ClarityBeta

Security & Threat Intelligence

The Watch

9 min read · 1,723 words · 3 moves to watch
The Signal

Patching Cisco's email gateway won't evict attackers already duplicating your mail.

CVE-2026-76461 gave unauthenticated root on AsyncOS before disclosure, and it already sits in CISA's KEV. The persistence to hunt for is a silent filter no EDR will surface, because there is no agent on the appliance to surface it. Which means the remediation ticket your team closes this week is only half the job: the config on the box has to be read by hand, and it survives the patch.

In Play

  1. Inline Security Controls Became the Intrusion Path

    Cisco confirmed CVE-2026-76461 in AsyncOS for Secure Email Gateway allows unauthenticated root command execution. CyberScoop reports it was exploited before disclosure and is now in CISA's KEV catalog, and that Cisco shipped IOCs plus a statement that multiple customers were likely compromised. This appliance sits inline on everything, so the work is a compromise assessment, not a patch cycle.

    Ask Clarity
    Try

  2. Human Reviewers Are Reading Consumer LLM Prompts

    404 Media reports OpenAI pays hundreds of contractors, under the internal codename Project Lily, to read real ChatGPT conversations. The data-sharing setting is on by default for Free, Plus and Pro, and off for Enterprise, Business and Edu. Reviewers see no username, but they do see a memories summary covering prior usage and approximate location. OpenAI's own Privacy Filter documentation concedes it misses uncommon identifiers and under-redacts when context is limited.

    Ask Clarity
    Try

  3. Agent-Approved Code Merges Enter the Change-Control Path

    The Pragmatic Engineer documented that inside OpenAI, changes an agent classifies as low-risk are auto-approved with no human in the merge path, while high-risk changes get extra AI review or mandatory sign-off. One Codex identity reads GitHub, Slack, Notion, Databricks, Datadog and internal logs, and some of its skills are maintained by Codex itself. Build-test-deploy load rose sharply over six months — that is the pressure that will push your own security gates to the back of the queue.

    Ask Clarity
    Try

  4. Confidential Computing Integrity Claims Are Contested

    Researchers disclosed DDRop, a hardware attack that silently drops writes to server memory so the processor keeps reading stale data, defeating memory protection in both Intel TDX and AMD SEV-SNP. It breaks the integrity guarantee rather than confidentiality, and because it lands on both major x86 implementations, switching vendors buys nothing. If any customer commitment or audit narrative asserts the cloud operator cannot tamper with a workload, that claim now resolves on firmware and silicon timelines.

    Ask Clarity
    Try

  5. Model Retention Terms Now Decide Where Workloads Run

    Anthropic's Fable model family has stored customer data for 30 days by default since June, citing abuse monitoring. The general remedy, Enterprise Frontier Safeguards, is not live until later this fall, and eligibility is undefined. Palantir and Booz Allen restricted Fable use and expanded OpenAI's Astra, which they secured with zero data retention. One cybersecurity vendor serving the US government moved production customer-facing apps between labs purely over the retention term.

    Ask Clarity
    Try

Deep Dives

The Box That Reads All Your Mail Is Now Running Someone Else's Commands

Patching AsyncOS closes the entry point and leaves everything a rooted gateway was holding — directory bind accounts, TLS keys, and any silent duplication rule — exactly where an operator put them.

Why the patch is the least important step

The highest-value persistence on a compromised secure email gateway is not a webshell. It is a message filter or BCC rule that silently duplicates mail, as CyberScoop's analysis sets out: it raises no alert, it appears in no EDR console because there is no agent on the appliance, and it survives the upgrade. That is why Cisco shipping indicators of compromise alongside the fix matters more than the fix. A vendor that publishes IOCs with a patch is telling you to run an assumed-breach process.

Second reason to slow down: on a root-compromised appliance, the upgrade destroys evidence. The Hacker News guidance is blunt and correct — preserve artifacts off-box before you touch the build.

Root here is an identity problem, not a mail problem

A gateway terminates TLS on all inbound and outbound mail, usually holds an AD/LDAP bind account for recipient validation, holds SMTP relay secrets, and in hybrid deployments is often a trusted inbound connector into Microsoft 365 or Google Workspace. An operator with root reads your password-reset mail, your MFA-enrollment mail, your legal correspondence and your invoice traffic — and can send messages that your own anti-phishing controls trust because they originate inside the perimeter. Mapped to ATT&CK: T1190 for initial access with no escalation step required, T1114 for collection, then lateral movement using harvested directory credentials.

Where the two accounts converge, and where they don't

Both sources agree on the operative facts: unauthenticated root command execution, exploitation before a patch existed, and KEV listing. CyberScoop adds Cisco's own assessment that multiple customers were likely compromised, and the finding that self-hosted deployments carry materially higher risk than vendor-managed cloud instances — a patch-velocity gap, not a code-quality gap. Both sources note the same evidentiary hole: no CVSS value was stated. Treat "unauthenticated root, KEV-listed, exploited pre-patch" as the operative severity and stop waiting for a number to start hunting.

