Three AI Attacks This Week, Not One New Way In

Wiz's Red Agent autonomously found and exploited a GitHub Actions script injection in Snowflake's snowflake-connector-net and read the company's internal Jira, on a workflow GitHub Advanced Security had already scanned and cleared. Five federal agencies warned that AI-written scripts are driving python-snap7 against exposed Siemens S7 controllers. ThreatDown took apart Kriminal, a $12.99 clearnet storefront that is a jailbreak wrapper over Grok and Claude. Meanwhile CVE-2026-21962, Oracle HTTP Server and WebLogic Proxy Plug-in at CVSS 10.0, reached CISA KEV 214 days after the first recorded exploitation attempt.

Date: 2026-08-25 | Classification: TLP:CLEAR

Why this matters. Grep every GitHub Actions workflow you own for a github.event expression interpolated straight into a run block, and rotate whatever credentials those runners hold. That is the exact defect an autonomous agent used to reach a major vendor's internal Jira this month, and a scanner had already looked at it and said nothing.

The Operator's Take

Three separate AI-driven attacks surfaced this week and not one of them needed a new class of weakness.

An autonomous agent broke into Snowflake through an unquoted shell variable in a YAML file. Five federal agencies warned that actors are pointing AI-generated Python at an industrial protocol that has never had authentication. A criminal storefront sells frontier reasoning for $12.99 a month by prepending a system prompt that tells the model to ignore its instructions, which is the oldest trick in this field and still works.

The pattern is worth saying out loud because the marketing goes the other way. Autonomy changed who does the work, not what the work lands on. A model does not invent a new attack surface; it removes the human bottleneck in front of the old one. Wiz's agent failed its first payload on a bash syntax error, read the error, rewrote the payload and succeeded, and the entire novelty in that story is the absence of a person between the two attempts.

So the counter-move is not an AI control. It is the boring inventory you already owe, executed at the speed the other side now moves. And the week's own scoreboard makes the case: the one maximum-severity flaw CISA forced this week, Oracle's CVE-2026-21962, was published in January and first attacked two days later. It took 214 days to reach a federal deadline. No agent was required to find that. Somebody just had to look.

One more thing, because it cuts against the easy read. The tooling that was supposed to catch the Snowflake bug was itself AI. GitHub Advanced Security scanned the final revision of the pull request, including the vulnerable workflow, and did not flag it. Treat a passing scan as one data point, not as evidence.

Executive Summary

Wiz's Red Agent autonomously discovered, exploited and validated a GitHub Actions script-injection flaw in snowflakedb/snowflake-connector-net, exfiltrated a Jira API token and authenticated to Snowflake's internal Atlassian environment with read access to engineering, security compliance and bug bounty projects. No human steered the exploitation.
The same Wiz writeup notes that GitHub Advanced Security, which uses Copilot Autofix, analyzed the final revision of the pull request including the vulnerable workflow and did not flag the injection.
CVE-2026-21962 in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, CVSS 10.0 and unauthenticated over HTTP, reached CISA KEV on August 24 with a remediation deadline of August 27. NVD published it on January 20 and CloudSEK's honeypot recorded the first exploitation attempt on January 22, the day exploit code went public. That is 214 days.
NSA, CISA, FBI, the Department of Energy and the EPA published joint advisory AA26-231A on active threat activity against Siemens S7 Series PLCs, where actors use AI to generate exploitation scripts wrapping snap7.dll and python-snap7, speaking S7comm, disguised as monitoring tools, with target discovery through Censys and ZoomEye.
ThreatDown documented Kriminal, a clearnet criminal-AI subscription running $12.99 to $99 a month. It is not a purpose-built model. It is a reseller calling Grok for primary inference, Claude for long context, and Mistral Large and Llama 3.3 through OpenRouter, with the guardrail bypass carried in a single prepended system prompt.
Correction worth carrying: Citrix's own bulletin puts the authentication bypass at CVE-2026-19490, CVSS v4.0 9.3, and the memory overflow at CVE-2026-19489, 8.8. Widely circulated coverage this week has the two numbers reversed, which matters because the preconditions are completely different.
Cisco patched nine flaws across Crosswork and Secure Workload on August 21, five of them at CVSS 10.0, all found in internal testing and none known to be exploited.
Cl0p has now named more than 40 victims of its PTC Windchill and FlexPLM campaign built on CVE-2026-12569, an unauthenticated remote code execution flaw PTC patched on June 17.
Zimbra CVE-2026-73570 entered CISA KEV on August 21 with an August 24 deadline, which has now passed. This brief flagged it as exploited and not yet listed four days ago.
The MCP roadmap published on August 22 makes agent identity a first-class priority, naming Demonstrating Proof of Possession, Workload Identity Federation through the ID-JAG grant, and standard token exchange, with engagement in the IETF OAuth and WIMSE working groups.
OpenAI previewed Private Safety Processing on August 19, an architecture for spotting misuse across related interactions while keeping Zero Data Retention for eligible API customers, with rollout stated for September.

