Microsoft: Poisoned AI Agent Tool Descriptions Can Silently Exfiltrate Company Data

Pre-auth root RCE in Progress Kemp LoadMaster (CVE-2026-8037, CVSS 9.8). An unauthenticated attacker can run arbitrary commands as root on the appliance by sending a crafted request to its API; the bug lives in an escape_quotes() routine that fails to properly sanitize input before it reaches a shell. LoadMaster is an edge-sitting application delivery controller and load balancer, which makes a pre-auth flaw especially dangerous. Progress published its advisory on June 4 and reported no known exploitation at the time; watchTowr Labs released a full exploit-chain write-up on June 29, and a patch is available. If the API is enabled, update now.

So what: The vulnerability items this week are an edge-and-ERP patch-window story — two of the three already have patches out, yet the gating question is the same one worth asking every time: do you actually know every place these systems run before the exploit window closes? The stealers and the clipper reinforce that credential and crypto theft is now the default monetization once an unauthenticated foothold exists — inventory and edge-exposure discipline, not signature detection, is the leverage point.

Oracle E-Business Suite payments flaw under active exploitation (CVE-2026-46817, CVSS 9.8). An improper-privilege-management and authentication flaw in the File Transmission component of Oracle Payments lets an unauthenticated attacker with HTTP access take over susceptible instances running versions 12.2.3 through 12.2.15. Defused Cyber reported the first in-the-wild attempts — six unauthenticated file-read hits from a single source on June 27 — roughly six weeks after Oracle’s May critical patch update and before any public proof-of-concept.

So what: The vulnerability items this week are an edge-and-ERP patch-window story — two of the three already have patches out, yet the gating question is the same one worth asking every time: do you actually know every place these systems run before the exploit window closes? The stealers and the clipper reinforce that credential and crypto theft is now the default monetization once an unauthenticated foothold exists — inventory and edge-exposure discipline, not signature detection, is the leverage point.

SimpleHelp auth bypass (CVE-2026-48558, CVSS 10.0) exploited to drop TaskWeaver and Djinn Stealer. An unknown actor is abusing a maximum-severity OIDC authentication bypass — a forged token with arbitrary identity claims yields a fully authenticated ‘Technician’ session — to deliver two previously unreported malware families. TaskWeaver is an obfuscated Node.js loader, delivered as jquery.js and run via node.exe, that provides an encrypted payload channel; the second stage, Djinn Stealer, harvests cloud credentials across Windows, macOS, and Linux.

So what: The vulnerability items this week are an edge-and-ERP patch-window story — two of the three already have patches out, yet the gating question is the same one worth asking every time: do you actually know every place these systems run before the exploit window closes? The stealers and the clipper reinforce that credential and crypto theft is now the default monetization once an unauthenticated foothold exists — inventory and edge-exposure discipline, not signature detection, is the leverage point.

RustDuck botnet rebuilds in Rust for DDoS. QiAnXin XLab detailed a two-stage botnet, tracked since February 2026, that hijacks routers, IP cameras, Android boxes, and weakly secured servers using a mix of old, well-known exploits plus default and weak credentials. The notable shift is a rewrite from C to Rust, with newer variants going to unusual lengths to resist analysis and takedown.

So what: The vulnerability items this week are an edge-and-ERP patch-window story — two of the three already have patches out, yet the gating question is the same one worth asking every time: do you actually know every place these systems run before the exploit window closes? The stealers and the clipper reinforce that credential and crypto theft is now the default monetization once an unauthenticated foothold exists — inventory and edge-exposure discipline, not signature detection, is the leverage point.

‘Silent Swap’ crypto clipper ships as fake ‘Google Notes’ Chrome extension. McAfee Labs flagged an active campaign using unsigned .NET and Golang installers that force-close Chromium browsers and inject a malicious extension by editing browser preference files. The extension swaps a victim’s cryptocurrency wallet address at transaction time to redirect payments to the attacker.

So what: The vulnerability items this week are an edge-and-ERP patch-window story — two of the three already have patches out, yet the gating question is the same one worth asking every time: do you actually know every place these systems run before the exploit window closes? The stealers and the clipper reinforce that credential and crypto theft is now the default monetization once an unauthenticated foothold exists — inventory and edge-exposure discipline, not signature detection, is the leverage point.

Poisoned MCP tool descriptions can turn agents into a data-exfil channel. Microsoft Incident Response and Defender research shows the attack rides on metadata, not a code bug: the visible tool name and summary stay put while the hidden description is rewritten to direct the agent to collect and quietly ship out sensitive data. Prior art includes Invariant Labs’ naming of ‘tool poisoning’ in April 2025, and the MCPTox benchmark from August 2025 found up to a 72.8% success rate across 45 real MCP servers and 20 models.

So what: The four AI items this week are one story told at three altitudes — tool descriptions, the shell an agent runs in, and the browser it drives — plus sloppy AI-app plumbing. The through-line: the trust extended to AI-adjacent tooling is now the attack surface, and none of these are ‘bugs’ in the classic sense, they’re governance gaps. Agent permissions, tool metadata, and the execution environment all need to be treated as privileged access with monitoring.

‘GuardFall’ — a decades-old shell trick bypasses AI coding-agent safety checks. Adversa AI found that a public bash-rewriting technique defeats the command-blocklist guardrail in 10 of 11 popular open-source coding and computer-use agents — only ‘Continue’ resisted. Because these agents run shell commands with the user’s full account access, a booby-trapped repo or package can trigger a hidden command that wipes files or steals SSH keys and cloud credentials.

So what: The four AI items this week are one story told at three altitudes — tool descriptions, the shell an agent runs in, and the browser it drives — plus sloppy AI-app plumbing. The through-line: the trust extended to AI-adjacent tooling is now the attack surface, and none of these are ‘bugs’ in the classic sense, they’re governance gaps. Agent permissions, tool metadata, and the execution environment all need to be treated as privileged access with monitoring.

‘BioShocking’ — AI browsers tricked into leaking credentials via prompt injection. LayerX showed that convincing an AI browser it was ‘playing a game’ got six agents and assistants — including OpenAI’s ChatGPT Atlas, Perplexity’s Comet, and Anthropic’s Claude browser extension — to copy a user’s login details and send them to an attacker. The root cause is the familiar indirect-prompt-injection problem: page content and user instructions arrive as one text stream the agent can’t reliably separate.

So what: The four AI items this week are one story told at three altitudes — tool descriptions, the shell an agent runs in, and the browser it drives — plus sloppy AI-app plumbing. The through-line: the trust extended to AI-adjacent tooling is now the attack surface, and none of these are ‘bugs’ in the classic sense, they’re governance gaps. Agent permissions, tool metadata, and the execution environment all need to be treated as privileged access with monitoring.

282 of 444 iOS AI apps leak API keys or open proxy access. Wake Forest researchers, using a tool called LLMKeyLens, found nearly two-thirds of tested iPhone AI chatbot apps exposed paid model access in plaintext network traffic — a hardcoded key, a reusable token, or a backend accepting keyless requests — letting anyone run model calls on the developer’s dime. Three months after disclosure, only 28% had fixed the issue.

So what: The four AI items this week are one story told at three altitudes — tool descriptions, the shell an agent runs in, and the browser it drives — plus sloppy AI-app plumbing. The through-line: the trust extended to AI-adjacent tooling is now the attack surface, and none of these are ‘bugs’ in the classic sense, they’re governance gaps. Agent permissions, tool metadata, and the execution environment all need to be treated as privileged access with monitoring.