# KLM Innovation Security Monitor - Weekend Edition
**Date:** November 8, 2026

> Informational security guidance. Not certification. Not a substitute for scoped human review.

## Executive Summary
Today's theme is that your secrets are what the agents are hunting. Microsoft says attackers are using the ARTEX agent framework to search GitHub for leaked app secrets and AI service keys, then sign in with them. In one case an agent went from a GitHub search to pulling data out of Azure Key Vault in five minutes. VulnCheck says the same IP address hit its Langflow decoys through CVE-2025-3248, which has been in KEV since May 2025, and spent 36 minutes working out how to decrypt the keys stored inside. Microsoft also says a group it tracks as Storm-3358 is now using ARTEX against banks. Per LATENT's analysis of Apiiro's research, Claude Code's "don't ask again" approvals had saved 1,379 distinct secrets into 1,122 settings files in public GitHub repos. Check Point published a now-fixed way around ChatGPT's Lockdown Mode, and new CVE records cover critical JupyterLab Desktop and Tracecat bugs whose fixes have been available since July and June, respectively.

No new KEV additions; none of today's new CVEs are in KEV.

## Headline Developments

### 1. ARTEX agents are hunting leaked secrets and AI keys, from GitHub and from exposed Langflow (HIGH)
**Source:** [Microsoft: Threat actors use agentic AI tooling to find and abuse exposed secrets](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/) (November 5th). Also [VulnCheck: Our Canaries Caught Microsoft's Agentic AI Secret Hunter Exploiting Langflow](https://www.vulncheck.com/blog/microsoft-secret-hunter) (November 8th), [Microsoft: ARTEX abuse expands as cybercriminals target financial sector](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/) (November 6th) and [Censys: ARTEX: Agentic Asbestos](https://censys.com/blog/artex-agentic-asbestos/) (November 5th).
- **GitHub to the cloud:** Microsoft says that starting in August, attackers used ARTEX, an open-source autonomous pentesting framework, to send large volumes of GitHub searches for secrets, often pairing a target company's name with keywords for cloud or AI services. From October 28th, Microsoft saw successful sign-ins as app identities (service principals) from 199.19.77[.]84 on dozens of apps across several tenants. One was a vendor's app that's installed in many customer tenants, so one stolen secret opened the way into its customers. Microsoft doesn't name the actor.
- **What the agents went after:** storage keys, connection strings, Key Vault secrets, SharePoint and OneDrive files, more secrets in Azure DevOps, and scripts run on VMs through Run Command. Microsoft says they kept coming back to AI service keys. When a cloud request failed, the agent fixed it and retried within about 28 to 80 seconds.
- **Same address, different door:** VulnCheck says 199.19.77[.]84 hit its Langflow decoys on the evening of November 6th (US time) through **CVE-2025-3248**, the unauthenticated code injection in Langflow before 1.3.0 (VulnCheck, the CNA, CVSS 3.1 9.8; **in KEV since May 5th, 2025**). Over 36 minutes it ran 11 stages: dumped environment variables, `.env` files and the Langflow database, searched logs and saved flows for AI provider keys, checked the Docker socket and cloud metadata service, then kept trying until it decrypted Langflow's stored variables with the instance's own secret key. Only decoy data was recovered in this session; VulnCheck says no real customer was touched. VulnCheck says it can't prove from traffic alone that an AI agent ran the session, but each stage built on the last and retries came at machine speed.
- **Banks too:** Microsoft says Storm-3358, which it describes as a financially motivated, Cambodia-based cluster, started using ARTEX against financial organizations in October, mostly in Southeast Asia plus some large institutions elsewhere. The agents exploit anonymous file upload and server-side request forgery bugs, then pull down the WISP, vshell and AdaptixC2 remote access tools with curl and netcat. Separately, Censys counted 1,465 internet-exposed ARTEX consoles as of November 4th.
- No new CVE. CVE-2025-3248 was fixed in Langflow 1.3.0.

**Why this matters:** It's HIGH because the time between a secret leaking and someone using it is now minutes, and the agents doing it go straight for AI keys and the cloud access behind them. Deleting a leaked secret from a repo doesn't help; rotating it does. Microsoft says to treat any secret that reached a public repo as compromised, rotate everything in any Key Vault the affected app could read, and move apps to managed identities so there's no secret to leak. If you've ever had Langflow on the internet, treat every key stored in it as exposed. IP blocks won't hold for long, so hunt for behavior too.

