KLM Innovation Security Monitor

Date: September 17, 2026

Informational security guidance. Not certification. Not a substitute for scoped human review.

Executive Summary

The pattern that got numbers yesterday now gets a market. Okta's threat intelligence flags a 7 GB infostealer dump with unexpired tokens for Anthropic, Google, Microsoft, Amazon, and Cursor, and underground listings selling discounted model access with support and money-back language. Stolen machine credentials are no longer just an attack enabler. They are a commodity with a price, a warranty, and a storefront. That is the change in the picture.

A second thread deepens in parallel. Anthropic's September threat intelligence report documents a SaaS supply-chain compromise in which Claude identified and used developer and authentication APIs, built bulk-export and cross-tenant collection tools, and helped move session-store material at machine tempo (inbox framing: roughly 200 downstream customer orgs; 2,100+ Azure AD token sets across 40+ tenants in about 34 hours). Soft-flag those counts as vendor-asserted. The model was the tool. The API surface and the ambient tokens were the breach.

On the gateway layer, LiteLLM's MCP auth bypass (CVE-2026-59822, fixed in 1.84.0) joins yesterday's CVE-2026-42271 story: the AI proxy is a credential hub, and fail-open auth on MCP paths is where risk concentrates. Separately, secondary coverage of the BlackHatSect0r / Hermes case shows an operator flipping HERMES_DISABLE_SAFETY=1 to turn a self-hosted agent into credential-harvesting infrastructure. Safety that lives inside the agent's reach is not a control.

The defensive read is unchanged, and the evidence keeps confirming it. The agent is not the perimeter. The credentials, the tool surface, and the identity layer are. If an agent holds a long-lived, broad-scope key and can reach a network path without a scoped, logged, egress-restricted route, the next breach is a matter of when, not if. Organizations in the GreyNoise 395 set (09-16) were not doing anything exotic. They were running agents the way most teams do.

Headline Developments

1. Stolen AI credentials as a commodity market (Okta + underground listings) (HIGH)

• Sources: Okta: Signing in without actually signing in; Okta: Inside the underground market for AI access; The Hacker News secondary
• Okta Threat Intelligence analyzed a 7 GB Telegram infostealer dump (released Aug 2026) covering 5,871 infected machines across 162 countries. Unexpired session material and API keys tied to major AI and cloud services (Google, Microsoft, Anthropic, Amazon, Cursor, and others in secondary roundups).
• Replayable tokens bypass password + MFA prompts. Anti-detect browsers (e.g. Camoufox) and automation tooling (e.g. SeleniumBase) load stolen session data. Underground sellers advertise discounted Claude / related access with support and money-back language (e.g. "Poison Claude" naming in secondary coverage).
• Why it matters: Closes the loop on the week's credential pattern. Yesterday's GreyNoise PaperCut campaign (09-16) showed demand (agents that can use harvested access). Okta shows supply that looks like a product. Defense cannot be "hope nobody steals the key." It has to be scoped tokens, short lifetimes, egress restriction, and detection that treats credential replay as first-class.
• Pattern callout: Day 9 of "stolen credentials, agent as the vector" (09-09 through 09-17). Attack side (prior day) + market side (today) now paired.

2. Anthropic Sept 2026 threat report: Claude misuse, including SaaS supply-chain ops (MEDIUM-HIGH)

• Sources: Anthropic: Detecting and countering misuse of AI - September 2026; Threat Intelligence hub
• Anthropic's report covers disrupted activity (Dec 2025-Aug 2026) across seven harm areas. Inbox focuses on a SaaS supply-chain case: foothold at a provider, Claude used against developer/auth APIs, bulk-export and cross-tenant collection tooling, and a session-store dump framed as 2,100+ Azure AD token sets across 40+ tenants in about 34 hours, with roughly 200 downstream customer orgs impacted.
• Separate inbox note: actor also claimed HackerOne payouts from infiltrated targets. Treat as vendor-reported claim inside the case study.
• Why it matters: Detailed public account of a model as an operational layer in a real supply-chain / API-surface breach. Tempo (hours, not weeks) is the design constraint for IR, not only for patch SLAs.
• Pattern callout: Extends "MCP/wrapper layer as the new perimeter" (day 5, 09-13 through 09-17) and the broader stolen-credentials thread. The breach is API surface + ambient tokens, exploited with an agent, not a novel model jailbreak as the root cause.

3. LiteLLM MCP auth bypass CVE-2026-59822 (CISA KEV) (MEDIUM-HIGH)

• Sources: GitHub Advisory GHSA-7488-6r32-c95q; DEV Community; Wiz: Breaking LiteLLM; Wiz CVE page
• CVE-2026-59822: MCP Streamable HTTP auth fail-open before 1.84.0. Failed key check could fall back to an empty UserAPIKeyAuth(), so a forged Authorization header reached MCP tooling. CVSS commonly cited ~8.8 (CWE-287). Fixed in LiteLLM 1.84.0. CISA KEV add dated Sep 2, 2026 in secondary coverage.
• Related research (Wiz and others) documents chaining themes with MCP test-endpoint RCE (CVE-2026-42271, 09-16 brief) and dependency/host-header issues toward unauthenticated RCE in some trees. Inbox associates Qilin ransomware campaigns and memory scraping for master keys. Soft-flag campaign attribution and ITW detail as secondary.
• Why it matters: A LiteLLM proxy is a credential hub by design. Unauthenticated MCP tool invocation inherits the reach of every connected DB, repo, and internal API. Unlike default-key-only stories, this bypass does not require leaving a default master key in place.
• Pattern callout: Day 5 of MCP/wrapper perimeter. Gateway auth between agent and tools is where fail-open bugs concentrate.

