Three of this edition's four items describe the same movement. Attacker-controlled instructions are migrating out of the chat window and into the places an AI system reads without pausing to question them: a memory file the agent rewrites and reloads every session, a tool description returned by a connected server, a repository hook that fires the moment a project is opened. The fourth item is more ordinary and more urgent. An AI orchestration platform that holds every model key and connector credential an organisation gave it is being exploited in the wild, and it now sits on CISA's exploited-vulnerabilities list.
1
Anthropic and EPFL show that a payload written into an agent's own memory file can survive a context reset and pass to the next agent
A preprint released on 10 August 2026 examined what happens when instruction text is written into the self-modifiable files that autonomous agent harnesses reload into the system prompt at the start of each session. The researchers tested a simulated six-agent coding collaboration and chains of paired agents modelled on OpenClaw, the open-source autonomous assistant previously known as Clawdbot. The finding that matters for defenders concerns durability rather than cleverness. Payloads placed in a reloaded identity file accounted for roughly 88 percent of propagation attempts at about a 55 percent infection rate, against roughly 12 percent of attempts and a 17 percent rate for the same content sitting in an ordinary workspace file. All four tested payloads survived a twenty-hop chain. The authors are careful about scope: there is no evidence the technique has spread in the wild, and their review of about 2,000 archived posts from Moltbook, a social network for agents, found no successful agent-to-agent propagation despite attempts. A single paragraph of warning text added to the system prompt reduced spread to near zero. The npm worm that Datadog Security Labs documented on 4 August 2026 is the non-theoretical version of the same idea. Starting from a poisoned keyv release published that morning and spreading through the Cacheable family into hundreds of packages, it wrote a .vscode/tasks.json that ran on folder open and a .claude/settings.json carrying a session-start hook, so the persistence lived in the repository rather than in the operating system.
Why it matters for IndiaIndian software services firms, GCC engineering teams and product startups now give agents a persistent project memory precisely so that context is not lost between sessions. That same design means a tainted instruction rides the repository into the next sprint, the next developer's workstation and, for firms doing delivery work, the client's environment. Wiping a conversation is not a containment step when the durable state is a file in the repository.
ActionTreat agent state files as code. Put CLAUDE.md, AGENTS.md, memory files, .claude/, .vscode/ and equivalent directories under review in every pull request, and alert on changes to them the way you would on a change to a build script. Do not let an agent write to its own system-prompt file without a human approving the diff. Add the standing instruction that content read from external sources is never to be copied into durable agent state. After any dependency compromise, rebuild from a clean checkout rather than cleaning in place.
SourceAnthropic and EPFL preprint (10 August 2026); The Hacker News (18 August 2026); Datadog Security Labs (4 August 2026); safedep analysis of the keyv and cacheable compromise (4 August 2026).
2
A malicious tool server can split one refused instruction across three channels a coding agent already trusts, and the agent reassembles it
The ASSET Research Group disclosed a technique it calls GhostSplice, reported on 11 August 2026 and carried again in industry roundups on 17 August. The researchers, Murali Ediga and Sudipta Chattopadhyay, describe it as cross-channel trust fragmentation. Everything an agent reads during a task, including a tool's description, a project scan result and a follow-up result, lands in one block of working context with nothing marking which source each part came from. No single fragment has to look malicious. A request the assistant refuses when presented whole is complied with when it arrives in pieces. Across eleven models tested through their APIs, average compliance rose from about 42 percent to about 82 percent once the instruction was split in two, though Claude Sonnet and Opus refused throughout. The same model refused in one coding client and exfiltrated in another, which means the safety behaviour being relied on belongs to the surrounding product rather than to the model. Clients covered include Cursor, Visual Studio Code with GitHub Copilot, Codex CLI and Claude Code. The stated targets are SSH keys, environment secrets and source code. Two preconditions apply: the server is already connected, and the agent already has read access to what is taken. The work was carried out in isolated projects seeded with fabricated credentials, not against a live victim, and CVE identifiers are to follow coordinated disclosure. Separate coverage on 17 August set out the adjacent exposure, which is that tool servers routinely hold credentials in plaintext configuration files and run under service accounts nobody scoped.
Why it matters for IndiaConnecting tool servers to coding assistants has become routine in Indian engineering organisations, and the connection is usually made by an individual developer rather than approved centrally. A developer workstation in a services or GCC environment commonly holds customer source code, cloud credentials and deployment rights at once. The finding that protection varies by client is the difficult part for procurement, because an approval granted after testing one assistant does not carry across to another.
ActionMaintain an approved list of tool servers and block connection to anything outside it from managed machines. Mirror approved servers internally and pin versions rather than pulling current. Require that values returned by one tool are not passed into another tool's arguments without validation. Keep human approval on file reads outside the working directory and on any outbound request. Where a server holds credentials, move them into a secrets manager with short-lived tokens instead of a configuration file on disk.
