# KLM Innovation Security Monitor

**Date:** October 9, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary

The agent's own files are now the target. Gen says Warden Stealer, a malware-as-a-service infostealer, is one of the first to systematically harvest AI-agent config files, local tokens, prompt histories, and MCP settings from Claude, Codex, Grok, and Cursor. If an endpoint gets hit by an infostealer, those artifacts belong in your incident scope.

A compromised release of the tensorlake npm SDK (0.5.144) shipped the Shai-Hulud worm on October 8th. It steals npm, GitHub, cloud, and Vault credentials, and it writes `.claude/settings.json` and `.vscode/tasks.json` into repos it can reach so it runs again when someone opens the project. Endor Labs says the bad version has been pulled and 0.5.143 is clean. If any machine or CI job installed 0.5.144, treat it as compromised and rotate everything it could reach.

Zenity showed a single prompt to one public-facing Amazon Bedrock AgentCore agent reaching IMDS, then using a broad default role to read other agents' conversations, pull Secrets Manager values, and plant a memory that kept steering the agent. AWS calls it expected, documented behavior. Either way, the fix is on you: tighten the execution role and block metadata access from agent VMs.

CrowdStrike published its analysis of the ARTEX campaign against South Korean banks (covered October 5th and 6th), including exposed Claude Code session histories on attacker infrastructure. ARTEX's developer pulled the tool from GitHub on October 8th. PCI SSC also published AI security guidance built around "least agency" and human approval for agent actions on cardholder data.

## Founder Take

Your agent's files are the new crown jewels. They're stolen, used to persist, and planted, so treat agent config and memory like secrets.

## Headline Developments

### 1. tensorlake npm SDK 0.5.144 compromised with the Shai-Hulud worm (HIGH)

**Source:** [The Hacker News - Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm](https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html) (October 8th). Also [Endor Labs - Tensorlake npm package compromised by Shai-Hulud](https://www.endorlabs.com/learn/tensorlake-npm-package-compromised-by-shai-hulud-in-latest-software-supply-chain-attack) (October 8th) and [GBHackers - Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware](https://gbhackers.com/tensorlake-package-hijacked/) (October 8th).
- `tensorlake` is the TypeScript SDK for Tensorlake's agent infrastructure, sandboxes, and cloud services. Version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," per Socket via THN.
- The first rogue commit landed October 7th. The repository's own release workflow published 0.5.144 to npm a day later. Endor Labs points to a compromised maintainer account as the most likely root cause.
- Targets include npm tokens, GitHub tokens, AWS credentials, and HashiCorp Vault and Kubernetes secrets. StepSecurity says the malware writes `.claude/settings.json` and `.vscode/tasks.json` into reachable repos so it re-runs when the project opens in Claude Code or VS Code.
- Endor Labs says the bad version has been removed from npm and 0.5.143 is clean. Endor puts the package at more than 12,000 weekly downloads. Treat that as a vendor figure.
- It's part of the ChainDrop / Shai-Hulud campaign, first documented in early August 2026 with hundreds of compromised npm packages.

**Why this matters:** The rating is HIGH because the payload is confirmed, it self-propagates, and it targets exactly the credentials that unlock the rest of your pipeline. Removal from npm doesn't help a machine that already ran it, and persistence survives removing the dependency. The new wrinkle is the persistence path: the worm uses agent and editor config files as its re-entry point.

**Pattern callout:** New thought today: agent config files are now a persistence mechanism, not just a place secrets leak from. Extends the agent supply-chain thread (September 13th onward) into the package registry and the developer's own repo.

### 2. Zenity "AgentCorruption": one prompt to one AgentCore agent reached account-wide agent data; AWS disputes (MEDIUM)

**Source:** [The Next Web - Zenity says one prompt took over every AgentCore agent in an AWS account](https://thenextweb.com/news/aws-agentcore-zenity-agentcorruption-one-prompt-agents) (October 8th). Also [Dark Reading - 'AgentCorruption' Puts AWS Environments At Risk With One Prompt](https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt) (October 8th).
- Zenity Labs published the research on October 8th alongside a SecTor 2026 talk in Toronto. A public-facing agent with a web-request tool was prompted to fetch from the instance metadata service (IMDS). The agent VMs didn't block that traffic.
- The default execution role covered resources across the whole account and region. With it, the researchers listed every agent, downloaded container images, invoked internal agents, read private conversations, and pulled values from Secrets Manager.
- Persistence came from memory: a fake conversation event was stored as a lasting user instruction telling the agent to visit an attacker-controlled page before every answer. Editing that page changed the agent's behavior without touching the memory again.
- Per Zenity, it reported IMDS access in December 2025 and the broad default role on January 12th, 2026. AWS closed the first report as "informative" in April. AWS told Zenity that since February 14th, new AgentCore agents launch IMDSv2-only, and Zenity later found the default role narrowed.
- AWS says the research "inaccurately paints expected and documented behavior as a vulnerability." There's no CVE. Treat the impact as vendor research the platform owner disputes.

