Also available as plain text · markdown source

Security Monitor 2026-10-27

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is where your prompts and agent data actually end up. Cloudflare says a GLM-5.3 model on Workers AI answered 155 long-context requests with fragments of other customers' requests between August 27th and September 9th. The cause was a KV cache pool smaller than the advertised context window plus an SGLang bug in disaggregated serving that let decode read stale cache pages. Cloudflare found no evidence of deliberate exploitation, and SGLang says operators should be on v0.5.22 or later. On the same day, Warp's CEO said an agent swarm got in through a vendor in Warp's infrastructure and reached "a limited amount of agent trace and telemetry data" for up to roughly 1% of users. And Xint showed that OpenAI's compaction step could be steered into copying a model's hidden reasoning out in plain text; OpenAI fixed it on October 23rd.

The operator clock moved too. CISA added the Brotli decoder bug, CVE-2026-111497, to KEV today with a November 10th federal due date, a day after ELLIO recorded the first in-the-wild exploit attempt against an official Node.js build. PHP2Shell's KEV deadline is Thursday. On the agent tooling side, NVIDIA rated a missing-authentication bug in NeMo Agent Toolkit (CVE-2026-65145) at CVSS 10.0, OpenHands' Software Agent SDK shipped its sandbox agent server with authentication off by default before 1.52.0 (CVE-2026-112346), and VulnCheck published nine command-injection CVEs against nine MCP servers, eight with no fix.

Attackers are writing for the agent, not just the human. Sublime Security says an invoice fraud campaign hid a prompt in invisible Unicode Tag characters telling an email-reading agent to forward the invoice to accounts payable. TrendAI says one operator ran 44 AI agents through CyberStrikeAI against at least 19 organizations, and another went after AI workflow platforms and inference services to get cheap inference capacity.

Headline Developments

1. Cloudflare Workers AI: a GLM-5.3 cache bug returned other customers' prompt data in 155 responses HIGH

Source: Cloudflare: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (October 26th). Also SGLang security update: improving request isolation (October 26th).
- Cloudflare says a researcher, Gadi Evron of Knostic, reported through its HackerOne program on September 8th that very long prompts to @cf/zai-org/glm-5.3 sometimes returned text from other users' sessions. Cloudflare reproduced it the next morning, took the model offline within 40 minutes of declaring an incident, and restored it on September 9th. It says no other Workers AI model was affected.
- Between August 27th and September 9th, 155 responses contained data from other customers' requests made to the same model shortly before. All were to prompts longer than 681,280 tokens. After excluding its own and the researcher's testing, Cloudflare says the requests look like ordinary long-context use, and it found no evidence of deliberate exploitation.
- Two things lined up. Cloudflare advertised a 1,048,576-token context window, but the prefill KV cache pool only held 681,280 tokens; Cloudflare says it knew about the mismatch and expected the engine to return an error. In SGLang's disaggregated prefill/decode mode, an over-length request was marked rejected and swapped for a one-token placeholder but still went through the handoff, so the decode node generated a reply over cache pages that still held earlier requests' data. Cloudflare notes KV pages aren't zeroed between requests, which is common for performance.
- Cloudflare resized the pool (now about 2.04 million tokens), patched the rejection path, and worked the fix upstream. SGLang says operators running disaggregated serving should move to v0.5.22 or later, check pool size against context length from the engine's own startup log after every change, and not assume a proxy or the engine will reject what doesn't fit.

Why this matters: It's HIGH because it's a cross-tenant data exposure in a shared inference service, with no attacker needed. The trigger was a configuration check nobody enforced and tests that looked at HTTP status codes instead of output. If you run your own inference stack, KV cache ownership is a tenant isolation boundary. If you use a hosted one, assume prompts can surface where you didn't expect and keep secrets out of them.

