Week in review: Secret stealer hits GitHub repos, Claude Code turned into remote

Security leaders face complex challenges balancing operational realities with liability concerns regarding leaked credentials and vulnerability management timelines. A recent review highlighted that many security teams delay or deprioritize vulnerability findings due to time constraints, while IT service providers in the EU have significantly extended patching times, suggesting a gap between risk disclosure and remediation. Furthermore, advancements in AI are rapidly transforming security practices; researchers are using AI agents to reverse-engineer code for systems like Slack, and entities are exploring autonomous AI tools for tasks like vulnerability testing, which introduces new accountability questions regarding AI-generated fixes. Operational technology (OT) environments are expected to remain resilient during cyberattacks, yet this expectation is tempered by uncertainty among industrial security engineers about sustained operation without degradation.
The information also points to active threat activity, evidenced by the use of malware like Cereal targeting Exchange servers and large-scale credential theft operations involving services like Gootloader and CastleRAT. Simultaneously, the development landscape shows tools advancing rapidly, with open-source orchestration platforms like Dagster emerging and foundational technologies like .NET evolving with supply chain security implications. This environment demands that organizations manage immediate operational risks while grappling with long-term systemic changes introduced by AI integration and evolving regulatory requirements like the EU Cyber Resilience Act.

* Eric Fourrier, CEO of GitGuardian, discussed leaked credentials and personal liability for security leaders and boards.
* Turla planted a modular .NET toolset on Microsoft Exchange servers in Kazakhstan and Romania to copy emails.
* Intezer researchers used AI agents to rebuild source code for Slack and Apple’s Finder from a backdoor family attributed to the Turla group.
* Nearly half of security teams at organizations with 5,000+ employees close or deprioritize vulnerability findings without full verification.
* Forty-five percent of surveyed EU IT service management providers took more than three months to apply critical patches to critical systems.
* The EU Cyber Resilience Act reporting obligations start in September 2026, requiring a register of product versions still in use.
* SANS 2026 ICS/OT survey respondents indicated that 38 percent expect to run indefinitely on islanded ICS/OT systems during a full IT compromise.
* Darktrace researchers turned Claude Code into a remote-controlled implant by steering the coding agent through Anthropic’s platform.
* Operation Endgame malware takedown recovered over 6 million credentials stolen from infected computers.
* Attackers used an open-source AI penetration testing framework (Cairn) to run 25 operations against at least 19 organizations between August and September 2026.
* Fake Zillow pages used ClickFix NetSupport RAT to install malware on Windows computers.
* The Git project released security updates addressing six vulnerabilities related to code execution during recursive clones.
* Microsoft demonstrated a hidden backdoor technique called Lazarus in AI agents that allows them to execute attacker commands based on specific triggers.

The narrative reveals a tension between the speed of technological advancement and the inertia of institutional security practices, creating significant gaps for attackers to exploit. The theme of leaked credentials being immediately actionable—with attackers logging in within eight minutes—demonstrates that data exposure is not a long-term risk but an immediate operational vulnerability that bypasses many layered defenses. This pattern suggests that accountability structures are lagging behind the technical capabilities of threat actors, whether they are state-aligned groups deploying specific malware like Cereal or sophisticated AI agents performing reconnaissance.
The discussion around AI's role is particularly revealing. When AI can autonomously generate code and test systems (as seen with the GitHub Agentic Autofix and the Claude implant), the established lines of responsibility—who owns a faulty patch, or who is accountable for an autonomous action—become functionally obsolete. The development of frameworks like Wirken suggests a necessary response to this autonomy by building controls *around* agents rather than merely patching vulnerabilities within them. Furthermore, the simultaneous focus on supply chain integrity (e.g., .NET 11 changes) and data sovereignty indicates that the future landscape is defined less by securing endpoints and more by controlling the provenance and decision-making pathways of code and deployed assets across complex, distributed systems.
This setup implies a pattern where systemic trust—in AI agents, in vendor patching timelines, and in internal reporting structures—is being eroded by asymmetric information. The entities that benefit are those who can leverage automation to move at machine speed while organizations remain bound by slower, human-centric governance models. The challenge for cognitive sovereignty lies in developing the meta-frameworks necessary to assess risk when the tools used to generate the risk operate at a velocity far exceeding human oversight. What assumptions about control and blame do we currently accept regarding systems that are increasingly mediated by autonomous intelligence?