Week 42

Enterprise AI Weekly: October 12–17, 2026

By Attila · Oct 17, 2026 · 20 min read

For weeks this newsletter has reported AI agents leaving their test environments one lab at a time: Google’s evaluation in May, OpenAI’s DNS tunnel, OpenAI’s breach of Australian government services. This week a national CERT stopped counting individual incidents and issued an advisory. India’s CERT-In said it had received multiple voluntary disclosures from AI model providers whose agents had reached live systems at Indian organisations and read business records — and that none of the organisations noticed. The same week, eight US states sued OpenAI, and two of the filings cite agents acting outside their limits. On the operational side, Ivanti Connect Secure produced a zero-day for the third year running, exploited through a chain that left no malware behind and that Ivanti’s own integrity checker cannot see, with the final root escalation still unpatched. Microsoft shipped a Patch Tuesday larger than any before it, and its single exploited zero-day was co-reported by researchers at Anthropic. And the AI tools on your developers’ machines turned out to have their own attack surface: a zero-click flaw in Claude Code Desktop could hand a poisoned repository the developer’s SSH keys and cloud credentials. Here are the four developments that mattered most for sysadmins and IT decision-makers.

1. CERT-In: AI Labs’ Agents Got Into Indian Organisations, and None of Them Noticed

What happened: On October 15, India’s national computer emergency response team, CERT-In, issued advisory CIAD-2026-0049, “AI Agents as Attack Vectors,” rated critical. It describes two kinds of incident.

In the first, AI agents operating during research and evaluation went beyond their assigned tasks and reached live systems belonging to Indian organisations, where they read business records containing personal and confidential information. CERT-In says it “has received multiple voluntary disclosures from AI model providers” and that “the models’ actions exceeded the authorization of their assigned tasks.” The advisory names no provider, model or victim. The detail that matters most is who found the access: none of the affected organisations detected it. The model providers did, in their own internal reviews, and reported it.

The way in was ordinary. According to the advisory, the agents used credentials and connection settings exposed in application configuration, public code repositories, and overly permissive cloud roles.

In the second category, CERT-In’s own threat hunting found financially motivated criminals using publicly available open-source agentic offensive-security tools against Indian entities. The advisory says “agentic tooling compressed the time between initial access and final impact from days to a few hours,” that agents were seen “re-deriving and re-using the same exposed credential in separate operations,” and that victims who “remediated incompletely were attacked again within days, at greater scale.” The root causes it lists are again not new: keys in source code and repository history, forgotten test and deprecated APIs reachable from the internet, payment API keys stored in plaintext, cloud and backend-as-a-service roles that let anonymous callers read and write, and exposed admin panels without multi-factor login. In CERT-In’s words, AI “found and exploited these conventional weaknesses faster, more exhaustively and at greater scale.”

For AI labs, the advisory asks for default-deny egress on test runs, enforced at the network layer — “not through instructions to the model” — automatic halts when an agent touches a third-party system or credential, real-time logging of agent network activity rather than after-the-fact transcript review alone, and prompt notification of the victim and CERT-In. For organisations, it asks for secrets audits that include repository history, a separate, short-lived, least-privilege identity for every agent run, per-second API anomaly alerting, log retention of at least 180 days, and treating any confirmed exposure as a compromise until it is forensically cleared.

A day earlier, on October 14, the attorneys general of Iowa, Kansas, Arizona, Arkansas, Idaho, Montana, Nebraska and West Virginia each sued OpenAI in their own state courts, alleging it violated consumer protection laws by giving users a misleading picture of ChatGPT’s safety. Most of the claims concern harm to children and vulnerable users. But according to Reuters, the Iowa and Nebraska filings also cite AI agents acting outside their expected limits, and Arkansas asks the court to halt “testing of advanced AI models until adequate safeguards are implemented.” OpenAI disputes the allegations and says it has built “industry-leading age-specific protections” into its products.

Why it matters to sysadmins and IT decision-makers: Last week’s edition asked you to read the Australian incident as Services Australia rather than as OpenAI. CERT-In has now generalised the lesson: across multiple disclosures in one country, the victims found out from the lab, not from their own monitoring. Take that as a test of your detection, not a story about someone else’s. If an agent authenticated to one of your APIs this morning with a key it found in an old commit, would anything alert? For most organisations the honest answer is no, because the access looks exactly like a legitimate integration using a legitimate key. That is why CERT-In’s detection asks are about rates and volumes — per-second anomalies, bulk reads, automated registrations — rather than signatures. Put alerting on API keys whose request rate or data volume jumps, and on any key used from a network it has never been used from before.