DeploymentExploitabilityPatch controlRequired response
On-prem or virtual, internet-facingHighest — pre-disclosure exploitation confirmedYours; days to weeksEmergency patch plus full compromise assessment and secret rotation
Lab, DR, or decommissioned-but-listeningHigh and usually unmonitoredOften neverDiscovery sweep first — you cannot patch what is absent from the CMDB
Vendor-managed cloud instanceLower per researcher assessmentVendor's; fasterConfirm remediation in writing, still diff mail-flow rules

The hunt, given no agent on the box

Detection is configuration- and network-based. Diff the running config against last known-good. Enumerate message and content filters for unauthorized BCC, journaling or redirect rules. Review admin, CLI and GUI authentication logs plus diagnostic-shell usage. Pull netflow for any outbound session from the management interface to non-Cisco destinations — this appliance should be a mail talker, not a general-purpose internet client. Then check cron and at job creation, new local accounts, and unauthorized SSH keys.

Patching the gateway closes the door; rotating the credentials it was holding is what actually evicts the operator — and most organizations will only do the first one.

The compounding risk nobody sequences

CyberScoop pairs this with the extradition of five alleged Black Axe leaders and draws the right inference: an adversary reading your mail knows which invoice to intercept, which vendor's bank details to change, and when your controller is away. Out-of-band callback verification on every payment and bank-detail change breaks that chain regardless of how the mail was read, and it is the one control here that costs you nothing but process.

What to do

  1. Capture a support bundle and off-box forensic artifacts from every internet-reachable AsyncOS instance, then apply the fix and confirm the build version post-reboot rather than post-install.

  2. Rotate every secret the appliance could reach within 72 hours of patching — AD/LDAP bind accounts, SMTP relay credentials, M365 or Workspace connector credentials, API tokens, SSH keys, TLS private keys and admin passwords.

  3. Set a written 24-hour remediation SLA for KEV-listed edge-appliance CVEs and publish a customer-facing attestation template covering affected status, patch timestamp and hunt outcome before questionnaires arrive.

Contractors Are Reading Prompts, and the Redaction Layer Admits It Misses Things

The exposure is not model training — it is an external human population your organization never screened, reached through the exact consumer tiers your staff expense on personal cards.

The configuration detail that makes this a shadow-AI event

The default-on tiers are the ones your staff buy for themselves, and that fault line maps precisely onto your shadow-AI problem: the employee who bought a personal Plus seat because procurement was slow has been the exposure all along. Remediation cannot reach backwards — everything already pasted stays in the pool. You cannot configure your way out of it.

Pseudonymization with the linkage key attached

Reviewers do not see usernames. They do see a memories summary above the prompt showing what the person has used the assistant for previously and roughly where in the world they live. Suppressing the identifier while surfacing behavioral history and coarse geolocation is not anonymization. Under GDPR reasoning that remains personal data, with human-subprocessor access — a live Article 28 disclosure question and an Article 32 adequacy question, not a policy nudge.

The second layer is weaker than most teams assume. Pivot 5's read of OpenAI's own Privacy Filter documentation is the sharpest fact in the source material: the filter can make mistakes, miss uncommon identifiers, and under-redact when context is limited. That is a vendor documenting an accepted residual risk. "Uncommon identifiers" is exactly the category containing internal hostnames, ticket IDs, account numbers, API keys, and patient or case identifiers.

Your DLP program was calibrated for the wrong threat

Most enterprise DLP treats generative-AI egress as a machine-processing risk — the worry is model training. That calibration is now wrong. The MIT Technology Review reporting puts the base at 900 million users, most of whom do not know human review happens. Every prompt typed into an unmanaged session should be modeled as potentially disclosed to an external human population you have never assessed, screened, or contractually bound. Your stack was built to catch data leaving by email, USB and file sync — not by textarea.

Where the accounts reinforce each other

  • Techpresso supplies the tier map and the prospective-only opt-out.
  • Pivot 5 supplies the vendor's documented under-redaction and the re-identification pairing.
  • MIT Technology Review supplies scale and the absence of user awareness.
  • CSO First Look adds the corollary nobody has costed: that transcript corpus, indexed behind one admin console, is itself among the highest-value exfiltration targets in your estate — and the litigation angle in the Watson Grinding matter establishes those transcripts as discoverable records with retention and legal-hold obligations no AI policy anticipated.
Every prompt your staff typed into a consumer tier should be treated as read by a contractor you never vetted — and switching the setting off does not un-read it.