Threat Intelligence

Critical Vulnerabilities

CVE	Product	CVSS	Class	Exploited	Fixed in
CVE-2026-21962	Oracle HTTP Server, WebLogic Server Proxy Plug-in	10.0 Critical	Improper access control (CWE-284), unauthenticated over HTTP	Yes, KEV Aug 24, due Aug 27	Oracle January 2026 patches
CVE-2026-73570	Zimbra Collaboration	8.9 High	Unauthenticated OS command injection via SNMP notifications	Yes, KEV Aug 21, deadline Aug 24 passed	10.1.20
CVE-2026-12569	PTC Windchill and FlexPLM	Critical	Improper input validation to unauthenticated RCE	Yes, Cl0p	patched June 17, 2026
CVE-2026-19490	NetScaler ADC and Gateway	9.3 (v4.0)	Authentication bypass using an alternate path (CWE-288), SAML action	No	14.1-73.32 / 13.1-63.21
CVE-2026-19489	NetScaler ADC and Gateway	8.8 (v4.0)	Memory overflow to DoS (CWE-119), SIP ALG on an LSN group	No	14.1-73.32 / 13.1-63.21
CVE-2026-20030	Cisco Crosswork	10.0 Critical	SQL injection	No	7.2.1-SP
CVE-2026-20357	Cisco Crosswork	10.0 Critical	Missing authentication for a critical function	No	7.2.1-SP
CVE-2026-20315	Cisco Secure Workload	10.0 Critical	Improper access control	No	3.10.9.1 / 4.0.4.16

Oracle: a maximum-severity flaw that waited 214 days for a deadline

CVE-2026-21962 affects the WebLogic Server Proxy Plug-in for Apache HTTP Server and for IIS, in Oracle HTTP Server and WebLogic 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. NVD scores it 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, classified CWE-284, improper access control. An unauthenticated attacker with nothing but HTTP access can create, delete or modify data across the accessible server resources, and the scope change in that vector is why it reaches 10.0 despite no availability impact.

The timeline is the story. NVD published the record on January 20, 2026, alongside Oracle's fix. CloudSEK stood up a high-interaction WebLogic honeypot and recorded the first exploitation attempt on January 22, the same day exploit code was published, then watched twelve days of automated scanning from rented VPS infrastructure using libredtail-http and the Nmap Scripting Engine. GreyNoise separately observed exploitation attempts in February. CISA added the CVE to the Known Exploited Vulnerabilities catalog on August 24, with a Binding Operational Directive 26-04 deadline of August 27.

What the 214 days actually measure

Not CISA's speed. The KEV catalog is a forcing function for federal agencies, not a discovery mechanism, and it cannot list what nobody reports. What the gap measures is how long a patched, maximum-severity, unauthenticated flaw stayed useful enough to keep attacking. Seven months of automated scanning against a bug with a January fix means the population of unpatched hosts never got small enough to make it uneconomic. If your own remediation clock for a CVSS 10.0 is measured against KEV rather than against the vendor advisory, you are running seven months behind a bug that attackers had working exploit code for on day two.

