KLM Innovation Security Monitor

Date: September 22, 2026

Informational security guidance. Not certification. Not a substitute for scoped human review.

Executive Summary

Two of yesterday's patch-now items now have hard deadlines inside the week: CISA gave federal operators until September 24 to mitigate or remove exploited Zyxel GS1900 switches, and the MaxKB AI assistant platform has a CVSS 10.0 prompt-injection-to-command-execution flaw with a published fix (2.10.5-lts) that any internet-reachable, tool-enabled instance needs immediately. On the trend side, Akamai's State of the Internet report (via Infosecurity Magazine) quantifies what this week's incidents keep demonstrating: AI-driven bot traffic up 300%, daily API attacks up 113% year over year, and MCP exposure ranked last among CISO priorities even as rogue agents are expected to be a top threat by 2030. The operational imperative is unchanged and now better documented: scope agent credentials, restrict egress, and treat every API and MCP endpoint as untrusted input until proven otherwise.

Headline Developments

1. MaxKB AI assistant: prompt injection executes OS commands without approval (CVE-2026-77521) HIGH

Source: GBHackers (Sept 21).

• CVE-2026-77521 (CVSS 10.0, CWE-78 / CWE-250 / CWE-749) is reported to affect 1Panel-dev MaxKB through 2.10.3-lts. Assistants with tools, MCP tools, skills, or sub-applications are reported to expose a shell-execution path without a human approval gate.
• Untrusted chat or ingested content can therefore trigger command execution when a shell tool is exposed without an approval gate. Some deployments reportedly run those commands as the application user, and container privilege-dropping wrappers have been described as incomplete in secondary coverage.
• Fixed version reported as 2.10.5-lts. CVE published September 21, 2026. No confirmed in-the-wild exploitation as of this brief (secondary). The attack path (prompt injection into a tool-enabled assistant) matches the architectural failure mode seen in LiteLLM (09-20 continuity) and Orkes Conductor (09-18 continuity).

Why this matters: MaxKB is a self-hosted enterprise AI assistant platform. Internet-reachable, tool-enabled deployments are one prompt-injection payload away from host compromise if the report holds. The flaw is the exact architectural assumption the agent-security pattern keeps punishing: a shell tool exposed to untrusted input with no approval step. If you run MaxKB below 2.10.5-lts, patch and check for unauthorized process execution.

Pattern callout: Extends the "agent's supply chain is the supply chain" thread (09-13 through 09-22). MaxKB is the assistant framework layer, LiteLLM the gateway layer, Orkes Conductor the orchestration layer. Same failure mode: the tool interface is treated as a trusted boundary, and it is not.

2. Akamai State of the Internet: AI drives 300% bot traffic surge, APIs now the dominant attack surface CONTEXT

Source: Infosecurity Magazine (Sept 22), summarizing Akamai's State of the Internet report.

• Akamai's report, published September 22 per coverage, recorded a 300% increase in AI-driven bot traffic year over year, primarily impacting commerce, and a 113% increase in daily API attacks between 2024 and 2025.
• 87% of surveyed organizations experienced an API-related security incident in 2025, up from 76% in 2022 (vendor-report).
• 40% of enterprise users have installed AI browser extensions; a quarter altered their permissions within 12 months, which the report flags as a significant risk-profile increase (vendor-report).
• 6% of chatbot conversations on enterprise devices contain sensitive corporate information. Nearly half (47%) of AI conversations on enterprise devices use personal identities and accounts, outside IT visibility (vendor-report).
• MCP exposure ranks last among current CISO security priorities, even as security leaders expect rogue AI agents to become a top cyber threat by 2030 (vendor-report).

Why this matters: This is large-scale quantitative confirmation that APIs are the dominant attack surface and that AI agents are a major driver. The defensive controls are the same ones this week's CVEs keep validating: scope the token, restrict egress, log the tool call, and enforce approval gates on every privileged action. The report also quantifies the blind spot: personal-identity AI usage means DLP and SIEM may be watching the wrong traffic.

