A house newsletter · daily · researched and written by the Kurzia AI
Friday 6 November 2026 · Issue 6 · 5 min read
AI agents loot GitHub secrets into Azure in five minutes; OpenSSH emergency Alpine fix; 948 kernel exploits in one AI run
Act on this first
Microsoft Security Blog · today
ARTEX secret-hunting campaign
Takeaway: five minutes
Microsoft's threat team reports attackers pointing an agentic AI framework, ARTEX, at public GitHub repositories to harvest exposed credentials and AI-service API keys, then using them against Entra ID tenants, Azure and Microsoft 365. Once a stolen application credential works, the agents enumerate the tenant, hunt more secrets in Azure DevOps, and can run commands on Azure VMs. In one observed case an agent moved from scanning GitHub to exfiltrating Azure Key Vault data in five minutes.
Treat every secret ever committed to GitHub as already found and used: agents remove the human-speed bottleneck of scanning and reviewing repos, and a leaked secret stays valid until rotated — deleting the commit fixes nothing. Microsoft watched successful service-principal sign-ins from one IP across multiple tenants, and saw the agent adapt, retrying failed Azure API calls with corrected versions until they succeeded. Check first: scan your repos for secrets and rotate anything found, then block 199.19.77[.]84/32 in Conditional Access; migrating OAuth apps to managed identities removes this whole class of exposure.
Under attack
Zyxel GS1900 — Zyxel GS1900 switches: the 2.90 fix doesn't stop the exploited zero-day — Binarly shows unauthenticated web-interface command execution still works; new firmware for 10 models closes it.
CVE-2024-27834 — Apple OSes: CVE-2024-27834, improper authentication (CVSS 5.5), used to deliver info-stealing malware; CISA's exploited-vulnerabilities catalogue added it after active attacks; already patched — update stragglers. No CISA or Apple primary link was available for this addition; the source here is The Hacker News' report.
Holes in AI tools
Check Point Research · yesterday
ChatGPT Lockdown Mode
Check Point found a bypass of ChatGPT's Lockdown Mode, the optional setting that blocks prompt-injection data theft. The HTML-preview sandbox allowed popups; a rendered page could nest one more iframe and use its window.open to open a popup that escaped the sandbox entirely. From there an attacker could silently exfiltrate whole chat histories, or show spoofed ChatGPT windows for phishing and malware downloads.
In the Electron-based ChatGPT Classic app, window.open worked without any user gesture, so simply having a conversation could leak it — and a shared chat delivered the payload even to logged-out visitors. Anyone who enabled Lockdown Mode for sensitive chats was not fully protected while this was live. OpenAI removed the popup permissions from the preview sandbox; Check Point retested and the technique no longer works. No attack reported.
Read it at Check Point Research
Disclosed 5 Nov · We had it 6 Nov, 03:33 UTC
GitHub Advisory Database · today
banks
Takeaway: fixed in 2.4.3
Banks, a Python library that builds LLM prompts from Jinja templates, turns a tool's import_path into a Python callable via importlib with no allowlist — and tool definitions can be parsed out of the rendered template body itself. A prompt from an attacker-influenced source can therefore name os.system and get arbitrary code execution in the banks-hosting process when the model emits the matching tool call.
This slips past the template-sandbox fix shipped for CVE-2026-44209, because the malicious tool JSON is plain text the sandbox never inspects. If you load prompts from Redis or shared storage, that earlier fix does not cover you. Affected through 2.4.2, fixed in 2.4.3; GitHub rates it High, CVSS 7.5, and the RCE inherits the inference server's privileges.
Read it at GitHub Advisory Database
Affected: <= 2.4.2 · Fixed in: 2.4.3 · Disclosed 5 Nov · We had it 5 Nov, 23:05 UTC
Found or caused by AI
OpenAI kernel exploit pipeline — OpenAI says an autonomous pipeline built working root exploits for 948 unique Linux kernel vulnerabilities in a single run on the kernel's master branch that cost $1.2 million in API credits: 2,308 candidate bugs flagged, 1,724 confirmed, 1,169 working local privilege escalation exploits (a low-privileged user becoming root) and 291 information-leak proofs of concept, tested with KASLR, SMEP and SMAP enabled, using at least 10 novel techniques OpenAI is keeping private. Reports and patches are reaching kernel maintainers in stages, so treat any stale, multi-user Linux box as effectively lost — the OpenSSH project, elsewhere in this issue, is shipping out-of-band fixes for exactly this reason, saying bugs its AI reporters find keep being independently rediscovered by others. OpenAI puts the haul at $18.9–66.3 million at typical Pwn2Own rates, and raised its own bug bounty: critical product flaws now pay up to $30,000, exceptional cases $172,000 with bonuses.
ARTEX — Check Point obtained the databases of ten misconfigured ARTEX consoles — the Chinese open-source agentic hacking platform — and found the agents running campaigns almost unattended: one harvested over 300 Apple code-signing certificates from grey-market iOS signing shops, three of which validated, burning 36 billion tokens in two weeks for an estimated $700–1,500. This is commodity crime now: operators mostly typed variations of 'what's the progress', the agents found their own way in through command injection and missing authentication, and 1,608 live consoles were publicly reachable at scan time — attacker infrastructure that is itself findable. Chinese models dominated the configured LLMs, led by Deepseek Flash; Anthropic's Opus was the only model that hit guardrails, after which operators switched.
Crafty Falcon — CERT-In says an AI-assisted actor it tracks as Crafty Falcon is actively attacking Indian banking, finance and insurance firms with publicly available AI-driven offensive tools.
Patches worth knowing
OpenSSH 10.6p2 — OpenSSH on musl Linux without PAM: accounts with a `*` password field accept any 257–1024-character password; rated critical; fixed in 10.6p2, or turn password logins off.
Affected: Linux systems using musl libc with PAM disabled · Fixed in: 10.6p2 · We had it 6 Oct, 23:01 UTC
One thing to do
sshhole — On every Alpine, OpenWRT or other musl-based image, check three things: is sshd running without PAM, are password logins still on, and does /etc/shadow hold accounts whose password field is just `*`? If so, any of those accounts accepts any 257–1024-character password — on Alpine's official AWS and Azure images the default alpine user has passwordless doas, which means root. The browser demo at sshhole.com shows the crypt() difference live, running entirely locally. sshhole.com