Three of this edition's four items describe the same movement. Attacker-controlled instructions are migrating out of the chat window and into the places an AI system reads without pausing to question them: a memory file the agent rewrites and reloads every session, a tool description returned by a connected server, a repository hook that fires the moment a project is opened. The fourth item is more ordinary and more urgent. An AI orchestration platform that holds every model key and connector credential an organisation gave it is being exploited in the wild, and it now sits on CISA's exploited-vulnerabilities list.
1
Anthropic and EPFL show that a payload written into an agent's own memory file can survive a context reset and pass to the next agent
A preprint released on 10 August 2026 examined what happens when instruction text is written into the self-modifiable files that autonomous agent harnesses reload into the system prompt at the start of each session. The researchers tested a simulated six-agent coding collaboration and chains of paired agents modelled on OpenClaw, the open-source autonomous assistant previously known as Clawdbot. The finding that matters for defenders concerns durability rather than cleverness. Payloads placed in a reloaded identity file accounted for roughly 88 percent of propagation attempts at about a 55 percent infection rate, against roughly 12 percent of attempts and a 17 percent rate for the same content sitting in an ordinary workspace file. All four tested payloads survived a twenty-hop chain. The authors are careful about scope: there is no evidence the technique has spread in the wild, and their review of about 2,000 archived posts from Moltbook, a social network for agents, found no successful agent-to-agent propagation despite attempts. A single paragraph of warning text added to the system prompt reduced spread to near zero. The npm worm that Datadog Security Labs documented on 4 August 2026 is the non-theoretical version of the same idea. Starting from a poisoned keyv release published that morning and spreading through the Cacheable family into hundreds of packages, it wrote a .vscode/tasks.json that ran on folder open and a .claude/settings.json carrying a session-start hook, so the persistence lived in the repository rather than in the operating system.
Why it matters for IndiaIndian software services firms, GCC engineering teams and product startups now give agents a persistent project memory precisely so that context is not lost between sessions. That same design means a tainted instruction rides the repository into the next sprint, the next developer's workstation and, for firms doing delivery work, the client's environment. Wiping a conversation is not a containment step when the durable state is a file in the repository.
ActionTreat agent state files as code. Put CLAUDE.md, AGENTS.md, memory files, .claude/, .vscode/ and equivalent directories under review in every pull request, and alert on changes to them the way you would on a change to a build script. Do not let an agent write to its own system-prompt file without a human approving the diff. Add the standing instruction that content read from external sources is never to be copied into durable agent state. After any dependency compromise, rebuild from a clean checkout rather than cleaning in place.
SourceAnthropic and EPFL preprint (10 August 2026); The Hacker News (18 August 2026); Datadog Security Labs (4 August 2026); safedep analysis of the keyv and cacheable compromise (4 August 2026).
2
A malicious tool server can split one refused instruction across three channels a coding agent already trusts, and the agent reassembles it
The ASSET Research Group disclosed a technique it calls GhostSplice, reported on 11 August 2026 and carried again in industry roundups on 17 August. The researchers, Murali Ediga and Sudipta Chattopadhyay, describe it as cross-channel trust fragmentation. Everything an agent reads during a task, including a tool's description, a project scan result and a follow-up result, lands in one block of working context with nothing marking which source each part came from. No single fragment has to look malicious. A request the assistant refuses when presented whole is complied with when it arrives in pieces. Across eleven models tested through their APIs, average compliance rose from about 42 percent to about 82 percent once the instruction was split in two, though Claude Sonnet and Opus refused throughout. The same model refused in one coding client and exfiltrated in another, which means the safety behaviour being relied on belongs to the surrounding product rather than to the model. Clients covered include Cursor, Visual Studio Code with GitHub Copilot, Codex CLI and Claude Code. The stated targets are SSH keys, environment secrets and source code. Two preconditions apply: the server is already connected, and the agent already has read access to what is taken. The work was carried out in isolated projects seeded with fabricated credentials, not against a live victim, and CVE identifiers are to follow coordinated disclosure. Separate coverage on 17 August set out the adjacent exposure, which is that tool servers routinely hold credentials in plaintext configuration files and run under service accounts nobody scoped.
Why it matters for IndiaConnecting tool servers to coding assistants has become routine in Indian engineering organisations, and the connection is usually made by an individual developer rather than approved centrally. A developer workstation in a services or GCC environment commonly holds customer source code, cloud credentials and deployment rights at once. The finding that protection varies by client is the difficult part for procurement, because an approval granted after testing one assistant does not carry across to another.
ActionMaintain an approved list of tool servers and block connection to anything outside it from managed machines. Mirror approved servers internally and pin versions rather than pulling current. Require that values returned by one tool are not passed into another tool's arguments without validation. Keep human approval on file reads outside the working directory and on any outbound request. Where a server holds credentials, move them into a secrets manager with short-lived tokens instead of a configuration file on disk.
