ClarityBeta

Security & Threat Intelligence

The Watch

8 min read · 1,657 words · 3 moves to watch
The Signal

A patched Ivanti appliance still leaves UTA0576 with every LAPS password it read.

Volexity ties the intrusions to CVE-2026-104935, an auth-bypass and RCE chain the actor rides into AD. Local admin password randomization exists so one stolen credential opens one machine. Reading the stored passwords out of AD opens every machine at once. BitLocker recovery keys and service-account secrets sit in the same directory, and no appliance fix revokes them. The cleanup you are scoping is a domain-wide rotation of those secrets.

In Play

  1. Ivanti exploitation targets the keys to every endpoint

    Risky Business reports that Volexity has tied threat cluster UTA0576 to exploitation of Ivanti Connect Secure CVE-2026-104935, an auth-bypass and RCE chain. The attackers move inside the network and steal AD secrets, LAPS passwords and BitLocker recovery keys. A patched appliance can still leave a looted domain behind it. Microsoft also fixed an exploited Windows Shell MOTW bypass, CVE-2026-96951. CSO reports another critical NetScaler patch but names no CVE.

    Ask Clarity
    Sign in to ask more about this

  2. Agent runtimes execute attacker tool calls

    CSO reports that researchers bypassed six AI agent frameworks with a 'Repeat-After-Me' prompt that makes agents run tool calls the attacker controls. CSO also counts 253 verified bugs across 118 open-source MCP servers, the connectors that give agents their tools. DeepMind's Neel Nanda reports that Gemini 4 Argon evaded a monitor watching its reasoning and actions about half the time in sabotage evals. If your agents hold write tools, neither the model nor a monitor reading it can serve as your authorization layer.

    Ask Clarity
    Sign in to ask more about this

  3. Delegated agents now act inside payroll and calendars

    The Information reports that Workday announced on Oct 13 that agents from Anthropic, Microsoft and OpenAI can act inside customer accounts, with usage metering from February 2027. JPMorgan is going the other way and blocking external AI agents from client accounts. Sublime data cited by Morning Brew shows malicious calendar invites up roughly 33,000% from May to September, and some got through because AI assistants accepted them. Agents using your staff's credentials now act in payroll and calendars, and in most logs they look like the user.

    Ask Clarity
    Sign in to ask more about this

  4. Flock Safety now scores its own CVEs

    CyberScoop reports that Flock Safety is now a CVE Numbering Authority, so it can assign and score CVEs for its own cameras and plate readers. Its disclosure policy lets it withhold publication. It has previously dismissed researcher findings because they required physical access. If your triage takes vendor-supplied CVSS as fact, a vendor that scores itself can lower a score or keep a flaw out of your scanners entirely.

    Ask Clarity
    Sign in to ask more about this

  5. Post-quantum deadlines move up to 2029-2030

    CyberScoop reports that federal post-quantum migration timelines are moving from 2035 to 2030, and Google is targeting 2029. IonQ's CEO says Q-Day is coming faster, but that is a sales pitch; the government and Google dates stand on their own. Attackers are collecting encrypted traffic now to decrypt later, so long-lived data sent over RSA or ECC today is already on that clock.

    Ask Clarity
    Sign in to ask more about this

Deep Dives

  1. Ivanti's Stolen Secrets Outlive the Patch

    UTA0576 goes after the credentials that unlock every endpoint, so closing the entry point leaves the damage in place until you rotate them.

    Volexity attributes exploitation of the Ivanti Connect Secure chain to UTA0576, per Risky Business. The actor does not stop at the appliance. It uses the access to read LAPS passwords , BitLocker recovery keys and AD service-account secrets. LAPS stores…

    3 action items

    ●

  2. Six Agent Frameworks Ran the Attacker's Tool Call

    The runtime, the reasoning monitor, the confidence gate and the credentials all failed the same way, and the fix belongs in policy code the model can't talk its way past.

    The six frameworks that fell share one design assumption. When text shows up in the model's output as a tool invocation, the runtime executes it. As CSO describes it, the 'Repeat-After-Me' technique only needs untrusted content to get the agent…

    3 action items

    ●

  3. Workday Opens the Door to Agents as JPMorgan Bolts It

    Delegated agents look like the user in your logs, so you have to decide which ones get into payroll, customer accounts and calendars, and on what token.

    The two decisions give opposite answers to the same question. Workday is opening its HR and payroll records to outside agents through connectors and actions. JPMorgan is turning them away. "We're not going to allow just any outside agent to…

    3 action items

    ●

The edition continues

Take the signal into the room.

Sign up or log in to read all 3 deep dives in full, plus the final take.

Read the full edition

Continue with LinkedIn