The Watch

Simultaneous Critical Vulnerabilities Across Disparate Attack Surfaces

Today's intelligence cycle delivered an unusually dense cluster of critical-severity vulnerabilities that share one dangerous trait: all are exploitable without authentication in default configurations. The convergence across physical security, enterprise identity, and AI-powered development toolchains means most organizations are exposed on at least one vector.

Honeywell CCTV: CVE-2026-1670

CISA issued an advisory for a missing authentication flaw in Honeywell I-HIB2PI-UL and NDAA-compliant PTZ cameras. An unauthenticated attacker can remotely change the password recovery email, achieving full account takeover and unauthorized video feed access. The ATT&CK chain is clean: T1190 → T1098 → T1125. For organizations under NERC CIP, HIPAA physical security, or PCI DSS Requirement 9, this is compliance-impacting.

OpenText OTDS: Unauthenticated Java Deserialization

Assetnote disclosed an RCE in OpenText Directory Services exploitable via a broken HMAC signature verification where attacker-controlled length fields truncate the signed message to begin at an injected payload. The exploit required building a custom Deflate compressor with tailored Huffman codes — sophisticated engineering, but the attack surface is simple: unauthenticated, default config, network-reachable. Since OTDS is the authentication backbone for OpenText's entire ecosystem, compromise cascades to every integrated application.

Cline AI Bot: Prompt Injection → Supply Chain Compromise

A prompt-injected GitHub issue title can drive Cline's Claude-based triage bot to execute arbitrary commands, poison GitHub Actions caches, and steal publishing tokens for VS Code Marketplace, OpenVSX, and npm. This is the threat model most security teams haven't built: AI agents with CI/CD write access are supply chain attack surfaces. The attacker doesn't need credentials — they need a string an LLM interprets as an instruction.

Detection Opportunities

• Honeywell: Alert on unauthenticated API calls to camera account management endpoints; monitor for password recovery email change requests
• OpenText OTDS: Deploy network-level detection for serialized Java objects in HTTP traffic to OTDS endpoints; monitor logs for deserialization exceptions
• CI/CD: Monitor GitHub Actions cache writes for unexpected entries; alert on publishing token usage from non-standard IPs; require human approval for workflow changes

Three unauthenticated critical vulnerabilities in one cycle — across cameras, identity systems, and AI bots — means your attack surface is wider than your asset inventory suggests.

Converging Evidence Across Five Intelligence Streams

A pattern emerged today across five independent sources that, taken together, constitutes the most significant emerging attack surface for enterprise security: AI coding agents, marketing automation bots, and LLM-powered triage systems are operating with privileged access, minimal sandboxing, and zero security telemetry across your organization.

The Data Exfiltration Problem

A researcher intercepted 3,177 API calls across four AI coding tools and found that Gemini Pro sends up to 350,000 tokens of code context to Google's API for a single bug fix — 15x more than Claude Opus for the identical task. Every token is proprietary code, potentially including secrets, architecture details, and customer data patterns. Meanwhile, Anthropic's own research on Claude Code shows experienced developers auto-approve more agent actions over time, granting increasing autonomy without increasing oversight.

This isn't limited to engineering. Marketing teams are building multi-API AI pipelines chaining Ahrefs, Gemini, Anthropic, and Telegram — processing competitive intelligence and customer data through unsanctioned workflows that bypass CASB and DLP entirely.

The Supply Chain Compromise Vector

The Cline prompt injection attack demonstrated today shows the offensive potential: a crafted GitHub issue title drives an AI triage bot to execute arbitrary commands, poison CI caches, and steal publishing tokens. New developer tooling (Expo MCP Server, cmux) is integrating agents directly into build systems with expanding access. AI agent frameworks are reinventing concurrency patterns without the fault-isolation guarantees of battle-tested systems like Erlang/BEAM.

The Governance Gap

Cursor published its agent sandboxing architecture — implicitly acknowledging the threat — but it's opt-in security with approval gates most developers click through reflexively. Jailbreak research is maturing from novelty to weaponizable tradecraft, meaning LLM safety guardrails are a usability feature, not a security control. And Google's Gemini 3.1 Pro rollout across its entire ecosystem simultaneously constitutes a silent supply chain change that can alter prompt-based guardrail behavior without notice.