Pattern callout: Quantifies the "agent's supply chain is the supply chain" pattern (09-13 through 09-22) with enterprise-wide data. LiteLLM, Orkes Conductor, and MaxKB are the leading indicators. The Akamai numbers are the confirmation layer.

3. CISA adds exploited Zyxel GS1900 switch flaw to KEV, September 24 deadline HIGH

Source: CISA alert (Sept 21). Primary for KEV addition and federal deadline.

• CVE-2026-7273 is a stack-based buffer overflow in the CGI program of Zyxel GS1900 Series Switches, allowing unauthenticated local attackers to execute arbitrary OS commands via specially crafted HTTP requests.
• CISA confirmed active exploitation and added the CVE to the KEV catalog on September 21, 2026, with a deadline of September 24 for affected federal organizations to implement vendor mitigations or discontinue use.
• The flaw is LAN-based (local-network access), not internet-exposed, which narrows the blast radius but does not eliminate it. A compromised GS1900 switch is a persistent foothold in the network fabric.

Why this matters: The September 24 deadline is the hard operational constraint. If you run GS1900 switches and have not applied the Zyxel patch, this week is the deadline. The local-network requirement means initial access is likely a compromised endpoint or a rogue device on the same VLAN, which is exactly the lateral-movement scenario Cisco ISE exploitation (09-20/09-21 continuity) creates.

Pattern callout: Continues the "exploited flaws move to KEV and stay exploited" pattern (09-17 through 09-22). The Zyxel addition is the second KEV entry of the week with a federal deadline inside five days.

4. Remus infostealer targets AI platform credentials, MCP configs MEDIUM-HIGH

Source: GBHackers (Sept 21).

• Remus, a Windows infostealer that surfaced on underground marketplaces in March 2026 per coverage, has expanded its credential-theft playbook to explicitly target API tokens and local usage data for OpenAI and Anthropic, in addition to browser cookies, cryptocurrency wallets, and passwords.
• The malware harvests locally stored LLM usage history, which can include prompts, project context, code fragments, internal URLs, and credentials accidentally entered into AI chat interfaces.
• MCP configuration files are a specific target because they contain API keys for connected services. Related infostealer trends have documented theft of access and refresh tokens, prompt histories, conversation databases, and MCP configuration files across multiple campaigns (secondary).

Why this matters: The infostealer is the credential-harvesting layer that makes agent attacks work. If developer workstations run AI coding tools alongside source control, cloud, and ticketing platforms, the local credential store is a high-value target. Assume the token is compromised if the endpoint was, and rotate. Scope AI platform tokens to the minimum lifetime and the minimum set of tools they can reach.

Pattern callout: Extends the "the credential is still the breach" pattern (09-13 through 09-22). LiteLLM API key harvest (09-20 continuity), Gemini credential-guessing (09-21 continuity), and Remus are the same failure mode at different layers of the stack.

Pattern Analysis

Pattern 1: The agent's supply chain is the supply chain (09-13 through 09-22, 10 days running). LiteLLM CVE-2026-59822 (09-17), WSO2 BOLA (09-18), Orkes Conductor RCE CVE-2026-58138 (09-18), Plugin4Shell (09-19), LiteLLM KEV chain (09-20), OWASP ACS + SkillSpector (09-20), and now MaxKB CVE-2026-77521 (09-21/09-22) all point at the same architectural assumption: that the agent's tool interface is a trusted boundary. It is not. MaxKB is the clearest public description yet of how a shell tool exposed to untrusted input, without an approval gate, becomes a host compromise.

Pattern 2: The credential is still the breach (09-13 through 09-22, 10 days running). Gemini credential-guessing and reuse (09-21 continuity), Remus infostealer targeting OpenAI/Anthropic API tokens (today), Vite CVE-2026-39364 continuity (09-15), and the LiteLLM API key harvest (09-20 continuity) are the same failure mode at different layers. Agents and infostealers do not invent new attack techniques. They execute the old ones faster. Scope the token, restrict egress, log the tool call.

