Threat Brief — 2026-07-28 — Autonomous agents meet infrastructure zero-days

Executive summary: Two critical infrastructure zero-days are now confirmed exploited in the wild: Arista VeloCloud Orchestrator has a max-severity command injection flaw added to CISA KEV, and a FastJson RCE zero-day is actively targeting US firms. Separately, persistent "confused deputy" flaws in both Google Cloud and Microsoft Azure offer a shortcut to admin-level cloud permissions, and an autonomous AI agent ("Hermes" in unrestricted YOLO mode) was used in a real espionage operation against Thailand's Ministry of Finance — a concrete demonstration of weaponised AI agents beyond proof-of-concept.

Top items

• Arista VeloCloud Orchestrator max-severity zero-day — actively exploited, now in CISA KEV. CVE-2026-16812KEV is an OS command injection vulnerability in on-premises VeloCloud Orchestrator allowing remote attackers to access privileged internal functionality. Arista has released patches, but exploitation is already underway. This is a known-exploited vulnerability per CISA's KEV catalog — prioritise patching on-prem orchestrator instances immediately. (src: BleepingComputer) (src: CISA KEV) [CVE-2026-16812KEV in CISA KEV]

• FastJson RCE zero-day actively exploited against US firms. Attackers are targeting a vulnerability in the widely used FastJson open-source Java library that enables remote code execution without user interaction or elevated privileges. Any Java application deserialising untrusted input via FastJson is potentially exposed. Given FastJson's ubiquity in enterprise Java stacks, assess dependency trees urgently. (src: BleepingComputer)

• "Confused deputy" vulnerabilities persist across Google Cloud and Microsoft Azure. This class of flaw lets attackers obtain administrative permissions and bypass cloud-provider access controls by tricking the platform's own authorisation mechanisms into performing privileged actions on the attacker's behalf. Both major clouds are affected; review IAM trust relationships and service-account token scopes. (src: Dark Reading)

• Autonomous AI agent "Hermes" used in real espionage against Thai Ministry of Finance. Attackers deployed Hermes — an open-source autonomous agent — in unrestricted "YOLO mode" to conduct espionage operations. This is a notable escalation from proof-of-concept AI-agent attacks to a confirmed government-targeting operation, and aligns with the broader pattern of adversaries weaponising available tooling rather than developing bespoke capabilities. (src: Dark Reading)

Themes

Infrastructure zero-days under active exploitation. Both the Arista VeloCloud and FastJson flaws are being exploited in the wild right now, with no user interaction required — patch-or-contain urgency is immediate for any exposed instances.

AI agents as operational offensive tools. The Hermes/Thai MoF attack marks a shift from theoretical concern to confirmed in-the-wild use of autonomous AI agents for espionage. This extends the pattern noted on 2026-07-27 (Dark Reading) — adversaries are leveraging off-the-shelf automation rather than custom zero-day development.