Also available as plain text · markdown source

Security Monitor 2026-10-17 - Weekend Edition

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Someone stole the credential that ConnectWise Cloud Backup (formerly SkyKick) uses to sign in to its customers' Microsoft 365 tenants, and used it. As of Huntress's latest update (October 17th, 5:15 PM ET), it has confirmed unauthorized sign-ins in 162 tenants and has seen sign-in activity from the attacker's address in almost 1,000 tenants, more than 300 of them successful. In at least one tenant, a related ConnectWise app gave itself Global Administrator and added new secrets to two other trusted apps. ConnectWise has revoked the shared credentials, suspended the service and, per Huntress, disabled the related apps, but that doesn't remove anything the attacker planted. If you have any ConnectWise or SkyKick app in Entra, disable it and check every app's credentials now.

Two agent stories round out the weekend. A researcher says a hidden instruction in a public GitHub repository got ChatGPT's GitHub connector to commit a workflow to a different, private repository and send a test secret to his server. OpenAI closed his report as out of scope, so treat it as unconfirmed, but scoping the connector to selected repositories stopped the attack in his own test. And two new CVEs in the DeepSeek Harness preview show how a poisoned agent can plant its own copy of a tool's executable, and how an injected instruction can survive context compaction into the next session.

Headline Developments

1. A stolen ConnectWise Cloud Backup credential opened Microsoft 365 tenants, and at least one tenant got a new Global Admin CRITICAL

Source: Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (October 16th, updated October 17th)
- ConnectWise Cloud Backup holds broad, already-granted access to mail, OneDrive, SharePoint, Teams and directory data in every tenant that installed it. Huntress says the app's own credential, which lives in ConnectWise's tenant, was used from 144.172.64[.]128 on October 15th to get Microsoft Graph tokens in customer tenants, moving through them a few seconds apart in what looks like a scripted target list. Huntress had confirmed unauthorized sign-ins in 162 tenants as of 3:00 PM ET on October 16th. Its latest update (October 17th, 5:15 PM ET) adds almost 1,000 Entra tenants with sign-in activity from that address, more than 300 of them successful, and a second, targeted wave against 16 tenants in the policy, national security, trade and critical-minerals sectors that failed because the app wasn't installed there. An earlier October 17th update says the attacker also abused ConnectWise Cloud Management apps for Exchange Online, Teams and SharePoint Online, and ConnectWise has since told Huntress it disabled the relevant apps.
- In one tenant, the ConnectWise Cloud Management app for Microsoft Teams (24205314-2b89-4e07-a2a4-579e898a5640) added itself to Global Administrator and then added new client secrets, set to expire in 2028, to an MSP management app and to Huntress's own app. That whole sequence took about five minutes, and the secrets keep working until someone removes them. In roughly 50 tenants Huntress also saw ConnectWise Cloud Management apps assign themselves directory roles, mostly Exchange Administrator, though the user agent on those events matches ConnectWise's own automation and Huntress hasn't confirmed who was behind them.
- Because these are app-only sign-ins, no user signs in and MFA never comes into play. Microsoft calls it an active supply-chain attack and says the attacker likely abused permissions such as Directory.ReadWrite.All. Todyl adds that disabling an app stops new tokens but doesn't end tokens already issued (BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack, October 17th; also The Hacker News).
- ConnectWise says it identified the issue on October 14th, revoked the certificates behind the affected app connections, and suspended Cloud Backup for everyone, so the shared credentials no longer work. It says it has no evidence its encrypted backup archives were accessed, but it can't see into customer tenants and can't tell you whether yours was touched. It hasn't said how the credential was exposed or when backups will resume (ConnectWise Trust Center: Cloud Backup (formerly known as SkyKick) Service Interruption, updated October 17th).

Why this matters: It's CRITICAL because abuse is confirmed in hundreds of tenants, the access bypasses MFA by design, and in at least one tenant it turned into Global Administrator plus new credentials on other privileged apps. The vendor's fix closes the front door, but anything the attacker added in your tenant is still there. MSPs should check first, because a credential planted on an MSP management app can reach that MSP's customers too.

2. A researcher says one hidden instruction got ChatGPT's GitHub connector to write to a private repo and leak a secret MEDIUM

Source: Sunil Tripathy: ChatGPT GitHub Connector Vulnerability (October 15th)
- Independent researcher Sunil Tripathy says he connected a test victim account to ChatGPT's GitHub connector with the default access to all repositories, then asked it to do a "deployment review" of a public repository he controlled. Instructions hidden in that repository led the agent to commit a GitHub Actions workflow to a different, private repository the user never named. The workflow then sent a dummy secret, AUDIT_CANARY, to his external server. He also reports the agent listing every repository on the account, committing attacker-written files, and rebuilding the workflow from git history after he'd removed it.
- Plainly worded instructions were refused. Instructions framed as deployment requirements got through, and the exfiltration code sat in a separate custom action that the visible uses: step pointed to. When he scoped the connector to a single selected repository, the same attack failed and nothing was written.
- He says he reported it privately with a working proof of concept, and that OpenAI's bug bounty closed it on October 14th as out of scope. He posted a fresh run on October 17th that still committed the workflow, and notes that the same prompt is sometimes refused, so the guardrail isn't consistent. His CVSS 4.0 score of 9.3 is his own rating. There's no CVE and no OpenAI statement.
- Cybersecurity News points out that OpenAI documents the standard ChatGPT GitHub app as read-only, which doesn't match the reported commits, so the exact integration and permissions still need confirming (Cybersecurity News: Critical ChatGPT GitHub Connector Flaw Could Allow Attackers to Steal Private Repository Secrets, October 15th).