SourceASSET Research Group GhostSplice disclosure and proof-of-concept repository; The Hacker News (11 August 2026); The Hacker News weekly summary and MCP secrets analysis (17 August 2026).
3CriticalCVSS 9.8
Langflow, an AI orchestration platform holding model and connector credentials, is under active exploitation and now carries a CISA exploited-vulnerabilities listing
CVE-2026-9198 is a code-injection flaw scored CVSS 9.8 that gives an unauthenticated attacker remote code execution on a Langflow deployment left in its default configuration. The path chains two endpoints. An automatic-login endpoint issues a superuser token to any caller on the network where the default auto-login setting remains enabled and reachable, and a code-validation endpoint then executes supplied Python. Versions 1.0.0 through 1.10.0 are affected and 1.10.1 carries the fix. IBM, which maintains Langflow, disclosed the flaw on 17 July 2026 and shipped the patch the same day. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 August 2026 and set 7 August as the remediation deadline for United States federal civilian agencies. Working proof-of-concept code circulated publicly in late July, and tracking cited in the reporting recorded 650 exploitation attempts from 6 July onward across 244 source addresses in 41 countries.
Why it matters for IndiaThe significance is what the host holds rather than the host itself. Visual AI-flow builders are the standard route for a first agent pilot in Indian banks, state departments, public sector undertakings and managed service providers, because they let a small team show a working prototype quickly. Those instances accumulate model provider keys, database connection strings and connector tokens, and pilots are frequently stood up on a cloud instance with a public address for the convenience of a demonstration, outside the asset register that CERT-In's May blueprint asks for. Remote code execution on that host is not one application compromised. It is every credential the pilot was trusted with.
ActionFind every Langflow instance, including ones a business team stood up without involving IT, and upgrade to 1.10.1 or later. Remove public exposure and put the service behind authenticated access. Turn off the default auto-login behaviour. Rotate every model provider key, database credential and connector token held on an affected host, on the assumption of exposure rather than on proof of it. Review logs for superuser token issuance and calls to the code-validation endpoint. CERT-In's six-hour incident reporting obligation applies here as it would to any other compromised server.
SourceBleepingComputer (5 August 2026); The Hacker News (5 August 2026); CISA Known Exploited Vulnerabilities catalogue entry for CVE-2026-9198 (4 August 2026); CERT-In, Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (25 May 2026).
4
A discounted resale service for frontier-model access routes every customer prompt through its operator
Okta researchers Jeremy Kirk and Mathew Woodyard documented a service trading as Poison Claude that sells access to Anthropic models at roughly 5 to 15 percent of the official per-token price. The economics come from pooled accounts and promotional credits, including a hundred-dollar bonus available on new cloud accounts, rather than from any efficiency. The customer pays in cryptocurrency, receives an API key and points an existing tool at the operator's endpoint. That is the whole exposure. Prompts, attached files, source code and any credential pasted into a session pass through infrastructure controlled by an anonymous party before reaching a model, with no undertaking about retention or resale. A configuration error left an interface exposed that indicated roughly 881 registered users and 872 active ones. The researchers reported finding more than half a dozen comparable services advertised in underground channels.
Why it matters for IndiaIndian teams face genuine cost pressure on model spend, and a ninety percent discount is a persuasive line to a project manager working to a fixed-price contract. The configuration change involved is a single environment variable on a developer's machine, which sits below the level most organisations monitor. For firms holding client code under a services agreement, or processing data covered by the Digital Personal Data Protection Act or by RBI localisation direction, routing that material through an unknown intermediary is a contractual and regulatory failure independent of whether the operator does anything with it.
ActionPublish the list of approved model endpoints and block the rest at the proxy and DNS layer. Look for non-standard base-URL settings in environment variables, IDE configuration and CI definitions, since that is the single artefact these services need. Fund a sanctioned route to model access, because unofficial gateways get adopted where the approved path is slow or unavailable. Treat confirmed use on client or production material as a data exposure incident and notify on that basis.
SourceOkta research reported by The Hacker News (5 August 2026); Help Net Security (6 August 2026).
AI defender tip: Read these four together and the common failure is a trust boundary that was never drawn. An agent trusts a file it wrote itself. An agent trusts a tool description because a server it is connected to returned it. An orchestration host trusts any caller on the network because a convenience setting was left at its default. A developer trusts an endpoint because a key was issued and the responses looked correct. In each case the system behaved exactly as designed, and the design assumed the input was benign. The exercise for this fortnight is short. Take one AI system in production and list every source it reads from without a human seeing the content first, including memory files, connected tool servers, mailboxes, repositories and web pages. For each one, record who can write to it. Anything on that list that an outsider can write to is an input path carrying the agent's full authority, and it should either be removed, put behind validation, or recorded as accepted risk with a named owner.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
WeeklyLatest Weekly Brief14 August 2026Open issue →
Microsoft's August update carried a single exploited zero-day, and the research behind it names India among the countries where a North Korean campaign has been aiming fake recruitment lures at defence and aerospace suppliers. CISA added three vulnerabilities to its Known Exploited catalogue on 11 August with remediation due within three days, among them a Cisco firewall flaw that crashes remote-access VPN appliances and an analytics platform flaw scored at maximum severity. A load balancer family widely deployed in Indian data centres reached the same catalogue days earlier. Two further incidents this week required no vulnerability at all: a ransomware intrusion that walked in through a VPN without multi-factor authentication, and a phishing campaign hidden inside image files that most mail gateways do not inspect.
