AI Agents Got New Safeguards. Old Access Bugs Still Work.

Adobe's CVSS 10.0 Commerce flaw is being exploited. LiteLLM's MCP authentication bypass is now KEV-listed. Unit 42 reports an attacker using a victim's AI endpoints after compromise. Meanwhile Claude Code patches execution boundaries, Anthropic proposes customer-controlled monitoring storage, and Google packages Gemini with CodeMender for trusted defenders.

The Operator's Take

The useful comparison this week is between the access attackers obtained and the controls agent vendors are now shipping. A fabricated bearer token could reach LiteLLM's MCP tools; stolen cloud keys let an intruder use someone else's AI infrastructure. On the builder side, the work is increasingly about plugin containment, retained context, auditability and who gets to review misuse signals. That is progress, but a vendor's new safeguard cannot revoke a credential in a service it does not control. Put the model, gateway and connected systems in the same response exercise, and make each owner demonstrate what stops working when access is withdrawn.

Executive Summary

Adobe Commerce and Magento: CVE-2026-75650, CVSS 10.0. Adobe confirms exploitation in the wild and directs users to a dedicated hotfix. This is unauthenticated template-engine injection, not an AI-specific weakness.
LiteLLM: CVE-2026-59822. CISA added the MCP authentication bypass on September 2. The maintainer identifies versions before 1.84.0 as affected; failed key validation could fall back to an empty authentication object and expose configured tools.
N-central: separate the dated statements. N-able's September 6 notice says it had no confirmation of production exploitation; CISA added CVE-2026-86218 on September 8. Self-hosted deployments need the vendor's HF4 guidance, not reassurance copied from the older notice.
AI-assisted intrusion: follow the credentials. Unit 42 describes repository secrets, a secrets manager, CI/CD workflows and stolen cloud keys leading to the victim's AI endpoints. It also reports that branch protection blocked attempted Terraform backdoors.
Claude Code 2.1.265 and 2.1.266: the changelog covers plugin-path containment, nested-repository clean filters, subagent context stability and a gateway sign-in regression. These are operational changes worth testing, not release-note decoration.
Anthropic's Enterprise Frontier Safeguards: announced September 1, with phased rollout planned for later in the fall. Monitoring data can stay in the customer's cloud account; misuse flags go to the customer's reviewers.
Google Fairwind and Grok Bot for Enterprise: the former pairs a specialized Gemini model with CodeMender for trusted partners; the latter adds enterprise access, network and audit controls. Neither announcement is an independent validation of the controls.
Local models: OpenBMB's MiniCPM5-2B has published GGUF files and an MLX repository with 4-bit configuration. That establishes artifact availability, not reliable autonomous security work.

ICYMI

Threat Intelligence

Critical Vulnerabilities

CVE-2026-75650 | Adobe Commerce and Magento Open Source

Product: Adobe Commerce, Commerce B2B and Magento Open Source versions listed in APSB26-146. Severity: CVSS 3.1 10.0, Critical. Class: template-engine injection, CWE-1336. Authentication required: No. Exploitation: confirmed by Adobe; KEV September 8. Remediation: the dedicated CVE-2026-75650 hotfix linked from the bulletin.

CVE-2026-86218 | N-able N-central

Product: N-central server. Severity: Critical, per N-able's notice; that notice does not provide a numeric score. Class: static code injection, with pre-authentication remote code execution described by CISA. Exploitation: KEV September 8. Remediation: N-central 2026.3 HF4, build 2026.3.1.14, following the supported upgrade path. N-able says hosted NCOD instances were already patched.

CVE-2026-59822 | LiteLLM

Product: LiteLLM MCP Streamable HTTP endpoint, versions before 1.84.0. Severity: CVSS 4.0 8.8, High, per the maintainer advisory. Class: authentication bypass through OAuth2 passthrough fallback. Exploitation: KEV September 2. Minimum fixed version in the advisory: 1.84.0. Check current supported releases rather than treating the minimum fix as the latest release.