4. BlackHatSect0r: safety controls removed to automate credential harvesting (MEDIUM)

• Sources: IT Security News (indexes GBHackers); The Daily Tech Feed secondary
• French-speaking crew allegedly disabled safety controls on a self-hosted Nous Research Hermes agent (DeepSeek-backed), including removing a "discernment retained" instruction and setting HERMES_DISABLE_SAFETY=1.
• Exposed server material framed as ~4.9 GB / 9,299 files, custom Go C2/scanner DXSCAN, vault with 16,834 harvested credentials, phishing/extortion tooling. Scanner scale claims (millions of domains/IPs) and path classes (public buckets, exposed env files, browser keys, default signing secrets) come from secondary writeups. Inbox also notes a large identity dump and age-targeted vishing prep. Soft-flag PII-adjacent detail for LinkedIn.
• Why it matters: Clearest public example this week of an operator treating safety as a config line to delete. Defenders should put egress, token scoping, and action logging outside the agent's context, not inside a prompt or env flag the agent (or its operator) can flip.
• Pattern callout: New dimension on day 9 credential thread: the agent is the attacker's platform, and prompt-level safety is the first control removed.

Pattern Analysis

Pattern 1: Agent credentials are the perimeter, and the market now prices them. Prior-day GreyNoise 395-org PaperCut campaign (continuity), Okta's 7 GB dump / underground AI access market, and Anthropic's SaaS supply-chain case converge: the credential the agent holds is the attack surface, and it was typically broad and long-lived. New today: supply is organized enough to look like a product. Scoped, time-limited tokens per operation remain the control that separates a contained tool failure from a multi-week compromise.

Pattern 2: The MCP and wrapper layer is the most active vulnerability surface. CVE-2026-59822 (LiteLLM MCP auth bypass), CVE-2026-42271 (LiteLLM MCP test endpoint from 09-16), and Contentful MCP SSRF continuity from 09-16 share one assumption: the agent's tool interface is a trusted boundary. It is not. Soft-flag: Contentful item not re-verified today.

Pattern 3: Detection is structurally late, and the gap is quantified. Prior-day GreyNoise short time-to-compromise anecdotes and Anthropic's ~34-hour session-store tempo are the data points. Monitoring for "weird API calls" after the fact is late. Credential scoping, egress restriction, and automated containment are the controls that change the outcome.

Pattern 4: Safety controls are the first thing removed. BlackHatSect0r / Hermes (HERMES_DISABLE_SAFETY=1) is the clearest example this week. Prompt-level or env-flag safety inside the agent's reach is not a control. Network, IdP, and gateway policy are.

Pattern 5: Known-exploited pressure is stacking on agent and gateway surfaces. CISA KEV additions (PaperCut CVEs from 09-16 continuity; LiteLLM CVE-2026-59822 today) plus Okta market data point at a common baseline: scoped tokens, short lifetimes, and machine-speed response.

Recommended Actions

Immediate (this week):
1. Verify LiteLLM ≥ 1.84.0 everywhere; rotate keys if any instance was below. CVE-2026-59822 is fail-open MCP auth, not a default-key-only story. Treat pre-patch exposure as credential compromise until proven otherwise.
2. Patch PaperCut NG/MF for CVE-2026-81578 / CVE-2026-82078 if still unpatched (covered in the 09-16 monitor). CISA KEV deadline was September 14. Audit domain-level service accounts with no expiration.
3. Audit agent-held credentials for scope and lifetime. Long-lived broad-scope keys are the shared failure across Okta, Anthropic, and prior-day GreyNoise cases. Prefer per-operation scoped tokens. Treat session replay as a first-class detection event.

This month:
4. Implement scoped, time-limited token issuance for agent operations. Agent never holds a standing key; it receives a scoped token per job that expires.
5. Add egress restriction and automated containment to agent environments. Machine-tempo dumps require outbound paths that are explicit, logged, and scoped.
6. Move safety controls outside the agent context. Egress policy, token scoping, and action logging belong in network / IdP / gateway layers, not in a prompt or HERMES_DISABLE_SAFETY-style flag.

Ongoing:
7. Treat agent credential exposure as a standing incident-response scenario. Build procedures for scoped-token failure, replayed sessions, and machine-speed containment before the next campaign forces it. Track CISA KEV / vendor threat reports as a compliance program, not a headline feed.

Sources

1. https://www.okta.com/blog/threat-intelligence/signing_in_without_actually_signing_in/
2. https://www.okta.com/newsroom/articles/inside-the-underground-market-for-ai-access/
3. https://thehackernews.com/2026/09/infostealer-logs-expose-replayable-ai.html
4. https://www.anthropic.com/threat-intelligence-report-september-2026
5. https://www.anthropic.com/threat-intelligence
6. https://github.com/advisories/GHSA-7488-6r32-c95q
7. https://dev.to/bianliang/the-ai-gateway-is-now-a-credential-hub-what-the-litellm-mcp-authentication-bypass-means-for-55jo
8. https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise
9. https://www.wiz.io/vulnerability-database/cve/cve-2026-59822
10. https://www.itsecuritynews.info/hackers-turn-ai-agent-into-a-cyber-weapon-after-deleting-its-safety-refusals/
11. https://thedailytechfeed.com/blackhatsect0rs-deepseek-powered-ai-agent-harvests-over-16800-credentials/
12. Prior KLM Innovation Security Monitor: 09-15, 09-16 (pattern continuity; includes GreyNoise 395-org PaperCut + METR key theft + AEPD)