This edition's four items put AI on both sides of the engagement. An attacker asked an exposed evaluation agent for its own API key and then spent three weeks of somebody else's inference budget. A Russia-aligned group shipped malware carrying a sentence written to make an analyst's language model refuse to read it. Researchers priced the work of moving an industrial exploit onto a new controller with model assistance, and published the figures. And a Langflow flaw that has had a patch since January came under attack over the weekend, with the attackers going straight for the model and cloud keys held on the host. The common failure is not in the models. It is that in every one of these cases the AI component was governed as a laboratory tool while it held production credentials or carried production consequences.
1
A third Langflow flaw came under attack this weekend, and this time the attackers went straight for the model and cloud keys
CVE-2026-0768 is an unauthenticated remote code execution flaw in the code validator of Langflow's custom component editor, scored 9.8, which runs arbitrary Python as root. It affects version 1.4.2 and earlier and is fixed in 1.11.6. The identifier was issued in January 2026, so the instances now being reached have been unpatched for roughly eight months. VulnCheck recorded more than 50 exploitation attempts within a few hours on 30 August 2026, rising to 360 by 1 September. Caitlin Condon, VulnCheck's VP of Threat Research, characterised the activity as reconnaissance and credential harvesting: queries against environment variables including LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS and AWS_SECRET, reads of the Langflow secret key file, and checks on SSH access and shell history. The observed traffic came primarily from Russian addresses against sensors in the United Kingdom. No public proof-of-concept code is known. We have carried Langflow twice already this quarter, CVE-2026-9198 on 18 August and CVE-2025-3248 on 30 July, and the recurrence is worth stating plainly.
Why it matters for IndiaVisual flow builders are the normal route to a first agent pilot in Indian banks, state departments, public sector undertakings, GCCs and managed service providers, because a small team can show something working in a week. An instance still on 1.4.2 has now sat unpatched through two advisories in this publication alone, which says less about the vendor than about who owns the box. The exposure is not the host. It is what the host was trusted with: provider keys, cloud access keys and database connection strings, all of them reachable from an environment variable once code runs as root.
ActionUpgrade to 1.11.6 or later. Find your instances by scanning your own address ranges rather than by asking teams what they have deployed, because the ones that matter were never registered. Remove internet exposure and put the service behind authenticated access. Rotate every provider key, cloud credential and SSH key that was present on an exposed host, on the assumption of exposure rather than on proof of it. Review logs for reads of the secret key file and for enumeration of environment variables. CERT-In's six-hour incident reporting obligation applies to this as it would to any other compromised server.
SourceVulnCheck via The Hacker News (1 September 2026); BleepingComputer (1 September 2026); SecurityWeek (1 September 2026); Dark Reading (1 September 2026).
2
An exposed dashboard let an attacker ask an agent for its own API key, and three weeks of model usage worth about $600,000 followed
METR, the non-profit that runs frontier-model evaluations, published a security update on 31 August 2026 setting out two incidents from earlier this year. In March a researcher ran agents on a personal EC2 instance placed behind Google authentication. A fail-open defect silently disabled that authentication and left the host internet-facing for several days. METR's assessment is that the attacker located it by searching certificate-transparency logs for terms associated with language models, then prompted the agent to disclose the model-provider API key, added an SSH key for persistence, and used the key for three weeks. The credits had been supplied free by an unnamed provider, so the figure is commercial value rather than money lost. Two details matter more than the number. The usage was hard to distinguish from legitimate work, because heavy model traffic is ordinary for an evaluation lab, and there was no way to cap spend on a free-credit key. A second incident in May involved sustained probing of public infrastructure, with agents used for vulnerability discovery alongside credential stuffing and phishing; an exposed SQL query path in a public transcript viewer could in principle have exposed unpublished evaluation data, though METR found no evidence it was reached. Neither incident was attributed. In the same week, on 30 August, Anthropic warned that commodity infostealers including Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and AMOS on macOS, are taking Claude session tokens from infected machines and draining paid usage, and noted that signing a user out ends the stolen session but does not remove the malware.
Why it matters for IndiaRead together, these two say that AI credentials have become a target class in their own right. In most Indian organisations the model key is not governed like a database password. It is issued to a team, pasted into a pilot, and left in an environment variable on an instance somebody raised for a demonstration, while the finance conversation about AI spend happens somewhere else entirely. The METR case is the pilot server; the Anthropic advisory is the developer's laptop, which matters at Indian engineering scale, where a large share of paid assistant seats sit on machines that also carry client code. In both, the first symptom is a bill, and the bill is the least of it.
ActionInventory where model keys live: gateways, notebooks, CI variables, agent configuration, developer machines. Scope and time-limit them, and keep production keys off personal cloud infrastructure as a stated rule. Set spend and rate caps wherever the provider supports them, and alert on usage anomalies for each key rather than on the aggregate, since an aggregate hides exactly this. Treat an agent that can read its own configuration as an agent that can disclose it, and keep credentials out of the context it can reach. Add AI platform sessions to your infostealer runbook: on any infostealer detection, revoke assistant sessions alongside browser and mail sessions, and check the account for usage that does not match the user.
SourceMETR security update (31 August 2026); Infosecurity Magazine (1 September 2026); The Hacker News (1 September 2026); The Register (1 September 2026); BleepingComputer, on the Anthropic advisory (30 August 2026).