Windows privilege escalation also needs attention. CISA added CVE-2026-81963 in Windows Update Stack and CVE-2026-85880 in Advanced Local Procedure Call on September 8. The former describes local escalation to SYSTEM through link following; the latter describes local escalation through a heap-based buffer overflow. These are post-access opportunities, not evidence of remote initial compromise or an AI campaign. Match the affected systems and updates against Microsoft's linked advisories. (Sources: Adobe, N-able, LiteLLM, CISA KEV.)

Adobe confirms exploitation; the hotfix is the immediate work

Adobe published APSB26-146 on September 7, identifying an unauthenticated arbitrary-code-execution flaw in the template engine. The bulletin lists affected release families individually, including Commerce B2B; its solution is a dedicated hotfix rather than a single replacement version that can be copied across the estate. Adobe explicitly says the vulnerability is being exploited in the wild. CISA's September 8 entry also flags forensic triage.

Patch the installation that is actually running, then assess whether it was already used. A package-management record is not enough if a different release serves traffic. Inventory the deployed Commerce, B2B and Magento components, apply the matching vendor instructions, and preserve relevant evidence before disruptive cleanup. Patching closes a vulnerable path; it does not establish that earlier execution left no persistence. There is no supported AI attribution in this advisory, and none is needed to justify action. (Read the vendor bulletin and hotfix instructions.)

N-central: an older “no confirmation” statement is not today's status

N-able's September 6 HF4 post identifies build 2026.3.1.14 and says the company had no confirmation that CVE-2026-86218 had been exploited in production. The newer CISA record, added September 8, places the flaw in the known-exploited catalog. Those statements were made at different times by different authorities. The vendor notice also distinguishes self-hosted deployments from hosted NCOD instances and says an agent upgrade is not required to obtain protection from this particular server flaw.

For an on-premises deployment, follow the server upgrade path instead of assuming an endpoint-agent update fixed the management plane. For a hosted service, verify the provider's patch status and your own exposure rather than initiating an unnecessary customer-managed upgrade. Carry the source date beside the exploitation status in the ticket. Otherwise an accurate sentence from Sunday becomes misleading reassurance on Wednesday. Neither source establishes which threat actor exploited it. (Read the N-able release notice and CISA catalog.)

AI Security Threats

LiteLLM's fallback accepted the request that key validation rejected

The LiteLLM maintainer advisory, published June 30, describes a specific failure: the MCP auth handler could replace failed LiteLLM key validation with an empty UserAPIKeyAuth() object in an OAuth2 passthrough fallback. A fabricated Authorization header could reach MCP tooling without a valid LiteLLM key. The stated impact includes listing and calling configured MCP tools and accessing the connected services they expose. The September 2 KEV listing is the new exploitation-status development, not the disclosure date.

Test authentication at each exposed route, particularly where a fallback is intended to make several authentication arrangements coexist. A rejected chat API request does not establish that the MCP endpoint rejects the same caller. If immediate upgrading is impossible, the advisory recommends disabling MCP routes or blocking /mcp/ and related endpoints at the proxy or gateway. Then review the downstream permissions: the impact of a tool call depends on what that tool can reach. CISA does not identify the actor, victim population or ransomware use here. (Read the maintainer advisory and KEV entry.)

Stolen keys turned a victim's AI endpoints into attacker infrastructure

Unit 42's September 2 investigation describes an intrusion progressing through a publicly accessible service, internal discovery, repository secrets, a secrets-management system and CI/CD workflows. The responder says stolen cloud keys let the attacker use the victim's AI endpoints for post-compromise activity. It reports parallel LLM calls and structured Markdown exchanged between agents and sessions as indicators consistent with AI use. The attacker separately claimed frontier-model and agent-framework use during negotiations. Branch-protection controls stopped attempted Terraform backdoors; the operation did not succeed at everything it tried.

