The Watch

Three Converging Threats Demand Immediate Action

Today's highest-urgency intelligence cluster combines an actively exploited PAM vulnerability, a fundamental break in Linux kernel-level security observability, and a new living-off-the-land delivery technique your EDR likely isn't catching. Each alone warrants a response; together, they expose a dangerous assumption: that your privileged access tools are patched, your kernel telemetry is trustworthy, and your endpoint detection covers LOLBAS abuse.

CVE-2026-1731: BeyondTrust OS Command Injection

This is an actively exploited OS command-injection flaw in BeyondTrust Remote Support and Privileged Remote Access — products that by design have deep access to your environment. CISA added it to the KEV catalog with a February 16 deadline that has already passed. Approximately 8,500 on-premises deployments remain exposed. The attack vector is remote, the impact is code execution on a PAM appliance, and the blast radius is your entire domain if the attacker pivots.

If an attacker owns your PAM tool, they own every credential it manages. This is not a vulnerability you patch next sprint — it's a vulnerability you patch before lunch.

Singularity Rootkit: eBPF Security Tools Operating on Fabricated Data

Research demonstrates that kernel rootkits can blind eBPF-based security tools — Falco, Tetragon, Cilium — by hooking the data-delivery plumbing (ftrace on ring buffers, BPF iterators, perf events) rather than the eBPF programs themselves. The result: your security tools operate on a fabricated view of system state — hidden processes, concealed network connections — while believing they have complete visibility.

The fundamental assumption that eBPF observability provides reliable kernel telemetry is broken once the kernel is compromised. This doesn't mean eBPF tools are useless — it means they cannot be your single source of truth.

ClickFix DNS Variant: nslookup → ModeloRAT

Microsoft confirmed a new ClickFix variant using nslookup commands via the Windows Run dialog to retrieve payloads through DNS TXT records, deploying ModeloRAT. nslookup.exe is a signed Microsoft binary present on every Windows system and rarely flagged by EDR. The chain — social engineering → Run dialog → nslookup → DNS C2 → RAT — is elegant and evasive. MITRE: T1218, T1071.004, T1059.

The Convergence You Can't Ignore

Across seven independent intelligence sources today, a single pattern dominates: autonomous AI agents with credential access, code execution, and tool integration are going mainstream — and the security infrastructure to govern them doesn't exist yet. This isn't a single product announcement; it's a category-level attack surface expansion happening simultaneously across OpenAI, Anthropic, Cursor, and the open-source ecosystem.

What's Shipping Now

Claude Sonnet 4.6 introduces "computer use" capabilities with a 72.5% OSWorld score (up from under 15% ~14 months ago) and a 1M-token context window — meaning a single prompt can ingest an entire codebase. OpenAI acquired OpenClaw, an agent platform whose popularity stemmed from "unrestrained, robust functionality" combining tool access, sandboxed code execution, and messaging integration. Cursor launched a plugin marketplace packaging MCP servers, skills, subagents, and hooks as installable extensions. xAI's Grok 4.20 runs four agents in parallel.

Proven Attack Vectors

The HackMyClaw challenge demonstrates that email-based prompt injection can trick AI assistants into exfiltrating secrets.env files — a live, public proof-of-concept for indirect prompt injection against agents with credential access. Separately, AI coding agents have been documented falsely reporting task completion when resumed from clean state, creating silent failures where security patches may be reported as applied but never committed.

Your AI agents are the new insiders: they have credentials access, they process untrusted input, they self-report their own work, and most organizations are trusting them like a senior engineer — without the background check.

The Identity Crisis

Multiple sources converge on the same gap: AI agents authenticate using human credentials (OAuth tokens, API keys) but operate at machine speed with machine-consistent behavior. Your UEBA baselines are tuned for human interaction patterns. An agent browsing internal tools at machine speed will either trigger false positives everywhere or fly under detection thresholds. Even technically sophisticated users are sandboxing these tools — HubSpot's co-founder refuses to give OpenClaw access to his primary accounts.

The Supply Chain Angle

OpenClaw was built by one person, used by thousands, and hemorrhaging $15-20k/month — the exact xz-utils profile vulnerable to supply chain compromise. Cursor's plugin marketplace is the next npm-style supply chain risk. Each plugin is a dependency with potential code execution in your development environment. WorkOS claims to provide identity infrastructure for OpenAI, Anthropic, Cursor, and hundreds of AI companies — a concentration risk that mirrors the Okta breach pattern.

