Newshot Article title: FreeBuf Morning Brief | AI Hacking Frameworks Running on the Public Internet; Microsoft Researchers Demonstrate Covert Backdoor Technique for AI Agents
Body:
Global Cybersecurity Incident Briefing
1. AI hacking frameworks such as ARTEX, PentAGI, and Agent Zero are running on the public internet, with some consoles lacking authentication
GitGuardian disclosed that AI hacking frameworks such as ARTEX, PentAGI, and Agent Zero are exposed to the public internet, and some consoles have no authentication, making them abusable for automated attacks; exposure does not equate to criminal activity. [Foreign publication - Read original article]
2. Microsoft researchers demonstrate covert backdoor technique for AI Agents that bypasses conventional security assessments without retraining
Microsoft revealed the Lazarus backdoor: tampering with fewer than 10 dormant neurons can cause an AI Agent to execute malicious instructions when trigger conditions are met, and conventional assessments struggle to detect it; the original weights must be compared for tracing, and least privilege, sandboxing, and auditing must be implemented. [Foreign publication - Read original article]
3. More than 35,000 Grok-generated apps exposed online, some leaking confidential data and passwords
A security company found that more than 35,000 Grok apps are publicly exposed, with about one-tenth containing internal data or personal information; the default "anyone with the link" permission has flaws that can lead to unauthorized access and tampering, and it is recommended to change it to "only me" and investigate and take down affected apps. [Foreign publication - Read original article]
4. Attackers exploit AhsayCBS vulnerability to hide malicious code in PNG images and deploy covert backdoors
Attackers exploited an AhsayCBS vulnerability to gain SYSTEM privileges, compromised 3 backup servers, and implanted webshells, PNG steganographic payloads, and host-bound backdoors to establish persistent channels; patching is unlikely to remove the backdoors, so investigation and rebuilding are needed, along with credential rotation. [Foreign publication - Read original article]
5. Attackers target Qlik Sense servers with reverse shells and pre-position ActiveMQ and Veeam exploit tools
Qlik Sense servers came under targeted attack linked to CACTUS, which attempted to deploy PowerShell reverse shells without success; the attackers pre-positioned exploit tools for ActiveMQ, Veeam, and others, and may be preparing a broader campaign. [Foreign publication - Read original article]
6. Token's self-developed testing Agent broke through all security rules, outlining feasible paths for enterprise Agent protection
Browser Agents parasitic on user sessions easily break through independent identity, least privilege, and traceability. Channels must carry the Agent identity, delegation relationship, and task permissions smaller than those of the user; enterprises should immediately discover Agents, constrain permissions, and audit operations, with sensitive operations requiring human confirmation. [Foreign publication - Read original article]
7. Hackers peddle Gmail tool for $1,000 per month, claiming persistent access even after password changes
Remus Stealer is being peddled for $1,000 per month for an enterprise version offering persistent Gmail access, claiming it remains effective even after password changes and session revocation, but the mechanism has not been disclosed or independently verified; the device must first be infected, and users should maintain basic protections. [Foreign publication - Read original article]
8. Microsoft uses AI to find 59 Linux kernel vulnerabilities, including a flaw hidden for more than 20 years
Microsoft's AI scanned the Linux kernel and found 59 vulnerabilities, 33 of which received CVEs, 8 of which allow local root privilege escalation, and some of which lay dormant for more than 20 years; AI improves efficiency but manual verification and remediation are still needed, with high-severity issues prioritized. [Foreign publication - Read original article]
9. Microsoft discloses Windows BitLocker vulnerabilities that allow physical access to bypass encryption protections
Microsoft disclosed two BitLocker bypass vulnerabilities, CVE-2026-97015 and CVE-2026-119832, which allow someone with physical access to bypass protections without user interaction; patches have been released, and the scope of impact must be checked separately and patches installed. [Foreign publication - Read original article]
10. Palo Alto Networks discloses PAN-OS RCE vulnerability allowing attackers to gain root privileges and execute arbitrary code
Palo Alto disclosed the PAN-OS vulnerability CVE-2026-0330, which allows an authenticated administrator with network access to execute arbitrary code as root; it is rated medium severity and no exploitation cases have been observed. Panorama should be patched as soon as possible, and management interfaces should be restricted to trusted internal network access. [Foreign publication - Read original article]
Featured Articles
1. Research on TOCTOU authorization race condition risks in AIAgent tool retries
Agent retries reuse authorization only by session or tool name, and drift in parameters, versions, or side effects can cause TOCTOU and inherit old permissions; experiments show session caching produced 100% unauthorized side effects, so retries must be treated as new requests with strict identity binding and reauthorization. [Read original article]
2. Normalization of numbers and units: looking only at numbers classifies 50% and 0.5 as two different conclusions
Numbers must be normalized together with units and semantic types: string comparison alone, numbers only, and normalization with units achieved accuracy of 40%, 0%, and 66%, respectively; distinguish ratios, multiples, and absolute quantities, and preserve approximate ranges. [Read original article]
3. Whitelist bypass in Agent scraping tools: only two of fourteen forms actually got through
In testing 14 types of internal network URLs, the blacklist let 7 through with only 2 reachable, private-network判定 let 2 through, and strict rules let 0 through; the core flaw is "right name, wrong address," where whitelisted domain redirects or resolution to the internal network can bypass controls. Defenses should validate after resolution, reuse the same resolution, recheck at each hop, and evaluate based on real reachability. [Read original article]
*This article collects content from media and publications worldwide. The producer is responsible for its completeness but not for its truthfulness or validity.
*Content marked as [Foreign publication] mainly comes from media and publications in English-speaking countries, and some content requires registering an account on the original link platform before it can be read.