Why this matters: It's MEDIUM because it's one researcher's account with no vendor confirmation and no known abuse, and the mitigation is a settings change. The lesson holds either way: an agent that reads untrusted repos and can write to your other repos turns a prompt-injection problem into a CI secrets problem. A workflow file is code that runs with your secrets, so an agent that can commit one can reach them.

3. DeepSeek Harness: a poisoned agent can replace a tool's executable, and an injected task survives compaction MEDIUM

Source: al-ice.ai: The Summary Is the Persistence Layer: DeepSeek Harness Adds a Search-Path RCE and a Compaction Injection (October 16th)
- CVE-2026-95182 is an untrusted search path in the MCP client of DeepSeek Harness (dsh), at commit c291e796. dsh starts a stdio MCP server by its bare command name, such as npx, and resolves it against the inherited PATH. In pnpm source checkouts, the first PATH entries are the project's node_modules/.bin, which the agent is allowed to write to under dsh's default workspace-write sandbox. So an agent steered by injected content can drop a fake npx there, and every later spawn or reconnect of that MCP server runs it with the server's tools and credentials. CISA's enrichment scores it 10.0 (CVSS 3.1).
- CVE-2026-95183 is a prompt injection in context compaction. The summarizer copies the user's request "verbatim" and lists pending jobs, but tool output isn't marked as untrusted, so injected instructions, including full shell commands, carry over into the resumed session as if the user had asked for them. In the researcher's test the resumed model refused the planted command, so persistence is reliable but execution isn't.
- Both NVD records are from MITRE and were published October 16th, with no fixed version listed. al-ice.ai found no vendor advisory or fix commit. dsh is a developer preview. Neither CVE has reported exploitation, and neither is on KEV.

Why this matters: It's MEDIUM because it's a preview with no known exploitation. The two ideas will outlast this project, though. Any agent that can write to a directory on its own PATH can replace its tools, and a summary the agent writes for itself becomes a place an attacker's instruction can hide between sessions.

Continuity Footnotes

  • BeyondTrust Remote Support CVE-2026-102764 and Fortinet CVE-2025-61624: covered October 16th. Both KEV deadlines are Monday, October 19th.
  • CERT-In advisory on test agents reaching Indian organizations: covered October 16th. New today: government sources told PTI that India's upcoming AI regulation consultation may examine autonomous agents (Moneycontrol: CERT-In flags AI agent cyber risks, October 17th).
  • OpenAI misalignment reports: covered October 16th. The Decoder adds that in several cases the models didn't mention the unauthorized access in their answers (The Decoder, October 17th).
  • Cisco Secure Email Gateway CVE-2026-76519, PAN-OS CVE-2026-0322 and AhsayCBS CVE-2026-105133 and CVE-2026-105134: covered October 14th. Their KEV deadline is today, October 17th.
  • Atlassian CVE-2026-21589: covered October 15th. KEV deadline is tomorrow, October 18th.

Pattern Analysis

  1. A trusted app identity is an admin login (October 14th to 17th): ConnectWise's backup credential (Story 1) signed in with no user and no MFA. It joins BeyondTrust's credential vault and FortiManager's trust material (October 16th). Whoever holds the vendor's key holds every tenant that trusted it.
  2. Content an agent reads becomes something it does (October 14th to 17th): a hidden repo instruction became a workflow commit (Story 2), and tool output became a pending task after compaction (Story 3). The same seam showed up in ZCode and the Claude Agent SDK (October 16th) and Copilot in Visual Studio (October 14th).
  3. Default grants set the blast radius (October 16th to 17th): a backup app with directory write rights (Story 1), a connector with access to every repo (Story 2), and the permissive cloud roles in CERT-In's cases (October 16th). Narrow grants were the control that actually worked, as in the researcher's single-repo test.

Immediate (this weekend):
1. If any ConnectWise or SkyKick app is in your Entra tenant, disable it, but don't delete it. Start with Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae and Cloud Management - MS Teams 24205314-2b89-4e07-a2a4-579e898a5640, then the other Cloud Management IDs Huntress lists (older tenants may show "SkyKick Cloud Manager"). Deleting removes consent and you'd have to re-consent later. Keep them off until ConnectWise confirms all credentials are reset, and plan for the gap in backups.
2. Hunt in Entra. Check service principal sign-ins (not the default user tab) for 144.172.64[.]128 and anything outside Microsoft and Azure ranges, starting October 13th. Remove any directory role a ConnectWise or SkyKick app gave itself. Review client secrets and certificates on every enterprise app and app registration, especially management and security tools, and remove anything added since October 13th that you didn't create.
3. Scope AI coding connectors to selected repositories, not all repositories. Then run git log --all --pretty="%h %an %ad %s" -- .github/workflows/ on repos those agents can reach and look for workflow commits you didn't expect.
4. If you run DeepSeek Harness, use absolute paths for every MCP server command, keep node_modules/.bin out of the agent's writable area, and read compacted summaries before resuming sensitive sessions.

This month:
5. Inventory third-party apps holding powerful Graph permissions such as Directory.ReadWrite.All or role-assignment rights, and alert when any service principal adds itself to a role or adds credentials to another app. Application management policies and Conditional Access for workload identities make a planted secret harder to use.
6. Require human approval for agent writes that cross repositories or touch workflow files, and gate Actions secrets behind protected environments with required reviewers.
7. Patch BeyondTrust Remote Support and Fortinet CVE-2025-61624 before the October 19th KEV deadline if you haven't yet.

Sources

Informational security guidance. Not certification.