Skip to main content

Am I a Target? AI agents turn up inside a supply-chain attack — and the discipline to say when they don’t

Am I a Target?
Daily Cyber Brief
MONADNOCK CYBER  •  Monday, September 15, 2026  •  Honest broker · no FUD

What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Confirmed facts and unverified claims are labeled throughout.

Featured · AI in the kill chain
● AI-linked · intent disputed

AI agents turn up inside a supply-chain attack — and the discipline to say when they don’t

The freshest case of AI in the kill chain is a software-supply-chain campaign that researchers have linked to a swarm of OpenAI agents[1]. Dubbed GemStuffer and surfaced September 12, it uploaded 2,000+ malicious packages to RubyGems, abused an account-handling flaw to spin up hundreds of publisher accounts, and gained remote code execution on RubyDoc’s servers through the YARD documentation-build pipeline — then used that foothold to scrape target sites and pack the stolen data back into gems.

The nuance is the story: OpenAI acknowledges the agents were its own but calls the activity benign automation and has not explained the campaign; the malicious attribution is the researchers’, and RubyGems’ stewards say they cannot confirm the packages were AI-created. So: AI-linked and agent-driven, intent still contested — exactly the kind of claim we label rather than inflate.

AGENTIC AI LINKED ACROSS THE KILL CHAIN · “GEMSTUFFER”Researchers linked an OpenAI agent swarm to every step01Resource dev2,000+ malicious gems,hundreds of accounts02ExecutionRCE via RubyDocYARD doc build03Collectionscrape targetsites04Exfiltrationdata packed intogems, re-uploadedHonest-broker check: machine-speed ≠ AI — the Marimo 8-second pivot used NO LLM (Sysdig).Source: RubyGems/RubyDoc researchers; OpenAI acknowledges the agents, disputes intent. Surfaced Sept 12, 2026.

It lands on top of Anthropic’s early-September disclosure[2] of state and criminal actors automating intrusions with Claude — that one confirmed. Together they mark a real shift: agents and models operating across resource development → execution → collection → exfiltration.

And here is the discipline that makes this brand worth reading: not every machine-speed attack is AI. This week a human attacker exploited a Marimo notebook RCE (CVE-2026-39987)[3] and pivoted to an SSH bastion in eight seconds — and Sysdig’s researchers titled their write-up “hold the AI,” finding no LLM at any stage; it was a hand-built Python toolkit. Likewise, the researcher who tracked the Red Heron[4] campaign against 13 organizations said there is no evidence AI was used to build its exploitation framework. We flag AI in the kill chain when it is shown — and say so plainly when it isn’t.

● Act now

A perfect-10 firewall bug and a NetScaler bypass are under active attack

CISA’s Known Exploited Vulnerabilities catalog[5] added several flaws now being exploited — two you should treat as emergencies:

Cisco Secure Firewall Management Center — CVE-2026-20079 CVSS 10.0
Authentication bypass in the web interface giving an unauthenticated attacker root. Cisco reports three clusters exploiting it[6]: a state-sponsored actor (Sandworm), a Qilin ransomware affiliate, and a separate credential-theft operation.

Citrix NetScaler ADC / Gateway — CVE-2026-19490
Authentication bypass exploited in the wild since at least September 3[7] on AAA / Gateway configurations.

Also on the list: an Adobe Commerce / Magento template-injection RCE, and a JFrog Artifactory flaw chain used to plant backdoors between Aug 15 and Sept 8 — alongside last week’s ScreenConnect and MikroTik RouterOS flaws.

If you run Cisco FMC or NetScaler, patch today. A CVSS 10.0 auth-bypass-to-root on a security appliance is as severe as the score suggests.

● Our collection · claims

Leak-site tempo jumped: 73 new listings in 48 hours

Our collection logged 73 organizations added to ransomware leak sites in 48 hours — about 248 over the past week, with the United States the most-listed country. The surge is led by a large multi-country spree from TheGentlemen (a prolific ransomware-as-a-service (RaaS) crew, ~330 victims so far in 2026) and steady volume from Qilin, with smaller crews filling in. Healthcare, manufacturing, and education are prominent among the named victims. These are unverified leak-site claims[8], tracked as they post — not confirmed breaches.

● Verified · public record

The regulatory record: a verified cyber 8-K, and a telling non-filing

When a public company judges a cyber incident material, it must file an SEC 8-K under Item 1.05. The most recent we’ve found is Boston Scientific’s September 8 filing[9] (disclosing an August incident with likely material impact on results).

An honest-broker note on a name in the headlines: McKesson disclosed its August incident in an 8-K filed August 28[10] — but under Item 7.01 (voluntary Regulation FD), expressly not deemed material, rather than the mandatory Item 1.05. The distinction matters, and we don’t count a voluntary disclosure as a material-incident filing.

● Also moving

On the wire

Microsoft detailed two separate campaigns: a large financial-fraud email blast sent through third-party delivery infrastructure, and passkey-themed social engineering used to break into Microsoft 365 and cloud accounts.

Microsoft’s September updates continue to break Remote Desktop Services on Windows Server 2019/2022/2025 (Microsoft has mitigated it via Known Issue Rollback) — an operational-disruption issue, not an attack.

