Security briefing: August 2026

Permission granted

Poisoned packages that spun out of valid credentials, an AI agent turned insider threat with only the permissions it was already given, and a ransomware affiliate whose LLM pressed on the moment it was granted authorization. Attackers have realized that AI doesn’t need new permissions to wreak havoc. That means privilege escalation is also no longer a high-priority tactic. Sysdig’s own August research makes the point even sharper: Seven of the eight AI-enabled attacks studied ran the most ordinary command execution technique in the MITRE ATT&CK Framework. AI isn’t inventing a new attack surface, but ask nicely (or just the right way) and it will get the job done. 

Let’s dig into this month’s security briefing.

Aug 4: Shai-Hulud worm returns yet again

• ChainDrop is an evolution of the self-propagating npm supply chain worm Shai-Hulud 2.0 from late November 2025. However, this iteration has not been connected to TeamPCP, who leaked the Shai-Hulud source code in May.
• The new payload resolves its C2 from an Ethereum smart contract and specifically targets AI coding tool credentials. 
• In under four hours, ChainDrop poisoned over 400 packages and 2,000 versions. It targeted public developer tools in the JavaScript ecosystem and shifted to enterprise SDKs at companies like ServiceTitan and Qlik within the first two hours. 
• Most headlines were buried under Black Hat promotions, but if you installed any affected versions, assume compromise. A compromised GitHub maintainer account let malicious releases ship with valid SLSA provenance. 

Aug 9: Ghostjacking turns AI coding agents into insiders

• At DEF CON 34, Tenet Threat Labs presented their research, showing how a single log line could turn an AI coding agent into an insider threat on a developer’s machine. 
• What Tenet Threat Labs showed isn’t a platform vulnerability. The flaw pattern hit Cloudflare, Datadog, and Sentry, with a 90% success rate against Claude Code on Cloudflare’s own recommended configuration.
• A separate zero-day in Anthropic’s Claude Desktop sandbox escape was found. It removed the control which would’ve otherwise blocked data exfiltration. 
• All four vendors were notified in advance, and the Claude Desktop flaw was confirmed patched before the DEF CON presentation. 
• Ghostjacking attacks cannot be detected because every step taken by an AI agent — reading a log, writing a DNS record, etc. — was something it already had permission to do. 
• This ultimately requires an architectural correction: Never let a read-only tool and a write/execute tool share a session without an explicit trust boundary between them. 

Aug 13: Claude Code used during ransomware intrusions 

• The Gambit Security Threat Intelligence team published a report on three unrelated cases on August 13 where attackers successfully used AI in offensive operations. 
• In one of these reported operations, a suspected “The Gentlemen” ransomware-as-a-service affiliate used Claude Code during the intrusion of at least six victim organizations. 
• The operator ran Sonnet 4.6, not a frontier model, likely to avoid tighter safety guardrails.
• Claude executed commands, ranked databases by importance, correctly flagged live production databases, and highlighted the most important assets. 
• When Claude refused to log in to a live production system, the operator opened a new session and claimed authorization over the system, and so Claude moved forward. 

Additional Sysdig TRT findings

AI is collecting on your tech debt

• On August 12, the Sysdig Threat Research Team (TRT) published an analysis of eight AI-enabled attacks, none of which include novel techniques. The only thing AI changed is who can run the operation and how fast.
• Seven of the eight attacks ran the single most ordinary technique in the MITRE ATT&CK Framework, T1059: Command & Scripting Interpreter. 

• The blog is framed as five AI debts coming due at once. These debts come from neglect of code, infrastructure, governance, skill, and AI attack surface. 

Also in the news

• OWASP GenAI Security Project update: The OWASP Top 10 for LLM Applications received an update on August 3, and it holds some notable significance. While Prompt Injection maintains the #1 spot for a second consecutive edition, the framing shifted and results changed across the rest of the top 10. For the first time on this list, breach data impacts the ranking in addition to experts’ votes. With this change, Excessive Agency and Misinformation made big jumps up the list. 
• Cyber Incident Reporting for Critical Infrastructure Act of 2022: CIRCIA is still quietly on target for final rule implementation in September after a few public meetings through the summer. The deadline has moved twice since the original date of October 2025, but once it’s finally set in stone, CISA will require reporting incidents within 72 hours and ransom payments within 24 hours. It’s worth watching and being ready for, but don’t make any bets yet. 
• NIST modernizing the NVD: On August 17, NIST published a request for information (RFI) asking for the community’s suggestions to help modernize the National Vulnerability Database (NVD). That includes making it machine-readable and better positioned for a cybersecurity landscape shaped by AI. Comments are open until October 13, 2026. 
• Cl0p’s exploitation of PTC Windchill: Throughout mid-August, the Cl0p ransomware group used CVE-2026-12569, an RCE for unauthenticated users in the PTC Windchill PDMLink and FlexPLM product lifecycle management software, to exploit around 50 organizations. Cl0p stole image files, documents, blueprints, project files, databases, and more from well-known companies such as Shell, Philips, Fiserv, Toast, and Zebra Technologies.

Closing thoughts

August is your reminder that trust boundaries (not just permissions granted) are the things worth auditing right now. The assumption that a human is the final check before something executes in your architecture is gone. The audit that matters now isn’t who has access, but what someone’s allowed to do once they’re in, and whether anything stands between them reading only and taking action. 

September already has its own reckoning lined up: CIRCIA’s clock is ticking toward a final rule, and that’s going to bring a whirlwind of governance conversations. NIST also wants your input on the NVD by October. 

To stay informed between our monthly wrap-ups, you can get the latest from the Sysdig TRT on our blog or follow my bi-weekly security newsletter musings on LinkedIn. 

‍