2. Brotli (CVE-2026-111497) joins KEV a day after the first in-the-wild exploit attempt CRITICAL

Source: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 27th). Also ELLIO: Node2Shell (CVE-2026-111497) aka HTTP2Shell and Broccoli2Shell: RCE analysis (updated October 26th) and NVD: CVE-2026-111497.
- CISA added Google Brotli CVE-2026-111497 to KEV on October 27th (catalog version 2026.10.27), with a federal due date of November 10th. CISA's entry describes a remote unauthenticated attacker corrupting decoder memory, disclosing memory, crashing the process or potentially running code with a crafted Brotli stream. NVD lists Brotli 1.0.3 through 1.2.0 (CVSS 4.0 9.2 from Google's CNA).
- ELLIO says its sensors recorded a 23,069,983-byte Brotli-compressed request body at 15:08 UTC on October 26th (11:08 AM ET) built for the official Node.js 24.22.0 build. ELLIO says the delivery matched public tooling, but the attacker's final stage got zero shells in 50 replays against a vulnerable target, while a chain built from the public construction does return a shell. Treat it as an attempt, not a confirmed compromise.
- The fixes haven't changed since our October 23rd coverage: Node.js 22.23.4, 24.22.1 and 26.12.1, Brotli 1.0.10, 1.1.1 or 1.2.1, and the runtime-specific updates covered October 25th and 26th. A process that already loaded the old decoder stays vulnerable until it restarts.

Why this matters: It's CRITICAL because it's now on KEV and the decoder sits in ordinary API traffic on both sides, in request bodies you accept and responses you fetch. Container images and CI runners carry their own copy of Node and Brotli, so host patching alone won't cover them.

3. Agent tooling CVEs: NVIDIA NeMo Agent Toolkit at CVSS 10, OpenHands' open sandbox server, and nine MCP servers CRITICAL

Source: NVIDIA: Security Bulletin: NeMo Agent Toolkit - October 2026 (October 27th); NVD: CVE-2026-112346 (October 26th); NVD: CVE-2026-117558 and the eight related VulnCheck records (October 27th).
- NVIDIA NeMo Agent Toolkit: NVIDIA's bulletin rates CVE-2026-65145, a missing-authentication bug (CWE-306), at CVSS 3.1 10.0, with possible code execution, privilege escalation, data tampering, denial of service and information disclosure. It affects 1.0 through 1.8.0 and is fixed in 1.9.0. The same bulletin lists CVE-2026-65151, a local SQL injection (CVSS 8.4) in 1.4 to 1.6, fixed in 1.7.0. NVIDIA says both were found externally. Neither is on KEV.
- OpenHands Software Agent SDK: before 1.52.0, the DockerWorkspace and Apptainer launchers bound the sandbox agent server to all interfaces with an empty session_api_keys list, so authentication was off by default. NVD says anyone who can reach the published container port can run shell commands as root in the sandbox, reach the mounted workspace and read plaintext secrets from the secrets store (CVE-2026-112346, CVSS 3.1 9.8 from VulnCheck; GHSA-rp7h-crm7-h5qj). The fix is in v1.52.0. Not on KEV.
- Nine MCP servers: VulnCheck published nine CVEs, CVE-2026-117558 through CVE-2026-117573, against ai-sdlc's MCP server, DroidMind, the ATXP Gemini CLI extension, sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, nmap-mcp and hagent. Eight are OS command injection, where a tool parameter reaches execSync, child_process.exec or subprocess.run(shell=True); nmap-mcp's is an allowlist that lets exploit, dos and brute script categories through. Several NVD records name prompt-injected agents as the attacker; CVE-2026-117560 says instructions planted in email or SMS content can do it, and CVE-2026-117568 says a crafted file or directory name is enough. Most score CVSS 4.0 8.5 as local attacks. Only ai-sdlc has a fix commit referenced; the others list no fixed version. None are on KEV.

Why this matters: It's CRITICAL because two of these are network-reachable with no credentials, and the agent sandbox in OpenHands' case holds the secrets the agent works with. The MCP batch shows the "local" score is misleading when the caller is an agent reading untrusted email. Upgrade where fixes exist, and uninstall or isolate unfixed MCP servers rather than waiting.

4. Warp: an agent swarm reached agent trace and telemetry data through a vendor MEDIUM

Source: Zach Lloyd (Warp CEO) on X (October 26th). Also BleepingComputer: Warp discloses breach exposing AI agent logs, user telemetry data (October 27th).
- Warp's CEO says the company became aware on Friday, October 23rd, of "an active and narrow-banded exploitation of a vendor in Warp's infrastructure," detected it within hours, and remediated it. He says the attack appears to have come from "an agent swarm," likely starting with a hole in a vendor dependency, and ultimately reached a limited amount of agent trace and telemetry data.
- He puts the upper bound at roughly 1% of Warp users, says Warp has notified everyone it positively identified as affected, and says CrowdStrike and law enforcement are involved.
- BleepingComputer notes Warp hasn't said whether the exposed traces included source code, prompts or credentials.