Citrix: two CVE numbers that most coverage has backwards

Citrix published CTX696939 for two NetScaler ADC and Gateway flaws, and this is a case where reading the vendor bulletin instead of the aggregators changes what you patch and why.

Per Citrix, CVE-2026-19490 is the serious one: CWE-288, authentication bypass using an alternate path, CVSS v4.0 9.3, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. It applies when the appliance is configured as a Gateway for SSL VPN, ICA Proxy, CVPN or RDP Proxy, or as an AAA virtual server, and on 14.1-43.56 and later or 13.1-61.28 and later it requires a SAML action to be configured.

CVE-2026-19489 is the lesser one: CWE-119, a memory overflow producing unpredictable behavior or denial of service, CVSS v4.0 8.8, and it only applies when SIP ALG is enabled on a Large Scale NAT group.

Check Point's August 24 threat intelligence report attaches the authentication bypass to 19489 and the denial of service to 19490. That is reversed. If you triage by CVE number, or write a detection keyed to one, the preconditions you go looking for are the wrong ones: SIP ALG on an LSN group instead of a SAML action on a Gateway or AAA vserver. Both are fixed in 14.1-73.32 and 13.1-63.21, so patching resolves it either way, but the exposure assessment does not.

Cisco: nine flaws, five at maximum severity, none exploited

Cisco's August 21 release covered nine vulnerabilities, four in Crosswork and five in Secure Workload, with five scoring CVSS 10.0: CVE-2026-20030 (SQL injection), CVE-2026-20357 (missing authentication for a critical function) and CVE-2026-20358 (external control of file system) in Crosswork, and CVE-2026-20315 (improper access control) and CVE-2026-20317 (improper authentication) in Secure Workload. CVE-2026-20359 at 9.9 covers insufficiently protected credentials in Crosswork.

Crosswork Data Gateway, Network Controller and Planning are affected at 7.2.1 and earlier regardless of configuration, fixed in 7.2.1-SP. Secure Workload 3.10 and earlier is fixed in 3.10.9.1, and 4.0 in 4.0.4.16. Cisco found all nine in internal testing and states it is not aware of exploitation. That is the unglamorous half worth saying: five 10.0s with no attacker attached is a patching task, not an incident.

AI Security Threats

An agent found the bug, exploited it, and a scanner had already cleared it

This is the item of the week and it deserves the detail.

Wiz pointed its Red Agent, the autonomous offensive agent it previewed at RSA and put into public preview in April, at snowflakedb/snowflake-connector-net. The agent found a script injection in jira_issue.yml, the workflow that opens a Jira ticket whenever someone files a GitHub issue.

The defect entered on June 18, 2026, in PR #1218, merge commit 4a1b8ce. The change replaced a safe pattern with an unsafe one. Before, the issue title went into an environment variable and was parsed with jq --arg. After, it was interpolated directly into a shell command inside single quotes and then passed through sed to escape quotes. The escaping runs after GitHub's template expansion, not before, so a quote character in the issue title breaks out of the string before sed ever sees it. Anyone with a GitHub account could open an issue and run commands on the runner.

The agent's first payload failed. It used # to comment out the remainder of the line, which swallowed the closing parenthesis of TITLE=$(...) and produced a bash end-of-file error. The agent read the error, worked out that it needed to close the command substitution properly, and rewrote the payload to terminate with ; echo '. The second attempt worked. The successful payload base64-encoded JIRA_API_TOKEN, JIRA_USER_EMAIL and JIRA_BASE_URL and sent them out over an out-of-band HTTP callback.

