Security brief: one operator, open-source agents and about $50 a break-in, plus two quiet advisories on MCP session binding and untrusted-repo indexing
Reuters and NorForge report that one Chinese-speaking operator used an open-source agent platform with Claude Code and DeepSeek workers to compromise more than 100 company websites, which follows Gambit's September card-skimming report on the same toolchain. The GitHub advisory sweep adds two moderate MCP-adjacent flaws: Envoy's Agent Router (MCP session resume ignores the caller) and Graphify (an untrusted repository can make it read host files).
Covers Mon 19 Oct 08:00 to Tue 20 Oct 08:00 CEST
Thin window: the GitHub Advisory Database shows no critical or high agentic advisory first published between 19 Oct 08:00 and 20 Oct 08:00; the only new reviewed entries were the two moderate ones below, and both are older advisories whose database listing or review is dated 19 Oct. No new MCP specification or SDK release was found, so the signal for today is correspondingly short. Source access: github.com, anthropic.com and the GitHub advisory pages were read in full. Reuters, NorForge, Gambit, BleepingComputer, The Next Web and other outlets returned 403 from this environment's egress proxy, so the Cairn campaign rests on search-result extracts plus the Cairn repository README, and is tagged press. A single aggregator also claimed on 20 Oct that OpenCode's backend services were compromised and developer API keys exfiltrated, citing BleepingComputer; I found no second source and no vendor statement, so it is not reported as fact. I could not check CISA KEV directly; a KEV search surfaced no new agentic entry. Per AGENT.md I am still using the v1 report types because the site code does not yet accept the v2 ones, and content/ledger.json and the source registry do not exist yet.
Act now
- Look for web shells and card skimmers on your own e-commerce and marketing sites If you run internet-facing storefronts or CMS sites, check recent file creations in upload and plugin directories, new JavaScript on checkout pages and unexpected outbound requests from the web tier since 25 Sep. The reported pattern is 'run code, drop an uploader web shell, then install skimmers'. Also upgrade Envoy AI Gateway/Agent Router to 1.2.0 or later if you proxy MCP for several tenants.
In brief
- Cairn campaign (Reuters, 19 Oct, from NorForge): one operator, roughly 1,200 sites attempted since 25 Sep, 100+ compromised, about $5,000 of tokens, around 23 hours per successful break-in. Victims named by Reuters include Deere, SharkNinja and Cummins. I could not open Reuters or NorForge; details come from search extracts.
- It is the same toolchain family Gambit described on 22 Sep (Strix, Cairn and Hermes, 600,000+ cards from two victims). The new fact is scale and unit economics: an intrusion now costs less than a phishing kit.
- Cairn is a public AGPL project whose README says its agents run with the user's permissions and no sandbox in local mode, and documents a server on port 8000 without mentioning authentication. NorForge reportedly found about two dozen exposed Cairn control panels.
- Envoy AI Gateway, now Agent Router (GHSA-953h-535j-jg2v, moderate, no CVE): MCP session resume never checks that the caller owns the session, and the old Helm chart shipped a public encryption seed. Fixed in 1.2.0 (7 Oct); the advisory was reviewed on 19 Oct.
- Graphify before 0.9.70 (GHSA-pcc4-rvhr-2pr8, moderate, no CVE): indexing an untrusted repository with Fortran files can pull host files into the graph and its MCP query tools.
Executive summary
The headline is not a vulnerability. It is an economics number. A researcher at NorForge, as reported by Reuters on 19 October, counted more than 100 company websites broken into by one person who gave open-source agents a sub-100-character instruction in Chinese: find a way to run code on the site, then plant an uploader web shell. At roughly $5,000 in model tokens for the whole run, that is about $50 per compromise.
The advisory sweep is quiet. Two moderate flaws are worth a line each because they show familiar mistakes: an MCP gateway that does not bind a session to its owner, and a code-indexing tool that follows an attacker’s include path.
Recommendation (opinion): plan for the attacker to be cheap and patient, not for the attacker to be clever. An agent that spends 23 hours on one target does not need a zero-day. It needs your unpatched plugin, your forgotten admin panel or your public upload form. Your external attack-surface hygiene is the control that matters this week.
Act now
- Hunt for web shells and skimmers on internet-facing sites. The reported chain is code execution, an uploader web shell, then (in the September Gambit report) payment-card skimmers on checkout pages. Review file creation in web roots since 25 September and script changes on checkout pages.
- Upgrade Envoy AI Gateway (Agent Router) to 1.2.0 or later if you broker MCP sessions across users, and read the breaking changes first (see the daily signal).