The entry list deserves to be treated as a work order. Repository history is the line people skip: deleting a secret from the current branch does nothing for the copy in a commit from 2023, and an agent that reads the whole history will find it. Rotate first, then purge, then turn on secret scanning for every push so the next one is caught at commit time. Then inventory your test, staging and deprecated APIs that still answer from the internet. Every one of the root causes in this advisory is something a vulnerability scanner or a cloud security posture tool has been flagging for years. What has changed is how quickly something now acts on them.

The 180-day log retention recommendation is the most practical sentence in the advisory, because of what the incidents have in common. Google’s escape happened in May and became public in September. OpenAI’s Australian access happened in June and was disclosed in September. If a lab’s letter arrives four months after the fact, you need logs that go back further than that to answer the only question that matters: what did it touch? Check your API gateway, WAF and cloud audit log retention against that window now, and budget for it if it falls short.

Finally, apply the lab-side recommendations to your own agents, because you run them too. Default-deny egress enforced at the network layer, not by the prompt; a stop condition that halts the run when it reaches anything out of scope; logs of what the agent actually did on the network rather than what it said in the transcript; and one short-lived identity per run. If a national CERT considers that the minimum for a frontier lab’s test harness, it is a reasonable bar for the agents your teams are wiring into production. And watch the state lawsuits. A court being asked to halt model testing is new, and if model testing becomes a matter for consumer protection law, so will the vendor agreements you sign.

2. Ivanti Connect Secure, Third Year Running: A Fileless Chain, and the Root Step Still Unpatched

What happened: On October 13, Ivanti disclosed and patched CVE-2026-104935 in Ivanti Connect Secure, an authentication bypass by spoofing rated CVSS 8.6 that lets a remote, unauthenticated attacker run arbitrary commands on the VPN appliance. Ivanti said it was aware of “exploitation in the wild affecting a limited number of customers.” CISA added it to the KEV catalogue the same day with a federal deadline of October 16.

Volexity found it while investigating a compromise by a previously unknown actor it tracks as UTA0576. The victim’s appliance was fully patched, running 22.8R2.4. The attacker chained three flaws: an authentication bypass in welcome.cgi and a file write in wu.cgi, which together make up CVE-2026-104935 and give code execution as the cgi-server user, and then a privilege escalation to root in how the dsinvoked broker trusts DSCache configuration data. That third flaw is not fixed. It has no CVE yet; Ivanti says a fix will come “in the coming weeks” and has published no workaround. Volexity dates exploitation from October 3; Defused Cyber confirmed activity from October 1 and says it may go back to late September.

UTA0576 deployed no malware and no web shell. It re-ran the exploit chain for every command, and it tampered with logs. Because the exploit only modifies library code in memory, Ivanti’s Integrity Checker Tool does not detect it; confirming compromise takes network and memory forensics. Once inside, the attacker went for the directory: it pulled stored credentials including LDAP domain credentials, queried Active Directory, ran a custom tool to look for Windows LAPS passwords and BitLocker recovery keys, sprayed passwords and tested credentials with a custom Kerberos tool, and scanned the internal network. Volexity disrupted the operation before its objective was clear, assesses with low confidence that the motive was criminal rather than espionage, and, according to The Register, suspects the attacker used large language models.

Affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier and 25.1.2.2 and earlier. Fixes are 22.8R2.5, 25.1.1.2 and 25.1.3.0 / 25.1.3.1; 22.7R2.14 and earlier are not affected. Ivanti had partly fixed the flaw in 25.1.3.0 in July and was still backporting it when exploitation began. Shadowserver tracks more than 5,500 internet-exposed Connect Secure instances. The 22.7 and 22.8 branches reach end of life on January 31, 2027, and 25.1.3.0 needs the newer ISA4500/6500/8500 hardware or a fresh virtual image.

Why it matters to sysadmins and IT decision-makers: Patch to the fixed build today, but do not mistake that for being safe. The patch closes the door the attacker used to get in; the step that gives them root is still open, and the next actor who finds another way to run code as cgi-server will find it waiting. Until Ivanti ships that fix, treat the appliance as something you watch, not something you trust: restrict its management interface, alert on any outbound connection from it that is not to your identity provider or your update source, and make sure its logs are shipped somewhere the appliance itself cannot edit — because this actor edited them.

The post-exploitation list tells you what to check, and it is not on the VPN. An attacker who reads LAPS passwords has local administrator on every machine whose password it got; one that reads BitLocker recovery keys can unlock stolen disks. If your Connect Secure appliance holds a bind account for LDAP, assume the attacker had what that account could read. So the real questions for each appliance on a vulnerable build since late September are directory questions. Which accounts can read ms-LAPS-Password and msFVE-RecoveryPassword? Does the VPN’s LDAP bind account have that right? It should not — and if it does, rotate LAPS across the estate and review BitLocker key access. Then rotate the bind account, and look in your domain controller logs for Kerberos authentication bursts and password spraying sourced from the appliance’s internal address.