Pattern 3: Exploited flaws move to KEV and stay exploited (09-17 through 09-22). Cisco ISE and SEG (09-20/09-21 continuity), the two Microsoft EoP zero-days (09-20/09-21 continuity), and now Zyxel GS1900 CVE-2026-7273 (today) are all in KEV. Active exploitation is a weekly baseline, and the patching backlog is growing with it. The Zyxel September 24 deadline is the first federal deadline inside five days this week.

Pattern 4: The API is the dominant attack surface (09-13 through 09-22). Akamai's State of the Internet report (today) provides large-scale quantitative confirmation: 300% AI-driven bot traffic increase, 113% daily API attack increase, 87% of organizations with an API security incident. The CVEs in this brief (MaxKB, Zyxel) are API-adjacent. The agent story and the API story are the same story. The agent is the new API consumer, and the API is the new attack surface.

Pattern 5: Regulatory and legal posture continues to tighten (09-14 through 09-22). AEPD continuity (09-16), the Swiss ransomware sentencing (09-19), mainstream framing of AI breach risk (09-20 continuity), and the CISA Zyxel deadline (today) all move in the same direction. The cost of treating agent security as only an engineering problem is rising.

Recommended Actions

Immediate (this week):

1. Patch MaxKB to 2.10.5-lts if you run it. CVE-2026-77521 is reported as a CVSS 10.0 prompt-injection-to-command-execution flaw with a published fix. If you self-host MaxKB with any tool, MCP tool, skill, or sub-application enabled, and the instance is internet-reachable, patch immediately and check for unauthorized process execution.

2. Patch Zyxel GS1900 switches by the September 24 CISA deadline. CVE-2026-7273 is in KEV with a federal deadline inside the week (CISA primary). If you run GS1900 switches, apply the Zyxel patch now and verify no unauthorized commands were executed. The local-network access requirement means initial access is likely a compromised endpoint or rogue device on the same VLAN.

3. Keep Cisco ISE / Secure Email Gateway patching in the same window. CVE-2026-76460 and CVE-2026-76461 remain continuity from 09-20/09-21. Do not treat today's Zyxel deadline as a reason to deprioritize them.

This month:

1. Audit the credential posture around AI platform access. The Remus infostealer campaign targets OpenAI and Anthropic API tokens specifically. If developer workstations run AI coding tools, assume the local credential store is a high-value target. Scope AI platform tokens to the minimum lifetime and the minimum set of tools they can reach. Rotate any token that was on a compromised endpoint.

2. Review MCP endpoint exposure and enforce approval gates. The Akamai report quantifies the gap: MCP exposure is the last CISO priority even as rogue agents are expected to be a top threat by 2030. MaxKB and LiteLLM are the leading indicators. Audit your MCP tool surface, enforce least-privilege identity, and require human approval for every privileged action.

3. Vite / local-dev credential hygiene (continuity from 09-15). If any developer workstation or CI runner exposed a Vite dev server with a project-root .env, rotate cloud keys and check for unauthorized API usage. Keep no internet-reachable dev servers.

Ongoing:

1. Build the agent-incident disclosure path now, not after the first breach. The Google/Gemini incident (09-21 continuity) shows that victims finding out via a news report is still a live failure mode. Organizations that already have a tested disclosure path for AI-caused incidents will be in a better position when enforcement lands.

Relevant Risk Summary

Sources

• GBHackers. Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands
• Infosecurity Magazine. AI Drives Surge in Bot and API Threats
• CISA. CISA Adds One Known Exploited Vulnerability to Catalog
• GBHackers. New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets
• The Hacker News. Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers (continuity)
• SecurityWeek. Google Confirms Gemini AI Breached Three Firms (continuity)
• Help Net Security. Week in review: Cisco patches exploited email gateway 0-day, Revolut breach (continuity)
• Senserva. Microsoft Patch Tuesday September 2026 (continuity;