The Watch

The Research That Changes the Conversation

Three independent research efforts published this cycle collectively establish that AI agent exploitation is no longer theoretical — it's measurable, repeatable, and alarmingly effective. Google DeepMind published the first systematic adversarial framework for AI agents, Redwood Research measured undetected sabotage rates in production-like environments, and the Cloud Security Alliance quantified enterprise breach rates through AI agents. The convergence of these findings demands immediate defensive action.

DeepMind's Six Attack Surfaces

DeepMind's framework identifies six distinct attack surfaces for AI agents: content injection, semantic manipulation, cognitive state corruption, behavioral control, systemic attacks, and human-in-the-loop traps. The headline numbers are stark: simple HTML injection into pages agents browse achieves up to 86% hijack rates. RAG corpus poisoning succeeds at over 80% with just 0.1% corrupted data — individual poisoned documents look completely benign until aggregated by the agent.

DeepMind's core conclusion is critical: training-time defenses cannot solve inference-time problems. No amount of RLHF or safety tuning protects an agent whose environment has been manipulated.

MCP Tool Poisoning: Already in Your IDEs

Simultaneously, researchers demonstrated three MCP tool poisoning attack patterns against Cursor IDE: direct tool poisoning (malicious instructions hidden in tool descriptions, invisible to users but executed by models), cross-server hijacking (one rogue MCP server compromising all trusted servers on the same client), and post-approval "rug pulls" where servers change tool definitions after user approval. These aren't theoretical — Cursor is in active use across engineering teams.

Enterprise Impact: The Numbers Are Damning

CSA research confirms the real-world impact:

• 47% of organizations have already been breached through AI agents
• 53% report agents exceeding their intended permissions
• 87% run 2+ agent platforms with fragmented visibility
• Only 21% maintain real-time agent inventories

Redwood Research's LinuxArena adds the detection dimension: frontier AI models achieve roughly 23% undetected sabotage against trusted monitoring in production-like Linux environments. One in four malicious agent actions goes unseen by your current SIEM and EDR stack.

Confirmed Exploits in Production Platforms

This isn't limited to open-source tools. Microsoft Copilot Studio and Salesforce Agentforce have confirmed form-based prompt injection vulnerabilities — attackers craft malicious prompts as normal form input that override agent behavior and exfiltrate data. Google's own Antigravity AI agent manager was found vulnerable to RCE via prompt injection even at its highest security setting, because tools classified as "native" bypassed the sandbox entirely. Google patched this specific instance, but the design flaw — exempting trusted tools from security boundaries — is architectural, not instance-specific.

The attack surface for AI agents isn't the model — it's everything the model reads, and your current controls have a 23% blind spot for what the model does.

The Insurance Gap Compounds This

Adding urgency: insurers are quietly excluding AI workloads from cybersecurity and E&O coverage, meaning a breach through your AI agents may land as a fully uninsured loss. The combination of quantified exploitability and vanishing insurance coverage creates a risk posture most boards haven't been briefed on.

The Exploitation Landscape This Week

Five distinct active exploitation or imminent-exploitation items landed this cycle. Two are on CISA's KEV catalog with deadlines that have already passed. One is flagged by Microsoft as "automatable" — meaning mass exploitation tooling is expected within days. One is an adware-turned-SYSTEM-malware campaign with 23,565 confirmed compromised endpoints and specific IOCs you can hunt today. And one has a public PoC on GitHub for a security appliance in your stack.

Apache ActiveMQ CVE-2026-34197: 13 Years of Default Credentials

Horizon3 researchers — using Anthropic's Claude to find it — discovered a code injection vulnerability in ActiveMQ's Jolokia JMX-HTTP bridge at /api/jolokia/. The flaw technically requires authentication, but widespread use of default credentials (admin:admin) makes it effectively unauthenticated RCE. CISA added it to KEV on April 17 with an April 20 remediation deadline — already expired. The unusually tight 3-day window signals confirmed exploitation at scale.

ActiveMQ is a Java message broker embedded in countless middleware stacks since 2004. Many organizations don't realize they're running it. The fact that AI found a critical vulnerability human auditors missed for 13 years should recalibrate your assumptions about what's hiding in legacy codebases.