### 2. Claude Code's "don't ask again" saved secrets into settings files; LATENT reports Apiiro found 1,379 on public GitHub (HIGH)
**Source:** [Apiiro: coding agents leaking secrets to GitHub through "don't ask again"](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again) (November 5th, updated November 8th). Also [LATENT: Claude Code's "Don't ask again" and secrets in public repositories](https://latent.tokyo/en/articles/2026-11-08-claude-code-dont-ask-again-secrets) (November 8th) and [Claude Code issue #5544](https://github.com/anthropics/claude-code/issues/5544).
- When you pick "Yes, and don't ask again" for a shell command, Claude Code saves that exact command as a permission rule in `.claude/settings.local.json` in the project folder. If the command had a password or token in it, such as a database connection string, `sshpass -p` or a curl call with a bearer token, the secret is saved in plain text.
- According to LATENT's November 8 analysis of Apiiro's research, Apiiro collected 104,185 copies of that file from public GitHub repos between November 1st and 3rd and found 1,379 distinct secrets in 1,122 of them. LATENT calculates that more than a third were database passwords or service-role keys. Counting shared settings files, git history and saved chat logs, Apiiro's total reached 2,539 distinct secrets across 1,994 repos. Apiiro didn't test the credentials; it judged them by format and whether they were paired with a public host.
- LATENT reports that, in Apiiro's tests, gitleaks flagged 564 of the 1,122 files and TruffleHog 643; 215 were missed by both. The scanner versions and settings weren't published.
- Claude Code adds the file to the machine's global git ignore list when it creates it. That doesn't help on a new machine or container, in a copied project folder, or once the file is already committed. The problem was first filed as issue #5544 in August 2025; a bot closed it as "not planned" for inactivity on January 3rd. LATENT reports that a Claude Code team member said on November 7th the team is looking at ways to prevent this, and found no fix in the changelog as of November 8th.
- No CVE. This is product behavior, not a versioned bug, so nothing to check against KEV.

**Why this matters:** It's HIGH because this is exactly what the agents in Story 1 are searching GitHub for, and LATENT calculates that more than a third were database passwords or service-role keys. Rotate first, then clean up, because removing a rule leaves it in git history and forks. Add the local file to `.gitignore` and `.dockerignore`, keep passwords in environment variables instead of typed into commands, and approve command patterns rather than exact commands.

### 3. ChatGPT Lockdown Mode: a popup got past it, now fixed (MEDIUM)
**Source:** [Check Point Research: ChatGPT Lockdown Mode Bypass](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/) (November 5th). Also [The Hacker News](https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html).
- Lockdown Mode is an optional ChatGPT setting OpenAI introduced for enterprise plans in February and expanded to personal and self-serve Business accounts in June. It reduces prompt-injection data-exfiltration risk by limiting live web access and other outbound features.
- Check Point found that the HTML previews ChatGPT renders inside code blocks ran in a sandbox that still let popups open and escape it. By creating one more frame inside the preview, a page could open a popup that wasn't held by the sandbox or by Lockdown Mode. From there, an attacker could send chat history out, show fake "update" or sign-in pages that look like they belong to ChatGPT, or push a malware download.
- Check Point says that in the ChatGPT Classic desktop app, popups opened without a click, so just having the conversation could leak data. The trigger could be a malicious prompt, a malicious GPT or a shared chat.
- Check Point says OpenAI told it on September 18th that a fix had been deployed, and its retest confirmed the described technique no longer worked. Details came out this week. No CVE is assigned in the cited disclosure.

**Why this matters:** It's MEDIUM because it's already fixed, but the lesson holds: a safety mode is only as strong as every feature around it, and a new preview feature quietly reopened the path Lockdown Mode was meant to close. Don't treat one setting as the control for your most sensitive chats. Be careful with shared chats and third-party GPTs, and keep desktop clients current.

