AI Weakly #15 - "When AI Meets Zero-Days: The New Offensive Security Era"
AI Weakly is the weekly newsletter for those who make decisions on AI and security without time to waste. Every Tuesday: the facts that matter without the noise.
Issue #15
Top Story —
Week 33 serves up a masterclass in why perimeter security is dead: researchers demonstrated critical reasoning-trace extraction from Anthropic, OpenAI, and Google APIs; Lazarus deployed a Windows zero-day against defense contractors; and Kimsuky stood up an offline AI stack to automate phishing and malware without touching public LLMs. Meanwhile, three critical vulnerabilities (VMware vCenter CVE-2026-59310, SAP Commerce CVSS 10.0, SharePoint CVE-2026-55040) are under active, widespread exploitation. The pattern is clear: enterprises patching like it's 2015 while adversaries operationalize AI and zero-days in hours, not months.
Weakly Digest —
01 —
Stealing Reasoning Traces from Proprietary LLM APIs—Shared Encryption Keys Enable Model Jailbreaking at Scale
🟣 AI/supply chain vulnerability
Researchers discovered that encrypted reasoning traces from frontier LLM APIs (Anthropic, OpenAI, Google) could be extracted and replayed across models using shared encryption keys, enabling adversaries to jailbreak weaker sibling models with stolen proprietary reasoning. The vulnerability represents a fundamental architectural flaw in LLM provider security posture affecting all organizations relying on these APIs for sensitive workloads.
EDITOR’S NOTE
If your enterprise uses OpenAI, Anthropic, or Google LLM APIs for sensitive analysis (legal, financial, R&D), you cannot assume reasoning traces are protected. Immediate actions: (1) audit what data you're submitting to LLM APIs; (2) assume all reasoning is potentially recoverable; (3) escalate to your LLM provider for encryption-key isolation guarantees; (4) consider local/private LLM deployment for genuinely sensitive tasks. This is not a patch—it's an architectural problem.
02 —
Lazarus Exploits Windows Zero-Day to Deploy Backdoor Against Defense and Aerospace—Operation Dream Job Escalates
🔴 Critical / active exploitation
Lazarus Group exploited a Windows zero-day vulnerability to gain SYSTEM-level access and deploy a novel backdoor against defense and aerospace organizations across multiple countries as part of Operation Dream Job. The attack demonstrates nation-state-grade infrastructure targeting against critical sectors with no patch available.
EDITOR’S NOTE
Defense, aerospace, and supply-chain contractors: assume your Windows infrastructure is under active targeting. Zero-days cannot be patched. Implement immediate compensating controls: (1) segment defense networks from corporate IT; (2) deploy EDR/XDR with behavioral anomaly detection for SYSTEM process execution; (3) hunt for unusual child processes spawned from system services; (4) brief your incident response team on backdoor indicators specific to Lazarus tooling. This is an existential threat to critical infrastructure.
03 —
Malicious LiteLLM Releases Stole Credentials from 2,100+ Organizations—Supply Chain Compromise of AI/ML Libraries
🟣 Supply chain / credential theft
Malicious LiteLLM packages on PyPI harvested cloud keys, SSH credentials, Kubernetes tokens, and database passwords from 2,100+ organizations within a 40-minute window before removal. The compromised libraries demonstrate critical supply chain risk in widely-used AI/ML dependencies.
EDITOR’S NOTE
Every organization running LLM/GenAI applications likely has LiteLLM or similar AI libraries in their dependency tree. Immediate actions: (1) audit your requirements.txt/poetry.lock for LiteLLM versions deployed in March 2024 or any suspicious releases; (2) rotate all credentials that could have been exposed (cloud keys, SSH, K8s tokens, DB passwords) on affected systems; (3) implement software composition analysis (SCA) with real-time notification for high-risk packages; (4) restrict PyPI package installation to vetted, pinned versions only. This is not theoretical—2,100 organizations were already compromised.
04 —
Global VMware vCenter Campaign—CVE-2026-59310 Under Active Exploitation with Patching Insufficient
🔴 Critical / active exploitation
A global threat campaign is actively exploiting CVE-2026-59310, a critical directory-traversal vulnerability (CVSS 9.8) in VMware vCenter enabling remote code execution and persistent access to data center infrastructure. Patching alone is insufficient; compensating controls and threat hunting are required.
EDITOR’S NOTE
VMware vCenter is foundational to 90% of enterprise virtualization deployments. This is an immediate, active threat. Required response: (1) patch vCenter immediately if you haven't already—this is not negotiable; (2) implement network-level isolation for vCenter management interfaces (restrict access to authorized admin networks only); (3) enable vCenter API audit logging and hunt for suspicious directory traversal patterns; (4) assume breach and hunt for persistence indicators (suspicious user accounts, SSH keys, privilege escalations). If your vCenter was exposed to the internet, you must assume compromise.
05 —
Kimsuky Builds Offline AI Stack to Automate Phishing and Malware—Nation-State AI Infrastructure Operationalized
🟣 Nation-state threat / offensive AI
North Korea's Kimsuky threat group has deployed offline AI infrastructure to enhance phishing campaigns and automate malware development, eliminating reliance on public LLM APIs and integrating RAG capabilities with stolen documents directly into malware tools. The group represents the first operational example of nation-state offensive AI automation at scale.
EDITOR’S NOTE
This is the first confirmed case of a nation-state operationalizing offline AI for offensive purposes. Your phishing detection and OSINT capabilities are now obsolete. Required actions: (1) assume all phishing emails from now on may be AI-generated with domain-specific context—email security rules based on typo/grammar detection are dead; (2) update security awareness training to focus on behavioral anomalies rather than stylistic indicators; (3) deploy AI-based anomaly detection on email and endpoints; (4) if you're in financial services, critical infrastructure, or defense, assume you're being targeted with AI-enhanced spear phishing; (5) brief your SOC that Kimsuky tooling now includes AI-assisted malware development—expect polymorphic, targeted payloads. This is a step-change in adversary capability.
Also worth reading —
Max-Severity SAP Commerce Cloud RCE Already Under Active Exploitation—Patch Immediately — If you run SAP Commerce Cloud, patch now—weaponization happened within 72 hours of patch release.
SharePoint CVE-2026-55040 Authentication Bypass Enables Unauthenticated RCE—Active Exploitation Underway — Unauthenticated remote code execution with admin impersonation—patch your SharePoint deployment today.
Metabase Zero-Day Grants Unauthenticated Remote Admin Access—No CVE, No Patch Available — Metabase instances exposed to untrusted networks face immediate compromise—implement network segmentation now.
Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA—Critical Infrastructure at Risk — Patch Fortinet VPNs and audit your MFA implementation—ransomware groups are actively bypassing legacy controls.
City-Forum Campaign Targets Salesforce and ServiceNow Since March 2025—Long-Running SaaS Compromise — Audit your Salesforce/ServiceNow access logs for suspicious API authentication and data exports.