Wiz then used the token to authenticate to Snowflake's internal Atlassian instance as qa@snowflake.net, with read access to projects covering engineering, security compliance and bug bounty tracking. Disclosure went through HackerOne on June 23. Snowflake patched the same day in PR #1402 and rotated the token on June 24. The window from introduction to fix was five days.

The part that should change your process, not your threat model

Two things happened here and only one of them is about AI.

The AI part: an agent chained recon, exploitation, error recovery and credential use with no human in the loop, and recovered from a syntax error by reading the error. That is a throughput change.

The part that is not about AI: the vulnerability is a textbook GitHub Actions script injection, documented for years, and a code-scanning product analyzed the exact file and said nothing. If your assurance argument for CI/CD rests on a scanner's green result, this is the counterexample. Go look at your own workflows by hand, specifically anywhere ${{ github.event.issue.title }}, github.event.pull_request.title, github.event.comment.body or a branch name lands inside a run: block. Then look at what secrets those runners can see.

Five agencies on AI-written scripts against Siemens PLCs

NSA, CISA, the FBI, the Department of Energy and the EPA issued joint advisory AA26-231A on active threat activity against Siemens S7 Series programmable logic controllers. The targeting spans critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, and covers S7-200, S7-300, S7-400, S7-1200 and S7-1500 models including F-series safety controllers.

The AI element is specific and unromantic. Actors are generating exploitation scripts from public technical information, known vulnerabilities and open source industrial automation libraries, then integrating snap7.dll and python-snap7 into Python tools that speak S7comm and can read and write PLC memory, configuration data and ladder logic. The tools are dressed as legitimate monitoring software. Discovery runs through Censys and ZoomEye.

Read the observed and assessed columns separately, because the advisory does. Observed: internet scanning for exposed devices and exploitation using default or weak credentials. Assessed: persistent reconnaissance and capability development toward future write operations that would disrupt a process. Nobody has published a case of ladder logic being altered in this campaign. What has happened is that the script-writing cost fell.

The mitigations named are the ones an OT engineer could have recited in 2015: inventory devices, patch, isolate PLCs from the internet, strengthen access control, harden services and protocols, monitor, and run compromise assessments. That is the point. python-snap7 has been on PyPI for years and S7comm has never carried authentication. The model wrote the wrapper faster.

Kriminal is a jailbreak with a pricing page

ThreatDown published a teardown of Kriminal, a criminal AI service that markets itself as purpose-built and is not. The researchers pulled the vendor stack out of the site's own production JavaScript, corroborated it by prompting the tool to drop its persona, and checked the billing dashboard URLs embedded in the application.

What it actually calls: Grok as primary inference, internally labeled NEXUS; Claude as the long-context layer, labeled CIPHER; Mistral Large and Llama 3.3 routed through OpenRouter for specialist tasks; Tavily for search. Payments run through NowPayments in cryptocurrency. Hosting sits on Google Cloud and Cloudflare. It is on the clearnet, indexed, with a pricing page.

Five tiers: free, AGENT at $12.99 a month for roughly 200 messages, OPERATIVE at $34.99, SHADOW DEV at $59.99, and GHOST at $99 for roughly 1,800 messages. That works out to about ten cents a message. It sells OSINT dossiers at $0.55 to $0.90, on-chain tracing at $0.12 per analysis, unrestricted exploit generation, a browser sandbox and an OpenAI-compatible API endpoint, behind four personas named PHANTOM, ARCHITECT, ORACLE and WRAITH.

The guardrail bypass is one block of text prepended to every request, telling the model to disregard anything limiting its output. No fine-tuning, no abliterated weights, no local inference. The honest read is that this is unimpressive engineering with an uncomfortable consequence: the resilience comes from fragmentation. Grok's operator sees Grok traffic, Anthropic sees Anthropic traffic, OpenRouter sees a routing pattern, and none of them sees the product. That is precisely the visibility gap the provider side spent this week trying to close, which is the connection worth holding onto.