Incidents
The Cairn campaign: one operator, 100+ sites, about $50 each
What happened. Reuters reported on 19 October, citing researcher Snorre Fagerland of NorForge, that one Chinese-speaking operator used AI agents to break into more than 100 company websites. Fagerland counted more than 1,200 sites attempted, mostly e-commerce stores in the US, Canada, Australia and Japan, starting 25 September. He estimated about $5,000 in model usage, roughly $50 per successful break-in, and about 23 hours per success. Reuters says it independently identified victims including Deere, SharkNinja and Cummins. The activity ran on Cairn, an open-source multi-agent platform, with a mix of DeepSeek and Anthropic’s Claude Code, and NorForge found about two dozen exposed Cairn control panels used maliciously. Cairn’s author said the platform was not designed for hacking attacks.
Analysis. This is the second public report on this toolchain. Gambit Security’s interim report of 22 September described one operator chaining three open-source tools, Strix to find vulnerabilities, Cairn to exploit them and Hermes to orchestrate and carry out post-compromise work, against at least 27 companies between 10 and 15 September. It reported 600,000+ valid cards copied from two victims, skimmers confirmed on checkout pages at 19 named victims, 180 database tables dropped (backups included) at a bicycle retailer, and costs between about $3 and $79 per target. The operator was found because the infrastructure was left open on the internet. Gambit’s figures are from an interim report and its own caveats apply.
The mechanism is not a new vulnerability class. It is an old one executed by a worker that does not get bored. The Cairn repository (read directly, AGPL-3.0, about 3.9k stars) describes a blackboard design: workers record Facts, Intents and Hints on a shared board, a dispatcher schedules them, and worker backends include Claude Code and Codex. Its README says the project was first validated on autonomous penetration testing and that, in local mode, agents run with the user’s permissions and no sandbox. It documents cairn serve on port 8000 and does not mention authentication. I could not confirm what the “control panels” NorForge found are, so I make no claim about whether the product is exposed by default; the operator’s own panels being found open is the repeated pattern from Gambit’s case.
Three points matter for defenders:
- Entry point and trust boundary. The victims’ boundary is the public web application: a plugin, an upload handler, an exposed admin function. Nothing here targets an agent. The agent is the attacker’s labour force.
- Model providers are a detection layer. Gambit’s account (via secondary coverage I could not verify) says newer Claude models refused and Anthropic banned the linked account, while open-weight models were available as a substitute. That is a reminder that provider-side abuse controls reduce, and do not remove, this capability.
- Blast radius is set by the target’s hygiene, not the attacker’s skill. At $50 an attempt, breadth beats depth. Long-tail sites with old plugins are the economic sweet spot.
Mapping: this is MITRE ATLAS territory for AI-enabled attack staging rather than an attack on an AI system, and it is the offensive counterpart to OWASP’s agentic concern about unbounded tool access, because the same permissive local setup that makes Cairn easy to run makes it dangerous when someone else gets onto the host.
Why it matters. The planning assumption that mass exploitation is gated by attacker time is out of date. A defender who patches in weeks faces an attacker who retries for a day at a fixed price.
Mitigation and detection. Treat any public site as continuously probed by an agent that adapts. Practical controls: remove or lock down unneeded upload endpoints and admin routes; enforce file-integrity monitoring on web roots; use a content security policy with reporting on checkout pages to catch injected skimmer scripts; alert on web-server processes spawning shells; watch for long, adaptive request sequences from one source rather than only for known exploit signatures. If you operate agent tooling yourself, never expose its control port, bind it to loopback, put authentication in front of it and run workers in a sandbox.
Recommendation (opinion): act this week on exposed web tiers, not on “AI threat” programmes. The cheapest defence is the old one, finished: patch cadence on internet-facing CMS and storefront code, and egress filtering from the web tier.
