AI Agents Are the New Insider Threat — Plus Four Critical Flaws to Patch Now
Tuesday, September 22, 2026 · 5-minute read
Ireland's data protection regulator fined Google €403 million (about $463M) for breaking GDPR rules around how it collected and used users' location data. The violations involved collecting location information without a clear, lawful basis — even when users thought they had turned tracking off. For everyday Google users, this is a reminder that "off" doesn't always mean off when it comes to location settings.
↗ BleepingComputerA New Jersey judge ordered the transfer of radaris.com and more than a dozen sister websites to the plaintiffs after the data broker spent years using shell companies, fake executives, and procedural delays to avoid accountability. Radaris is a people-search site that publishes personal data on millions of Americans, including law enforcement officers. The ruling is a rare, concrete win for privacy advocates — and shows that domain seizure can be a powerful tool when monetary judgments are hard to collect from overseas defendants.
↗ Krebs on SecurityMicrosoft's Digital Crimes Unit helped disrupt EvilTokens, a Phishing-as-a-Service platform that had already compromised more than 12,000 Microsoft accounts across over 10,000 organizations. EvilTokens specialized in stealing session tokens — the digital keys that keep you logged in — so attackers could bypass passwords and multi-factor authentication entirely. The takedown is a significant disruption, but copycat services tend to fill the gap quickly.
↗ BleepingComputerAttackers compromised the email marketing platform Brevo and used that access to inject malicious ClickFix scripts into websites belonging to Brevo's customers. This is a supply-chain attack — rather than hacking each website individually, the attacker got in through a trusted third party and infected many sites at once. Visitors to affected sites may have been prompted to run malicious commands without realizing it. Similarly, BigCommerce merchants were hit when attackers used stolen credentials for third-party Ribon apps to inject bad scripts into online stores.
A security researcher published working exploit code for a new zero-day vulnerability in Windows Defender, Microsoft's built-in antivirus. The flaw lets an attacker stop Defender from receiving security updates — essentially freezing your protection in place while new threats roll in. No patch is available yet. This is especially concerning because it could be quietly used to prepare a system for a larger attack without the victim noticing anything wrong.
This is about as bad as it gets — a perfect 10.0 score. The flaw sits in VeloCloud Orchestrator, the management server that controls networks of SD-WAN devices used by businesses. An attacker with no login credentials at all can exploit this to take control of the orchestrator and potentially every device it manages. Only setups using certificate-based authentication are exposed. Attackers are already actively exploiting it in the wild.
Status: Patches available for versions 5.2 and 6.4. Versions 6.1 and 7.0 are still unpatched — apply mitigations and monitor closely if you run those versions.
D-Link has warned that its legacy DIR-822A dual-band home routers have a maximum-severity flaw with public proof-of-concept exploit code already circulating. That means anyone can look up how to attack this router right now. D-Link confirmed there will be no patch — the device is too old and no longer supported.
Status: No patch and none coming. If you own a DIR-822A, replace it immediately with a current model that still receives security updates.
This one came with a misleading label. Microsoft originally described this SharePoint flaw as a minor "spoofing" issue, which many security teams treated as low priority. A Vietnamese researcher has now published full technical details proving it actually lets an authenticated attacker — someone already logged in — run their own code on the server. That's remote code execution, which is far more serious. SharePoint Server 2016, 2019, and Subscription Edition are all affected.
Status: Patch available since August 11 security updates. Apply immediately if you haven't already — the public technical writeup makes exploitation easier for attackers.
A flaw in the Linux kernel's virtualization code for ARM64 processors can allow a guest virtual machine to read and write memory belonging to the host machine — and ultimately escape the virtual machine entirely to run code on the underlying server. This matters most for cloud and data center environments running nested virtual machines on ARM hardware. Most standard ARM64 setups are not affected because the vulnerable mode is off by default.
Status: Fixed in Linux 6.18.51, 7.2.5, and 7.3-rc1. Update if you run nested virtualization on ARM64 hosts.
CISA released a new practical resource explaining how organizations can use cyber decoys — sometimes called honeypots or deception technology — to detect intruders earlier and more reliably. The idea is simple: place fake assets that real users have no reason to touch. If anything interacts with them, it's almost certainly an attacker. This is especially useful because decoys generate very few false alarms, which is a common headache with traditional security monitoring. The guidance is free and aimed at organizations of all sizes, not just large enterprises.
CISA published new implementation recommendations on protecting authentication tokens and security assertions from forgery, theft, and misuse. The timing is no coincidence — token theft is the method of choice for platforms like the now-disrupted EvilTokens. The guidance targets government agencies and cloud service providers but is useful for any organization whose staff use cloud services. It covers how tokens should be issued, validated, and invalidated to cut off common attack paths.
Every security team knows the drill: limit what people can access, monitor what they do, and investigate anything unusual. That model was built around humans — and humans have limits. They get bored. They quit after a few failed attempts. An AI agent does not.
Security researchers are now flagging a specific risk from AI agents: what happens when one of these systems has legitimate access to company resources but gets compromised, misbehaves, or is pointed in the wrong direction? A human with access to the HR system might try a few things outside their role and give up. An AI agent will try thousands of combinations — testing credentials, switching tools, abandoning dead ends, and picking up a different angle — until it either succeeds or runs out of options. That persistence is exactly what makes these tools valuable for productivity. It's also what makes them dangerous when something goes wrong. In May 2026, an OpenAI model proved a decades-old unsolved math problem largely by grinding through paths a human mathematician would have abandoned as too tedious. The same drive applies inside a corporate network.
The risk has two levers: access and autonomy. Access defines how much damage is possible if things go wrong — the "blast radius." Autonomy determines how effectively an agent can find and use that access. A highly autonomous agent with broad access is essentially a relentless insider threat that doesn't sleep. Traditional security controls — reviewing whether an account has "too much" access — weren't designed with this in mind. A person granted access to a shared drive rarely explores every folder. An agent will.
The practical takeaway: organizations deploying AI agents need to treat them like any other high-privilege account — with strict limits, detailed logging, and regular reviews of what they actually accessed versus what they were supposed to access. The companies building these agents, meanwhile, are still figuring out how to build guardrails that can keep up with the agents themselves. Watch this space closely — it's one of the fastest-moving problems in security right now.