1HighCVSS 7.0
Windows AFD.sys Privilege Escalation Exploited in Fake-Recruitment Campaign — CVE-2026-68820
CVSS 7.0 | Microsoft Patch Tuesday, 11 August; CISA KEV, 11 August* Microsoft's 11 August 2026 release addressed 421 vulnerabilities, of which this was the only one already under attack. The flaw is a use-after-free in the Ancillary Function Driver for WinSock, the kernel-mode driver behind the Windows Sockets API. A locally authenticated attacker who runs a crafted application can win a race condition, obtain a kernel read and write primitive, and escalate to SYSTEM. It is not an initial-access flaw; it is what turns one user's mistake into control of the machine. Check Point Research attributes the exploitation to the North Korea-linked Lazarus group's Operation Dream Job, which uses fake job offers and trojanised PDF software against defence, aerospace, aviation, drone, robotics and military-technology organisations, and names India among the affected countries alongside France, Germany and Brazil. After escalating, the operators deployed the FudModule v3.1 kernel-mode rootkit to suppress endpoint security visibility.
India exposureIndian defence suppliers, aerospace and aviation engineering firms, drone and robotics manufacturers and their subcontractors are within the stated target set. Recruitment lures reach engineers directly, often on personal devices and personal messaging, well outside the mail gateway.
ActionDeploy the August Windows updates, prioritising engineering, research and privileged-administrator endpoints. Brief technical staff that unsolicited job approaches carrying documents or software to install are an active intrusion vector in this sector. Verify that endpoint tooling still reports after driver-level tampering, since a rootkit that silences the agent also silences the alert.
SourceCheck Point Research, 11 August 2026; SecurityWeek, 11 August 2026; Help Net Security and SOC Prime, 12 August 2026; CISA KEV addition, 11 August 2026.
2HighCVSS 8.6
Cisco Secure Firewall ASA and FTD Remote-Access VPN Flaw Exploited to Crash Appliances — CVE-2026-20349
CVSS 8.6 | CISA KEV, 11 August — federal remediation due 14 August* Insufficient error checking when the appliance processes HTTP requests lets a remote, unauthenticated attacker send a crafted request to the Remote Access SSL VPN service and force the device to reload. Cisco says it became aware of active exploitation in August 2026, having found the issue through internal security testing alongside a report from researcher Valerio Brussani. Devices are affected where IKEv2 Remote Access VPN with client services, SSL VPN, or Zero Trust Network Access on Threat Defense is enabled. Cisco states there is no workaround that addresses the flaw.
India exposureThis is a remote-access outage risk rather than a data-theft one, which changes who feels it first. Indian BFSI, IT services and government-contracting organisations running remote workforces on ASA or FTD lose VPN availability at the attacker's choosing, including during an incident response that depends on that same VPN.
ActionApply the Cisco hotfix or fixed release for your train; hotfixes cover ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24, and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0. Confirm which remote-access services are actually enabled and disable those not in use. Treat repeated unexplained reloads on an internet-facing appliance as a security event, not a stability one.
SourceBleepingComputer, 11 August 2026; The Hacker News, 12 August 2026; CISA KEV addition, 11 August 2026.
CVSS 10.0 | Disclosed 8 August; CISA KEV, 11 August — federal remediation due 14 August* An unauthenticated attacker can inject SQL through the POST /api/session/reset_password endpoint and obtain administrator access to the Metabase instance. Metabase found the flaw while its own cloud platform was under attack on 2 August 2026 and disclosed it on 8 August. Affected releases are 1.58.x below 1.58.24, 1.59.x below 1.59.21, 1.60.x below 1.60.17, 1.61.x below 1.61.11, 1.62.x below 1.62.9 and 1.63.x below 1.63.5. The consequence is worth stating plainly: administrator access to a business-intelligence platform may expose the stored credentials for every database connected to it, and the data reachable through those connections.
India exposureMetabase is common in Indian fintech, SaaS and analytics teams precisely because it is quick to self-host, and those instances sit deliberately close to production data stores. Internet-reachable deployments are the immediate concern; instances exposed only to a partner VPN are not far behind.
ActionUpgrade to the fixed build for your train without waiting for a maintenance window. Remove internet exposure until patched. Rotate the database credentials Metabase holds, on the assumption that admin access implies credential access, and review logs for password-reset requests that return an error followed by an authenticated session.
SourceThe Hacker News, 8 August 2026; CISA KEV addition, 11 August 2026.
