Your AI Work Assistant Can Be Hijacked — Plus a Perfect-10 Database Zero-Day
Saturday, August 8, 2026 · 5-minute read
Connor Riley Moucka, a 26-year-old from Ontario, has pleaded guilty to hacking and extorting more than 165 organizations that used cloud provider Snowflake. His crew stole call and text records from over 100 million AT&T customers, plus financial data, passport numbers, and Social Security numbers from victims including TicketMaster, Neiman Marcus, and Lending Tree. Moucka and his co-conspirators pocketed over $2.5 million in ransom — and in at least one case, he went back and extorted the same victim a second time.
↗ Krebs on SecurityA cyberattack disrupted IT systems at three North Carolina port facilities — Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The Port Authority confirmed the incident slowed operations, though it has not said who was responsible or what data, if any, was accessed. Port infrastructure attacks are a growing concern because they can ripple into supply chains far beyond the immediate target.
↗ BleepingComputerSwitzerland's federal IT office says attackers exploited vulnerabilities in its Microsoft SharePoint servers and compromised roughly 200 accounts. The breach affects the Swiss federal government's internal collaboration systems. No specific group has been named publicly, and the investigation is ongoing.
↗ BleepingComputerA maximum-severity flaw in Metabase — software many companies use to visualize and explore their data — is being actively exploited right now. An attacker who finds your Metabase instance online doesn't need a username or password. They can inject malicious SQL commands and instantly gain full administrator control. From there they can steal database credentials, read all connected data, and change your configuration. The breach has already hit real companies: Framework and Tally have both confirmed they were affected. Metabase Cloud has been patched automatically, but anyone running a self-hosted instance needs to act immediately.
New research presented at Black Hat USA 2026 shows that specially crafted emails can break out of their message boundaries and interfere with the webmail app you're using to read them. On Outlook with Firefox, an email can pop up a fake Microsoft sign-in screen and capture whatever password you type. On Yahoo and AOL, an attacker can grab a login token for your Medium account and sign in as you. On Gmail, a chain involving prompt injection can steal a Slack token. Affected providers include Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These are proof-of-concept findings — no confirmed malicious use yet — but public demo code is available, meaning criminals can study it.
Anyone on the internet can send a specially formed request to a Metabase server and gain full administrator access — no login needed. The flaw is a SQL injection bug. With admin access, an attacker can steal stored database passwords, read all data those databases contain, and alter system settings. Metabase confirmed it was hit as a zero-day — meaning attackers found and used it before a fix existed.
Status: Patch available. Metabase Cloud updated automatically. Self-hosted users must apply the patch manually now.
Progress Kemp LoadMaster is a load balancer used by enterprises to keep their web services running smoothly. This flaw lets an attacker who has never logged in send a crafted request that runs any command they want on the device. CISA added it to its Known Exploited Vulnerabilities list after 792 reported exploit attempts. The bug lives in a function that was supposed to safely handle user input but doesn't.
Status: Patch available from Progress. CISA has flagged it as actively exploited — federal agencies must patch by deadline, and all organizations should treat this as urgent.
N-central is Remote Monitoring and Management (RMM) software — the kind IT service providers use to manage hundreds of client computers at once. Attackers have already used this flaw to break into managed systems and establish a persistent foothold, meaning they can come back even after a restart. N-able confirmed unusual activity in a customer's environment on July 31, leading to the discovery. A second hotfix (Hotfix 2) has now been released and supersedes the first — you need this one even if you already applied Hotfix 1.
Status: Hotfix 2 available. Apply immediately even if Hotfix 1 was already installed. All versions prior to 2026.3.1.7 are affected.
Security researcher Pedro Falé at Bitsight registered an expired domain name and used it to peer inside a sprawling ad fraud operation. Cheap Android TV streaming boxes — specifically the popular H96 brand, sold on Amazon — were secretly pretending to be mobile phones and clicking fake ads on AI-generated websites. Bitsight traced the operation back to a mainland China company called Zhejiang Fengwo IoT Technology, which runs the ad-publishing network that profits from the fake clicks. The technique of registering expired command-and-control domains to expose malware operations is a powerful and inexpensive research method that more firms are now adopting. If you own one of these cheap streaming boxes, it may be quietly committing ad fraud on your home internet connection.
Imagine hiring an assistant who follows any written instruction they find on your desk — even notes left there by strangers. That's roughly the problem security researchers discovered with Atlassian's Rovo, an AI assistant built into Jira and Confluence. Two separate security firms found, independently, that they could trick Rovo into collecting sensitive internal data and shipping it to an attacker's server outside the company.
The first firm, PromptArmor, hid malicious instructions inside a file that Rovo reads. That was enough. The AI dutifully gathered whatever internal data the logged-in user had access to — project notes, tickets, documents — and sent it out via a web request, without asking anyone's permission. No extra steps required. The second firm, Varonis, took a different route: they embedded instructions in a link. When an authenticated employee clicked that link, Rovo's chat interface was preloaded with attacker-controlled instructions and the attack played out the same way. This class of attack is called prompt injection, and it's quickly becoming one of the most serious risks in enterprise AI tools.
What makes this particularly unsettling is the blast radius. Jira and Confluence sit at the heart of how most software companies and large organizations operate. They store product roadmaps, security documentation, HR processes, source code discussions, and internal communications. An employee with broad access who uses Rovo is essentially handing an attacker a guided tour of everything they can see. Atlassian confirmed that one of the two attack paths has been closed. The other — PromptArmor's file-upload route — has not been publicly confirmed as fixed as of today.
This story is bigger than Atlassian. Microsoft Copilot, Google Gemini in Workspace, and every other AI assistant embedded in productivity software faces the same fundamental problem: AI models are designed to be helpful and follow instructions, and they can't always tell the difference between instructions from their employer and instructions planted by an attacker. Watch for vendors across the industry to start publishing their own prompt injection disclosures in the months ahead — and if your organization uses AI assistants inside work tools, ask your IT team what guardrails are in place to prevent exactly this kind of data leak.