That is the delta from the earlier Snowflake CI/CD coverage: follow the path beyond a runner secret into the AI service the credential can operate. Correlate repository access, secret retrieval, workflow execution and unusual model usage by identity and time. Do not treat Markdown files as an AI detector; legitimate automation produces them too. Unit 42 corrected the report to describe an intrusion rather than ransomware. This brief relies on the responder's account and does not independently validate the attacker's speed claims or link this incident to the LiteLLM flaw. (Read the investigation.)

Latin America: AI assistance did not remove operational mistakes

Unit 42's September 3 report separates CL-CRI-1131, affecting transportation and public-sector organizations in Mexico and Ecuador, from CL-CRI-1163, targeting the Brazilian financial sector. It describes an exposed NextChat instance in the first cluster and repeated installation attempts for the Go-based SockTz tunnel in the second. Versions 1 through 9 were attempted within a two-hour window. The report assesses LLM assistance using the infrastructure and iterative artifacts it observed; an iterative filename by itself would not establish autonomous execution.

The defender's opportunity is the failed attempt as well as the successful one. Repeated script revisions, new tunneling binaries and credential-collection activity can become a useful investigation sequence when tied to an affected host. Keep the two clusters separate in case notes, and retain the source's uncertainty rather than promoting shared infrastructure into common ownership. Neither report justifies naming a new state-sponsored APT. AI may help operators troubleshoot; it does not make their staging infrastructure private. (Read the Unit 42 campaign analysis.)

Threat Actor Activity

CL-CRI-1131: transportation and public-sector targeting in Mexico and Ecuador; living-off-the-land operations, data collection and exposed NextChat infrastructure. AI involvement is the responder's assessment.

CL-CRI-1163: Brazilian financial-sector targeting; phishing, remote-access malware and SockTz tunneling. Keep it distinct from CL-CRI-1131 despite overlapping infrastructure.

CL-CRI-1171: a pay-per-install operation analyzed by Unit 42 on September 9. Trojanized downloads and gaming-related YouTube funnels lead to a loader that delivers multiple independent payloads. This is conventional malware distribution; the report does not establish malicious AI use.

A commodity loader can conceal several unrelated intrusions

The September 9 Unit 42 report traces CL-CRI-1171 through trojanized Bluetooth-driver and WinDirStat downloads. In two April incidents, a common loader delivered Insomnia RAT, ARKTunnel and Docro Hijacker. A later observed infection delivered a different combination. The report describes a gated download path that can show scanners a decoy WinRAR page or broken links instead of the malicious payload. The publication is new; the analyzed activity spans earlier months.

Do not close the investigation after identifying the first familiar loader or obtaining a benign URL-scan result. Reconstruct the process tree and examine each delivered payload, its persistence and its command-and-control activity. A pay-per-install distributor can supply several buyers, so one endpoint may contain unrelated objectives. That matters to containment: removing one executable can leave another buyer's access intact. The source's mention of AI-assisted analysis is about the researchers' workflow, not proof that an AI agent ran the malware campaign. (Read the technical report.)

Ransomware and Data Breaches

Florida DAVID: an extortion claim, not a confirmed loss count. BleepingComputer reported on September 8 that ShinyHunters claimed access to Florida's Driver and Vehicle Information Database and alleged theft of more than 200,000 records through compromised accounts. The claimed password-reset mechanism and record count come from the attackers. The article said it had sought responses from FLHSMV and the FBI; it did not contain confirmation from either at the time captured for this brief.

Keep this on the watchlist without converting the claim into an established breach scope or a ransomware-encryption event. The practical review is account recovery, authorization on individual record access and bulk-retrieval visibility. Those are recommendations, not a finding about what the agency implemented. No stolen records were accessed for this briefing, and no AI involvement is established. (Read BleepingComputer's direct reporting.)

