Tenable's Research Special Operations team has identified a cluster of seven agentic AI incidents spanning November 2025 through August 2026, anchored by Taiwan's July 2026 autonomous AI attack that mapped 21 government systems, compromised 85 accounts, and exfiltrated 2,564 personnel records in four days. The cluster reveals that multiple unrelated threat actors—including JADEPUFFER and knaithe/KnYuan—have independently weaponized open-source AI agent frameworks to autonomously exploit common identity and authentication misconfigurations at machine speed, demonstrating that near-autonomous offensive AI has transitioned from theoretical risk to operational reality. Organizations face dual exposure: being targeted by autonomous agents that can self-discover and exploit weak credentials and exposed federation endpoints within minutes, and governance gaps in controlling their own deployed AI agents that cannot be quickly terminated or purpose-limited.
Read full article at Tenable ↗The U.S. has indicted Iranian cyber espionage operations while Medusa ransomware has compromised over 500 organizations, highlighting active threats across state-sponsored and criminal landscapes. Attackers are actively exploiting a critical Windows protocol vulnerability, demonstrating how legacy systems remain prime targets for threat actors.
Cybersecurity researchers have attributed a malicious backdoor discovered in compromised Rust packages to North Korean threat actors, connecting it to their historical supply chain attack campaigns. This incident demonstrates continued efforts by the nation-state group to infiltrate software dependencies and gain access to downstream users and organizations.
This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon
Suspected Russian cyber espionage groups UNC6293, UNC7005, and UNC5976 are exploiting legitimate authentication mechanisms including Google OAuth and WhatsApp linking to compromise accounts of individuals in academia, aerospace, defense, government, and think tanks across Europe and the United States. The threat actors demonstrate persistent and adaptive tactics in targeting these high-value sectors, leveraging trusted services to bypass conventional security measures and gain unauthorized access to sensitive accounts.