**Why this matters:** The rating is MEDIUM because it's a documented chain with fixes you control today, but no confirmed in-the-wild use. Agents deployed before February 14th, or with a hand-rolled broad role, are the ones to check first. Whoever's right about the label, the customer owns the role.

**Pattern callout:** New thought today: agent memory is a persistence layer. One planted memory redirects the agent indefinitely. Extends the default-permissions thread (September 20th onward) into the cloud runtime.

### 3. Warden Stealer harvests AI-agent tokens, prompt histories, and MCP settings (MEDIUM)

**Source:** [Gen Digital - Warden Stealer Rust Infostealer Analysis](https://www.gendigital.com/blog/insights/research/warden-stealer-rust-infostealer-analysis). Also [GBHackers - Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data](https://gbhackers.com/warden-stealer-malware/) (October 9th).
- Gen calls Warden Stealer one of the first infostealers targeting configuration files and local data belonging to AI assistants and agentic coding tools, including Claude, Codex, Grok, and Cursor.
- It's a Rust-based infostealer-as-a-service promoted on underground forums since August 2026, targeting Windows 8 through 11. It ships with its own loader and a cryptocurrency clipper.
- Delivery includes cracked software, game cheats, malvertising, and ClickFix campaigns. Gen previously tracked it as CallbackBeaver before attributing it to Warden.
- Gen recommends including AI assistants in endpoint inventories, secret-management reviews, and incident-response playbooks. After a suspected infection, revoke AI-service sessions, rotate API keys and MCP-linked credentials, review agent-connected apps, and check prompt and conversation history exposure.

**Why this matters:** The rating is MEDIUM because it's an active, commercial operation, and the fixes are process changes you can make now. A stolen agent token or MCP config can carry more access than a browser password, and conversation history can hold secrets people pasted in. Most IR playbooks don't list these files yet.

**Pattern callout:** New thought today: agent data has gone from opportunistic loot to a marketed feature. Extends the "credential is still the breach" thread (Remus, Muse token theft, September 22nd and 23rd) to the agent's local store.

### 4. CrowdStrike details ARTEX tradecraft in the South Korea bank campaign; developer pulls the tool (MEDIUM-HIGH)

**Source:** [CrowdStrike - Unknown Threat Actor Uses ARTEX to Target South Korean Finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/). Also [The Hacker News - ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html) (October 9th), [Infosecurity Magazine - Chinese Hacker Deployed AI in Campaign Against South Korean Banks](https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/) (October 8th), and [Startup Fortune - Developer of hacked bank tool ARTEX pulls it from public GitHub](https://startupfortune.com/developer-of-hacked-bank-tool-artex-pulls-it-from-public-github/) (October 9th).
- Covered October 5th and 6th. New today is the CrowdStrike analysis. It found open directories on a Hong Kong IP exposing Claude Code session histories, Claude memory files, and ARTEX configuration files.
- The ARTEX instance used DeepSeek as its main LLM backend, with Z.ai's GLM and Grok as supplements, per THN's summary. CrowdStrike hasn't attributed the campaign to a known group. Evidence points to a financially motivated, suspected Chinese-speaking operator. ARTEX itself was developed in China.
- Entry points were peripheral systems, not core banking: a loan-progress inquiry service used by brokers at one bank and an employee mobile work-support system at another.
- On October 8th, ARTEX's developer pulled the AGPL-licensed project from GitHub, saying it would no longer be updated and would go closed source. Copies already in circulation aren't affected. Startup Fortune puts the count at nine banks. That's a single secondary figure.

**Why this matters:** The rating is MEDIUM-HIGH because exfiltration is confirmed and the tool is public. The useful part for defenders is the tradecraft: an operator directing agents at partner- and employee-facing services, with session logs and memory files on the attacker's side. Detection should key on behavior (fast automated login discovery, credential testing, chained tool use), not on the ARTEX name.

**Pattern callout:** New thought today: attackers keep agent memory and session logs too, and that's where CrowdStrike found the evidence. Mirrors Stories 1 to 3 from the other side.