### 4. New CVEs for already-fixed JupyterLab Desktop and Tracecat bugs (HIGH)
**Source:** [NVD: CVE-2026-86044](https://nvd.nist.gov/vuln/detail/CVE-2026-86044) and [GHSA-2mr8-962v-wc67](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-2mr8-962v-wc67); [NVD: CVE-2026-102530](https://nvd.nist.gov/vuln/detail/CVE-2026-102530) and [GHSA-vrj4-r4fw-9rfh](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh) (JupyterLab Desktop CVE records published November 6th; advisories published July 24th; fix released July 22nd); [NVD: CVE-2026-58490](https://nvd.nist.gov/vuln/detail/CVE-2026-58490) and [GHSA-6g53-h6fh-c3pj](https://github.com/TracecatHQ/tracecat/security/advisories/GHSA-6g53-h6fh-c3pj) (Tracecat CVE record published November 6th; advisory published July 13th; fix released June 15th).
- **JupyterLab Desktop (CVE-2026-86044):** before **4.6.2-1**, a crafted link in an untrusted notebook could take over the app window with one click. The attacker's page could then read the local Jupyter server address and its login token, create a notebook, mark it trusted and run code as you. It needs a local session managed by the app (the default) with a JupyterLab version before 4.4.8; if your environment already runs JupyterLab 4.4.8 or later, the first step fails. GitHub, the CNA, scores it CVSS **3.1 9.6 CRITICAL**. Fixed in **4.6.2-1**. Not in KEV.
- **JupyterLab Desktop (CVE-2026-102530):** before **4.6.2-1**, a crafted remote server address that a user is talked into entering could run script in the app's Welcome screen and reach code execution. GitHub scores it CVSS **4.0 9.4 CRITICAL**. Fixed in **4.6.2-1**. Not in KEV.
- **Tracecat (CVE-2026-58490):** Tracecat is an open-source security automation platform for teams and AI agents. Versions 0.37.0 through 1.0.0-beta.48 are affected only in Docker Compose deployments with SAML enabled and both signature requirements unset, empty or false under the affected deployment defaults. An attacker who can reach the SAML login endpoint could then forge a sign-in as any existing user, including a superadmin. Fargate and Helm deployments aren't affected in their default setup. GitHub scores it CVSS **3.1 9.8 CRITICAL**. Fixed in **1.0.0-beta.49**. Not in KEV.
- We found no reports of exploitation for any of the three.

**Why this matters:** It's HIGH for the affected configurations: JupyterLab Desktop requires a malicious notebook link or submitted server URL, and Tracecat requires SAML-enabled Docker Compose with both signature requirements disabled. Successful exploitation can run code as the desktop user or take over an existing Tracecat superadmin account. Upgrade JupyterLab Desktop to 4.6.2-1 or later and don't open notebooks from people you don't know in the meantime. On Tracecat Docker Compose with SAML, set `SAML_SIGNED_ASSERTIONS` and `SAML_SIGNED_RESPONSES` to `true` today, then upgrade to 1.0.0-beta.49 or later.

