One operator ran a 12-agent AI attack mesh against hundreds of targets in 11 countries, plus a wave of stolen AI keys

Update: GPUStack (CVE-2026-102895, CVSS 9.8) is being exploited for unauthenticated admin, so upgrade to 2.2.0. Kernel, which runs browsers for AI agents, disclosed that a leaked API key led to stolen customer secrets and cryptominers on 4 GPU servers, and says the attacker used the AI pentest platform ARTEX. What to do: because the attacker used ARTEX, Kernel customers should rotate API keys and any third-party secrets stored with Kernel. Kaspersky detailed CyberStrikeAI, so alert on directory replication from non-domain-controllers. Check Point found "prompt adware" in the Haiou Codex jailbreak bundle, so audit agent instruction files for text you didn't write. OpenAI says GPT-6 Astra designed a Codex device's hardware and firmware, so keep a human reviewing agent-designed hardware. Sources: GPUStack advisory, Kernel, Kaspersky, Check Point, OpenAI.

The biggest story today is BOSSAI. Acronis's Threat Research Unit found a single operator running a mesh of 12 AI agents wired to MCP servers (HexStrike AI, a Kali MCP server and a Ghidra bridge among them) against hundreds of organizations in 11 countries. Confirmed breaches hit universities and emergency-services providers, with medical data and personal information pulled out. One Taipei patient-care records platform exposed ECG readings, ambulance video and vital signs with no credentials, and had since 2018.

What to do: inventory anything internet-facing that holds medical or personal data and close the old stuff first, meaning legacy subdomains, default admin credentials and unauthenticated APIs. Then add detection for MCP-style tooling in your recon traffic, such as bursts of nmap, sqlmap, ffuf and gobuster requests from one source in a short window, because these agents scan wide and fast.

My take: the commercial models did refuse. Acronis says they turned down every offensive prompt and even lectured the operator about computer crime law. It didn't matter, because he moved to locally run abliterated models with the safety training stripped out. Refusals slow down lazy attackers, but they aren't a control you can plan around. The agents also hallucinated, including a made-up critical Apache bug, and over half of one scanner's high-severity results were false positives. What actually worked was SQL injection, default credentials and open ports.

AI developer platforms keep getting hit. SecurityWeek counts at least a dozen in the past month, most recently CommandCode, Northflank, Trigger.dev, Chainstack and WorkOS, with attackers mostly after stored customer secrets. Wiz ties the surge to LLM-jacking, where stolen AI keys get resold. Rotate your OpenAI, Anthropic and cloud LLM keys today, not just the platform's own secrets, and set hard spending caps and usage alerts so a stolen key shows up as an alert and not an invoice.

Google also says attackers are exploiting CVE-2026-40217, a remote code execution bug in LiteLLM, so patch your gateway if you run one. Binance, meanwhile, published its first report on the $6.34 billion theft. The attackers used an internal AI tool on October 20 to take over two engineers' machines, though the report doesn't say how. The chain began with a tampered Homebrew install, then a fake recruiter and a coding assignment that ran malware on setup. Run coding tests from strangers in a throwaway VM, and review internal AI tools that reach production like any admin account.