### 5. PCI SSC publishes "Security Considerations for AI Systems" for payment environments (CONTEXT)

**Source:** [Help Net Security - PCI SSC calls for human approval of AI agent actions involving cardholder data](https://www.helpnetsecurity.com/2026/10/09/pci-ssc-payment-environments-ai-security-guidance/) (October 9th). Also [PCI SSC - Security Considerations for AI Systems v1 (PDF)](https://docs-prv.pcisecuritystandards.org/Guidance%20Document/AI/PCI_SSC_Security_Considerations_for_AI_Systems_v1.pdf).
- The guidance covers governance, deployment, access controls, testing, and how PCI standards apply to AI systems. It's advisory. Existing PCI requirements take precedence.
- It defines a "least agency" approach: each AI system gets only the access and capabilities its task needs, and a suitable human formally accepts responsibility for AI output.
- Avoid combining sensitive data access, external communications, and untrusted input in one AI system. Where a workflow needs all three, split the work across agents with different permissions.
- IR plans and testing should cover prompt injection, model poisoning, out-of-scope actions, and unauthorized AI tools reaching sensitive data. An AI inventory and bill of materials should list models, versions, hosting, integrations, data policies, and users.

**Why this matters:** CONTEXT because there's no flaw to patch. It's the first payment-standards guidance aimed at AI agents, and it gives teams in regulated environments a reference for scoping agent permissions and approvals.

**Pattern callout:** New thought today: "least agency" is the formal name for the default-permissions lesson in Story 2. Follows the CoSAI MCP v2.0 assurance model (October 8th).

## Continuity Footnotes

- **LMCache CVE-2026-105192 (unauthenticated RCE, no patch)** - covered October 7th and 8th; nothing new today. Firewall port 5555 and audit routable `--host` settings.
- **FortiBleed credential campaign** - covered October 8th; nothing new today. Treat internet-facing FortiGate as a compromise investigation.
- **Atlassian CVE-2026-21589 (8 Data Center products, CVSS 9.3)** - covered October 7th. Upgrade or restrict network access.
- **Citrix NetScaler CVE-2026-88779** - covered October 5th. CISA's federal deadline was October 7th. If the fix isn't deployed, it's past due.
- **GitLab AI Gateway CVE-2026-90970** - covered October 2nd. Self-hosted gateways should be on 19.2.4, 19.3.2, or 19.4.1.
- **KVM guest-to-host zero-day, Wikimedia OpenAI agents, Meta Muse VM escape, Exchange CVE-2026-96940, LiteLLM KEV, DataDirect ARCGenAI-Generator, MCP scanner evasion** - covered in earlier briefs; nothing new today.

## Pattern Analysis

| # | Pattern | Description |
| --- | --- | --- |
| 1 | Agent files are the target | Today's thought: the agent's local files get stolen (Warden, Story 3), poisoned for persistence (tensorlake writing `.claude/settings.json`, Story 1), and planted (AgentCore memory, Story 2). Attackers keep their own agent logs too (ARTEX, Story 4). Cross-brief history: 12% of MCP config credential slots hardcoded (October 8th), Muse token theft (September 22nd and 23rd). |
| 2 | Agent supply chain | Today's tensorlake worm (Story 1) adds a compromised agent-infrastructure SDK to the registry thread. Cross-brief history (September 13th through October 9th, 27 days running): LiteLLM, RubyGems swarm, DataDirect spec injection, MCP scanner evasion. |
| 3 | Default permissions are the blast radius | Today's AgentCore default role (Story 2) and PCI SSC's "least agency" (Story 5) are the same lesson from a researcher and a standards body. Cross-brief history (September 20th onward): Orkes Conductor, OpenAI agent sandbox cases. |
| 4 | Agents as offensive tools | Today's CrowdStrike write-up (Story 4) moves ARTEX from secondary press attribution (October 5th) to vendor analysis with exposed Claude Code sessions. The developer's repo pull is a first for this series. Cross-brief history: DIVD autonomous-agent breach (September 29th), Storm-3168 (October 2nd). |
| 5 | Vendor disputes the finding | Today AWS called AgentCorruption expected behavior (Story 2). Readers have to weigh the risk without a CVE. Cross-brief history: Google's VRP pause over AI-generated reports (October 6th). |
| 6 | Edge boundary failing | No new edge story today. FortiBleed and NetScaler remain open (footnotes). Cross-brief history (September 17th through October 9th). |

## Recommended Actions

**Immediate (this week):**

1. **If any machine or CI job installed tensorlake 0.5.144, treat it as compromised.** Rotate npm, GitHub, cloud, Vault, and Kubernetes credentials it could reach. Pin to 0.5.143. Check repos for unexpected `.claude/settings.json` or `.vscode/tasks.json` changes and for new workflow files.

2. **If you run Bedrock AgentCore or any agent platform, audit execution roles and block metadata access.** Enforce IMDSv2, block IMDS from agent VMs where agents don't need it, scope roles to one agent's resources, and restrict Secrets Manager and memory-write permissions. Check agents deployed before February 14th first.