● Backdrop

The AI-offense debate is no longer hypothetical

GemStuffer and the Anthropic disclosures have moved the AI-in-attacks conversation from “what if” to “here is the postmortem.” Expect more real cases — and more hype attaching AI to attacks where it played no part. Our job is to hold that line: map shown AI activity to the kill chain, and refuse the FUD where the evidence isn’t there.

Bottom line

Do today: patch Cisco FMC (CVSS 10.0) and NetScaler — both are auth-bypasses under active attack. The featured shift: AI agents are turning up inside real attacks (GemStuffer, agent-linked; Anthropic, confirmed) — but stay disciplined, because a machine-speed attack this week (Marimo) used no AI at all. And the regulatory record stays quiet: Boston Scientific is the most recent verified Item 1.05.

✓ Verified before publication. Cross-checked by a three-model fact-check panel and given a final domain proof by a local cybersecurity model. Honest-broker calls this edition: GemStuffer is AI-linked but OpenAI disputes intent; the Cisco FMC third cluster is credential theft, not ransomware; McKesson’s 8-K is Item 7.01, not 1.05; the Marimo and Red Heron attacks were found to involve no AI.
Sources & references
[1] The Hacker News — GemStuffer (OpenAI agents / RubyGems)
https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html
[2] Anthropic — September 2026 threat report
https://www.anthropic.com/threat-intelligence-report-september-2026
[3] Sysdig — Marimo CVE-2026-39987 ("hold the AI")
https://webflow.sysdig.com/blog/machine-speed-hold-the-ai-hand-rolled-marimo-cve-2026-39987-exploit
[4] The Hacker News — Red Heron (Gitea RCE)
https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html
[5] CISA — Known Exploited Vulnerabilities catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[6] CISA / The Hacker News — Cisco & Citrix KEV
https://thehackernews.com/2026/09/cisa-flags-exploited-cisco-citrix.html
[7] SecurityWeek — NetScaler CVE-2026-19490
https://www.securityweek.com/critical-netscaler-vulnerability-exploited-in-attacks/
[8] ransomware.live — leak-site listings
https://www.ransomware.live/
[9] SEC EDGAR — Boston Scientific 8-K (Item 1.05)
https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/0000885725-26-000059-index.htm
[10] SEC EDGAR — McKesson 8-K (Item 7.01)
https://www.sec.gov/Archives/edgar/data/927653/000092765326000247/0000927653-26-000247-index.htm

Comments

Post a Comment

Popular posts from this blog

Am I a Target? Daily Cyber Brief MONADNOCK CYBER • Monday, September 21, 2026

Am I a Target ? Daily Cyber Brief MONADNOCK CYBER  •  Monday, September 21, 2026  •  At the intersection of AI and Security What happened in cyber in the last 24 hours — verified, graded, and stripped of hype. Confirmed facts and unverified claims are labeled throughout. ● Foreign desk · raw & unevaluated China Desk: what Beijing is saying about cyber today New this week: we’re pulling foreign-language coverage into collection. This is a first, unfiltered look — machine-translated, not yet source-graded, and it includes Chinese state media. Read it as raw signal, not a finished assessment. China is running its annual National Cyber Security Awareness Week (launched September 14, nationwide). This year’s theme centers on the “intelligent era” — AI security (“智能时代 网安护航”). Coverage across state and commercial outlets (China.com.cn [1] , Guangming, Baidu) carries these themes: AI at machine speed. A widely-run piece frames it as the “attack-and-defense battle” of ...
Post a Comment
Read more

Above the Fold What foreign press tells its own public · a Monadnock Cyber summary

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 26 September 2026 · ATF-2026-09-26 · TLP:CLEAR Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. Global Cyber Weather Report · 26 September 2026 OUTLOOK Expect increased volatility driven by AI-enabled attacks and persistent state-sponsored activity. CONDITIONS NOW Ransomware activity remains high with 235 incidents in the last seven days. Clop, thegentlemen, and qilin are the most prolific crews. A cross-cutting signal indicates AI is integrated into attacks, specifically for autonomous skimming of payment ca...
Post a Comment
Read more

Above the Fold | What foreign press tells its own public | A Monadnock Cyber summary 24 September 2026 ·

  Above the Fold What foreign press tells its own public · a Monadnock Cyber summary 24 September 2026 · ATF-2026-09-24 Most foreign-cyber reporting is written for the domestic reader. This digest reads each monitored country’s own press, in its own language, and records what it tells its own people about cyber and AI — the lede first, then the reporting: named actors, figures, sectors, official statements. Framing is the source’s; state media is identified as such; a country’s silence is itself recorded. All items are filed and cross-indexed for correlation. In this issue 01   Iran   From data theft to sabotage: Iran's banks under service-disruption attacks 02   Russia   Under siege, wearing an AI mask: NightEagle and AI-crawler disguise 03   China   National Cyber Security Week: AI Safety Governance Framework 3.0 04   European Union   Cutting the cord: Europe moves to wean its governments off US clouds 05   Brazil   Braz...
Post a Comment
Read more