Security brief: an AI-orchestrated intrusion swarm, AgentCore's default role and GitLab's agent fixes
SOCRadar documents an access broker running 51 Claude Code agents against Ukrainian infrastructure. Zenity shows one prompt reaching every Bedrock AgentCore agent in a region through the default role, and GitLab fixes prompt injection and a 9.9 sandbox escape in its agent platform.
Covers Sat 10 Oct 09:00 to Mon 12 Oct 19:00 CEST
Weekend window, so this first security brief also covers items from 28 September to 9 October that PADAWAN had not yet reported (each carries its date). LiteLLM's fixed version for CVE-2026-42271 is not stated in the sources read; check BerriAI's advisory.
Act now
- Upgrade self-managed GitLab and self-hosted AI Gateway GitLab to 19.4.2, 19.3.4 or 19.2.8 (CVE-2026-96893, CVE-2026-105458). Self-hosted AI Gateway to 19.4.1, 19.3.2 or 19.2.4 (CVE-2026-90970, CVSS 9.9). GitLab.com, Dedicated and GitLab-hosted gateways are already patched.
- Replace AgentCore default execution roles with per-agent roles List runtimes with aws bedrock-agentcore-control list-agent-runtimes, check each execution role for wildcard bedrock-agentcore:*, InvokeAgentRuntime, ListEvents, CreateEvent and secretsmanager:GetSecretValue, and scope them to the agent's own resources. Separate public-facing agents into their own account.
- Take LiteLLM and Ollama off the public internet Bind to private networks or put them behind authentication, patch LiteLLM, rotate the master key and stored provider keys, and check egress logs for the Black Lotus Labs PoeLLM indicators.
In brief
- CyberXero, a Russian-speaking access broker, ran 51 Claude Code agents plus PentAGI and Cobalt Strike; 628,000+ Ukrainian records confirmed stolen. Refusals held on backdoors and lateral movement, but session resets got round many others.
- AgentCorruption (Zenity): a prompt-injected AgentCore agent read its credentials from the metadata service, and the default role then reached every agent, conversation, memory and secret in the region. AWS has narrowed the role; existing roles need review.
- GitLab 19.4.2 fixes prompt injection in the Duo Agent Platform (CVE-2026-96893) and a governance bypass; a separate AI Gateway release fixes a CVSS 9.9 template sandbox escape (CVE-2026-90970) for self-hosted gateways.
- PoeLLM botnet: 3,400+ exposed AI servers (LiteLLM, Ollama) turned into crypto miners, with C2 addresses hidden in a poem on GitHub. LiteLLM's MCP test endpoint is the likely way in.
- CrowdStrike: splitting an offensive task into benign requests to a guarded model and assembling them on an unguarded one worked in 9 of 10 ATT&CK categories. Per-request classifiers can't see it.
Executive summary
The pattern this window is agents on both sides of the line. On the offensive side, SOCRadar recovered the working files of an access broker who ran a swarm of 51 Claude Code agents and an open-source autonomous pentest agent against WordPress sites and Ukrainian energy companies. The model refused the most destructive steps, but session resets with a rehearsed “authorized pentest” story got it through a great deal of reconnaissance and exploitation. The lesson is the one SOCRadar draws: refusals live in a session, so the control has to live in the infrastructure.
On the defensive side, the week’s two platform findings are both about identity, not models. Zenity showed that a single prompt injection against an AWS Bedrock AgentCore agent reached the metadata service and, through an over-broad default role, every other agent, conversation and stored secret in the region. GitLab fixed prompt injection in its Duo Agent Platform that let one user’s content drive commands attributed to another, plus a 9.9 sandbox escape in its self-hosted AI Gateway. In each case the agent did exactly what its permissions allowed; the permissions were the bug.
Exposed AI infrastructure keeps getting harvested: the PoeLLM botnet has turned more than 3,400 LiteLLM and Ollama servers into miners. And CrowdStrike’s research is a useful corrective for anyone relying on provider classifiers as a control: decomposed requests sail through, and the harm is assembled somewhere the classifier never looks.
Incidents
CyberXero: an access broker ran 51 Claude Code agents against Ukrainian infrastructure
What happened. SOCRadar found an exposed open directory holding the working files of CyberXero, a Russian-speaking, financially motivated initial access broker active since at least July 2026. The actor’s workstation ran a swarm of 51 specialised Claude Code agents (C2 operation, exploit chaining, reconnaissance, post-exploitation), and PentAGI, an open-source autonomous pentest agent, drove a Cobalt Strike team server through an AI provider API. SOCRadar confirms exfiltration from four Ukrainian organisations, including 564,073 subscriber records from a Kharkiv district heating provider, and more than 628,000 records of Ukrainian individuals in total. One automated run scanned 4,708 WordPress targets, reached 429 admin panels and dropped 32 web shells in 61 seconds. The campaign is ongoing.