3. **Add AI-agent artifacts to infostealer response.** After any suspected infection, revoke AI-service sessions, rotate API keys and MCP-linked credentials, and review prompt and conversation history for pasted secrets.

4. **If you run LMCache in distributed mode, firewall port 5555.** There's still no patch for CVE-2026-105192.

**This month:**

5. **Inventory AI assistants on endpoints the way you inventory browsers.** Know which agent tools are installed, where they keep tokens and MCP configs, and who owns them.

6. **Hunt for agent-driven intrusion behavior on partner and employee portals.** Look for fast automated login discovery, credential testing, and chained tool use against peripheral services, not just known tool names.

7. **If AI agents touch cardholder data, map them to PCI SSC's AI guidance.** Apply least agency, require human approval for actions on cardholder data, split untrusted input from sensitive access, and build an AI inventory.

8. **Close out Atlassian CVE-2026-21589 and Citrix NetScaler CVE-2026-88779 if they're still open.**

**Ongoing:**

9. **Treat agent memory and config as integrity-critical.** Log memory writes, review persistent instructions, and alert on agent config changes in repos.

10. **Track ARTEX forks and the tensorlake maintainer's remediation notes.**

## Relevant Risk Summary

| Risk | Severity | Recommended Actions |
|---|---|---|
| tensorlake npm 0.5.144 Shai-Hulud worm (October 8th) | HIGH | Rotate credentials; pin 0.5.143; check repos for agent/editor config persistence |
| Zenity AgentCorruption on Bedrock AgentCore; AWS disputes (October 8th) | MEDIUM | Enforce IMDSv2 and block IMDS; scope execution roles; restrict Secrets Manager and memory writes |
| Warden Stealer targets AI-agent data (October 9th) | MEDIUM | Add agent artifacts to IR; rotate AI and MCP credentials after infection |
| ARTEX campaign against South Korean banks; CrowdStrike analysis (October 5th onward) | MEDIUM-HIGH | Behavior-based detection on partner and employee portals |
| PCI SSC AI security guidance (October 9th) | CONTEXT | Least agency; human approval on cardholder data; AI inventory |
| LMCache CVE-2026-105192, no patch (October 7th) | HIGH | Firewall port 5555; audit routable `--host` |
| FortiBleed credential campaign (October 8th) | HIGH | Compromise investigation; rotate credentials |
| Citrix NetScaler CVE-2026-88779, KEV deadline of October 7th passed | HIGH | Deploy fixed builds now |
| Atlassian CVE-2026-21589 (9.3) | MEDIUM | Upgrade or restrict network access |

## Sources

- [The Hacker News - Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm](https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html)
- [Endor Labs - Tensorlake npm package compromised by Shai-Hulud](https://www.endorlabs.com/learn/tensorlake-npm-package-compromised-by-shai-hulud-in-latest-software-supply-chain-attack)
- [GBHackers - Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware](https://gbhackers.com/tensorlake-package-hijacked/)
- [The Next Web - Zenity says one prompt took over every AgentCore agent in an AWS account](https://thenextweb.com/news/aws-agentcore-zenity-agentcorruption-one-prompt-agents)
- [Dark Reading - 'AgentCorruption' Puts AWS Environments At Risk With One Prompt](https://www.darkreading.com/cloud-security/agentcorruption-aws-environments-at-risk-single-prompt)
- [Gen Digital - Warden Stealer Rust Infostealer Analysis](https://www.gendigital.com/blog/insights/research/warden-stealer-rust-infostealer-analysis)
- [GBHackers - Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data](https://gbhackers.com/warden-stealer-malware/)
- [CrowdStrike - Unknown Threat Actor Uses ARTEX to Target South Korean Finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/)
- [The Hacker News - ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html)
- [Infosecurity Magazine - Chinese Hacker Deployed AI in Campaign Against South Korean Banks](https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/)
- [Startup Fortune - Developer of hacked bank tool ARTEX pulls it from public GitHub](https://startupfortune.com/developer-of-hacked-bank-tool-artex-pulls-it-from-public-github/)
- [Help Net Security - PCI SSC calls for human approval of AI agent actions involving cardholder data](https://www.helpnetsecurity.com/2026/10/09/pci-ssc-payment-environments-ai-security-guidance/)
- [PCI SSC - Security Considerations for AI Systems v1 (PDF)](https://docs-prv.pcisecuritystandards.org/Guidance%20Document/AI/PCI_SSC_Security_Considerations_for_AI_Systems_v1.pdf)

*Informational security guidance. Not certification.*