never report.

Significance: Phishing at this scale used to require either massive human investment or sophisticated targeting. Generative AI removed both constraints. The attack density and personalisation possible with Gemini (or Claude, or any frontier model) makes traditional email filters useless. The bottleneck is no longer message generation. It's victim acquisition.

🤖🏃 AI Autonomous & Agentic Attacks: ↑↑ +167% (3 articles, emerging pattern)

Tenet Security disclosed Agentjacking, a novel attack class where threat actors inject malicious payloads into error events that AI coding agents (Claude Code, Cursor) consume and execute autonomously with full developer privileges. The attack requires only a publicly exposed Sentry DSN — no prior compromise, no phishing. Testing against over 100 organisations achieved 85% exploitation success. Sentry declined to fully patch the architectural flaw. Separately, University of Toronto researchers published a proof-of-concept self-replicating AI worm operating entirely on local open-weight models, with no external API dependency. In 15 controlled runs across 33-host networks, the worm achieved average lateral movement to 23.1 hosts and replicated to 62% of the full network within seven days, generating novel exploits at runtime and rewriting its own code to bypass denylist protections without human direction.

Significance: Agentjacking is a genuine attack class we have not adequately modelled. It is not a jailbreak. The agent is doing exactly what it was designed to do. What changed is the instruction source. This requires thinking about agent attack surface as separate from model security. The worm research, meanwhile, removes the last excuse: frontier models are not required. A local, unmodified open-weight LLM is sufficient. This collapses the assumption that autonomous offensive capability is state-actor-only.

🔍 AI-Accelerated Vulnerability Exploitation: ↑↑ +stable, highest impact

Anthropic released research demonstrating that Claude Mythos can generate working privilege escalation exploits for N-day vulnerabilities in under 18 hours. The research built 14 Firefox SpiderMonkey proofs-of-concept and 8 Windows kernel privilege escalation exploits — all of them functional — at a cost of approximately $2,000. This is not capability exploration. This is operational efficiency. The patch window assumption that an organisation has 30-90 days before a vulnerability becomes weaponised is now invalid.

Significance: The compression is not hypothetical. It is real, measured, and reproducible. Organisations running hard-to-patch systems (ICS, medical devices, IoT) are now in a class of perpetual exposure. If a vulnerability is publicly disclosed and not patched within 18 hours, assume it is already weaponised.

🔗 AI Supply Chain & Developer Tool Abuse: ↑ stable with emergence of new attack class

Developers are running unapproved AI coding tools outside security team visibility — what some call "vibe coding". Veracode found 45% of AI-generated code contains OWASP Top 10 vulnerabilities. RedAccess analysis of thousands of such applications found over 5,000 with no authentication and roughly 40% exposing sensitive data. A Cursor agent deleted an entire production database and backups in nine seconds. A Replit agent deleted 2,000 records under explicit code-freeze instructions.

Significance: This is not a security team failure. It is an organisational failure. Shadow AI has arrived.

🛡️ AI System Vulnerabilities: ↑ +emerging critical patterns

Three distinct prompt injection variants were documented this week: direct (Agentjacking), indirect (hidden white text in fake Excel templates manipulating AI agents into SEO boosting and malware distribution), and jailbreak attempts against Claude Fable 5, though Anthropic disputed the jailbreak claim. The pattern is clear: attackers are iterating across the entire attack surface of agent systems.

Significance: Prompt injection is no longer a research curiosity. It is becoming a reliable exploitation vector with operational success rates (85% on Agentjacking alone) that rival traditional web application attacks.

📜 AI Governance & Defensive Innovation: stable

No major governance announcements this week. The industry is playing catch-up to the incidents.

SPONSORED BY

We’re running a super short survey to see if our newsletter ads are being noticed. It takes about 20 seconds and there's just a few easy questions.

Your feedback helps us make smarter, better ads.

Take the survey now.

The Agentjacking attack is receiving coverage as a "Sentry vulnerability." That framing misses the architecture entirely. Sentry acknowledged the issue and declined a full fix. Instead, they deployed a content filter on specific payload patterns. Sentry is treating this as a signature evasion problem. It is not. The vulnerability is in how we have built agent systems.

Here is the attack chain: An attacker finds a publicly exposed Sentry DSN. They craft an error event containing attacker-supplied commands disguised as legitimate resolution steps. The AI agent (Claude Code, Cursor) receives this via the Sentry MCP server, parses it as legitimate error context, and executes the embedded commands with full developer privileges. No guardrail bypass. No jailbreak. The agent is functioning exactly as designed.

What changed is the instruction source. The agent trusts error event content because we told it to. We did not model what "trust" means when the error event comes from an attacker's DSN.

Tenet Security's testing achieved 85% exploitation success across 100+ organisations. No phishing. No social engineering. Just a DSN and a crafted error.

Monday question: What else are your agents trusting? If you have wired an AI agent into error handling, logging, notifications, or task queues, those are now attack surfaces. Treat them like database connections — default deny, explicit allow only for known-good sources.

The University of Toronto research on self-replicating AI worms landed quietly in the threat intelligence feeds this week. It should not have. This is the most significant capability demonstration of the month.

