The Watch

What Happened

Malwarebytes reports an active Adobe Reader zero-day that allows a crafted PDF to read local files, pull remote code, and partially bypass Adobe's sandbox — the primary defense-in-depth control for PDF rendering. No CVE has been assigned. No patch is available. PDF remains the most commonly weaponized document format in enterprise phishing campaigns, and partial sandbox bypass means the attacker doesn't need a full escape — they're reading files and fetching payloads from within a weakened containment boundary.

Simultaneously, a separate confirmed incident revealed attackers used Claude (Anthropic) and GPT-4.1 (OpenAI) to process and exfiltrate Mexican citizen data during an active cyberattack. This isn't AI generating phishing emails — this is AI used as an operational tool within an attack chain for data handling during exfiltration. Bruce Schneier's analysis of cybercriminal forum discussions confirms this is not isolated: underground forums are actively discussing AI for fraud, tool development, and operational security.

LLM Safety Guardrails: Systematically Brittle

Wharton Generative AI Labs research found that applying classic persuasion principles — authority, commitment, and scarcity — more than doubles compliance with requests that LLM safety would normally block. This transforms jailbreaking from art into repeatable methodology. If you run any customer-facing or internal LLM application, these aren't edge cases — they're the new baseline attack.

The baseline threat model should now assume AI-augmented adversaries. AI-assisted offense has moved from proof-of-concept to confirmed field operations.

Cross-Source Pattern

Multiple intelligence streams converge on the same conclusion: AI is accelerating both sides of the security equation simultaneously. OpenAI created GPT-5.4-Cyber (a deliberately permissive model for defenders) while attackers weaponize commercial LLMs for exfiltration. Anthropic restricted Opus 4.7 below Mythos capabilities for safety while the same model family is confirmed in attack chains. This is not a paradox — it's an arms race, and your security program needs to treat AI as both attack surface and defensive capability.

Specific Mitigations

The Convergence

Six independent intelligence streams this cycle all converge on the same conclusion: agentic AI is entering production environments at scale, and the security governance gap is widening every week. The product announcements are relentless — OpenAI's Codex now operates computers autonomously with persistent memory and remote environment access, Google's Chrome Skills embeds AI workflows inside authenticated browser sessions, Factory's Droids run CI/CD pipelines at Morgan Stanley, EY, and Palo Alto Networks, and Google's Gemini macOS app can read any active window on the desktop via a global hotkey.

Meanwhile, Johns Hopkins' ManyIH research demonstrates that current frontier models — Claude, GPT-series, Gemini — fail to correctly resolve conflicts across multiple privilege levels. In practical terms: if an AI agent receives system-level instructions from your infrastructure and user-level inputs from an employee or customer, it cannot reliably distinguish which should take precedence. This is the exact mechanism prompt injection exploits, and every agentic product announced this week relies on this capability working correctly.

Four Distinct Shadow AI Vectors

Field reports from CISO conversations decompose the threat into four attack surfaces, each requiring different controls:

The word CISOs use about shadow AI is 'defeated.' AI adoption is moving faster than any security category in a decade, and defense tooling and budgets are both playing catchup.

The Data Exfiltration You Can't See

Cursor projects $6B+ ARR, meaning millions of developers send code to its APIs daily. Alibaba's Qwen3.6 runs competitively on a MacBook Pro as a 21GB model — entirely outside your visibility. Replit has 50M+ users explicitly designing for people who "don't know how to code." The on-device inference shift is critical: a 0.6B model runs at 25 tokens/second on a phone with zero network visibility. Your DLP controls were built for a world where data exfiltration requires network egress. That assumption is now broken.

What To Do

The recommended approach — validated across multiple CISO conversations — is sanctioned tiers with real security controls, not blanket blocking (which drives usage underground onto phones and personal devices). But those controls — browser-layer DLP, agent inventory, ACL cleanup, prompt injection testing — are wildly underfunded because they don't make it into AI rollout budgets.

The Unified Kill Chain

Credential attacks have converged into a single predictable pipeline that CISOs report seeing repeatedly in Q1 2026: infostealer logs harvest credentials from personal apps where employees reuse passwords. Those credentials are sprayed against corporate portals within two weeks of harvesting. When MFA blocks the front door, adversary-in-the-middle (AitM) kits steal session cookies — making the MFA rollout you completed in 2023 functionally irrelevant. Push-bombing, TOTP relay, and cookie replay are now the default phishing playbook, not edge cases.

But initial access through human identities is only the entry point. The real damage comes from the pivot: Midnight Blizzard's playbook moves from human credentials to OAuth tokens, service accounts, and SaaS-to-SaaS integrations. The Snowflake breach followed the same pattern. The attacker enters through a human and operates through machines. If your SOC watches human authentication, your IAM team manages service accounts, and your AppSec team owns OAuth integrations — who owns the kill chain?

DPRK's New Entry Vector: Fake Zoom Updates

A North Korean group is actively targeting crypto and finance workers through trojanized Zoom updates that steal passwords, cryptocurrency wallets, and Telegram session tokens. The critical detail: no software vulnerability is exploited. This is pure social engineering — the victim voluntarily executes what they believe is a legitimate update.

This campaign targets the human layer exclusively. No patching addresses it. Application allowlisting, EDR behavioral detection for unsigned Zoom binaries, and targeted security advisories are your controls.

Mac Endpoint Blind Spot

Jamf Security 360 data shows trojan malware now leads Mac detections, with Atomic Stealer classified as both trojan and infostealer — indicating classification confusion that may cause detection gaps. If your EDR solution categorizes these separately, you may miss Atomic Stealer under one classification. Developer machines and executive laptops are priority targets given their credential stores and API keys.

Edge Appliance Exposure Compounds the Problem

Five major vendors — Ivanti, Fortinet, Palo Alto, Cisco, and F5 — have all shipped critical auth-bypass or RCE chains in the last 24 months, built on architecturally insecure CGI/PHP codebases. Nation-states exploit new CVEs within days of disclosure. The root cause is architectural, not incidental — you're not patching individual bugs, you're running a permanently vulnerable attack surface. ZTNA has matured enough to replace classic VPN appliances, and organizations that have migrated report sleeping better.

Every top Q1 2026 credential threat starts in enterprise security and ends in AppSec, or vice versa. The organizational split between those teams is the attacker's favorite entry point.