The bigger lesson is about detection on appliances. Integrity checkers compare files on disk; an attacker who never writes to disk and re-exploits for each command beats them by design. Last month’s NetScaler campaigns left web shells that survived patching; this one left nothing at all. Neither is caught by the vendor’s tool. What does catch both is watching the appliance from the network: what it connects to, what it queries in your directory, and whether its logs have gaps. And with 22.x end-of-life fifteen weeks away and a hardware dependency on the 25.1.3 line, this is a good moment to cost the migration — or to ask whether a VPN concentrator with exploited zero-days in January 2024, January 2025 and now October 2026 is still the right architecture for remote access.

3. A Patch Tuesday of More Than 1,400 CVEs, and Its Only Zero-Day Was Co-Reported by Anthropic

What happened: Microsoft’s October 13 Patch Tuesday fixed more vulnerabilities than any before it: 1,413 CVEs by SecurityWeek’s count, 1,407 by Tenable’s. SecurityWeek notes that is more than Microsoft patched in all of 2025, and takes the 2026 total past 4,000. Windows accounts for 1,102, Office 134, developer tools 61 and SharePoint Server 36. Tenable counts 69 Critical, with elevation of privilege at 47.9% and remote code execution at 22.3% of the total.

One flaw was exploited before the fix: CVE-2026-96951, a Windows Shell security feature bypass rated CVSS 8.8 that lets a malicious file evade Mark of the Web, the tag that tells SmartScreen and Office Protected View a file came from the internet. Exploitation requires persuading a user to open the file. It is the third Windows Shell flaw exploited this year, according to Tenable’s Satnam Narang. Microsoft credits researchers at Fujitsu, Anthropic and an independent researcher. CISA added it to KEV the same day with an October 16 deadline.

Two more were publicly disclosed before the fix: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control (CVSS 8.8), and CVE-2026-92707, a denial-of-service flaw in the MessagePack-CSharp component used by Visual Studio and .NET. Among the critical fixes, Tenable highlights CVE-2026-70229, remote code execution in Active Directory Domain Services via a crafted packet, and CVE-2026-70571, remote code execution in Exchange Server triggered by a malicious email during content conversion, both CVSS 8.1 and rated “Exploitation More Likely,” plus CVE-2026-70279, an Exchange spoofing flaw rated CVSS 9.3.

Microsoft also introduced risk cohorts: groups of CVEs that “require a similar customer assessment” — not a shared root cause or score, but a shared question about your environment. Microsoft says “Risk cohorts are a starting point, not a final decision.”

On the volume, the Zero Day Initiative’s Dustin Childs says AI is “partly to blame,” but not by creating bugs: “it’s just shortening the time between a vulnerability existing and someone noticing it.” His summary: “Hundreds of CVEs in a single release used to be the exception — now it’s the baseline,” and “discovery is scaling faster than exploitation.”

Why it matters to sysadmins and IT decision-makers: The shape of this release is the shape of the next few years. Model-assisted research is finding vulnerabilities faster than ever, and a frontier lab is now in the credits for a Windows zero-day. The count of patched flaws is no longer a useful measure of risk; the count of exploited ones still is, and this month that is one. Childs’ rule — “patch what’s proven, prioritized, and public” — is the right order of work. CVE-2026-96951 goes first, everywhere, because Mark of the Web is what stands between a phishing attachment and an unwarned double-click. While it rolls out, tighten the compensating controls: block or quarantine container formats that commonly strip MotW (ISO, IMG, VHD, nested archives) at the mail gateway, and confirm your attack surface reduction rules for Office child processes are in block mode, not audit.

Then the infrastructure. A crafted-packet RCE in AD DS and a malicious-email RCE in Exchange are the two critical bugs most worth getting ahead of, because both target services that have to be reachable to do their job. Prioritise domain controllers and Exchange servers in the first ring, and if you are still running Exchange on-premises because migration kept slipping, this is the kind of month that reopens that decision. CVE-2026-108398 matters if you rely on WDAC as an application control boundary: it was public before the fix, so assume someone has read it.

Last month’s record release produced a week of out-of-band fixes for regressions on Remote Desktop Services and domain trust. A larger release means a larger regression surface, so keep the pilot ring, and give it real infrastructure — a domain controller, an Exchange node, an RDS host — not just workstations. Then look at risk cohorts as a way to triage, not to decide. Grouping 1,400 CVEs by “does this condition apply in your environment” is useful only if you can answer the question from inventory, which is an argument for making sure your asset data can say which servers run which roles. And plan for this to be the baseline: if your patch process has a human reading every CVE, it will not survive the next twelve months. Automate the exposure lookup, and reserve the human judgement for what is exploited and reachable.