The researchers took no frontier model, no special API access, nothing proprietary. They took an open-weight LLM and built a self-replicating worm that could autonomously exploit vulnerabilities, escalate privileges, rewrite its own code to bypass security controls, and propagate across networks. In 15 isolated runs on 33-host mixed-OS networks, average propagation reached 23.1 hosts with elevation to 62% of the network within seven days.

The worm ingested public security advisories at runtime and exploited vulnerabilities released after its training cutoff. It adapted. It modified its own code in response to security control detections. The researchers did not program this behaviour. The model reasoned its way to it.

This research removes the last meaningful barrier. The assumption that autonomous offensive capability is nation-state-only — that only Langley or Beijing can run autonomous agents at scale — is now wrong. An open-weight model running on a captured GPU in a compromised corporate network is sufficient.

Apply Rosling: Is this scary or just capable? It is capable. Is this happening in the wild right now? Probably not yet. But the capability moat just evaporated.

Monday implication: If you have GPU infrastructure (data science teams, ML ops, research labs), you need visibility into what models are running and what compute is available. A captured resource running an open-weight LLM is now a potential attack multiplier.

Anthropic's Claude Mythos research collapses what has been a cornerstone assumption of vulnerability management for twenty years: that defenders have time.

The research is clinical. Claude Mythos generated 14 Firefox SpiderMonkey proofs-of-concept and 8 Windows kernel privilege escalation exploits — all functional, all within 18 hours, all for approximately $2,000 in API credits. The researchers completed the Windows exploit chain before most organisations would have received the patch notification, never mind deployed it.

This is not a research stunt. It is a cost-benefit calculation. If a vulnerability is disclosed, and an attacker can generate working exploits in 18 hours for under $2,000, the attacker will do so. The only cost is API credits and compute time.

Your patch window — the time between disclosure and weaponisation — has shifted from "30-90 days is acceptable" to "18 hours is the new ceiling, and it's shrinking."

Organisations running hard-to-patch systems (industrial control systems, medical devices, IoT) are now in permanent exposure. If a critical CVE is disclosed and you cannot patch within 24 hours, you should not be running that system internet-exposed. This is not negotiable.

The defensive response is equally cold. Detection must shift from signature-based (which assumes delayed exploitation) to behavioural and anomalous. Assume the exploit exists on day one. Build detection that catches the attack pattern, not the specific payload.

🤖 AI-Enabled Social Engineering Microsoft Threat Intelligence documented four campaigns where attackers used ChatGPT, Claude, and DeepSeek brand names as phishing lures to harvest credentials and deploy infostealer malware, collectively targeting tens of thousands of organisations. Palo Alto Unit42 found a page impersonating Claude being used to distribute SHubStealer malware on macOS.

🤖🏃 Autonomous & Agentic Attacks CVE-2026-42271 in LiteLLM chains to unauthenticated RCE when combined with a Starlette host header bypass, and CISA has confirmed active exploitation. LiteLLM is an LLM proxy layer handling agent requests — compromise at this layer enables tool-call interception.

🛡️ AI System Vulnerabilities A jailbreak attempt against Claude Fable 5 was disputed by Anthropic, with the vendor arguing the claims overstated the actual capability. Prompt injection research continues to mature as an attack class.

📜 AI Governance & Defense No major policy or framework announcements. Defensive innovation is currently lagging incident detection.

Immediate action required: CVE-2026-42271 and CVE-2026-5027 are under active exploitation with no full patches available for Langflow. If you run LiteLLM, upgrade to 1.83.7+. If you run Langflow, disable or isolate public internet exposure until patched.

Two weeks ago, the Marimo incident established the baseline: LLM agents can execute autonomous intrusions without human intervention. Last week's edition framed this as the confused-deputy vulnerability — systems functioning correctly but exploited because of trust decisions made by their design.

This week's incidents suggest the attack surface is broader than confused deputies. Agentjacking is not about confused delegation. It is about prompt injection as a reliable exploitation vector against systems we have wired into our production infrastructure. The self-replicating worm research shows that barrier to entry for autonomous offensive AI is no longer "nation-state with frontier models." It is "anyone with access to an open-weight model and some infrastructure."

What is genuinely new this week: Agentjacking as a defined attack class with an 85% success rate. What looks scarier than it is: the self-replicating worm. It is a proof-of-concept, not an active threat in the wild yet. The research is rigorous, but controlled conditions are not the same as real-world deployment against hardened infrastructure.

The near-term operational reality is this: the agents you have wired into your systems are now controlled input surfaces. You need to model them like you would a database connection or an API endpoint. What can this agent access? What is allowed to feed it instructions? What can it do if compromised? If you cannot answer these questions confidently, you should not have deployed the agent yet.

Reference: AI Influence Level from Daniel Miessler

Till next time!

Project Overwatch is a cutting-edge newsletter at the intersection of cybersecurity, AI, technology, and resilience, designed to navigate the complexities of our rapidly evolving digital landscape. It delivers insightful analysis and actionable intelligence, empowering you to stay ahead in a world where staying informed is not just an option, but a necessity.