3
Malware has turned up carrying a sentence written to make an analyst's AI refuse to read it
ESET disclosed the technique on 31 August 2026 and named it GuardBreaker. A malicious VBS script attributed to UAC-0099 carries a comment asking for help building a nuclear weapon. The line does nothing in the code. Its purpose is to pull a language model's safety machinery onto that text so the model declines and never examines the rest of the script, which downloads and installs MATCHBOIL, a C# loader used exclusively by this group. UAC-0099 is Russia-aligned, works mainly against Ukrainian transport and energy targets, and has been reported passing validated access to the GRU-linked Sandworm group. The cited reporting does not describe use of this technique against Indian organisations. What earns it an item is the target. This is not an attack on a production model. It is an attack on the analyst's own tooling, and it costs the author one line of text.
Why it matters for IndiaAI-assisted triage has entered Indian SOCs and managed security providers quickly, and mostly informally: script explanation, alert summarisation, first-pass notes on a suspicious file. The failure mode here is quiet. A refusal does not look like evasion. It looks like the tool being careful, and the sample slides down the queue while the analyst moves to something the model was willing to discuss. For a provider running first-pass triage at volume across many Indian clients, refusals that are never counted would be a hole in coverage that no dashboard currently shows.
ActionMake refusal a logged and alerted event rather than a silent outcome, and track the refusal rate for each tool as a quality measure. Route any refused sample to a deterministic fallback, which means sandbox detonation, static signatures, behavioural analysis or a person, and never let a refusal close a ticket. Test your own triage pipeline by placing benign safety-triggering text in a sample and confirming that the sample still reaches a verdict. State plainly in your procedures that model output is one input to a judgement and not the judgement.
SourceESET (31 August 2026); Help Net Security (31 August 2026); The Hacker News (1 September 2026).
4
Forescout measured what it costs to move an industrial exploit onto a new controller with AI assistance: eight and a half hours, $535.74, and one destroyed device
Forescout's Vedere Labs published the experiment on 1 September 2026. Using Claude Sonnet 4.6 and Claude Opus 4.6, the researchers ported a working remote code execution exploit from the WAGO 750-852 controller to the related 750-831, starting from CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server. The final stage of development took 8 hours and 32 minutes across several days and $535.74 in API usage. The qualifications are the useful part of the report and should be read as written. Success required substantial researcher involvement, guiding the model past dead ends and supplying disassembly context that it could not derive. A follow-on attempt to build a command-and-control implant wrote to a flash-mapped region and permanently bricked the controller, which the authors offer as a reminder of how unforgiving this class of work is. Once code execution was achieved, though, the model produced multiple working network payloads within minutes. Forescout's own reading is that this does not constitute present defensive urgency, and that both the time and the human effort involved are likely to fall as models improve. A separate criminal case shows agentic coding tools being used in intrusion planning: CloudSEK, an India-origin firm, reported on 27 August 2026 that a Russian-speaking Aurora ransomware affiliate used such an assistant to plan intrusions against more than 20 organisations across nine countries between April and July 2026, with no Indian victim named, and the reported planning covered conventional Active Directory abuse rather than anything novel.
Why it matters for IndiaThis is a measurement rather than a forecast, and Indian critical-infrastructure operators should use it as one. Power distribution utilities, water boards, ports, metro systems and process manufacturing run large fleets of embedded controllers, many well past their firmware support window, selected years ago for reasons that had nothing to do with patching. The figure to take away is not $535.74. It is that this cost falls on a device family rather than on a single target, so the economics reward an attacker who works patiently through a fleet that shares a firmware lineage. The defensible position for a CISO asked about AI and OT this quarter is that exploitation of this class still needs an expert and a budget, that the correct response is exposure reduction on the timeline already agreed, and that the position should be revisited when a comparable measurement shows the numbers falling.
ActionEstablish which OT and embedded devices are reachable from the corporate network or the internet by scanning for them, not by consulting the asset register. Prioritise by exploitability and consequence rather than by CVSS alone. Segment control networks and remove direct paths from IT to controllers. Where firmware cannot be patched, compensate with network controls and with monitoring of the protocols these devices actually speak. Rehearse an incident in which a controller stops responding and does not come back, because the device destroyed in this experiment was destroyed by accident and an attacker has no reason to be careful. Decide in advance which defensive responses may be automated, before the question is urgent.
SourceForescout Vedere Labs (1 September 2026); SecurityWeek (1 September 2026); CloudSEK, Caught in 4K: The Aurora Files (27 August 2026); The Hacker News (31 August 2026).
AI defender tip: The thread this week is that AI now sits on both sides of the engagement, and the two sides are governed very differently. The attacker's model is unconstrained and leaves a transcript on an exposed server. The defender's model can be stopped by one sentence that costs nothing to write. Meanwhile the object being stolen has not changed at all: in two of these four items the prize was a credential held on a system that nobody had entered in the register or the patch cycle. The exercise for this fortnight takes an afternoon. Sort every AI component your organisation runs into two lists. The first is the ones that hold a credential: gateways, agents, flow builders, notebooks, evaluation dashboards, assistant seats on developer laptops. For each, write down the owner, what the key can reach, whether a spend cap exists, and when it was last rotated. The second list is the ones that inform a decision: triage assistants, summarisers, code reviewers. For each, write down what happens when the model declines to answer or answers wrongly, and whether anyone would notice within a day. Most teams find the second list has never been written down, and that is itself the finding.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
