KLM Innovation Security Monitor
Date: September 15, 2026
Informational security guidance. Not certification. Not a substitute for scoped human review.
Executive Summary
Two high-signal items landed in the past 24 hours. Google Threat Intelligence Group (GTIG) documented financially motivated use of a multi-agent framework that planned, built, and ran mass credential harvesting in under six hours after a cloud foothold. Separately, GTIG described an exposed "Recon" C2 dashboard that managed more than 23,800 harvested secrets, including cloud and AI-service API keys. Treat those as related but distinct cases. Inbox copy sometimes merged them.
Microsoft published a draft Humanist AI Code of Conduct for MAI models. Absolute Constraints block exploit tooling and attack ops help. A Chain of Command rule strips tool outputs, files, webpages, and other AI systems of authority unless delegated. A six-week public consultation is open.
On the API side, CVE-2026-39364 (Vite server.fs.deny bypass) is tied to mass scanning for AWS, Azure, and Terraform secrets on exposed Vite dev servers. A further cluster of authz and key-exposure CVEs continues the multi-week pre-auth / broken-authz narrative.
Bottom line: Agent automation is compressing attacker tempo. Credential hygiene, API-key governance, and egress control are the practical last lines when detection windows shrink to hours.
Headline Developments
1. GTIG: multi-agent credential harvest under six hours + separate Recon dashboard (HIGH)
- Sources: Google Cloud / GTIG primary; Help Net Security; Biometric Update secondary
- Mandiant / GTIG describe a financially motivated actor that, after compromising cloud infrastructure, used an AI coding chatbot plus agent instruction files to run scanning, credential harvest, troubleshooting, and IP rotation with little human delay. Timeline claimed: under six hours to large-scale third-party credential compromise.
- Separately, GTIG found an exposed C2 hosting a "Recon" framework with agent files (AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md) and later a live dashboard managing 23,800+ harvested secrets, including cloud and AI API keys.
- GTIG hedges full autonomy: this does not prove independent zero-day discovery. The danger is automation of known labor-heavy steps at speed that breaks detect-analyze-contain assumptions.
- Why it matters: Strongest public data point yet for industrial "stolen inference" / API-key pipelines. Stolen AI-service keys compound the pattern tracked since 09-10.
2. Microsoft Humanist AI Code of Conduct: agent boundaries as Absolute Constraints (HIGH)
- Sources: SecurityWeek; microsoft.ai/code-of-conduct; consultation post
- Draft Absolute Constraints: no working exploit code, attack tooling, intrusion procedures, or operational attack guidance that deployers or end users can override.
- Chain of Command: authority flows code of conduct → operator policy → user preference. Tool outputs, file contents, webpages, and other AI messages carry no authority on their own unless explicitly delegated.
- Agent scope: stay within requested scope; no self-privilege escalation; prefer reversible actions; sub-agents inherit at least the same constraints and must honor stop/shutdown.
- Current MAI models are not yet trained on the draft. Six-week public consultation before a revised version guides 2027 development.
- Why it matters: First major vendor move to codify agent boundary enforcement as a non-negotiable model constraint, not only "trust alignment."
3. Vite CVE-2026-39364: exposed dev servers and credential mass-scan (MEDIUM-HIGH)
- Sources: OSV CVE-2026-39364; GitHub Advisory GHSA-v2wj-q39q-566r; BleepingComputer / F5 Labs secondaries (mass-scan narrative)
- Unauthenticated file-read /
server.fs.denybypass via query params (?raw,?import&raw, etc.) on Vite dev servers exposed to the network. - Secondary reporting describes mass scanning for
.env, AWS credentials, Azure tokens, and Terraform state. - Classic "dev tool as internet API with weak authz" failure. Fits the multi-week pre-auth / missing-authz class narrative.
4. Anthropic Sept 2026 threat report: LiteLLM wrapper prompt injection (CONTEXT)
- Source: Anthropic - Countering misuse of AI: September 2026
- Actors compromised AI wrapper services' LiteLLM implementations via prompt injection to exfiltrate production API keys from cloud containers.
- Report also describes opportunistic ecosystem targeting (vendors, evaluators, trusted access) and other cyber-ops misuse cases Anthropic says it disrupted.
- Why it matters: Wrapper and routing layers are attack surface, not only the model. Aligns with stolen-inference / supply-chain themes.
5. Pre-auth / broken-authz CVE cluster (MEDIUM)
- Sources: VulnCheck advisory for Casdoor; inbox TheHackerWire roundup (secondary)
- CVE-2026-90942 (Casdoor ≤4.4.0): certificate endpoints can expose instance-wide built-in private key to org admins (VulnCheck).
- Inbox also named Laradashboard license API missing authz, WordPress ThemeAtelier REST missing authz, PraisonAI invoke-without-token when
PRAISONAI_CALL_AUTHdisabled, and Magistrala SQLi in reader HTTP APIs. Treat as secondary until primaries are pinned. - PraisonAI config-flag bypass is especially relevant to agent tooling stacks.
Pattern Analysis
- "AI on both sides" - day 7 (09-09 through 09-15). Trajectory from Claude misuse reports through RubyGems agent narratives to GTIG automation + Microsoft boundary codification.
- Pre-auth / missing-authz API failures - week 7 narrative. Vite, Casdoor, and AI frameworks join prior GitLab / HexStrike-class stories. Dev tools are in scope.
- Stolen inference / API-key economy. GTIG Recon dashboard (23,800+ secrets, including AI keys) plus Anthropic LiteLLM wrapper cases strengthen the industrial pipeline claim. Hedge counts as observed inventory, not proven live reuse of every key.
- Vendor self-regulation as market signal. Microsoft Absolute Constraints and Chain of Command respond to the "boundary is the perimeter" pattern flagged 09-12 / 09-14.
Recommended Actions
Immediate (this week):
1. Audit exposed Vite / Next / similar dev servers. Patch CVE-2026-39364 paths; do not expose --host / server.host to the public internet. Rotate any secrets that sat on exposed hosts.
2. Review AI wrapper / LiteLLM-style routing for prompt-injection and key exposure (Anthropic report).
3. Keep agent instruction and knowledge files off public paths (GTIG Recon lesson).
4. Re-check every agent invoke and management API for real authz that cannot be disabled by a config flag (PraisonAI-class).
This month:
5. Enforce agent boundaries outside the model: tool allow-lists, egress control, action logging. Detection alone will not match a six-hour automated harvest window.
6. Track Microsoft's six-week consultation if MAI models are in scope.
7. Build a credential-rotation playbook that assumes keys may already be validated and reused in an attacker pipeline, not only "leaked once."
Sources
- https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
- https://www.helpnetsecurity.com/2026/09/08/ai-agents-cyberattacks-automation-google-research/
- https://www.securityweek.com/microsoft-ai-code-of-conduct-sets-cyberattack-boundaries-chain-of-command-safety-constraints/
- https://microsoft.ai/code-of-conduct/
- https://microsoft.ai/news/mai-code-of-conduct/
- https://osv.dev/vulnerability/CVE-2026-39364
- https://github.com/advisories/GHSA-v2wj-q39q-566r
- https://www.anthropic.com/threat-intelligence-report-september-2026
- https://www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-via-certificate-endpoints