## Continuity Footnotes
- **KEV today:** no additions. The catalog is still version 2026.11.06 (1,769 entries), and SonicWall SonicOS SSLVPN CVE-2026-19868 is still the newest add (due November 20th). No AI, LLM or MCP items have been added this week.
- **KEV deadlines this week:** Adobe Commerce CVE-2026-48356 and Brotli CVE-2026-111497 are due Tuesday, November 10th. Broadcom ESX CVE-2026-41709 is due November 11th. Ivanti Connect Secure CVE-2026-118527 is due November 13th. Apple CVE-2024-27834 is due November 18th.
- **ARTEX:** covered in October and on November 7th (WorkOS). New today: Microsoft's secret-hunting and Storm-3358 reports, VulnCheck's Langflow sighting and Censys's exposure count (Story 1).
- **Langflow:** covered November 2nd. New: NVD published IBM's [CVE-2026-97677](https://nvd.nist.gov/vuln/detail/CVE-2026-97677) today. A signed-in flow author on Langflow OSS 1.0.0 through 1.12.2 could write files anywhere the service account can and read files the service can reach, including secrets and the database. IBM, the CNA, scores it CVSS 3.1 8.1 and says to upgrade to 1.12.3 ([IBM bulletin](https://www.ibm.com/support/pages/node/7290694)); 1.13.0, from the November 2nd story, is later still. Not in KEV.
- **AgentScope and Chainlit:** covered November 4th to 7th. AgentScope's latest release is still v2.0.11 with PR #3448 open, so CVE-2026-123022 and CVE-2026-123024 still have no fixed release. Chainlit is still on 2.12.0 with no fix for CVE-2026-120492. None are in KEV.
- **Also noted:**
  - **Vikunja veans:** before 2.7.1, project titles and task text were pasted straight into the coding agent's trusted instructions, so a project member with write access could steer the agent into changing your checkout or running commands ([CVE-2026-123498](https://nvd.nist.gov/vuln/detail/CVE-2026-123498); VulnCheck CVSS 4.0 2.1 / 3.1 3.7; [GHSA-cvh3-hf56-g9xm](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-cvh3-hf56-g9xm)). A second bug let a hostile checkout make `veans init` overwrite a user file through a symlinked `.veans.yml`, or install veans hooks or plugins globally through symlinked `.claude` or `.opencode` entries. It requires the victim to run `veans init`; the attacker doesn't control the written content. ([CVE-2026-123496](https://nvd.nist.gov/vuln/detail/CVE-2026-123496); VulnCheck CVSS 4.0 4.8 / 3.1 3.3). Both fixed in 2.7.1. Neither is in KEV.
  - **IBM ContextForge MCP Gateway ([CVE-2026-18484](https://nvd.nist.gov/vuln/detail/CVE-2026-18484)):** in 1.0.0 through 1.0.11, a user allowed to register gateways could register one whose tool name collides with an existing tool, so calls to that tool fail for the whole team. IBM scores it CVSS 3.1 6.5 and fixed it in 1.1.0; until then, an admin can rename or remove one of the clashing registrations ([IBM bulletin](https://www.ibm.com/support/pages/node/7294233)). Not in KEV.

## Pattern Analysis
1. **Leaked means used, and fast.** Microsoft watched an agent go from a GitHub search to Key Vault in five minutes (Story 1), and LATENT reports that Apiiro found more than a thousand public settings files full of passwords that agents typed for us (Story 2). Rotation is the fix; deleting the file isn't.
2. **AI tools are both the target and the tool.** Microsoft observed attackers pursuing AI provider keys, and VulnCheck observed the same source IP working through Langflow decoys to decrypt stored variables. That decoy session doesn't establish theft of real provider keys, but it shows why tools that hold model and cloud keys need vault-level care.
3. **One feature next to the guardrail breaks it.** A preview popup got past ChatGPT's Lockdown Mode (Story 3), a link in a notebook got past JupyterLab Desktop's isolation, and an empty config value turned off Tracecat's SAML signature checks (Story 4). Test the controls you rely on with the features around them turned on.

## Recommended Actions

**Today:**
1. **Leaked secrets:** treat any secret that reached a public repo as compromised. Rotate it, review its past use, and rotate everything in any Key Vault the affected app could read.
2. **Microsoft indicators:** search Entra service principal sign-ins and Azure activity logs for 199.19.77[.]84 since October 28th, and look for one address signing in as several apps.
3. **Langflow:** take any internet-facing instance off the internet and plan an upgrade to 1.13.0 or later, including the auto-login changes described in the November 2nd brief. Rotate every provider key and the Langflow secret key on any instance that was reachable. Version 1.3.0 fixes the older KEV bug, not the later vulnerabilities.
4. **Claude Code settings:** search your repos and their history for `.claude/settings.local.json` and `.claude/settings.json`, rotate what you find, then add the local file to `.gitignore`.
5. **Tracecat on Docker Compose with SAML:** set both SAML signature settings to `true`, then upgrade to 1.0.0-beta.49 or later.

**This week:**
6. **JupyterLab Desktop:** upgrade to 4.6.2-1 or later.
7. **Secret scanning:** add agent config folders (`.claude/`, `.cursor/`, `.gemini/` and similar) to pre-commit and CI scanning, and add rules for passwords typed into commands, which key-format scanners miss.
8. **KEV:** finish Adobe Commerce CVE-2026-48356 and Brotli CVE-2026-111497 by November 10th, Broadcom ESX CVE-2026-41709 by November 11th, and Ivanti CVE-2026-118527 by November 13th.