Why this matters: It's MEDIUM because the scope is small and still being investigated, but agent traces are exactly where secrets land by accident: command output, environment dumps, pasted tokens. If you used Warp's agents, assume anything that passed through a session could be in those traces and rotate accordingly once Warp's instructions arrive. Scrub traces before they're stored, wherever you run agents.

5. Attackers write for the agent: hidden prompts in invoice fraud, and a 44-agent intrusion platform MEDIUM

Source: Sublime Security: Invoice fraud campaign adds prompt injection aimed at email AI agents (October 26th). Also TrendAI: Not Only ARTEX: The Different Levels AI Is Used in Attacks Targeting Japan (October 27th).
- Sublime says that on October 22nd it found an invoice fraud campaign that hid a prompt for an email-reading AI agent in a 1px, zero-height, white-text HTML span, written in invisible Unicode Tag characters. Decoded, it told the agent to forward the email and its PDF to an ap.confirm+ address at the target. The visible email used a fabricated reply chain impersonating the target's CEO or co-founder, sent to the Financial Controller, and pushed an invoice of about $88,000. Sublime says models it tested ranged from not seeing the text to flagging it as an injection.
- TrendAI reconstructed three attack setups from attackers' open directories. In one, the operator ran CyberStrikeAI, an open-source AI pentest platform, with 44 agents splitting reconnaissance, exploitation, command and control and reporting; at least 19 organizations, including at least 16 in Japan, went through its validation workflow in October. A second, human-led operator used an LLM for planning and tooling and targeted AI workflow platforms and inference services, which TrendAI infers was to get large amounts of inference capacity cheaply. TrendAI says entry points were still known weaknesses and misconfigurations, not AI-found zero-days.

Why this matters: It's MEDIUM because neither is a new exploit class, but both show attackers adapting to agents on both sides. If an agent reads inbound email, strip invisible characters and hidden HTML before the model sees it, and don't let it forward or pay on its own. If you run inference or AI workflow platforms, put them in your asset inventory as attack surface.

6. Xint: OpenAI's compaction step could leak a model's hidden reasoning CONTEXT

Source: Xint: Stealing OpenAI Reasoning Traces via Compaction Smuggling (October 26th). Also The Hacker News (October 27th).
- Xint says it sent a task to gpt-5.6-sol, kept the encrypted reasoning item, then called /responses/compact with instructions to preserve that reasoning verbatim, with spaces swapped for tabs to get past usage-policy classifiers. Because compaction items are portable, it then had gpt-4.1 and gpt-4o echo the item back in plain text.
- It worked because the mitigations OpenAI deployed in August, after the Stolen Thoughts research showed encrypted reasoning could be replayed into a weaker model, didn't apply: the compaction step runs on the same model that produced the reasoning. Xint says OpenAI confirmed the issue, deployed a fix on October 23rd and paid a $6,000 bounty. Developers don't need to change anything.
- Xint says it can't prove token-for-token fidelity without the original plaintext, though the recovered trace keeps the false starts and self-corrections you'd expect. Its write-up covers its own requests to gpt-5.6-sol; the risk it describes is distillation of a model's raw reasoning, not access to other users' data.

Why this matters: It's CONTEXT because the fix is server-side and there's no customer action. The lesson is broader: any server-side step that reads decrypted state and follows the caller's instructions can become an exfiltration path, the same shape as Story 1's cache and Story 4's traces.

Continuity Footnotes

  • PHP2Shell (CVE-2026-109618, CVE-2026-109619): covered October 21st, 23rd and 26th. Both are on KEV with a federal due date of this Thursday, October 29th. Nothing new today (CISA Known Exploited Vulnerabilities Catalog).
  • CISA KEV: the catalog moved to version 2026.10.27 today (1,760 entries). Besides Brotli (Story 2), CISA added Adobe Commerce and Magento CVE-2026-48356, an unrestricted file upload that CISA says could lead to arbitrary code execution, also due November 10th.
  • AGENTS.md in the Downloads folder: covered October 25th. Wider press coverage today, nothing new in substance.
  • Reference MCP servers v2.1.0: covered October 25th. All eight GHSAs (including GHSA-mvf5-2qqv-rg3c) still have no CVE aliases.

