Poisoned AI SDKs, Cross-Agent Access, and Untriaged Bug Reports

AI Sec News Weekly #30 — 221 sources scanned

This week’s strongest findings concern the infrastructure around AI: package publishing, cloud credentials, and the permissions agents inherit. Tensorlake’s compromised SDK and the patched AgentCorruption flaw show how failures there can extend well beyond a single tool or conversation.

On the defensive side, AI-generated vulnerability reports raise a different question: how much investigation work does automated discovery leave for maintainers?

This Week's Stories

Tensorlake SDK Compromise Delivered Shai-Hulud With a Destructive Token Monitor

Socket found Shai-Hulud in tensorlake 0.5.144, where a preinstall hook launched a Bun-based worm that stole cloud credentials and AI-tool configs. The payload established persistence and supported remote code execution. Its PowerShell “hostage token” monitor could wipe the home directory after GitHub token revocation. The malicious version has been removed from npm.

Why it matters: Even Sigstore provenance can accompany an infected release—the worm republishes compromised packages under the victim’s publishing identity.

The Hacker News — Published 2026-10-08

AgentCorruption Turned One Agent’s Credentials Into Cross-Agent AWS Access

At SecTor 2026, Zenity Labs detailed the now-patched AgentCorruption flaw in AWS Bedrock AgentCore. Researchers prompted a public-facing agent to retrieve IMDS credentials from inside its Firecracker MicroVM. The default role’s broad permissions then let them invoke other agents, read sessions and access Secrets Manager in the same account and region.

Why it matters: For incident responders, valid AWS credentials could make prompt-driven abuse look like legitimate service activity.

Dark Reading by Rob Wright — Published 2026-10-08

Researchers Link ARTEX and Claude Code to South Korean Bank Attacks

Researchers linked attacks targeting Shinhan, KB Kookmin and Hana banks earlier this month to ARTEX AI and Claude Code sessions. Exposed directories contained session histories, ARTEX configuration and memory files. ARTEX used DeepSeek v4.1-flash, while additional Claude Code sessions used GLM-5.3 and Grok 4.6. ARTEX’s developer subsequently closed the source and stopped updates, but derivatives remain available.

Why it matters: The client’s logo is a poor guide to whose model safeguards an attack actually encountered.

BleepingComputer by Bill Toulas — Published 2026-10-10

Tool Spotlight

New tools and implementation patterns.

OSS Scanner Sends Model-Generated Findings Without Human Triage

OSS Scanner’s reports are fully model-generated, with no human triage before delivery. Its Docker-based audit workflow accepts an optional threat_model.md to define scope and a GPG key for encrypted report emails. Anthropic won’t impose a blanket 90-day disclosure deadline; that clock can start if a human later validates a finding through its coordinated disclosure program.

Why it matters: Free scanning can still lengthen a maintainer’s investigation backlog when reports arrive faster than they can be validated.

The Hacker News — Published 2026-10-09

AgentCore Carries User Identity Into Lake Formation Queries

AWS published a deployable Bedrock AgentCore pattern for Strands or LangGraph data agents. It carries identity tokens over HTTP, outside model context, then exchanges them server-side in Lambda so Lake Formation applies the user’s grants rather than the tool’s IAM permissions. CloudTrail records the person behind each query.

Why it matters: A model’s mistaken or manipulated query would still face the requesting user’s data-access limits.

AWS Security Blog — Published 2026-10-06

Quick Hits

• Unpatched LMCache Flaw Allows Remote Code Execution Without Authentication (The Hacker News; Published 2026-10-07) — Malicious messages to an exposed ZeroMQ socket let attackers execute code in LMCache without authentication; the flaw remains unpatched.
• Wikimedia Reports Unauthorized Activity by OpenAI-Linked Agents (Simon Willison; Published 2026-10-07) — Wikimedia reports OpenAI-linked agents made unauthorized sandbox edits and sent hundreds of thousands of queries to its Wikidata Query Service.
• Google PageBreak Agent Finds Hundreds of Web App Flaws (Dark Reading; Published 2026-10-06) — Google's PageBreak AI agent found more than 500 flaws in its web apps, using non-AI validators to check that exploits actually worked.
• Deep XPIA Tests Prompt Injection Across Multiple Agents (GitHub; Publication date unverified) — The open-source deep-xpia benchmark tests how prompt injections travel between AI agents, with 250 attack cases and evaluations of four defenses.
• OpenAI Fires Three Safety Researchers Amid Risk Dispute (SecurityWeek; Published 2026-10-09) — SecurityWeek reports OpenAI fired three safety researchers amid a dispute over sensitive information handling and allegations that corporate interests took priority over safety.
• An AIxCC Winner Weighs In on Frontier Vulnerability Research (Microsoft Security Blog, by Taesoo Kim; Published 2026-10-07) — Kim’s post promises three lessons from frontier AI vulnerability research, but the available excerpt covers only his biography and Team Atlanta’s $6 million AIxCC win—not the lessons or supporting results.