SourceASSET Research Group GhostSplice disclosure and proof-of-concept repository; The Hacker News (11 August 2026); The Hacker News weekly summary and MCP secrets analysis (17 August 2026).
3CriticalCVSS 9.8
Langflow, an AI orchestration platform holding model and connector credentials, is under active exploitation and now carries a CISA exploited-vulnerabilities listing
CVE-2026-9198 is a code-injection flaw scored CVSS 9.8 that gives an unauthenticated attacker remote code execution on a Langflow deployment left in its default configuration. The path chains two endpoints. An automatic-login endpoint issues a superuser token to any caller on the network where the default auto-login setting remains enabled and reachable, and a code-validation endpoint then executes supplied Python. Versions 1.0.0 through 1.10.0 are affected and 1.10.1 carries the fix. IBM, which maintains Langflow, disclosed the flaw on 17 July 2026 and shipped the patch the same day. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 August 2026 and set 7 August as the remediation deadline for United States federal civilian agencies. Working proof-of-concept code circulated publicly in late July, and tracking cited in the reporting recorded 650 exploitation attempts from 6 July onward across 244 source addresses in 41 countries.
Why it matters for IndiaThe significance is what the host holds rather than the host itself. Visual AI-flow builders are the standard route for a first agent pilot in Indian banks, state departments, public sector undertakings and managed service providers, because they let a small team show a working prototype quickly. Those instances accumulate model provider keys, database connection strings and connector tokens, and pilots are frequently stood up on a cloud instance with a public address for the convenience of a demonstration, outside the asset register that CERT-In's May blueprint asks for. Remote code execution on that host is not one application compromised. It is every credential the pilot was trusted with.
ActionFind every Langflow instance, including ones a business team stood up without involving IT, and upgrade to 1.10.1 or later. Remove public exposure and put the service behind authenticated access. Turn off the default auto-login behaviour. Rotate every model provider key, database credential and connector token held on an affected host, on the assumption of exposure rather than on proof of it. Review logs for superuser token issuance and calls to the code-validation endpoint. CERT-In's six-hour incident reporting obligation applies here as it would to any other compromised server.
SourceBleepingComputer (5 August 2026); The Hacker News (5 August 2026); CISA Known Exploited Vulnerabilities catalogue entry for CVE-2026-9198 (4 August 2026); CERT-In, Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (25 May 2026).
4
A discounted resale service for frontier-model access routes every customer prompt through its operator
Okta researchers Jeremy Kirk and Mathew Woodyard documented a service trading as Poison Claude that sells access to Anthropic models at roughly 5 to 15 percent of the official per-token price. The economics come from pooled accounts and promotional credits, including a hundred-dollar bonus available on new cloud accounts, rather than from any efficiency. The customer pays in cryptocurrency, receives an API key and points an existing tool at the operator's endpoint. That is the whole exposure. Prompts, attached files, source code and any credential pasted into a session pass through infrastructure controlled by an anonymous party before reaching a model, with no undertaking about retention or resale. A configuration error left an interface exposed that indicated roughly 881 registered users and 872 active ones. The researchers reported finding more than half a dozen comparable services advertised in underground channels.
Why it matters for IndiaIndian teams face genuine cost pressure on model spend, and a ninety percent discount is a persuasive line to a project manager working to a fixed-price contract. The configuration change involved is a single environment variable on a developer's machine, which sits below the level most organisations monitor. For firms holding client code under a services agreement, or processing data covered by the Digital Personal Data Protection Act or by RBI localisation direction, routing that material through an unknown intermediary is a contractual and regulatory failure independent of whether the operator does anything with it.
ActionPublish the list of approved model endpoints and block the rest at the proxy and DNS layer. Look for non-standard base-URL settings in environment variables, IDE configuration and CI definitions, since that is the single artefact these services need. Fund a sanctioned route to model access, because unofficial gateways get adopted where the approved path is slow or unavailable. Treat confirmed use on client or production material as a data exposure incident and notify on that basis.
SourceOkta research reported by The Hacker News (5 August 2026); Help Net Security (6 August 2026).
AI defender tip: Read these four together and the common failure is a trust boundary that was never drawn. An agent trusts a file it wrote itself. An agent trusts a tool description because a server it is connected to returned it. An orchestration host trusts any caller on the network because a convenience setting was left at its default. A developer trusts an endpoint because a key was issued and the responses looked correct. In each case the system behaved exactly as designed, and the design assumed the input was benign. The exercise for this fortnight is short. Take one AI system in production and list every source it reads from without a human seeing the content first, including memory files, connected tool servers, mailboxes, repositories and web pages. For each one, record who can write to it. Anything on that list that an outsider can write to is an input path carrying the agent's full authority, and it should either be removed, put behind validation, or recorded as accepted risk with a named owner.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