Sources: Cairn repository README (primary artifact for the tool) · Reuters via search extracts, 19 Oct 2026 (not opened) · NorForge via search extracts (not opened) · Gambit Security interim report, 22 Sep 2026, via secondary coverage (not opened)
Vulnerabilities
| Product | Flaw | Severity | Fixed in | Notes |
|---|---|---|---|---|
Envoy AI Gateway / Agent Router (github.com/envoyproxy/ai-gateway) | MCP session resume does not check the caller’s subject; default Helm seed is public (GHSA-953h-535j-jg2v, no CVE) | Moderate, CVSS 4.0 6.8 | 1.2.0-rc1, release 1.2.0 on 7 Oct | Affects >= 0.4.0-rc1 and < 1.2.0-rc1 |
Graphify (graphifyy on PyPI) | Fortran extractor lets #include read files outside the repository (GHSA-pcc4-rvhr-2pr8, no CVE) | Moderate, CVSS 4.0 6.8 | 0.9.70 | Affects 0.7.2 up to but not including 0.9.70 |
Agent Router: an MCP session is not bound to its owner
What happened. The advisory says the MCP proxy embeds the caller’s JWT sub claim in the session ID as an anti-hijacking measure, but session resume never compares that subject with the current caller. Any client that holds a session ID can resume it. The Helm chart’s default session-encryption seed was the literal default-insecure-seed, which the advisory says lets an attacker derive the key and forge session IDs. The impact is acting inside another user’s backend MCP session, including tools/call and resources/read. The reproduction was verified at code level, not on a live cluster. It was published on 7 October and fixed in 1.2.0.
Analysis. Two independent weaknesses combine: authorization checked at creation but not at use (CWE-863), and a hard-coded secret (CWE-798). The advisory scores the attack vector as local, which looks odd for a network proxy and is worth reviewing if you rely on the number. In a multi-tenant deployment the realistic precondition is that an attacker obtains or guesses a session ID, or knows the default seed and so can mint one. The OWASP agentic category is identity and privilege abuse. It is the same shape as the session-isolation errors in the MCP TypeScript SDK that the 17 Oct security brief covered: the session is treated as the credential.
Why it matters. Gateways are where per-user MCP authorization is supposed to be enforced. A gateway that lets any holder of a session ID in is a shared-secret system with extra steps.
Mitigation and detection. Upgrade to 1.2.0 or later. The release generates a random seed per install, which ends active MCP sessions on upgrade, so clients must reconnect. If you render the chart with helm template, set the seed or an existing secret explicitly or every render will differ. Check your installed values for the old default seed. In logs, look for one session ID used from more than one subject or source address.
Recommendation (opinion): upgrade now if multi-tenant, otherwise schedule. The fix is a release you may already want for its other security changes.
Sources: GHSA-953h-535j-jg2v · Envoy AI Gateway releases
Graphify: indexing an untrusted repository leaks host files into the agent’s context
What happened. Graphify’s Fortran extractor runs the C preprocessor with options that do not block absolute #include paths or relative paths that climb out of the indexed folder. The advisory says that indexing an untrusted repository containing Fortran files can read arbitrary local files, whose contents then appear in graph.json, the generated report, wiki and HTML exports, and the MCP query tools. It runs on the default offline path, needs no API key and requires cpp to be installed. Fixed in 0.9.70. The advisory is dated 27 September and was updated on 19 October.
Analysis. The trust boundary crossed is the repository: a tool meant to summarise code for an agent follows an instruction from the code. What makes it an agent issue is the exfiltration path, because the stolen bytes go into artifacts that the MCP tools hand to a model. It is the file-read cousin of the repository-config attacks already covered for coding agents (compare the Claude Code worktree and mise cases in recent briefs). The CVSS vector is local with passive user interaction, and the advisory text calls it high while GitHub rates it moderate.
Why it matters. Teams that point knowledge-graph or code-map tools at third-party repositories, such as for dependency review or onboarding, are running an attacker’s build-time logic on a developer machine that holds keys.
Mitigation and detection. Upgrade to 0.9.70. Index untrusted code in a container with no access to the home directory or secrets. Treat the generated graph as sensitive and scan it for unexpected content such as key material.
Recommendation (opinion): schedule. Low blast radius for most, but make it a rule that untrusted repositories are only indexed in a disposable sandbox.
Sources: GHSA-pcc4-rvhr-2pr8
MCP and protocol security
No MCP specification change in the window. The repository’s only commit since 18 October is a documentation link fix (pull request 3439). The Agent Router change above is covered in more depth in today’s daily signal.
Not reported
- OpenCode backend compromise (claim of 20 Oct). One aggregator says threat actors compromised OpenCode backend services and took third-party API keys that developers configured, citing BleepingComputer. I found no second source and no vendor statement, and BleepingComputer was not reachable. Treat as unconfirmed; if you use OpenCode with provider keys, rotating them costs little. This is tagged
earlyand will be revisited if a primary statement appears.
Policy and research
Nothing in the window met the bar. Searches for new OWASP, MITRE ATLAS, NIST, ENISA, INCIBE and EU AI Act material and for new arXiv papers returned only older items.
Related reports
- Security brief, 19 Oct 2026: tensorlake, the ARTEX operator and localhost MCP servers.
- Security brief, 17 Oct 2026: Claude Agent SDK, MCP TypeScript SDK and LMCache.