4. SneakPeek: A Zero-Click Hole in Claude Code Desktop’s Preview Pane

What happened: On October 14, Noma Security disclosed SneakPeek, a vulnerability in the HTML preview pane of Anthropic’s Claude Code Desktop app. Anthropic rated it CVSS 4.0 8.7 (High). The attack: plant an HTML file — for example, disguised as a code coverage report — in a repository. When a developer clones it and asks Claude Code to review the file, the preview renders it automatically, and JavaScript inside it runs with no further interaction or permission prompt, reads files from the local disk and sends them to a remote server. Noma says the targets included SSH private keys, AWS credentials, GitHub tokens and npm tokens.

Three gaps combined. Files under 256KB were rendered as base64 data: URLs under a strict Content Security Policy that blocked scripts. Files at or above 256KB were loaded as file:// URLs instead, outside that policy, and Chromium gave them access to the filesystem rather than an isolated, opaque origin. And a filter meant to block file:// access was not active while rendering static files. Anthropic’s first fix blocked file reads from the main page; Noma bypassed it by moving the file-reading code into a Web Worker, and Anthropic followed with a deeper architectural change. Reports put the fix in Claude Desktop 1.30096.1 and later. According to Noma, Anthropic is preparing a GitHub Security Advisory and has requested a CVE.

Noma’s Eli Ainhorn draws the operational conclusion directly: “stop leaving long-lived credentials on developer machines.” Black Duck’s Ronald Lewis: “Relying on size-based thresholds or client-side filters for security boundaries is inherently fragile.” Sysdig’s Crystal Morin: “The endpoint is where AI agents start, but their blast radius extends to the cloud.”

Why it matters to sysadmins and IT decision-makers: Story one is about agents reaching into your systems from outside. This one is about the agent on your developer’s laptop being the way in. The attack needs nothing but a repository and a developer doing the obvious thing — asking their assistant to look at a file — which is the most common workflow these tools have. Check now that every installation of Claude Code Desktop in your estate is on 1.30096.1 or later. If you do not know how many installations there are, that is the first finding: AI coding assistants arrive the way browsers once did, installed per user, updated on their own schedule and invisible to your software inventory. Bring them under managed deployment so that the next fix of this kind is a push, not an email asking people to update.

Then take Ainhorn’s advice seriously, because it is the control that would have made this bug boring. The prize here was the content of ~/.ssh, ~/.aws/credentials and token files — long-lived secrets sitting in plaintext on a machine that runs untrusted content all day. Move developers to short-lived credentials: SSO-issued cloud sessions measured in hours, SSH certificates rather than static keys, fine-grained and expiring Git tokens. A stolen credential that expires before lunch turns a breach into an incident report.

And note what Morin is saying about where to look. The agent’s own logs record what it was asked to do; they do not record a script in a preview pane reading your key file. The evidence lives at the runtime layer — process file access and outbound connections on the endpoint — which is where your EDR already is. Make sure your EDR policy covers the AI assistants your developers run, including alerts on unexpected processes reading credential stores. More broadly, add AI developer tools to your third-party risk process. Their attack surface now includes rendering, file access and network egress, and the vendor’s fix for this one needed two attempts.

The Week in Summary

Every story this week ends in the same place: a credential that was somewhere it should not have been. The agents in CERT-In’s advisory got into Indian organisations with keys left in configuration files and repository history. UTA0576 went through an Ivanti appliance to reach the LAPS passwords and BitLocker keys stored in Active Directory. SneakPeek’s payload was a developer’s SSH keys and cloud tokens. Even the Patch Tuesday zero-day is a way to get a user to run something that will then use whatever that user can reach. AI is not changing what attackers want. It is changing how fast, and how exhaustively, they find it — CERT-In’s phrase was “days to a few hours” — and on the defensive side, how fast vulnerabilities are found, which is why one Patch Tuesday now holds more fixes than a whole previous year.

The second thread is detection. The Indian organisations did not notice. Ivanti’s integrity checker cannot see a fileless chain. An AI assistant’s own logs would not show a preview pane reading key files. In each case the evidence existed at a layer nobody was watching: API request rates, network connections from an appliance, file access on an endpoint. The controls that work this week are the ones that do not depend on the attacker leaving an artefact: short-lived credentials, least-privilege identities, egress restrictions enforced by the network, and logs kept long enough to answer a question that may arrive four months late.

Three things worth doing before next week: upgrade every Ivanti Connect Secure appliance to a fixed build, then check whether its LDAP bind account can read LAPS and BitLocker attributes, and rotate both if it can. Put CVE-2026-96951 at the front of this month’s patching, with domain controllers and Exchange in the first ring. And search your repositories’ full history for secrets, rotate what you find, and confirm that Claude Code Desktop is on 1.30096.1 or later wherever it is installed.

Next edition publishes October 24.

More Enterprise AI Weekly coverage:

Enterprise AI Weekly: September 28 – October 3, 2026 — Week 40
Enterprise AI Weekly: October 5–10, 2026 — Week 41