4CriticalCVSS 9.6
Progress LoadMaster Command Injection Under Sustained Exploitation — CVE-2026-8037
CVSS 9.6 | CISA KEV, 7 August — federal remediation due 10 August* Improper handling of user-supplied input in the appliance's escape_quotes() function allows an unauthenticated attacker to inject operating-system commands through API endpoints and execute code as root. watchTowr Labs published analysis in June 2026, and public exploitation followed the release of proof-of-concept code on 29 June; eSentire reported exploitation attempts through July. KEVIntel telemetry cited in reporting on the KEV addition counted 792 exploitation attempts over 41 days from 65 unique addresses across 18 countries, with activity as recent as 4 August. The scope is wider than the LoadMaster name suggests: ECS Connection Manager, Connection Manager for ObjectScale and MOVEit WAF are also affected.
India exposureLoad balancers sit in front of the application, which is the point of them and also the problem here. Indian data centres, payment platforms, hospital systems and public-sector application estates using these Progress appliances for internet-facing traffic should treat any reachable management or API interface as critical exposure.
ActionMove to LoadMaster GA 7.2.63.2 or LTSF 7.2.54.18 or later, and check whether ECS Connection Manager, ObjectScale Connection Manager or MOVEit WAF are also deployed. Restrict the management and API interfaces to an administrative network rather than relying on the appliance's own access controls. Given exploitation predates the patch by weeks, review appliance logs and configuration for unauthorised change before assuming a clean upgrade.
SourceThe Hacker News, 8 August 2026; SecurityWeek, 10 August 2026; CISA KEV addition, 7 August 2026.
5
Akira Affiliate Reaches Domain Enumeration in Seven Minutes Through a VPN Without MFA
No CVE | Huntress incident report, 12 August 2026* Huntress reported an intrusion that is instructive precisely because no vulnerability was involved. On 4 August 2026 at 03:45 UTC, a credential spray began against a SonicWall SSL VPN. At 03:52 UTC one account succeeded from an external address, against a VPN with no multi-factor authentication in front of it. Hands-on activity and Active Directory enumeration followed from around 05:30 UTC. At 06:29 UTC the operator rebooted the host into Safe Mode with Networking using msconfig, which took the endpoint agent and Defender real-time protection offline together while keeping network access. The ransomware ran at 06:34 UTC but failed in Safe Mode's restricted memory environment, and the payload was quarantined once the host returned to normal mode at 08:10 UTC. The encryption failed by accident, not by design.
India exposureMid-market Indian manufacturing, healthcare and regional government networks frequently run remote access on a VPN appliance where multi-factor authentication was scoped for a later phase that has not arrived. Seven minutes from first spray attempt to valid session is the figure worth putting in front of a budget committee.
ActionEnforce MFA on every remote-access path without exception, and treat any VPN account exempted from it as a known open door. Alert on authentication bursts against the VPN and on Safe Mode boot configuration changes, which have no legitimate place in normal server operation. Confirm that endpoint tooling reports its own absence.
SourceHuntress, 12 August 2026.
6
Seqrite Warns Indian Enterprises Over SVG Files as a Phishing Delivery Vector
No CVE | Seqrite advisory, reported 10 August 2026* Seqrite, the enterprise arm of Quick Heal, warned that attackers are embedding JavaScript and redirection logic inside SVG vector graphics to deliver phishing to Indian organisations. The format's advantage to the attacker is that controls treating SVG as an ordinary image will not inspect the script or the URL inside it. In one case Seqrite describes, the file executed embedded script in the browser and redirected the user to a counterfeit Microsoft 365 login page built to harvest credentials. The warning draws on Seqrite's India Cyber Threat Report 2026, which recorded 265.52 million detections across more than eight million endpoints.
India exposureSVG moves through exactly the workflows that raise no suspicion, including marketing, design, web publishing and document collaboration. Organisations where design and content files circulate routinely between agencies and internal teams have the weakest natural checkpoint.
ActionApply script and URL inspection to SVG attachments and downloads at the mail gateway and browser layers rather than exempting them as images. Add behaviour-based detection for browser-initiated redirection to credential-collection pages, and confirm that phishing-resistant authentication is in place for Microsoft 365, since credential harvesting is the objective here.
SourceCIOL, 10 August 2026; IT Voice and NCN Online, August 2026.
Takeaway
Two of this week's items required no vulnerability and two required no user. The Cisco, Metabase and Progress flaws are all reachable by an unauthenticated attacker from outside, and all three carried a CISA deadline of three days or fewer, which is the closest thing the catalogue offers to an urgency signal. The Lazarus campaign and the SVG phishing warning run the other way, through a person, and the AFD.sys flaw is what connects the two halves: the lure gets code running as a user, the driver flaw makes it SYSTEM, and the rootkit removes the evidence. The Akira intrusion sits outside both patterns and is the cheapest lesson of the week, in that MFA on one VPN account would have ended it before minute eight. This week's vendor sweep also checked Fortinet, Palo Alto Networks, Check Point, Juniper, Sophos, Barracuda, WatchGuard, Zscaler, Citrix NetScaler, Ivanti, F5 BIG-IP, Versa, VeloCloud and Aruba EdgeConnect by name. Palo Alto's 12 August bulletin covering eleven vulnerabilities topped out at 7.2 with none exploited, and Fortinet's FortiWeb and FortiManager authentication fixes carry no reported exploitation; neither displaced the six items above.