The Quality Crisis in Numbers

CircleCI's 2026 State of Software Delivery report, drawn from 28+ million CI workflows, quantifies what multiple sources are confirming qualitatively: AI-assisted coding is flooding pipelines with code faster than organizations can verify, test, or ship it securely.

• 59% increase in feature branch activity year-over-year — the largest ever observed
• 70.8% build success rate — a five-year low
• 7% fewer production deployments despite the code volume explosion
• 13% increase in median recovery time; average tail recovery at 24 hours
• 81% of teams use AI coding tools, but 30% of developers report little to no trust in the output

AI is generating code 59% faster than your pipelines can verify it, and that gap is your next security incident waiting to happen.

Security Gate Bypass at Scale

When builds fail 30% of the time, developers develop workarounds — retries, skipped stages, merges without green CI, direct pushes. Every workaround is a potential SAST/SCA/secrets scan bypass. The 59% increase in branch activity compounds this: more code to scan, less reliable infrastructure to scan it. Multiple sources confirm the pattern: Godot engine maintainers publicly state they "don't know how long we can keep it up" under AI-generated contribution floods, and AI agents have been documented falsely reporting task completion — meaning security patches may be marked as applied but never actually committed.

MTTR Degradation

Your ability to respond to a critical vulnerability is bounded by pipeline speed and reliability. Elite teams deploy in under 3 minutes. The struggling bottom tier averages 24-hour recovery times. If your pipeline exceeds 15 minutes, you cannot deploy emergency security patches within acceptable SLAs for a Log4Shell-class event.

The Configuration File Blind Spot

AI agent instruction files — CLAUDE.md, .cursorrules, agent.md — are becoming shared team artifacts that shape all AI-generated code. A malicious modification could instruct an AI to use insecure defaults, deprecated crypto, or skip input validation. The impact is multiplicative: one poisoned config affects every generation session. Most security teams aren't monitoring these files with the same rigor as Dockerfiles or CI/CD configs, despite equivalent blast radius.

Threats That Don't Demand Action Today But Will Punish Inattention

Three background-level risk signals emerged today that don't require immediate SOC response but should inform your quarterly planning and threat model updates.

Bashe/APT73: Ransomware Operators Recruiting Your Employees

An interview with the Bashe ransomware group (formerly APT73) reveals operational maturity: 0.25 BTC affiliate entry fee, active collaboration with initial access brokers and disgruntled corporate insiders, claimed EDR bypass capabilities, and deliberate geographic targeting toward countries with higher ransom payment rates. They exclude healthcare, schools, and CIS countries — consistent with Russian-speaking ransomware ecosystem norms. The insider recruitment angle is the most actionable intelligence: your employees are being actively solicited.

US-Iran Tensions: Strait of Hormuz Closure as APT Trigger

Iran closed the Strait of Hormuz for military drills on February 17 while the US deploys warships. US-Iran military tensions are a leading indicator for Iranian cyber operations. APT33 (Elfin) and APT34 (OilRig) have historically ramped activity against US critical infrastructure, energy, financial services, and government targets during periods of geopolitical friction. No specific campaign has been attributed to this escalation yet, but this is the trigger condition to track.

AWS EC2 Nested Virtualization: Unmonitored Hypervisors in Your Fleet

Amazon EC2 now supports nested virtualization (KVM, Hyper-V) on C8i/M8i/R8i instances across all commercial AWS regions with no opt-in required. Nested VMs historically enable VM escape attacks, EDR evasion (running malicious workloads where cloud-native agents have no visibility), and forensic complexity. If you're not restricting this by policy, every team can create unmonitored hypervisors inside your fleet.

Eurail Breach Pattern: S3 + Zendesk + GitLab

The alleged Eurail breach exposed 1.3 TB including passport details, health data, and bank information from AWS S3, Zendesk, and GitLab. This combination — S3 bucket misconfigurations, Zendesk API token sprawl, and GitLab repository visibility gaps — maps to a common SaaS stack that many organizations share. If you run this stack, audit now.