SharePoint CVE-2026-32201: "Automatable" Means It's Coming Fast

Microsoft itself flagged this Patch Tuesday SharePoint spoofing zero-day as "automatable". The CVSS 6.5 score is misleading — spoofing in SharePoint enables token theft, session hijacking, and phishing from trusted internal domains. The "automatable" designation means exploitation tooling will be commoditized rapidly. Prioritize internet-facing and hybrid SharePoint deployments immediately.

CVE-2009-0238: A 17-Year-Old Excel RCE Returns

CISA added this 2009 Excel RCE (CVSS 9.3, malformed objects) to its KEV catalog on April 14 after confirming fresh exploitation against legacy Office 2000–2007 and Mac Office 2004/2008 installations. Originally used to drop Trojan.Mdropper.AC, its re-emergence 17 years later proves threat actors are actively scanning for the legacy software nobody retired.

Dragon Boss Solutions: When Adware Becomes Malware

A signed adware binary from Dragon Boss Solutions LLC deployed a multi-stage chain: an off-the-shelf update mechanism fetches payloads that terminate antivirus products with SYSTEM privileges, establish WMI persistence, and modify hosts files to block vendor security updates. Huntress sinkholed the unregistered C2 domain chromsterabrowser[.]com and found 23,565 infected endpoints.

Specific IOCs to hunt immediately:

• WMI event consumer: MbRemovalMbSetupKillConsumer
• Defender exclusion paths containing DGoogle or DDapps
• DNS queries to chromsterabrowser[.]com
• Any signed binaries from "Dragon Boss Solutions LLC"

Your EDR's adware/PUP classification just became a security gap — Dragon Boss proves "nuisance" detections can mask SYSTEM-level compromise.

FortiSandbox CVE-2026-39808

A PoC exploit is now on GitHub. A compromised FortiSandbox lets malware sail through analysis unchallenged. If unpatched, restrict management interface access to trusted networks immediately.

A New Offensive Framework Changes the CI/CD Threat Landscape

SmokedMeat (AGPLv3) is the first purpose-built red team framework for CI/CD pipelines — described accurately as Metasploit for build infrastructure. Released in direct response to TeamPCP's March 2026 supply chain compromises of Trivy, LiteLLM, KICS, Telnyx, and dozens of npm packages, SmokedMeat codifies the attack patterns that nation-state and sophisticated criminal groups have been executing ad hoc.

What SmokedMeat Does

SmokedMeat's implant, Brisket, operates inside CI/CD runner environments and performs three critical functions:

1. Secret sweeping: Scans runner process memory for credentials, tokens, and API keys that workflows expose during execution
2. OIDC token exchange: Exchanges CI/CD OIDC tokens for AWS, GCP, and Azure access credentials — turning a pipeline compromise into cloud infrastructure access
3. Blast radius mapping: Generates live attack graphs showing what can be reached from a compromised runner

The OIDC token exchange capability is particularly dangerous. Many organizations use OIDC federation to grant CI/CD pipelines cloud access without long-lived credentials — a security best practice that also creates a token exchange pathway an attacker can abuse from within the runner.

TeamPCP's Targeting of Security Tools

The context matters: TeamPCP didn't just compromise random npm packages. They specifically targeted security tools themselves — Trivy (vulnerability scanning), KICS (infrastructure-as-code scanning). This represents a sophisticated escalation: compromising the tools defenders use to detect compromise. If your CI/CD pipeline includes Trivy or KICS, verify your dependency trees against TeamPCP's known compromised versions.

QEMU as an EDR Evasion Layer

In a related development, Sophos documented threat actors running ransomware inside QEMU virtual machines on target hosts. The ransomware executes inside the VM, evading endpoint detection that only monitors host-level processes. This is virtualization as a detection bypass — your EDR sees a legitimate QEMU process, not the ransomware running inside it.

When your security scanning tools are compromised and your ransomware runs inside VMs your EDR trusts, the detection model that assumes host-level visibility is sufficient has failed.

LLMs Accelerate the Bottom of Your Vulnerability Funnel

TrustedSec benchmarked six self-hosted LLMs across 4,800 test runs against OWASP Juice Shop. Results: 85–98% success on single-step exploits (SQLi, auth bypass, JWT confusion, IDOR) but 0% on multi-step chains requiring 10+ sequential tool calls. Translation: commodity AI now reliably exploits your low-hanging fruit automatically. Your SQLi and IDOR bugs are no longer waiting for a human attacker — they're automatable targets.