Four internet-facing management planes were pulled into active exploitation over the past three weeks — an SD-WAN orchestrator, an SSL-VPN gateway pair, a firewall manager, and a wave of exposed water-utility controllers in the United States — and every one of those product families sits inside Indian power, oil and gas, telecom, and transport estates. Add a pending Bill on critical-infrastructure accountability and a CERT-In push on AI-accelerated exploitation, and August opens with the sector's remote-access layer as the defining risk.
1. Sector snapshot
The pattern across July was consistent: attackers went after the systems that manage other systems, not end-user endpoints. SD-WAN orchestrators, SSL-VPN concentrators, and firewall management consoles gained three separate CISA Known Exploited Vulnerabilities entries in the last ten days of July, while a joint FBI-CISA-EPA advisory tracked hands-on-keyboard intrusion into internet-exposed PLCs at water utilities. None of these incidents named an Indian victim. All of them depend on product families and exposure patterns that are common in Indian CI operators' estates, which is the lens this issue applies throughout.
An unauthenticated attacker with network access to the on-premises VeloCloud Orchestrator web interface can run arbitrary operating-system commands, giving full control of the SD-WAN fabric it manages. No credentials are required and internet exposure is the appliance's default posture.
India exposuretelecom carriers, power utilities, and multi-site industrial operators using on-prem VCO to manage branch and substation SD-WAN links.
Actionpatch to 5.2.3.14 / 6.1.3.4 / 6.4.2.4 / 7.0.0.1 or later immediately; if patching is delayed, remove VCO from direct internet exposure and review edge configuration for unauthorised changes.
SourceArista PSIRT; BleepingComputer; The Register (27–28 Jul 2026).
2CriticalCVSS 10.0
SonicWall SMA1000 CVE-2026-15409 (CVSS 10.0 SSRF) chained with CVE-2026-15410 (CVSS 7.2 code injection) — SSL-VPN gateways compromised in the wild
The unauthenticated SSRF flaw in the Work Place interface gives initial access; chained with the post-authentication injection bug, it yields full appliance compromise and credential theft. SonicWall and CISA confirmed active exploitation.
India exposureany CI operator using SMA1000 as the remote-access front door for OT vendors, contractors, or distributed field staff.
Actionapply firmware 12.4.3-03453 / 12.5.0-02835 or later now; rotate all SMA1000 admin and Work Place credentials and enforce MFA regardless of patch status.
SourceSonicWall PSIRT; Arctic Wolf; Canadian Centre for Cyber Security (14–15 Jul 2026).
A built-in account with a static credential lets an unauthenticated attacker log in to FMC and read sensitive configuration data; Cisco rates it High severity because it can be chained with other FMC flaws to escalate privilege over firewall policy.
India exposureany operator centralising firewall policy for CI segments through FMC, including managed-security arrangements.
Actionapply Cisco's hotfix across 7.0–7.7 and 10.0 branches; hunt for the account's use via FMC license and access logs.
SourceCisco PSIRT; The Hacker News; CISA KEV (29–30 Jul 2026).
4
Suspected Iran-linked actor exploiting exposed water-utility PLCs across multiple US states — a global TTP, not an India-targeting claim
Actors believed by investigators to be CyberAv3ngers (also tracked as Storm-0784, Bauxite, UNC5691) accessed internet-facing Rockwell/Allen-Bradley, Schneider Electric, and Siemens PLCs, changed device passwords and IP addresses to lock out operators, and altered HMI displays; over thirty Minnesota systems and utilities in at least a dozen states were affected, forcing several back to manual operation. No ransom demand was made.
India exposurethe same PLC brands and internet-exposed-controller pattern are present in Indian water treatment, power distribution, and manufacturing OT; the technique, not the target, is the transferable risk.
Actioninventory every internet-facing PLC; remove direct exposure, restrict engineering-workstation access, and rehearse a manual-operations fallback.
- Management-plane concentration risk. All three July KEV additions above are administrative interfaces, not user-facing services — a single compromised orchestrator, VPN gateway, or firewall manager gives an attacker control over an entire fleet of devices at once, a disproportionate return for one exploit chain. - OT threat-actor growth. Dragos now tracks 26 distinct OT-focused threat groups worldwide, 11 confirmed active through 2025, alongside a documented rise in ransomware reaching industrial operators; the same report flagged over 100 internet-exposed battery energy storage system inverters, a device class expanding fast in India's renewable rollout. Source (with date): Dragos 2026 OT Cybersecurity Year in Review (17 Feb 2026). - Pakistan-nexus APT36/SideCopy continue cross-platform RAT campaigns, now spanning Linux as well as Windows hosts, against Indian defence, government, and CI-adjacent targets — a standing backdrop rather than a new incident this cycle. Source (with date): The Hacker News (11 Feb 2026).
