Daily digest · 2026-10-22

Daily Digest, 2026-10-22

TL;DR: Attack crews are now running commercial AI coding tools as their working stack, and three separate reports today put numbers on it: Wiz tracks the ARTEX agent hitting Okta, Entra and Cognito at software vendors, Straiker found a multi-agent crew aimed at 400+ Latin American banks, and the same operator pattern spread well past the South Korean banks first reported. On the defensive side, LiteLLM says its poisoned release traces back to a GitHub token that leaked into AI gateway logs, a reminder that the thing sitting between your apps and the model records everything passing through it. OpenAI also says a model found the PHP2Shell bugs in core PHP, code that runs most of the web. One research item worth the read: a shared framework for testing multimodal unlearning, which is how you check a deletion request actually removed something.

Top stories

• LiteLLM traces its poisoned release to a GitHub token captured in AI gateway logs (The Hacker News, 2026-10-22). Attackers broke several independent controls to ship version 1.107.0 with a credential stealer and backdoor to PyPI and Docker Hub; the suspected entry point was a token that leaked into gateway logs. An LLM gateway sees every request and response, so whatever its logs hold is reachable.
• Wiz tracks Storm-0940's ARTEX agent hitting Okta, Entra and Cognito at software vendors (Wiz Blog, 2026-10-22). An actor overlapping with Storm-0940 is using the ARTEX agentic tool against software vendors, going after enterprise identity providers and leaving traces Wiz documents. Identity providers sit in front of customer and employee data at every downstream tenant.
• Straiker traces a multi-agent crew running Claude, Grok and Kimi against 400+ Latin American financial firms (GBHackers, 2026-10-22). The CARLIY0S system wired commercial models from Anthropic, xAI and Moonshot into shared automation to attack more than 400 banks and payment providers. Provider-side abuse detection is now in the path of customer financial records.
• ARTEX plus Claude Code, Codex, Grok and DeepSeek drove attacks well beyond the South Korean banks (GBHackers, 2026-10-22). A Chinese-speaking operator ran worldwide attacks on shared instructions, persistent project records and automated handoffs between AI sessions. Stolen data gets carried forward across targets rather than sitting in one dump.
• OpenAI's Patch the Planet used GPT-5.6 Sol to find PHP2Shell bugs in core PHP (Latent Space, 2026-10-22). OpenAI was one of two parties to report the flaws, fixed through a two-month coordinated process, in a runtime behind roughly 70% of the web. A memory-disclosure class of bug there puts whatever personal data those applications hold within reach.
• Open-MMUnlearning puts multimodal unlearning methods and their evaluations in one place (arXiv, 2026-10-13). The paper unifies fragmented implementations and inconsistent evaluation protocols for removing designated content from image-and-text models. Erasure claims are only as good as the test behind them, which matters when a GDPR deletion request lands on a trained model.

Also notable

• Anthropic's red team used Claude to find 493 attack-surface issues across 25 open-source projects, including 94 cases of security controls dropping silently.
• Honeypot catches an attacker turning an exposed Flowise server into an offensive assistant, workflow enumeration and stored credentials handed over.
• Adversa reads Claude Code's enterprise settings for what they do not cover, a map of where product config stops and host containment has to start.
• SentinelOne ships runtime detection and response aimed at AI agents, agent discovery plus behavioral monitoring.
• Tenable on shadow AI spreading past chatbots and browser extensions, discovery as the precondition for any AI data control.
• Claude Security adds continuous scanning and tracks whether a fix stayed fixed, regression tracking in vulnerability management.
• Same final answer, different reasoning trace, depending on the language the user wrote in, questions whether traces collected in one language count as assurance evidence.
• Auditing quantum code-generation benchmarks across 15 models and 530 tasks, shows how much the scoring setup drives a benchmark number used in approval gates.