The unflattering half

ThreatDown does not evaluate whether Kriminal's output is any good, and neither will this brief. A jailbroken frontier model still writes mediocre exploit code for anyone who cannot tell mediocre exploit code from working exploit code. What $12.99 buys is not capability at the top end. It is the removal of a filter for people at the bottom, and it is the reason volume, not sophistication, is the metric to watch.

Threat Actor Activity

Actor	Target	TTP	Source
Cl0p	PTC Windchill and FlexPLM users, 40+ named	CVE-2026-12569 unauthenticated RCE, JSP webshells, data theft extortion	SecurityWeek, BleepingComputer
Unattributed (AA26-231A)	Water, energy, chemical, critical manufacturing, food and agriculture	AI-generated Python tools wrapping python-snap7, S7comm reads and writes, Censys and ZoomEye discovery	CISA AA26-231A
StopAndProtect	Visitors to thousands of compromised WordPress sites	ClickFix lure, ransomware combined with data theft, compromised sites used as storage	Check Point Research
Kriminal operators	Subscribers rather than victims	Clearnet SaaS reselling jailbroken Grok, Claude, Mistral Large and Llama 3.3	ThreatDown

Cl0p is the one to weigh properly. CVE-2026-12569 is an improper input validation flaw in PTC Windchill and FlexPLM allowing unauthenticated remote code execution with no user interaction. PTC patched it on June 17, 2026, and exploitation was flagged the following day, with reporting indicating Cl0p affiliates used it as a zero-day in early June. The operators deploy JSP webshells and exfiltrate product lifecycle data. Named victims include Shell, Philips, Fiserv, Zebra, Mindray and Largan Precision, across manufacturing, automotive, aerospace and retail. This is Cl0p running its usual play, a single unauthenticated flaw in a file-handling or engineering platform, worked at scale, and the affected data is design and manufacturing intellectual property rather than customer records.

Ransomware and Data Breaches

Victim	Actor	Impact	Source
Latvia Road Traffic Safety Directorate (CSDD)	Undisclosed, via an internet-facing system	1.2M people and 200,000 organizations: ID numbers, license plates, payment amounts, dates, addresses	Check Point Research
Sakura Internet	Undisclosed	Up to 1.36M customer accounts; unauthorized access to rental server environments and the sales management system, with malware installed	Check Point Research
Shell, Philips, Fiserv, Zebra, Mindray, Largan Precision and 35+ others	Cl0p	Engineering and PLM data theft, extortion listings	SecurityWeek, BleepingComputer
Hospital for Sick Children (Toronto)	Undisclosed	Employee, applicant and related-organization staff data via a third-party application; clinical systems and patient data unaffected	Check Point Research

Builder Intelligence

Anthropic

Thin week, and worth saying so rather than padding. The only new post since August 18 is Funding better evaluations of AI's impact on wellbeing, published August 25, announcing research grants for assessment methods. The text watermarking explainer that this brief covered on August 21 was published August 14 and has not moved.

MCP Ecosystem

The roadmap published on August 22 is the substantive item, and it reads as a protocol growing up rather than a feature list.

Priority	What it covers
Agentic messaging primitives	Tasks, subscriptions and progress notifications, past request and response
HTTP-native transport unification	Standardizing on Streamable HTTP across deployment modes
Agent identity and enterprise security	Cloud workload identities for agents
Improved primitives	Tool calling and progressive discovery
SDK developer experience	Ergonomics and specification conformance

The identity work is the one to watch: Demonstrating Proof of Possession and driving its adoption, Workload Identity Federation through the ID-JAG grant, standard token exchange, and engagement with the IETF OAuth and WIMSE working groups. Read that beside the Snowflake incident and the argument makes itself. A GitHub Actions runner holding a long-lived Jira API token in an environment variable is exactly the pattern DPoP and workload identity federation exist to retire, because a bearer token that leaks is a bearer token that works. Nothing in the MCP roadmap would have stopped this month's exploitation, but the direction is correct and it is the first time the protocol has treated an agent as a principal rather than as a client library.