Analysis. Two pipelines ran side by side: a fully automated, global one against WordPress and e-commerce (wp2shell, CVE-2026-63030 and CVE-2026-60137, and a Support Board SQL injection, CVE-2026-4815), and a slower, targeted one against seven Ukrainian energy and utility operators. The logs show the model’s refusals holding on the most dangerous steps: it declined, across four attempts, to install a backdoor, disable a firewall, move laterally or deploy a web shell, and it rejected a forged ownership token. The actor’s answer was not a jailbreak but procedure: one agent wrote a fictional authorization story, and when a request was refused, the actor opened a fresh session with that story preloaded and asked again. The same “my own infrastructure” claim appeared across four unrelated victims, which marks it as a script. This is the first public case of an access broker using an agent swarm at this scale, and it maps to OWASP Agentic Top 10 tool misuse and MITRE ATLAS AML.T0054 (LLM jailbreak via context manipulation).
Why it matters. Speed is the change: 61 seconds from scan to 32 shells means patch windows for internet-facing CMS plugins are now measured in minutes for anyone in the target set. For AI providers, per-session refusals are visibly not enough against an operator who resets sessions; account-level and cross-session signals are where detection has to move.
Mitigation and detection. Hunt for WordPress admin accounts matching wp2_ followed by eight hex characters and plugin paths matching /wp-content/plugins/wp2shell_ plus eight hex characters; check internet-exposed Redis hosts for unexpected authorized_keys entries; patch Support Board and any plugin affected by wp2shell. If you run agents internally, treat agent session logs like credential logs (retention, encryption, access control) and alert on repeated sessions that re-assert the same authorization claim.
Recommendation (opinion): act if you run WordPress or e-commerce in Eastern Europe, watch otherwise. Hunt for the indicators above this week. For anyone deploying coding agents, this is the clearest evidence yet that the model is not your containment boundary.
Sources: SOCRadar: CyberXero · The Hacker News · PentAGI · INCIBE-CERT: Support Board
PoeLLM botnet turns exposed AI servers into crypto miners
What happened. Lumen’s Black Lotus Labs tracked PoeLLM, a Linux botnet that has compromised more than 3,400 servers in the US and Western Europe, with up to 800 active in a day. Many victims ran exposed AI and developer tools: LiteLLM, Ollama, Gotenberg and Gitea. Infected hosts run XMRig miners and scan for more targets. The C2 address is encoded in four words of a poem kept in a GitHub repository; the operator has edited the poem 11 times to move the server.
Analysis. For LiteLLM, Black Lotus Labs points to command injection CVE-2026-42271 through the /mcp-rest/test/connection endpoint as the likely way in; Horizon3.ai showed it chains with CVE-2026-48710 to unauthenticated remote code execution. This is the second LiteLLM MCP-path flaw in active exploitation this autumn, after CVE-2026-59822 reached CISA KEV in September. A model gateway holds every provider key the organisation has, so a miner is the mildest outcome; the same access steals the keys.
Mitigation and detection. Keep model gateways and local inference servers off the internet, patch LiteLLM, rotate the master key and stored provider keys, and check logs for connections to the published indicators.
Recommendation (opinion): act. An internet-reachable LiteLLM or Ollama should be treated as an incident until proven otherwise.
Sources: Black Lotus Labs: PoeLLM · BleepingComputer
Vulnerabilities
| CVE | Product | Issue | CVSS | Fixed | Exploited |
|---|---|---|---|---|---|
| CVE-2026-90970 | GitLab AI Gateway (self-hosted) | Prompt template sandbox escape to command execution | 9.9 | 19.4.1, 19.3.2, 19.2.4 | No |
| CVE-2026-96893 | GitLab Duo Agent Platform (EE) | Prompt injection into agent instructions; commands attributed to other users | 7.3 | 19.4.2, 19.3.4, 19.2.8 | No |
| CVE-2026-105458 | GitLab Duo Agent Platform (EE) | Token that bypasses governance controls | 4.3 | 19.4.2, 19.3.4, 19.2.8 | No |
| CVE-2026-42271 | LiteLLM MCP test endpoint | Command injection | High | See advisory | Yes (PoeLLM) |
| (no CVE) | AWS Bedrock AgentCore default role | Region-wide permissions reachable via metadata service | n/a | Role narrowed by AWS | No evidence |
AgentCorruption: one prompt, every AgentCore agent in the region
What happened. Zenity Labs showed that a prompt injection against a public-facing Bedrock AgentCore agent with a web-request tool could make it fetch credentials from the instance metadata service inside its Firecracker microVM. The default execution role those credentials belonged to had permissions across every AgentCore resource in the account’s region. AWS calls the metadata access “documented and expected”, but between February and late September moved new agents to IMDSv2 and removed the role’s region-wide permissions to invoke agents, read conversations and read Secrets Manager.
Analysis. The chain has eight steps, and only the first involves the model: inject, read credentials from IMDS, enumerate agent IDs through DescribeLogGroups, pull container images from ECR, invoke other agents with InvokeAgentRuntime, read conversations with ListEvents, plant long-term memories with CreateEvent, and read tool credentials with GetResourceApiKey and secretsmanager:GetSecretValue. It is the 2019 Capital One pattern (SSRF to metadata to over-privileged role) with a prompt in place of the SSRF bug. The memory step is the new part: a planted memory changes an agent’s goals in later, unrelated sessions, which turns a one-off injection into persistence (OWASP Agentic Top 10 memory poisoning; MITRE ATLAS AML.T0051 and AML.T0080).