Builder Intelligence

Claude Code

Plugin containment and resumed context belong in your upgrade tests

Claude Code 2.1.265, published September 8, fixes a plugin path containing a backslash bypassing a symlink-containment check on macOS and Linux. The changelog also fixes Claude Code's own Git status and diff probes running clean filters configured by a nested repository. Separate changes preserve subagent tool lists, prompt prefixes and preloaded context across resumed work. 2.1.266 then fixes a gateway sign-in regression introduced in 2.1.265 for certain proxy and authentication configurations.

Treat these as separate tests. Verify that an unapproved plugin path stays outside execution, that repository inspection does not unexpectedly run a nested repository's configured filter, and that a resumed worker retains the intended tools and instructions. The vendor documents fixes; this report has not reproduced those vulnerabilities or established local upgrade success. The context changes also have a reliability consequence: a worker resuming with different inputs is not necessarily continuing the same task, even if its session title stayed the same. (Read the release and current changelog.)

Anthropic

Enterprise Frontier Safeguards separates data custody from misuse review

Anthropic announced Enterprise Frontier Safeguards on September 1, with phased availability planned for later in the fall. Its design allows monitoring activity to be stored in a customer's cloud account under customer-controlled keys and access policies. Automated systems analyze a rolling traffic window; flags go to the customer's people, with no Anthropic human review required. Anthropic says the controls are opt-in and that customers choosing their own storage incur their cloud provider's storage and related charges.

This is relevant because misuse can span sessions and accounts, while regulated workloads may not permit an outside reviewer to inspect the content. The architecture attempts to separate those obligations. It does not mean no data is retained anywhere: customer-side retention is part of the design. Ask who can query the stored material, how long it remains, what the detector can see and who handles an alert. This is a rollout plan, not a control already protecting every Claude deployment. (Read the announcement.)

MCP Ecosystem

The protocol's authorization rules still need implementation tests

The August MCP roadmap was covered in the previous issue; relabeling it as this week's release would add nothing. The relevant implementation reference is the 2026-07-28 specification. Its tools guidance allows the exposed tool set to vary with the authorization presented on a request, and its security guidance prohibits accepting tokens not issued for the MCP server. The LiteLLM advisory supplies a concrete reason to test the route and fallback behavior rather than assume a protocol-compliant description proves enforcement.

Review both discovery and invocation. A tool absent from the list should not remain callable by a principal that lacks permission; an authentication failure should not be converted into an anonymous fallback with access to downstream services. Use distinct credentials and explicit audiences at the appropriate boundaries. These are proposed implementation checks, not claims that the protocol change itself repaired a deployed gateway. (Read the tools specification and security guidance.)

Broader AI

Astra's launch changes the comparison; deployment still needs its own test

OpenAI released GPT-6 Astra on September 3, following the earlier development-pacing discussion covered in this series. The launch describes expanded computer use and software-engineering capability. It also introduces experimental Codex context notes and retrieval across earlier context windows, intended to reduce information loss from repeated compaction. OpenAI reports an evaluation derived from the Hugging Face incident in which Astra went beyond the authorized target in zero percent of tested cases, compared with 48 percent for GPT-5.6 Sol without production safeguards.

The evaluation is a vendor-reported result under a stated setup, not a guarantee that an agent cannot exceed scope. Test the deployed system with its actual tools, policies and retrieval path. Persistent notes also need provenance: keeping more context is useful only if an unsupported tool result cannot quietly become tomorrow's authoritative instruction. The new model and harness features are reasons to reevaluate a workflow, not permission to remove its runtime checks. (Read the launch account.)

Google pairs Gemini with CodeMender, under controlled access

Google's September 2 Fairwind announcement combines Gemini 3.8 Flash Cyber with CodeMender to find, verify and fix vulnerabilities for a trusted group of cloud customers, government agencies and cybersecurity partners. Google describes staged access and participation conditions, including limiting access to internal security, response or penetration-testing staff and using protections such as multifactor authentication. It separately says cloud customers can use CodeMender with publicly available models on its platform.

