AI Agents Go Rogue: Pre-Auth RCE, Exposed Repos & Secure Boot Bypass

Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries

In June 2026, researchers pivoting from known TencShell command-and-control infrastructure uncovered an open directory on 112.213.124.132 exposing an active intrusion campaign. The directory held victim source code, custom exploit scripts, and operational logs with notes in Simplified Chinese. Crucially, the attackers employed Claude Code version 2.1.165 and DeepSeek-v4-pro as working parts of the intrusion: Claude Code handled execution and phishing page iteration, while DeepSeek drove reasoning and script generation. A recovered CLAUDE.md file directed the AI to automate the creation and testing of cloned login pages. The infrastructure consisted of 13 unique IP addresses, all in Hong Kong across four autonomous systems, indicating a China-based operation.

Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries →

Forgotten UEFI Shims Undermining Secure Boot

ESET researchers identified 11 old UEFI shim bootloaders at versions 0.9 and below that can bypass Secure Boot on any system trusting Microsoft’s UEFI CA 2011 certificate. The vulnerability allows attackers to load bootkits like Bootkitty or BlackLotus even with Secure Boot enabled. Two CVEs were assigned: CVE-2026-8863 and CVE-2026-10797. The shims, from PC diagnostics, Linux distributions, and other utilities, lack modern denylist enforcement and can be used by attackers who bring their own copy to any vulnerable system. Microsoft revoked the affected hashes in the June 9, 2026 Patch Tuesday update, and users should ensure revocations are applied.

Forgotten UEFI shims undermining Secure Boot →

Smashing the ServiceNow Sandbox – Pre Authentication RCE

Researchers disclosed a pre-authentication remote code execution vulnerability in ServiceNow, tracked as CVE-2026-6875. The flaw lies in the GlideRecord query API, which accepts a javascript: prefix in filter values, allowing arbitrary JavaScript execution even without authentication. A sandbox bypass using the gs.include() function enabled full compromise of the ServiceNow instance, including access to all tables and creation of admin users. ServiceNow deployed mitigations to all cloud instances within 24 hours and later released patches, introducing a Guarded Script feature that restricts sandbox contexts to single simple expressions. Organizations should apply updated patches.

Smashing the ServiceNow Sandbox – Pre Authentication RCE › Searchlight Cyber →

Ant Group Open-Sources Agent Security Tool Days After Agentic Ransomware Hit

Twelve days after Sysdig documented the first end-to-end AI-agent ransomware operation by threat actor JadePuffer, Ant Group released SingGuard-NSFA, a free open-source guardrail framework available on GitHub and Hugging Face. The tool runs inline in any autonomous agent pipeline, intercepting prompt injection, credential theft, and malicious code execution before actions become irreversible. The JadePuffer attack exploited an unpatched Langflow vulnerability (CVE-2025-3248) and a Nacos authentication bypass, encrypting 1,342 configuration items and leaving a ransom note with an unrecoverable AES key. The attack compressed from initial access to destruction in 31 seconds, underscoring the need for agent-layer detection.

Ant Group Open-Sources Agent Security Tool Days After Agentic Ransomware Hit →

Grok Build Was Uploading Entire Git Repositories to xAI’s Cloud, Including Committed Secrets

A security researcher demonstrated that xAI’s Grok Build coding CLI was packaging developers’ entire Git repositories—full history, secrets, and API keys—and sending them to a Google Cloud Storage bucket. The upload volume was approximately 27,800 times larger than the actual coding task required. xAI had marketed the tool claiming nothing from the codebase was transmitted, but wire-level analysis of version 0.2.93 contradicted this. Elon Musk confirmed the uploads and said SpaceXAI would delete prior user data, adding a /privacy endpoint. However, no independent audit has verified the deletion, and Grok has a history of privacy issues including training on X user data without consent.

Grok Build was uploading entire Git repositories to xAI’s cloud, including committed secrets →