The move, in order

Scope before you police. CASB and egress logs for consumer endpoints authenticating outside your workspace tenant, cross-referenced against expense reports for personal-card charges, tell you the population. Then close the path with SSO-only access plus conditional access on consumer login flows, and verify in the admin console that sharing is off for your Business or Enterprise tenant — screenshot it for the audit file rather than inheriting a vendor default as a control. Finally, treat any credential pattern found in historical prompt traffic as disclosed and rotate it; you will never get confirmation either way.

What to do

  1. Enumerate every non-Enterprise session touching corporate data using CASB and egress logs plus an expense-report search for personal-card AI charges, and rank findings by the data classification of the host.

  2. Flip consumer-LLM DLP from alert-only to block on secrets patterns, PII and PHI classifiers and source-code fingerprints, then re-triage the historical alert-only backlog as your exposure inventory and rotate any credentials it surfaces.

  3. Demand written confirmation from your AI account teams that your tenant is excluded from human review, plus the reviewer population, screening standard and measured redaction false-negative rate, before your next audit cycle.

A Risk Classifier Now Decides Whether a Human Ever Sees Your Code

The reference architecture your engineering leadership will propose next quarter turns three change-management controls into a machine-learned judgment whose inputs an attacker can write.

What the classifier actually reads

The Pragmatic Engineer's reporting from inside OpenAI describes a tiering step. High-risk changes get extra AI review or mandatory human sign-off. Some codebase areas opt into an agent that auto-approves low-risk pull requests, to remove human acceptance as a bottleneck. The consequence is in the inputs. That classifier reads PR titles, descriptions, comments, commit messages and code comments, all of it shapeable by anyone with commit access or a poisoned dependency. That makes classifier evasion a route to unreviewed production code. The configuration defining "low-risk paths" is a tier-0 asset almost no SOC monitors.

One identity, every crown jewel, plus a browser

The same account reads Git and GitHub, Slack, Notion, Databricks, Datadog and internal logs. The desktop lead notes agents sometimes need new capabilities, such as a browser the agent can use. Cross-system read plus arbitrary outbound HTTP in one non-human identity is a complete exfiltration primitive. Agents already get pointed at Slack monitoring, so any message, including one arriving through an external Slack Connect partner, is a candidate command channel. OWASP LLM01 covers the injection, T1567 the egress. Human-centric DLP sees neither.

The supply-chain detail buried in the adoption story

Some internal skills are maintained by the agent itself. Each team distributes its own role-specific plugins, because that is what drove adoption. The reporting does not say whether those skills are signed or reviewed. This is executable capability code inside a build system, authored partly by a model and distributed shadow-IT style. Codecov and XZ Utils show what a compromised build-time tool does.

Audit language does not survive this

SOC 2 CC8.1 change management, and the segregation-of-duties expectation behind it, assume a human other than the author approves the change. PCI DSS 4.0 6.2.3 expects code review of bespoke software by someone other than the author. "An agent classified it as low-risk" is not that attestation. Two paths are defensible: agent approval as a supplement to human review on all in-scope systems, or an evidence model negotiated with the auditor in advance, covering classifier version, immutable decision log, tool-call audit trail, documented no-auto-merge scope, and periodic human sampling with measured error rates.

Read against the other material

Latent.Space reports that newer frontier models emit less intermediate reasoning and jump straight to answers, so the forensic timeline used to reconstruct an agent decision thins out with a routine model upgrade, not a change any CAB reviews. ByteByteGo's architecture explainer supplies the other half: memory stores auto-inject records into future calls with no provenance on the write and no logging of the injection. The audit trail for agentic delivery has to come from logs the organization emits itself: classifier version, tool calls, merge decisions.

The most autonomy-maximalist engineering org in the industry still refuses to let its incident agent act unprompted. The agent proposes; a human runs the command.

One counterweight for the file: the build-test-deploy load growth behind all this arrives at other pipelines too. SAST, secret scanning and SBOM generation are the slowest steps and the first candidates for sampling.

What to do

  1. Ratify a written no-auto-merge list this month — auth and authz, crypto, secrets handling, IAM policy, CI/CD config, branch protection, the feature-flag service, and payment and PII paths — and enforce it in branch protection rather than prompt instructions.

  2. Ship detections within 30 days for changes to risk-tier definitions, CODEOWNERS, branch protection and auto-approve path lists, plus any merge by a non-human identity outside the sanctioned allowlist, and purple-team validate they fire inside 15 minutes.

  3. Brief compliance and your external auditor on agent-assisted change approval before the current audit period closes, and agree the evidence model — classifier version, immutable decision log, tool-call trail, human sampling error rate.

The bottom line

Read together, these failures share a shape: the artifact doing the gatekeeping was itself reachable, and each one failed by handing over the trust it had been issued rather than by breaking. Your control inventory is also your target list, and the more traffic a single gate sits inline on, the higher its yield to whoever reaches it first. Name the five controls in your estate that touch everything, and prove for each one that you could detect its compromise using telemetry the control does not produce itself.