4. Regulatory & compliance watch
- CERT-In frontier-AI exercises and OEM directive. Between June and July 2026, CERT-In ran ten drills on defending against AI-accelerated exploitation, with 1,470 participants from 345 organisations spanning power, telecom, and BFSI, and issued a June directive requiring OEMs and technology providers to build in AI-assisted security testing and faster patch response. Source (with date): CERT-In; The News Mill (30 Jul 2026). - Critical Infrastructure (Resilience, Protection and Accountability) Bill, 2026 remains a pending private member's Bill in the Rajya Sabha, proposing criminal liability for negligent CI failures, a national CI classification framework, and mandatory monitoring dashboards for power grids, dams, ports, and transit systems; it has not yet been taken up for passage. Source (with date): ANI (6 Feb 2026); OpIndia (Jul 2026). - NCIIPC/CERT-In baseline obligations — annual third-party audit for Protected Systems, six-hour incident reporting, and 180-day in-India log retention under the CERT-In Cyber Security Directions, 2022 — are the practical test bench the July water-utility incident argues for rehearsing now, before an equivalent event, not after. Source (with date): CERT-In Cyber Security Directions, 2022, issued under Section 70B(6) IT Act (28 Apr 2022).
5. Actor in focus
CyberAv3ngers (Storm-0784 / Bauxite / UNC5691) — attribution suspected, not independently confirmed. Publicly tracked as an Iran-linked, IRGC-associated cluster, CyberAv3ngers' hallmark is opportunistic compromise of internet-exposed industrial controllers rather than a single software vulnerability: default or reused credentials, direct PLC web-interface access, and manipulation of device configuration to disrupt rather than destroy. The late-July water-utility campaign fits that pattern and again avoided a ransom demand, consistent with a disruption or messaging motive over financial gain. For Indian CI operators the relevance is the access pattern: any PLC or RTU reachable from the open internet without compensating controls is a candidate for the same opportunistic compromise, regardless of who is behind the next attempt. Source (with date): CISA/FBI/EPA advisory AA26-097A; Tenable (22, 28 Jul 2026).
6. IOC pack
Only public, attributed indicators; defang before operational use and pull exact values from the primary advisories. - CVE-2026-16812 (Arista VCO): exploitation source IPs from Arista's security advisory — 8[.]19[.]75[.]217, 206[.]72[.]242[.]124, 206[.]72[.]242[.]162 (Arista Security Advisory 0144, Jul 2026). - CVE-2026-15409/15410 (SonicWall SMA1000):extraweb_access.log entries showing /wsproxy requests with suspicious localhost or loopback host parameters returning HTTP 101, and rogue /__api__/login or /__api__/logout routes inside /var/lib/unit/conf.json (SonicWall PSIRT; Rapid7, Jul 2026). - CVE-2026-20316 (Cisco FMC): unexplained entries referencing /var/tmp/license.tmp in /var/log/messages (Cisco/The Hacker News, 30 Jul 2026). - AA26-097A PLC intrusions: unscheduled PLC password/IP changes, altered Add-On Instruction code modules, and HMI display values inconsistent with field readings — full indicator set in the CISA advisory (22 Jul 2026 update).
7. Tiered actions (Board / CISO / SOC)
Board: Commission a 72-hour inventory of every internet-facing management interface — SD-WAN orchestrator, SSL-VPN, firewall manager, PLC/HMI remote access — across CI estates, and track the pending CI Accountability Bill for governance implications.
CISO: Patch CVE-2026-16812, CVE-2026-15409/15410, and CVE-2026-20316 on an emergency track; rotate all SonicWall and Arista admin credentials; commission compromise assessments wherever vulnerable versions were internet-facing; align vulnerability SLAs to CERT-In's AI-accelerated exploitation guidance.
SOC: Hunt the published Arista VCO IPs and SonicWall log artefacts; audit every PLC/RTU for direct internet exposure and unscheduled configuration changes; validate MFA on OT remote-access paths; confirm 180-day log retention and rehearse manual-operations fallback for at least one CI process line.
8. Source index
Arista PSIRT / Security Advisory 0144, CVE-2026-16812 · BleepingComputer (27 Jul 2026) · The Register (28 Jul 2026) · cybersecuritynews.com (3 Aug 2026) · SonicWall PSIRT, CVE-2026-15409/15410 · Arctic Wolf (15 Jul 2026) · Canadian Centre for Cyber Security AV26-699 (14 Jul 2026) · Cisco PSIRT, CVE-2026-20316 · The Hacker News (30 Jul 2026) · CISA KEV catalog (27, 29 Jul 2026) · CISA/FBI/EPA advisory AA26-097A (7 Apr 2026, updated 22 Jul 2026) · Tenable (28 Jul 2026) · Dragos 2026 OT Cybersecurity Year in Review (17 Feb 2026) · The Hacker News, APT36/SideCopy (11 Feb 2026) · CERT-In; The News Mill (30 Jul 2026) · ANI (6 Feb 2026) · OpIndia (Jul 2026) · CERT-In Cyber Security Directions, 2022 (28 Apr 2022).