AI coding agents are the next shadow IT crisis: your developers are already using them, your security team hasn't sandboxed them, and the exfiltration path is one unsandboxed API call away.

Two Google Cases + 20% YoY Federal Surge = Pattern, Not Coincidence

The insider threat landscape shifted measurably this cycle. Three independent intelligence streams converge on the same conclusion: AI tools have created a DLP-invisible exfiltration channel that insiders are actively exploiting, and traditional controls aren't catching it.

The Google Signal

U.S. prosecutors indicted three Silicon Valley engineers on 14 felony counts for stealing hundreds of confidential files containing Pixel processor and Tensor chip designs, then funneling them to contacts in Iran via personal devices and third-party messaging. This comes weeks after a separate conviction of another Google engineer for stealing AI trade secrets. The exfiltration path was devastatingly simple: legitimate access → personal device → third-party messaging → Iran-based storage. No zero-days. No supply chain compromise. Just authorized users copying files through channels that didn't trigger alerts.

The DOJ's response — 14 felony counts with up to 20 years imprisonment — signals federal prosecutors are treating tech IP theft as a national security priority, particularly with nation-state connections.

The Macro Trend

Approximately 1,500 federal trade secret cases were filed last year — a 20% increase year-over-year — with AI explicitly identified as a contributing factor. The attack pattern: an insider pastes proprietary code, formulas, or strategic documents into an external AI service. The AI synthesizes or reformulates the content. The insider extracts the output. No file was copied. No USB was mounted. No email attachment was sent. Traditional DLP triggers don't fire.

The Credential Weakness

Compounding the insider problem, cybersecurity firm Irregular found that LLM-generated passwords contain predictable, repeatable patterns vulnerable to brute-force attacks. LLMs are deterministic pattern generators, not cryptographically secure RNGs. An attacker studying LLM password output can build targeted dictionaries that dramatically narrow the search space — especially dangerous for accounts without MFA.

Cross-Source Pattern

The Google case, the trade secret surge, and the LLM password weakness all point to the same structural gap: security controls designed for file-based, network-based exfiltration are blind to AI-mediated data movement. The Prince Andrew arrest — sharing confidential British trade reports with Epstein over years while serving as UK trade envoy — provides a historical case study of the same pattern: authorized access, slow exfiltration to external contacts, detection lag measured in decades.

AI didn't create a new threat category; it gave insiders a DLP-invisible exfiltration channel, and your 2024-era controls aren't catching it.

~1,400 Vulnerabilities Published Before CVE Assignment

Bitsight's analysis of China's two national vulnerability databases — CNNVD (Ministry of State Security) and CNVD (CNCERT) — reveals a deeply concerning intelligence asymmetry. Approximately 1,400 vulnerability entries were published in Chinese databases before becoming public in CVE, often by several months. Some entries have no CVE equivalent at all, representing vulnerabilities potentially unknown to Western defenders entirely.

The Regulatory Mechanism

China's 2021 RMSV regulations create a structural advantage: mandatory 48-hour government reporting of discovered vulnerabilities combined with prohibitions on sharing PoC exploits publicly. The Chinese government receives early notification while simultaneously restricting information flow to the global security community. Post-2021, CNVD saw a decline in non-CVE publications, but CNNVD has recently seen a resurgence — suggesting the MSS-affiliated database is actively expanding independent vulnerability collection.

Compounding Factors

This intelligence gap is worsened by two concurrent developments. First, the partial US government shutdown is degrading federal cyber services — during the 2018-2019 shutdown, TLS certificates for federal websites expired unrenewed and NIST's NVD fell behind on CVE processing. Second, US-Iran military escalation (carrier groups deployed, potential strikes within 10 days) historically precedes Iranian APT cyber retaliation campaigns. APT33/Peach Sandstorm, APT35/Charming Kitten, and MuddyWater all escalated operations during prior kinetic confrontation periods.

The implication: your vulnerability management program is operating with a structural blind spot that Chinese state actors can exploit during the gap, your federal threat intelligence sources may be degraded by the shutdown, and geopolitical escalation is elevating the likelihood of state-sponsored cyber operations.

If CVE is your only source of vulnerability truth, you're operating months behind adversaries who read CNNVD.