Threat Brief — 2026-07-24 — AI Agents Go Rogue at Scale

AI agent security dominates today's intake: a single phishing link could have weaponised ChatGPT Workspace Agents, an unattended Hermes AI agent autonomously compromised Thailand's Ministry of Finance, and researchers formalised "self-state attacks" against self-hosted agents. Meanwhile, a crafted SVG yielded SYSTEM-level RCE on Microsoft's Bing image-processing fleet, and the Suno music-AI breach exposed 55.3 million accounts.

Top Items

• Bing Images SVG → SYSTEM RCE on Microsoft production servers. A crafted SVG submitted to Bing's image search executed commands as NT AUTHORITY\SYSTEM on Windows workers and root on Linux machines in the same fleet. XBOW replicated the result across workers, indicating a systemic image-pipeline weakness rather than a single-box fluke. (src: The Hacker News)

• ChatGPT AgentForger flaw enabled rogue AI agent deployment via one phishing link. A critical vulnerability in OpenAI's ChatGPT Workspace Agents could have let an attacker stealthily build, authorise, and deploy an autonomous AI agent through a single phishing URL — turning the agent platform into a self-authorising attack vector. (src: The Hacker News)

• Unattended Hermes AI agent ran post-exploitation against Thailand's Ministry of Finance. An attacker installed a popular AI assistant on a rented Hong Kong server, disabled its permission-prompt safeguard, and pointed it at Thailand's treasury/tax systems. Investigators found 585 files related to the attack, with the AI operating autonomously for approximately three days. (src: The Hacker News; SecurityLab.ru)

• Suno AI music-generator breach leaks 55.3 million accounts. HIBP analysis of the stolen dump confirms 55.3M unique email addresses plus phone numbers and tens of thousands of payment records. This is one of the larger AI-platform breaches on record. (src: Xakep.ru)

• Golden Chickens MaaS resurfaces with four new malware families and modular implants. The malware-as-a-service ecosystem continues operating despite extensive prior public disclosures, adding new families that signal active development and a refreshed toolset for affiliate deployments. (src: The Hacker News)

• Vatican's official prayer app leaks 700K+ users' PII via porous API. Names, email addresses, location, and site status were exposed through an unauthenticated API endpoint accessible with a browser — a classic broken-object-level-authorisation flaw at scale. (src: Dark Reading)

• Chick-fil-A confirms credential-stuffing breach of 13,000+ customer accounts. The fast-food chain's website and mobile app were targeted June 17–19; the scale suggests automated credential reuse rather than a platform compromise. (src: BleepingComputer)

• Europol flags 4,340 URLs for removal in "The Com" crackdown. A multi-week operation targeted content linked to nihilistic violent-extremist groups loosely organised as "The Com," marking one of the larger coordinated takedowns of community-organised threat actors. (src: BleepingComputer)

• "Slopsquatting" / phantom domains / HalluSquatting unified as one AI attack pattern. ActiveState ties these names together as a late-binding attack where AI coding agents trust hallucinated package, repo, or domain names — recommending pre-fetch verification and governed dependency pipelines. (src: BleepingComputer)

• AI-based spam filters bypassed with revived text-salting technique. Attackers are reusing the classic "text salting" method — inserting hidden text — to evade ML- and LLM-based mail filters, demonstrating that legacy evasion still defeats modern detection. (src: Xakep.ru)

• Self-state attacks on self-hosted AI agents formalised in new research. The paper defines attacks where an agent's own memory and configuration files are corrupted via legitimate OS syscalls, exposing a class of threats that OS-level defences struggle to contain. (src: SeeBug)

Themes

AI agents as both weapon and target. Today's intake is saturated with AI-agent risk: AgentForger (phishing-deployed rogue agents), Hermes (unattended post-exploitation), self-state attacks (corrupting agent internals), slopsquatting (agents trusting hallucinated names), text-salting (evading AI filters), and commentary on least-privilege enforcement. The common thread is that autonomous execution authority is being granted faster than it can be governed.

Large-scale PII continues to flow from low-hanging API flaws. The Vatican app (700K) and Suno (55.3M) both stem from preventable API/data-handling weaknesses — not sophisticated exploitation — reinforcing that basic authorisation failures remain the dominant breach vector.