Three of this edition's four items describe the same movement. Attacker-controlled instructions are migrating out of the chat window and into the places an AI system reads without pausing to question them: a memory file the agent rewrites and reloads every session, a tool description returned by a connected server, a repository hook that fires the moment a project is opened. The fourth item is more ordinary and more urgent. An AI orchestration platform that holds every model key and connector credential an organisation gave it is being exploited in the wild, and it now sits on CISA's exploited-vulnerabilities list.
1
Anthropic and EPFL show that a payload written into an agent's own memory file can survive a context reset and pass to the next agent
A preprint released on 10 August 2026 examined what happens when instruction text is written into the self-modifiable files that autonomous agent harnesses reload into the system prompt at the start of each session. The researchers tested a simulated six-agent coding collaboration and chains of paired agents modelled on OpenClaw, the open-source autonomous assistant previously known as Clawdbot. The finding that matters for defenders concerns durability rather than cleverness. Payloads placed in a reloaded identity file accounted for roughly 88 percent of propagation attempts at about a 55 percent infection rate, against roughly 12 percent of attempts and a 17 percent rate for the same content sitting in an ordinary workspace file. All four tested payloads survived a twenty-hop chain. The authors are careful about scope: there is no evidence the technique has spread in the wild, and their review of about 2,000 archived posts from Moltbook, a social network for agents, found no successful agent-to-agent propagation despite attempts. A single paragraph of warning text added to the system prompt reduced spread to near zero. The npm worm that Datadog Security Labs documented on 4 August 2026 is the non-theoretical version of the same idea. Starting from a poisoned keyv release published that morning and spreading through the Cacheable family into hundreds of packages, it wrote a .vscode/tasks.json that ran on folder open and a .claude/settings.json carrying a session-start hook, so the persistence lived in the repository rather than in the operating system.
Why it matters for IndiaIndian software services firms, GCC engineering teams and product startups now give agents a persistent project memory precisely so that context is not lost between sessions. That same design means a tainted instruction rides the repository into the next sprint, the next developer's workstation and, for firms doing delivery work, the client's environment. Wiping a conversation is not a containment step when the durable state is a file in the repository.
ActionTreat agent state files as code. Put CLAUDE.md, AGENTS.md, memory files, .claude/, .vscode/ and equivalent directories under review in every pull request, and alert on changes to them the way you would on a change to a build script. Do not let an agent write to its own system-prompt file without a human approving the diff. Add the standing instruction that content read from external sources is never to be copied into durable agent state. After any dependency compromise, rebuild from a clean checkout rather than cleaning in place.
SourceAnthropic and EPFL preprint (10 August 2026); The Hacker News (18 August 2026); Datadog Security Labs (4 August 2026); safedep analysis of the keyv and cacheable compromise (4 August 2026).
2
A malicious tool server can split one refused instruction across three channels a coding agent already trusts, and the agent reassembles it
The ASSET Research Group disclosed a technique it calls GhostSplice, reported on 11 August 2026 and carried again in industry roundups on 17 August. The researchers, Murali Ediga and Sudipta Chattopadhyay, describe it as cross-channel trust fragmentation. Everything an agent reads during a task, including a tool's description, a project scan result and a follow-up result, lands in one block of working context with nothing marking which source each part came from. No single fragment has to look malicious. A request the assistant refuses when presented whole is complied with when it arrives in pieces. Across eleven models tested through their APIs, average compliance rose from about 42 percent to about 82 percent once the instruction was split in two, though Claude Sonnet and Opus refused throughout. The same model refused in one coding client and exfiltrated in another, which means the safety behaviour being relied on belongs to the surrounding product rather than to the model. Clients covered include Cursor, Visual Studio Code with GitHub Copilot, Codex CLI and Claude Code. The stated targets are SSH keys, environment secrets and source code. Two preconditions apply: the server is already connected, and the agent already has read access to what is taken. The work was carried out in isolated projects seeded with fabricated credentials, not against a live victim, and CVE identifiers are to follow coordinated disclosure. Separate coverage on 17 August set out the adjacent exposure, which is that tool servers routinely hold credentials in plaintext configuration files and run under service accounts nobody scoped.
Why it matters for IndiaConnecting tool servers to coding assistants has become routine in Indian engineering organisations, and the connection is usually made by an individual developer rather than approved centrally. A developer workstation in a services or GCC environment commonly holds customer source code, cloud credentials and deployment rights at once. The finding that protection varies by client is the difficult part for procurement, because an approval granted after testing one assistant does not carry across to another.