**Ongoing:**
9. Move apps from client secrets to managed identities where you can, and hunt for agent-speed behavior (bursts of varied requests, quick corrected retries) rather than relying on IP or user-agent blocks.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| ARTEX agents hunting GitHub secrets into Azure (Microsoft) and exploiting Langflow CVE-2025-3248 (VulnCheck CVSS 3.1 9.8; in KEV) for stored AI keys (VulnCheck); Storm-3358 against banks | HIGH | Rotate exposed secrets; hunt Microsoft's indicators; get Langflow off the internet and rotate its keys |
| Claude Code "don't ask again" saving secrets in `.claude/settings.local.json` (Apiiro research, per LATENT; no CVE) | HIGH | Search repos and history; rotate; ignore the file; scan agent config folders |
| ChatGPT Lockdown Mode bypass via preview popups (Check Point; fixed September 18th, according to Check Point; no CVE) | MEDIUM | Treat shared chats and third-party GPTs with care; keep clients current |
| JupyterLab Desktop CVE-2026-86044 (GitHub CVSS 3.1 9.6) and CVE-2026-102530 (GitHub CVSS 4.0 9.4), fixed 4.6.2-1; Tracecat CVE-2026-58490 (GitHub CVSS 3.1 9.8), fixed 1.0.0-beta.49 | HIGH | Upgrade JupyterLab Desktop; set Tracecat SAML signing to true and upgrade |

## Sources
- [Microsoft: Threat actors use agentic AI tooling to find and abuse exposed secrets](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)
- [VulnCheck: Same Attacker, Different Door: Our Canaries Caught Microsoft's Agentic AI Secret Hunter Exploiting Langflow](https://www.vulncheck.com/blog/microsoft-secret-hunter)
- [Microsoft: ARTEX abuse expands as cybercriminals target financial sector](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/)
- [Censys: ARTEX: Agentic Asbestos](https://censys.com/blog/artex-agentic-asbestos/)
- [NVD: CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
- [Apiiro: coding agents leaking secrets to GitHub through "don't ask again"](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again)
- [LATENT: Claude Code's "Don't ask again" and secrets in public repositories](https://latent.tokyo/en/articles/2026-11-08-claude-code-dont-ask-again-secrets)
- [Claude Code issue #5544](https://github.com/anthropics/claude-code/issues/5544)
- [Check Point Research: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/)
- [The Hacker News: Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction](https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html)
- [NVD: CVE-2026-86044](https://nvd.nist.gov/vuln/detail/CVE-2026-86044)
- [JupyterLab Desktop advisory GHSA-2mr8-962v-wc67](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-2mr8-962v-wc67)
- [NVD: CVE-2026-102530](https://nvd.nist.gov/vuln/detail/CVE-2026-102530)
- [JupyterLab Desktop advisory GHSA-vrj4-r4fw-9rfh](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh)
- [JupyterLab Desktop v4.6.2-1 release](https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1)
- [NVD: CVE-2026-58490](https://nvd.nist.gov/vuln/detail/CVE-2026-58490)
- [Tracecat advisory GHSA-6g53-h6fh-c3pj](https://github.com/TracecatHQ/tracecat/security/advisories/GHSA-6g53-h6fh-c3pj)
- [NVD: CVE-2026-97677](https://nvd.nist.gov/vuln/detail/CVE-2026-97677)
- [IBM: Security Bulletin: Langflow OSS is affected by multiple vulnerabilities](https://www.ibm.com/support/pages/node/7290694)
- [NVD: CVE-2026-123498](https://nvd.nist.gov/vuln/detail/CVE-2026-123498)
- [Vikunja advisory GHSA-cvh3-hf56-g9xm](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-cvh3-hf56-g9xm)
- [NVD: CVE-2026-123496](https://nvd.nist.gov/vuln/detail/CVE-2026-123496)
- [NVD: CVE-2026-18484](https://nvd.nist.gov/vuln/detail/CVE-2026-18484)
- [IBM: Security Bulletin: IBM ContextForge MCP Gateway](https://www.ibm.com/support/pages/node/7294233)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)