This follows the July 28 specification, which removed protocol-level sessions and the initialization handshake so servers can scale horizontally behind a plain load balancer, with server/discover for client discovery, plus issuer validation, issuer-bound client credentials and Client ID Metadata Documents as the preferred registration path.

Broader AI

OpenAI previewed Private Safety Processing on August 19, alongside Zero Data Retention for frontier models. The pitch is that eligible API customers get no retention of prompts or responses and no personnel access to content, while automated systems still analyze activity across related interactions and emit narrowly scoped signals naming a category of concerning behavior rather than exposing content. Rollout is stated for September with a white paper at the same time.

Hold that next to Kriminal. The hard problem in abuse detection is not seeing one bad prompt, it is correlating a pattern across many. Private Safety Processing is an attempt to keep that correlation possible under a no-retention promise, which is a genuinely difficult engineering position and, commercially, a direct move at the enterprise segment. And Kriminal's architecture defeats it by construction, not by cleverness: split the workload across four providers and no single correlation window contains the product. Cross-provider abuse signal has no owner and no protocol, and this week produced both a company trying to build the capability and a $12.99 service that routes around it.

On the local and open-weight lane, nothing new cleared the bar this week. The Qwen3.8-27B abliteration and its GGUF and MLX builds were covered on August 12 and August 21, MiniMax H3's community quants landed on August 3, and no first credible local release of anything that mattered appeared in the last few days. A new quant of a model already covered is not news.

Recommended Actions

Immediate

Inventory Oracle HTTP Server and WebLogic Server Proxy Plug-in at 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, and apply the January 2026 Oracle patches for CVE-2026-21962. The federal deadline is August 27.
Grep every GitHub Actions workflow you own for a ${{ github.event... }} expression interpolated directly into a run: block. Issue titles, PR titles, comment bodies and branch names are all attacker-controlled.
Rotate every credential reachable from a GitHub Actions runner that processes untrusted input, starting with Jira, Atlassian and any ticketing integration.
Confirm Zimbra is on 10.1.20, or that the optional zimbra-snmp package is not installed. The KEV deadline for CVE-2026-73570 was August 24 and it has passed.
Patch NetScaler to 14.1-73.32 or 13.1-63.21. If you are triaging by CVE number, the authentication bypass is CVE-2026-19490, not CVE-2026-19489.
Find internet-exposed Siemens S7 controllers on your own address space the way the actors do, with Censys or ZoomEye, and take them off the internet.

Short-Term

Convert workflows that touch untrusted input to the environment-variable plus jq --arg pattern, which is what the Snowflake repository used before PR #1218 replaced it.
Scope service-account tokens to a single project rather than an account. The Snowflake token read engineering, compliance and bug bounty projects because it could.
Patch Cisco Crosswork to 7.2.1-SP and Secure Workload to 3.10.9.1 or 4.0.4.16.
Stop treating a clean code-scanning result as assurance. Take a change you know was vulnerable, run your scanner against it, and record what it did not find.
Check whether PTC Windchill or FlexPLM is internet-exposed anywhere in your estate, and whether the June 17 patch for CVE-2026-12569 actually landed.

Strategic

Measure your own KEV latency against vendor advisory dates rather than KEV listing dates. CVE-2026-21962 had public exploit code on January 22 and a federal deadline on August 27.
Move agents and automation off long-lived bearer tokens. The MCP roadmap's DPoP and workload identity federation work names the destination; a static token in a runner environment is what it replaces.
Plan for attacker throughput that is no longer limited by attacker skill. Detection tuned to the pace of a human operator is tuned to the wrong pace.
Treat provider-side safeguards as one control among several. Kriminal works because it splits across four providers and none of them sees the whole product, so nothing that depends on a single vendor's abuse signal covers you.
Log what your own agents do, at the same fidelity you log what your people do. An autonomous agent that recovers from its own errors produces a different trail than a script, and you cannot reconstruct what you never recorded.