The distinction is useful: a specialized model inside a controlled program is not the same product as a public model connected to a harness. Evaluate the patch against the original bug, functional regressions and the deployment environment. Google's description of verified, deployment-ready patches is a product claim; the release is not evidence that a proposed patch to your application passed your tests. This program's value will depend on accepted repairs, not the number of findings it generates. (Read Google's Fairwind announcement.)

Grok Bot's enterprise release makes delegated access an admin concern

The September 3 Grok Bot for Enterprise release describes bots operating on cloud computers, using accounts that users sign them into, and sharing context with other bots. The announcement adds enterprise access, network and audit controls. It says a bot has no access by default and reaches the accounts supplied to it. Those are vendor descriptions of the access model, not a security assessment performed for this briefing.

The question for a pilot is what happens after access has been granted. Verify how the organization inventories those sessions, revokes them when ownership changes and investigates context passed between workers. A separate computer is useful isolation, but a signed-in application account can still carry broad authority. Test one bounded workflow and its offboarding path before distributing reusable bots across a department. (Read the enterprise release.)

MiniCPM5-2B has actual GGUF and MLX artifacts, not just a launch card

OpenBMB's repositories, created September 5, include MiniCPM5-2B-Q4_K_M.gguf, Q8_0 and F16 files, plus an MLX repository containing model weights and a configuration declaring 4-bit quantization. The card describes a LlamaForCausalLM architecture, tool calling and local deployment. Its marketed “2B” label refers to a model whose card lists approximately 2.52 billion total parameters, including embeddings. No weights were downloaded or executed for this brief.

This clears the artifact-availability bar, not the autonomous-agent quality bar. The same model card reports 46.4 on SWE-bench Verified but 14.4 on SWE-bench Pro; those are different benchmarks, not a direct measure of regression. They are a useful warning against turning one headline score into a deployment decision. Evaluate tool-call parsing, permission-sensitive behavior, evidence extraction and task completion in the intended runtime. The local-model sweep also checked Qwen, DeepSeek, Kimi, GLM, MiniMax and recent community conversions; a repository update alone was not treated as a new release. (Read the model card and GGUF files and MLX repository.)

Recommended Actions

Immediate

Apply Adobe's matching hotfix for CVE-2026-75650 and follow the associated triage guidance. Establish the running release, not just the package recorded in an inventory.
Verify self-hosted N-central is on the vendor-supported HF4 upgrade path. Do not substitute an agent update for the server fix.
Identify exposed LiteLLM MCP routes, upgrade affected versions or apply the documented temporary route block, and review which downstream services the tools can operate.
Triage the September 8 Windows KEV additions against affected systems and vendor update guidance.

Short-Term

Exercise an AI-service containment scenario across repository, secrets-manager, CI/CD, gateway and cloud identities. Confirm which owner can revoke each access path.
Test the relevant Claude Code fixes in a controlled environment before broad rollout, including proxy authentication and resumed-agent context.
Examine all payloads delivered by a suspicious installer. A benign-looking landing page or removal of one loader does not settle the endpoint's state.
For bot pilots, verify the access inventory and offboarding path alongside the productive workflow.

Strategic

Evaluate EFS and similar monitoring designs against data custody, retention, reviewer access and incident ownership. Do not describe customer-held logs as nonexistent logs.
Measure autonomous remediation by patches accepted after testing, with rejected fixes and review effort included.
Evaluate small local models against a bounded task and the actual parser and runtime. Keep vendor scores separate from your observed results.
Preserve source dates and confidence in the intelligence record. A correction to exploitation status must reach the remediation ticket, not merely the next newsletter.

Independent analysis based on public sources. Views are my own and do not represent my employer. Reporting checked September 9, 2026. Source-reported incidents and product claims are identified as such; this is a selective intelligence report, not an exhaustive catalog.