ActionMaintain an approved list of tool servers and block connection to anything outside it from managed machines. Mirror approved servers internally and pin versions rather than pulling current. Require that values returned by one tool are not passed into another tool's arguments without validation. Keep human approval on file reads outside the working directory and on any outbound request. Where a server holds credentials, move them into a secrets manager with short-lived tokens instead of a configuration file on disk.
SourceASSET Research Group GhostSplice disclosure and proof-of-concept repository; The Hacker News (11 August 2026); The Hacker News weekly summary and MCP secrets analysis (17 August 2026).
3CriticalCVSS 9.8
Langflow, an AI orchestration platform holding model and connector credentials, is under active exploitation and now carries a CISA exploited-vulnerabilities listing
CVE-2026-9198 is a code-injection flaw scored CVSS 9.8 that gives an unauthenticated attacker remote code execution on a Langflow deployment left in its default configuration. The path chains two endpoints. An automatic-login endpoint issues a superuser token to any caller on the network where the default auto-login setting remains enabled and reachable, and a code-validation endpoint then executes supplied Python. Versions 1.0.0 through 1.10.0 are affected and 1.10.1 carries the fix. IBM, which maintains Langflow, disclosed the flaw on 17 July 2026 and shipped the patch the same day. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 August 2026 and set 7 August as the remediation deadline for United States federal civilian agencies. Working proof-of-concept code circulated publicly in late July, and tracking cited in the reporting recorded 650 exploitation attempts from 6 July onward across 244 source addresses in 41 countries.
Why it matters for IndiaThe significance is what the host holds rather than the host itself. Visual AI-flow builders are the standard route for a first agent pilot in Indian banks, state departments, public sector undertakings and managed service providers, because they let a small team show a working prototype quickly. Those instances accumulate model provider keys, database connection strings and connector tokens, and pilots are frequently stood up on a cloud instance with a public address for the convenience of a demonstration, outside the asset register that CERT-In's May blueprint asks for. Remote code execution on that host is not one application compromised. It is every credential the pilot was trusted with.
ActionFind every Langflow instance, including ones a business team stood up without involving IT, and upgrade to 1.10.1 or later. Remove public exposure and put the service behind authenticated access. Turn off the default auto-login behaviour. Rotate every model provider key, database credential and connector token held on an affected host, on the assumption of exposure rather than on proof of it. Review logs for superuser token issuance and calls to the code-validation endpoint. CERT-In's six-hour incident reporting obligation applies here as it would to any other compromised server.
SourceBleepingComputer (5 August 2026); The Hacker News (5 August 2026); CISA Known Exploited Vulnerabilities catalogue entry for CVE-2026-9198 (4 August 2026); CERT-In, Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (25 May 2026).
4
A discounted resale service for frontier-model access routes every customer prompt through its operator
Okta researchers Jeremy Kirk and Mathew Woodyard documented a service trading as Poison Claude that sells access to Anthropic models at roughly 5 to 15 percent of the official per-token price. The economics come from pooled accounts and promotional credits, including a hundred-dollar bonus available on new cloud accounts, rather than from any efficiency. The customer pays in cryptocurrency, receives an API key and points an existing tool at the operator's endpoint. That is the whole exposure. Prompts, attached files, source code and any credential pasted into a session pass through infrastructure controlled by an anonymous party before reaching a model, with no undertaking about retention or resale. A configuration error left an interface exposed that indicated roughly 881 registered users and 872 active ones. The researchers reported finding more than half a dozen comparable services advertised in underground channels.
Why it matters for IndiaIndian teams face genuine cost pressure on model spend, and a ninety percent discount is a persuasive line to a project manager working to a fixed-price contract. The configuration change involved is a single environment variable on a developer's machine, which sits below the level most organisations monitor. For firms holding client code under a services agreement, or processing data covered by the Digital Personal Data Protection Act or by RBI localisation direction, routing that material through an unknown intermediary is a contractual and regulatory failure independent of whether the operator does anything with it.
ActionPublish the list of approved model endpoints and block the rest at the proxy and DNS layer. Look for non-standard base-URL settings in environment variables, IDE configuration and CI definitions, since that is the single artefact these services need. Fund a sanctioned route to model access, because unofficial gateways get adopted where the approved path is slow or unavailable. Treat confirmed use on client or production material as a data exposure incident and notify on that basis.
SourceOkta research reported by The Hacker News (5 August 2026); Help Net Security (6 August 2026).
AI defender tip: Read these four together and the common failure is a trust boundary that was never drawn. An agent trusts a file it wrote itself. An agent trusts a tool description because a server it is connected to returned it. An orchestration host trusts any caller on the network because a convenience setting was left at its default. A developer trusts an endpoint because a key was issued and the responses looked correct. In each case the system behaved exactly as designed, and the design assumed the input was benign. The exercise for this fortnight is short. Take one AI system in production and list every source it reads from without a human seeing the content first, including memory files, connected tool servers, mailboxes, repositories and web pages. For each one, record who can write to it. Anything on that list that an outsider can write to is an input path carrying the agent's full authority, and it should either be removed, put behind validation, or recorded as accepted risk with a named owner.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
