Threat Brief — 2026-09-18 — AI Agents Go Offensive

Two critical unauthenticated remote-code-execution flaws — one in Check Point security management infrastructure, one in Docker Sandboxes on macOS — lead today's brief. Separately, the Iran-linked Handala Hack persona is now formally tied to the HEAVYGRAM Telegram backdoor, and an AI-driven penetration-testing agent is reportedly being sold on dark-web markets, compressing attack timelines from weeks to days.

Top items

• Critical Check Point Management Server flaw enables unauthenticated root RCE. A network-reachable vulnerability in Check Point Security Management and Log Servers permits attackers without credentials to execute code as root. These servers are the central control plane for Check Point firewall policies, making compromise potentially cascading. No public exploit URL was provided in the findings. (src: The Hacker News)

• Critical Docker Sandboxes flaw lets guest code escape to macOS host. Malicious code inside a Docker Sandboxes VM on macOS can break out of the shared project directory and read or modify arbitrary host files. Docker issued a security announcement on 1 September. Organisations using Docker Sandboxes for untrusted-code execution on macOS are most exposed. (src: The Hacker News)

• Iran-linked Handala Hack persona attributed to HEAVYGRAM Telegram backdoor (developing). First reported 15 September as Telegram-controlled Windows malware detailed by US, UK, and Dutch agencies, the story has developed: the hacktivist persona "Handala Hack" is now formally tied to the HEAVYGRAM backdoor and a Delphi-based utility called CRUDEEXCLUDE. HEAVYGRAM supports built-in remote commands including password theft, reinforcing its role in surveillance of dissidents. (src: The Hacker News)

• "AI Hacker" agent reportedly sold on dark web, cutting penetration cycles to under three days. An automated penetration-testing agent is being marketed on dark-web forums, allegedly reducing the time from initial access to full penetration from roughly two weeks to 2.8 days. The claim has not been independently verified, and the underlying tool's capabilities are unclear from the single source. (src: Anquanke)

• Weekly threat roundup highlights 800+ patched flaws and self-rewriting agents. A ThreatsDay digest surveys the week's landscape: 800-plus vulnerabilities patched across vendors, AI agents that modify their own code, insider-enabled SIM swaps, and credentials stashed in AI tools and exposed services. The article is a broad summary rather than a single actionable finding, but it underscores the diversification of attack surfaces. (src: The Hacker News)

Themes

Offensive AI acceleration. The reported dark-web sale of an AI penetration agent and the ThreatsDay coverage of self-rewriting agents point to a narrowing gap between AI-assisted defence and AI-assisted offence. While the AI-hacker claim is unverified, the trend aligns with recent reports of AI agents automating malware campaigns and code-repository compromise.

Centralised security infrastructure as target. The Check Point Management Server flaw is significant precisely because these systems are trust anchors — compromising the management plane can undermine every firewall policy it controls. This mirrors the broader pattern of attackers targeting centralised control and identity systems rather than individual endpoints.

===