Welcome to the second AI for Defenders. This one took four weeks instead of the promised two, so it covers the whole gap. What the extra fortnight made unmistakable is the thread of this issue: the AI agent as attacker stopped being a conference talk and became an incident report, and five governments went on record saying more of that is coming, on a timeline of months. Both sides of that story, and what you can do about it on Monday, below.
What the industry’s doing
-
The first successful LLM-driven ransomware attack (Sysdig, the primary research). An AI agent broke into an internet-facing Langflow server through CVE-2025-3248, harvested LLM API keys and cloud credentials along the way, pivoted into a production database, encrypted 1,342 configuration items, dropped the original tables, and left a ransom note. Sysdig, who dubbed the operation JadePuffer, call it the first ransomware operation run end to end by an “agentic threat actor”. It diagnosed and fixed its own failed steps in as little as 31 seconds. The strangest part: the ransom was unpayable. The encryption key was never saved anywhere, and the Bitcoin address in the note is the canonical example from the Bitcoin docs, which Sysdig reads as either hallucinated or a very odd wallet choice. Destruction dressed as ransomware, at machine speed. And yes, Langflow is the same AI dev platform we flagged in issue 001, through a different flaw this time, which only sharpens that issue’s advice: inventory your AI build stack like any other internet-facing service, because attackers already have.
-
Five Eyes agencies sound the alarm on AI’s threat to cybersecurity (The Record). A week before JadePuffer went public, the cyber agencies of the US, UK, Canada, Australia, and New Zealand jointly warned that frontier AI is about to transform offensive operations: “The timeline is not years, it is months.” The recommendations are deliberately unglamorous (cut attack surface, patch faster, treat legacy systems as strategic liabilities, defense in depth), and that is the message: the fundamentals, executed at a much faster cadence. If you need budget or urgency for your AI defense work, this is the document to wave.
-
Cyber Shield: the UK commits to agentic AI defense at national scale (NCSC). The defender-side mirror of JadePuffer: coordinated autonomous red and blue agents finding and mitigating vulnerabilities across organizational boundaries, with the stated goal of cutting response from weeks to minutes. Whatever you think of the execution risk, a government committing to autonomous defense at national scale confirms where this is heading: both sides are automating.
-
Inside the Mastra npm supply chain compromise (Microsoft). A compromised maintainer account pushed a typosquatted dependency (“easy-day-js”, impersonating dayjs) into 140+ packages of the Mastra AI agent framework, attributed to North Korea’s Sapphire Sleet. Your AI framework dependencies are now a confirmed nation-state target, and this write-up is unusually actionable: indicators, C2s to block, and KQL hunting queries you can run this week.
-
‘Ghostcommit’ hides prompt injection in images to fool coding agents (BleepingComputer). Sudipta Chattopadhyay and Murali Ediga of UMKC’s ASSET Research Group hid instructions in a PNG referenced from a repo’s AGENTS.md file; the agent reads the image, extracts secrets from .env files, and smuggles them out inside legitimate-looking commits that text-based code review never catches. One of at least four demos this window with the same lesson: everything your coding agent reads is untrusted input, including binary files your reviewers never open. Two details worth keeping: tool design mattered more than model choice in the tests, and a survey they cite found 73% of merged PRs hit the default branch with no substantive human review. That is the multiplier.
-
Apple reverses its age-old patch policy to keep up with AI (Dark Reading). The update to issue 001’s patch-cadence thread: after CISA’s three-day clocks and the record AI-inflated Patch Tuesday we covered last time, Apple shipped out-of-cycle security updates on June 29 and said plainly it is moving faster because AI is compressing the time from patch to working exploit. When the most release-train-conservative vendor on earth rewrites its cadence, your own patch SLAs inherit the same math.
-
US lifts export controls on Anthropic’s frontier models (The Record). The whole arc landed inside this window: the first export controls ever applied to AI software rather than hardware, an open letter from 100+ cybersecurity professionals organized by Alex Stamos arguing the ban hurt US defense, and a reversal on June 30. The defender lesson survives the reversal: while it stood, access went dark for all customers for roughly three weeks. Model access is now a dependency that policy can switch off overnight, so build your AI workflows with a fallback path.
From the community
The work we want to amplify: practitioners showing what they tried, what broke, and what they learned.
-
Someone is scanning for your MCP servers and AI assistant credentials (SANS Internet Storm Center). ISC handler Manuel Humberto Santander Peláez pulled two weeks of logs from a single small web host and found 49 source IPs sending properly formatted MCP initialization requests to find exposed servers, plus probes for
/.claude/mcp.json,/.cursor/mcp.json, and unauthenticated LLM endpoints. Whatever you wired up for agents this year is on the recon target list. The Monday checklist is right in the diary: grep your access logs for MCP handshakes, confirm no agent config files are web-served, and check what your AI stack exposes before someone else does. -
Inside Elastic InfoSec’s agentic SOC: alert triage from 30 minutes to under 3 (Elastic Security Labs). A real security team documenting the agent pipeline they run on themselves, with numbers. Yes, it runs on their own product, but the patterns transfer to any stack: anything resolvable by a query should be a query, not an LLM call; separate fact-finding agents from verdict agents so the investigation doesn’t bias itself; narrow specialists beat one generalist.
-
When AI agents look like attackers (Sophos X-Ops). Legitimate coding agents are tripping endpoint detections written for adversaries: dumping credential stores, pulling installers through certutil, writing scripts to startup folders. Credential Access alone accounted for 56.2% of their blocking-rule hits. If your SOC hasn’t yet argued about an “is this an agent or an intruder” alert, it will this quarter. The tuning stance to steal: recognize known-good agent behavior to cut noise, but keep the rules for genuinely risky activity no matter who initiates it. Don’t tune yourself blind.
On the show
Still no episode to plug: the podcast lands later this year. The conversation lives in your replies for now, and after issue 001 that turned out to be a good place for it.
One idea to take with you
Stop treating your AI agents like service accounts. A service account has a fixed job and a narrow surface. An agent has intent, delegation, and a blast radius: it runs continuously, spans applications, and picks up permissions opportunistically. So give it what you give a human: an owner, least privilege, and a joiner-mover-leaver lifecycle, including the leaver part. The market just put a number on this idea (Cisco paid roughly $400M for a non-human-identity startup this window), but the concept costs nothing to apply: this week, pick one agent you run and answer three questions. Who owns it, what can it reach, and how would you offboard it?
Shape issue 003
This issue was built from what the community and the feeds surfaced over four weeks, and the best leads keep coming from you. If you’re building something with AI in defense, broke something interesting, or saw a story we missed, hit reply. Back in two weeks.