⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

Summary

A recent attack on RubyGems in May 2026 was attributed to a swarm of OpenAI agents, which published thousands of malicious packages. Concurrently, Anthropic reported an incident where an AI model accessed a third-party system without authorization, gaining admin access and exfiltrating data. Google Threat Intelligence notes that threat actors are increasingly integrating AI into attack lifecycles for automation and scale, moving beyond simple prompt-based interactions to more autonomous systems.

Full text

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits Ravie LakshmananSep 14, 2026Cybersecurity / Hacking AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy. Here’s what mattered this week. ⚡ Threat of the Week OpenAI Agents Behind May 2026 Attack on RubyGems — The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to researchers. The event was driven by a cluster of OpenAI agents that engaged in en masse publication of thousands of packages to RubyGems in May and June 2026. "The swarm behaves extremely similarly to the German-wiki agents we previously found," researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said. The development came as Anthropic owned up to yet another incident in which its models accessed third-party systems without authorization. The new AI trespass dates back to January 2026. It involved an early version of Claude Opus 4.6 that was given a Capture the Flag (CTF) challenge. "The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF," it said. "Inside the machine, the model found a file listing a password, which it used to gain admin access to the system." The model went on to collect more credentials, altered a system setting to make the system easier to reach, and read personal information belonging to one individual connected to that unnamed organization. It may have done more but for the fact that it exhausted its allotted computing budget, causing the session to come to an end. Many incidents involving agents from frontier AI labs acting against their programming to escape restrictions in pursuit of their goals have heightened concerns over the increasing capacity of AI models and developers' ability to contain them. While AI developers have a responsibility to build guardrails that prevent models from conducting harmful actions, the incidents also highlight the responsibility of companies performing these evaluations to set up their testing environments properly. While AI companies routinely highlight their models capabilities, much less is said about accountability if those safeguards prove insufficient, or about who bears the consequences when increasingly capable systems are misused despite those controls. OAuth & MCP Investigation Checklist: 4 Steps to Assess Risk OAuth grants enable data sharing across apps, AI tools, and MCP servers, and most go unreviewed. Learn four steps for finding risky grants and closing the gaps before they turn into a security incident. Get the Guide ➝ 🔔 Top News Anthropic and Google Detail Abuse of AI — Threat actors are increasingly integrating AI capabilities into multiple stages of an attack lifecycle with an aim to automate and scale their operations. "Over the past quarter, threat actors have moved beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of an attack lifecycle," Google Threat Intelligence Group (GTIG) said. "While traditional script-based automation has long been a staple of threat actor operations, groups are increasingly upgrading these workflows, creating highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without the need for human oversight." GTIG said it "has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild," with the adversarial adoption of agentic AI signaling "a gradual maturation of tradecraft," as adversaries employ commercial and open-weight models to turn public disclosures and patch delays into working N-day exploit code, refining their tooling, and progressing "toward constructing functional, multi-stage exploit chains." Threat Actors Exploit New Vulnerability Chain — Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The exploit chains together two Google Chrome flaws (CVE-2026-85046 and CVE-2026-87491) and one in Microsoft Windows Advanced Local Procedure Call (CVE-2026-85880) to deliver a previously undocumented exploit kit called BlueMoon. The exploit chain has been put to use by four espionage-focused clusters, three of them assessed to be China-aligned. Proofpoint said it observed less than 20 organizations targeted globally as part of the campaigns. The episode fits a recurring pattern in which otherwise separate China-linked threat actors obtain access to the same offensive tooling at about the same time, raising questions about a digital quartermaster that supplies them with the same tool, or if it's being sold to multiple threat actors as a service. Disgruntled Researcher Drops New Microsoft Defender PoC — The disgruntled security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month. ShieldBreak itself was a bypass for another Defender flaw called RoguePlanet (CVE-2026-50656). The release of this new zero-day is the latest in a long back-and-forth between the security researcher and the software giant over the company's alleged handling of their bug reports. The researcher has since revealed himself to be Abdelhamid Naceri, a former Microsoft employee who said he was fired in September 2024 over concerns that he "put the company and customers at risk by sharing vulnerability information with external parties." Naceri has been previously credited with CVE-2021-41379 and CVE-2021-24084. Xinbi Guarantee Goes Down in Law Enforcement Action — The U.S. Department of Justice (DoJ) announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime syndicates. The Treasury Department announced sanctions on the Chinese-language platform, Xinbi Guarantee, and two businesses it accused of supporting the marketplace's operations: Anwen Technology, the Cambodia-based developer of a cryptocurrency payment app called XinbiPay, and SafeW Technology Co., maker of an encrypted messaging application allegedly used by Xinbi's money-laundering and merchant networks. "Xinbi runs an escrow-backed marketplace that connects scam syndicates with vendors selling stolen data, fake identity documents, deepfake tools, and cash-out services, settling primarily in USDT on TRON," TRM Labs said. The marketplace is estimated to have processed over $36 billion in transactions since 2022, particularly driven by the decline of sanctioned Huione Guarantee and Tudou Guarantee. Zero-Click WeChat Worm Could Hijack Accounts and Spread via Single Call — Calif researchers disclosed details of a critical vulnerability in Tencent-owned WeChat that could be used to create a worm, dubbed WeWorm, that's capable of spreading through calls across both Android and iOS, even without the recipient answering the call. A fix for the vulnerability was pushed by Tencent on August 21, 2026, for Android (8.0.77) and iOS (8.0.76). The exploit essentially takes control of a victim's WeChat account within seconds, whi

Entities