Threat Brief — 2026-07-25 — AI vs AI: offensive agents find the bugs, offensive agents exploit the platforms

Executive summary: Today's feeds re-surface five stories first reported yesterday (2026-07-24) with no material new developments. The dominant pattern remains striking: autonomous AI agents are now discovering critical vulnerabilities faster than human researchers — while simultaneously becoming the attack surface themselves. Three of the five items involve AI-discovered bugs (NodeBB, Redis, Bing Images), and one involves weaponising an AI agent platform (ChatGPT AgentForger). If any of these affect your stack, patching remains urgent, but there is nothing fresh to act on today beyond what was already briefed.

Top items

All five findings are continuations of stories first reported 2026-07-24 with no new developments. Listed by severity for reference; no action beyond yesterday's guidance is required.

• Bing Images SVG command injection (CVE-2026-32194, CVE-2026-32191) — Critical. Crafted SVGs submitted to Bing's image-search upload or crawler routes executed arbitrary commands as NT AUTHORITY\SYSTEM (Windows) and root (Linux) on Microsoft's production image-processing workers. Both CVEs carry CVSS 9.8. This is Microsoft's production fleet, not a customer-hosted component — impact is to Microsoft infrastructure. First reported 2026-07-24 by TheHackerNews/XBOW. (src: TheHackerNews)

• NodeBB — eight high-severity flaws found by AI pentest agents. Aikido Security's autonomous AI agents discovered 8 high-severity vulnerabilities in NodeBB < 4.14.0 in six hours, including unauthenticated admin-dashboard redirect, arbitrary private-message reading, and XSS with published exploit code. Patch to 4.14.0+. First reported 2026-07-24 by TheHackerNews/Aikido Security. (src: TheHackerNews)

• AgentForger — ChatGPT Workspace Agent CSRF. A single phishing link could stealthily create, authorize, and deploy an attacker-controlled autonomous AI agent inside a victim's ChatGPT Workspace via a CSRF flaw in OpenAI's Agent Builder. Demonstrates AI-agent platforms as a new attack surface. First reported 2026-07-24 by TheHackerNews/Zenity Labs. (src: TheHackerNews)

• Redis zero-day authenticated RCE — AI-discovered by Kimi K3 agents. Two authenticated RCE paths: a Redis Streams use-after-free (double-free via corrupt RDB) and a RedisBloom TDigest out-of-bounds write. Affects Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0. If you run exposed Redis with authenticated access, treat this as urgent. First reported 2026-07-24 by TheHackerNews/Redis. (src: TheHackerNews)

• Certighost — AD CS Domain Controller impersonation (CVE-2026-54121, CVSS 8.8). A low-privileged domain user can obtain a certificate for a Domain Controller via an AD CS enrollment "chase" fallback and authenticate as that machine. Standard AD CS hardening (restrict enrollment agent templates, enforce certificate-name SAN mapping) applies. First reported 2026-07-24 by TheHackerNews/NVD. (src: TheHackerNews)

Themes

AI as both discoverer and target. Three of today's five stories involve AI agents finding vulnerabilities (Aikido agents → NodeBB, Kimi K3 → Redis, XBOW → Bing Images), while a fourth (AgentForger) shows AI-agent platforms themselves being exploited. The asymmetry is narrowing: offensive AI is now productive enough to ship critical findings in hours, and defensive teams should expect the window between disclosure and exploitation to shrink correspondingly. AI-platform security (agent authorization, CSRF on agent-creation flows, sandbox integrity) is emerging as a first-class concern alongside traditional appsec.