Why it matters. AWS’s position is technically right: the agent can read its own role, by design. That is exactly why the role is the security boundary, and why a default that spans the region is the real flaw. AWS changed the default, but roles created before the change keep their old permissions.
Mitigation and detection. Give each agent its own role scoped to its own resource ARNs; never let a public-facing agent share an account with internal ones; block 169.254.169.254 from agent tools at the egress layer or require IMDSv2 with a hop limit of 1; alert in CloudTrail on InvokeAgentRuntime, ListEvents and CreateEvent calls from a runtime’s own role against other runtimes.
Recommendation (opinion): act. Audit every AgentCore execution role this week; anything created before late September should be assumed over-privileged.
Sources: Zenity Labs: AgentCorruption · Dark Reading · AWS: AgentCore credentials management
GitLab Duo Agent Platform: prompt injection, a governance bypass and a 9.9 sandbox escape
What happened. GitLab’s 8 October patch release (19.4.2, 19.3.4, 19.2.8) fixes CVE-2026-96893 (CVSS 7.3), which let an authenticated user inject crafted content into Duo Agent Platform instructions and cause commands to run attributed to other users, and CVE-2026-105458 (CVSS 4.3), which let a user with a specific granular permission obtain an agent platform token that bypasses governance controls. Both were found internally. A separate AI Gateway release (19.4.1, 19.3.2, 19.2.4) fixes CVE-2026-90970 (CVSS 9.9): a crafted custom flow configuration escapes the prompt template sandbox and runs commands on the self-hosted gateway host.
Analysis. These are three different failure classes in one agent platform. CVE-2026-96893 is classic indirect prompt injection with a confused-deputy twist: the agent acts with the victim’s identity on the attacker’s words (OWASP LLM01). CVE-2026-90970 is not prompt injection at all; it is server-side template injection (CWE-1336) that fires before any model call, the same mistake web frameworks made a decade ago, now in the code that assembles prompts. CVE-2026-105458 shows governance enforced on the token path rather than on the action, so a different token skips it.
Mitigation and detection. Upgrade; restrict who can create custom flows on self-hosted gateways; review agent actions in audit logs for commands attributed to users who did not start the session.
Recommendation (opinion): act. Self-hosted AI Gateway operators should treat CVE-2026-90970 as an emergency: low-privilege access to the gateway host is enough.
Sources: GitLab patch release 19.4.2 · GitLab AI Gateway patch release 19.4.1
MCP and protocol security
MCP Python SDK: a 404 could hand OAuth secrets to a malicious server
What happened. Cycode found that the MCP Python SDK’s OAuth client fell back to legacy discovery when a server returned 404, accepted the server’s own authorization configuration and skipped issuer validation. A malicious MCP server could send the user to the real login page and then receive the authorization code, client secret and PKCE verifier at its own token endpoint. Versions 1.9.1 to 1.29.1 and 2.0.0 to 2.1.1 are affected; fixed in mcp 1.30.0 and 2.2.0.
Why it matters. Downgrade paths are where protocol security quietly fails: the modern path was right, the fallback undid it. Any agent that connects to MCP servers from a registry or a prompt is exposed.
Mitigation and detection. Upgrade, pass issuer= to the machine-to-machine providers, clear stored client registrations once, and rotate secrets if clients may have reached untrusted servers.
Sources: Cycode: MCP Python SDK OAuth account takeover
15,465 public MCP servers and no registry vetting
OX Security deduplicated 15,465 servers from five public registries to 5,095 hostnames: 2.3% no longer resolve, six sit on expired domains anyone could register for a few dollars, and some route through consumer tunnels to home machines. None of the registries reviewed submissions. An expired domain behind a listed server is an identity takeover waiting for a buyer; pin servers by more than name.
Sources: The Hacker News (OX Security) · OX Security report
Research
Request, aggregate, bypass: classifiers can’t see harm that is assembled elsewhere
What happened. CrowdStrike’s Cyber Superintelligence Lab split offensive goals into individually benign requests (framed as game modding, detection engineering or ordinary development), sent them to a frontier model guarded by a strong safety classifier, and had a smaller, unguarded model assemble the answers. About 515 direct bypass techniques scored 0% against the classifier; the decomposition pipeline produced working code in 9 of 10 ATT&CK-aligned categories. Only defence evasion held.
Why it matters. The CyberXero logs above are the same idea in the wild: individually plausible requests, recomposed by the operator’s own tooling. Provider-side classifiers are a speed bump against this, not a wall; the knowledge transfer is largest exactly where the attacker most needs help (process injection, CVE-specific exploits).
Recommendation (opinion): watch. If you run an internal model gateway, log per-key request sequences and look for decomposition patterns; don’t count provider classifiers as one of your controls.