Pattern Analysis

  1. The inference path is a data store whether you planned it or not (October 26th to 27th): a shared KV cache (Story 1), agent traces at a vendor (Story 4) and a compaction step that read decrypted reasoning (Story 6) all held data their owners didn't expect to be reachable. Yesterday's HiddenLayer gateway research made the same point about the hop between agent and model. Secrets that pass through prompts, traces and logs by accident need scanning and scrubbing; encoding or encryption at one layer doesn't stop a later layer from reading them.
  2. Agent tool servers still ship open doors (October 22nd to 27th): MCP Inspector (October 22nd), FastMCP (October 24th), Google's MCP Toolbox (October 26th), and today NeMo Agent Toolkit, OpenHands and nine MCP servers (Story 3). Missing auth, all-interfaces binds and shell=True keep showing up.
  3. Attackers aim at agents and at inference capacity (October 20th to 27th): hidden prompts for email agents and inference-service targeting (Story 5) sit alongside the AI-key theft behind the Railway and Zeabur incidents covered earlier this month.

Immediate (today):
1. Patch Brotli everywhere it decodes: Node.js 22.23.4, 24.22.1 or 26.12.1, Brotli 1.0.10 / 1.1.1 / 1.2.1, and the runtime updates covered October 25th and 26th. Rebuild images and CI runners and restart long-running workers. Federal deadline November 10th.
2. Federal operators: PHP2Shell CVE-2026-109618 and CVE-2026-109619 are due Thursday, October 29th.
3. Upgrade NVIDIA NeMo Agent Toolkit to 1.9.0 and OpenHands Software Agent SDK to 1.52.0. For OpenHands, also check that sandbox ports weren't published beyond localhost and rotate any secrets the sandbox held.
4. Inventory MCP servers against the nine CVEs in Story 3. Where there's no fix, remove the server or run it in an isolated, low-privilege account with no secrets in reach.

This week:
5. If you run SGLang in disaggregated prefill/decode mode, move to v0.5.22 or later and compare KV pool size to context length from the engine's startup log after every model, quantization or parallelism change.
6. If you used Warp's agents, watch for Warp's notice and rotate any credential that appeared in an agent session.
7. Sanitize inbound email before an agent reads it: strip Unicode Tag characters (U+E0000 to U+E007F) and hidden HTML, and require a human for forwarding or payment actions.

Ongoing:
8. Treat prompts, KV caches, agent traces and logs as places secrets land by accident. Scan and scrub them; keep keys in vaults and NHI stores, not in the model path.
9. Add inference services, AI workflow platforms and GPU environments to your asset inventory and exposure reviews.

Relevant Risk Summary

Risk Severity Recommended Actions
Cross-tenant KV cache exposure in shared inference (Cloudflare Workers AI GLM-5.3 / SGLang) HIGH SGLang v0.5.22+; check pool vs context length; keep secrets out of prompts
Brotli CVE-2026-111497 (KEV, due Nov 10) CRITICAL Patch runtimes and libraries; rebuild images; restart workers
NeMo Agent Toolkit CVE-2026-65145 / 65151, OpenHands CVE-2026-112346, nine MCP server CVEs CRITICAL NeMo 1.9.0; OpenHands 1.52.0; remove or isolate unfixed MCP servers
Warp agent trace and telemetry exposure via vendor MEDIUM Follow Warp's notice; rotate credentials seen in sessions; scrub traces
Hidden prompts for email agents; agent-run intrusion platforms MEDIUM Strip hidden text; human approval for forward/pay; inventory AI infra
OpenAI compaction reasoning-trace leak (fixed Oct 23) CONTEXT None required
PHP2Shell CVE-2026-109618 / 109619 (KEV, due Oct 29) CRITICAL Confirm patched before Thursday

Sources

Informational security guidance. Not certification.