AI Agents Are the New Attack Target — And It Already Happened in Thailand
Friday, July 24, 2026 · 5-minute read
CISA and BleepingComputer both flagged this one today. A Russian state-backed group called Laundry Bear — also known as Void Blizzard — is actively breaking into organizations that use Zimbra Collaboration email servers. The attack combines old-fashioned phishing with exploitation of a now-patched software flaw — meaning unpatched servers are sitting ducks. If your organization runs Zimbra, updating immediately is not optional.
↗ BleepingComputerSomeone rented a server, loaded up an open-source AI assistant called Hermes, turned off its safety guardrails, and pointed it at Thailand's Ministry of Finance — the agency that runs the country's taxes and treasury. The AI agent then crawled through the ministry's network on its own, looking for weaknesses and digging through staff personnel records going back to 2012. The attacker accidentally left their own logs exposed on the internet, which is how security researchers discovered what had happened. This is one of the first confirmed real-world cases of an autonomous AI agent being used as a hands-off hacking tool.
↗ The Hacker NewsResearchers at Spur found that over 42% of apps available on LG smart TVs quietly turn your television into a residential proxy — meaning strangers' internet traffic flows through your TV and your home network. LG has now told app developers to remove this feature or face removal from the store. Samsung's Tizen TV platform had the same problem in more than a quarter of its apps. You don't need to do anything — but it's a reminder that your TV is a computer, and not every app on it has your interests at heart.
↗ Krebs on SecurityCriminals are running ads on Bing that look like legitimate promotions for Claude, Anthropic's popular AI assistant. The ads lead to a fake installer that drops a piece of malware called SectopRAT onto your machine. What makes this especially sneaky: the fake page is hosted on the real Claude.ai domain, making it look completely legitimate at first glance. SectopRAT is a remote access trojan that gives attackers full control of your computer.
The Clop ransomware gang has launched a new campaign targeting companies using PTC Windchill and FlexPLM — software widely used in product manufacturing and supply chain management. Clop isn't encrypting files this time; they're stealing data and threatening to publish it unless companies pay up. Internet-facing installations of these products are the primary target. If your company uses either of these platforms and they're accessible from the web, that's a serious risk right now.
Researchers at XBOW found that sending a specially crafted image file to Bing's image search could run commands as the most powerful user on Microsoft's own servers — the equivalent of handing a stranger the master keys to the building. A companion flaw, CVE-2026-32191, also rated 9.8, gave the same level of access on the Linux servers in the same system. Both flaws sat inside Bing's image-processing infrastructure, not on a single machine.
Status: Already fixed on Microsoft's servers — no action needed from users. Microsoft patched both silently in March 2026; XBOW published the technical details yesterday after holding them back at Microsoft's request.
A nine-year-old bug nicknamed RefluXFS was found hiding in the Linux kernel. Someone who already has basic access to a Linux machine could use this flaw to quietly upgrade their own permissions and gain full root — essentially becoming the administrator of the entire system. This type of flaw is known as a privilege escalation vulnerability.
Status: Patch available. Linux users and sysadmins should apply the latest kernel updates for their distribution as soon as possible.
Critical flaws in the wp2shell WordPress plugin are being actively exploited to install webshells on vulnerable websites. Once a webshell is in place, attackers can run commands on the server, steal data, or use the site to attack visitors. WordPress site owners who have this plugin installed are at immediate risk.
Status: Update or remove the plugin immediately. If you manage a WordPress site, log into your dashboard and check your installed plugins today.
Security researchers at BleepingComputer spotted a new remote access trojan called Dolphin X that claims to use an AI-powered scoring system to rank infected computers by how valuable the victim is likely to be. Instead of treating every compromised machine equally, it profiles users — looking at job titles, files, and installed software — and tells the criminal which targets to focus on first. This is a significant shift: it means attackers can work smarter, concentrating their effort on executives, accountants, or anyone with access to sensitive data. The tool is not yet widely deployed, but its existence signals where criminal malware is heading next.
XBOW is an autonomous offensive security startup whose AI-powered testing platform discovered both critical Bing vulnerabilities covered above. Rather than waiting for human researchers to manually probe systems, XBOW's tool continuously hunts for flaws at scale — and then reported them responsibly to Microsoft. This is the same approach Microsoft's own executives have acknowledged: AI is now finding vulnerabilities faster than humans ever could, which is why Microsoft's monthly patch releases have nearly tripled in size. XBOW's work is a glimpse at how the security industry is racing to use AI for defense before attackers use it exclusively for offense.
Imagine clicking what looks like a normal ChatGPT link your colleague sent you — and silently handing an attacker a fully authorized AI employee inside your company's systems. That's exactly what the AgentForger vulnerability made possible, and it's a preview of a whole new category of security threat that most organizations aren't ready for.
Here's what happened. Researchers at Zenity Labs found a critical flaw in ChatGPT's Workspace Agents — the feature that lets companies build and deploy AI agents that can take actions on their behalf. The bug was a cross-site request forgery (CSRF) flaw. In plain terms: a specially crafted link could hijack the ChatGPT Agent Builder on behalf of whoever clicked it. Without any further interaction, it would silently create a new AI agent — running with that employee's real permissions, with its safety approvals switched off — ready to carry out whatever the attacker programmed it to do. All from a single link click.
For regular people, the immediate risk from AgentForger is gone — OpenAI fixed the flaw on June 8, 2026. But the broader lesson is important. As companies rush to adopt AI agents that can send emails, read files, book meetings, and make purchases on employees' behalf, each of those agents becomes a new door into the organization. A compromised AI agent with a real employee's access is, in many ways, more dangerous than a compromised account, because agents are designed to act autonomously and quietly — exactly the behavior an attacker wants.
Watch for more vulnerabilities like this. Security researchers are only beginning to understand how agentic AI platforms can be abused. The Hermes attack on Thailand's Finance Ministry — covered above — is the real-world version of what AgentForger made theoretically possible. The era of AI-powered hacking has started, and the targets aren't just data — they're the AI systems companies are handing the keys to.