In each of this week's items the AI is doing something ordinary, only cheaply. It writes an exploit script for an industrial controller from documentation that was already public. It scaffolds the back end of a fraud operation and cleans up the target list. It reads a project file, or a web page, that somebody else controls. No new capability was required, and in three of the four cases the boundary that failed was one the vendor had already built. What changed is the cost of the work on the other side of it.
1
American agencies warn that exploit scripts built with AI assistance are being used against internet-exposed Siemens S7 controllers
Joint advisory AA26-231A was released on 18 August 2026 by the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency. It describes an active campaign against Siemens S7 Series programmable logic controllers that are reachable from the internet or poorly separated from enterprise networks. The agencies state that the actors used AI to quickly produce and refine exploit scripts from public technical documentation and known vulnerabilities, then packaged them to look like legitimate operational-technology monitoring utilities. Targets were located through internet-wide scanning services including Censys and ZoomEye. The S7-200, S7-300, S7-400, S7-1200, S7-1500 and F-series safety controllers are all named, across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. The advisory records disruption at more than thirty community water systems in Minnesota and reported activity across at least twelve states.
Why it matters for IndiaThe documented incidents are American and the advisory does not attribute any of this activity to targeting of India. The transferable part is the economics. S7 controllers run water boards, state generation and distribution utilities, refineries, fertiliser and cement plants and metro systems here, often on networks where the plant and corporate sides were joined years ago for reporting convenience. Writing reliable code against an unfamiliar controller was the step that kept smaller operators out of scope. When that step costs a few hours, the long tail of municipal utilities and mid-sized plants becomes worth an attacker's time, and those are precisely the operators without an OT security team.
ActionInventory every S7 controller with its firmware version, including units a machinery vendor installed and nobody entered in the asset register. Confirm exposure empirically by searching your own address ranges on a public scanning service, rather than trusting the network diagram. Block S7comm on TCP port 102 at the perimeter and separate plant from corporate networks through a properly configured DMZ. Enable PLC password protection, require multi-factor authentication for remote engineering access, and monitor for unauthorised commands and unexpected program downloads. Compromise of a controller is reportable to CERT-In within six hours.
SourceJoint advisory AA26-231A, NSA, CISA, FBI, Department of Energy and Environmental Protection Agency (18 August 2026); CNBC (19 August 2026); GBHackers (20 August 2026).
2HighCVSS 8.8
One link was enough to make Microsoft's consumer Copilot read a user's mail and files and send the contents out
Varonis Threat Labs published research on 18 August 2026, credited to Lior Adar, on a flaw it calls CoSnitch, tracked as CVE-2026-24301 and rated critical. Public reporting places it at CVSS 8.8. Three weaknesses chain. An undocumented autorun=1 parameter, used alongside the existing query parameter, caused an attacker-supplied prompt to run on page load with no confirmation. The assistant could then reach data through connectors the victim had already authorised and send it out using its own page-fetch capability, with base64 encoding used to get past content filtering. Instructions could also be written into the assistant's persistent memory through ordinary web-page summarisation, so the poisoning outlived the session that introduced it. Mail contents and metadata, calendar entries, Google Drive file metadata, chat history and stored memory were reachable. Varonis reported the issue in December 2025, Microsoft shipped a server-side fix on 18 August 2026, and Varonis found no evidence of exploitation before that. The research covers the consumer Copilot Personal product and does not state that enterprise Microsoft 365 Copilot behaved the same way.
Why it matters for IndiaThis is shadow AI rather than an enterprise exposure, which is what makes it hard to see. Consultants, founders, finance staff and engineers connect personal assistant accounts to the mailbox and cloud storage where their work actually sits, with no licence, no tenant policy and no log the organisation can read. Nothing in a Microsoft 365 audit trail records what a personal Copilot account was asked to do. For anyone handling customer records that is an exposure under the Digital Personal Data Protection Act, whichever product the data passed through. The memory step deserves separate attention, because persistence in a consumer assistant is not something awareness training has prepared users for.
ActionNo client patching is needed, but the exposure window ran from December 2025 to August 2026. Establish which staff have connected a personal AI assistant to an account holding work material, revoke the relevant authorisations, and have anyone who used the product before 18 August clear its stored memory rather than assume the fix removed injected entries. Put in writing that official documents and customer data are not processed through consumer assistant accounts, and fund a sanctioned alternative, because a prohibition without one is ignored. Add unsolicited AI-assistant links to phishing awareness material as their own category.
SourceVaronis Threat Labs (18 August 2026); The Hacker News (18 August 2026).
3
A coding agent ran attacker-supplied code the moment a developer opened a repository
GitLab's Threat Research Group disclosed on 17 August 2026 a server-side template injection in Serena, which GitLab describes as a popular MCP coding agent. The flaw is tracked as GHSA-pp25-4cg4-qcr9 and gives arbitrary code execution inside the Serena process. An attacker places a crafted .serena/project.yml file in a repository under their control, and the code runs as soon as a developer opens that repository through the Serena MCP server. The mechanism defeats trusted_project_path_patterns, the control Serena had added specifically to prevent execution from untrusted repositories, so teams that had configured it were not protected. Versions of serena-agent up to and including 1.6.1 are affected and 1.7.0 carries the fix. GitLab reported the issue confidentially on 1 August 2026 and the maintainers fixed it eight days later. Serena is used alongside Claude Code, Codex, Gemini CLI, Roo Code and Cursor.
Why it matters for IndiaOpening somebody else's repository is routine work in Indian services firms and GCC engineering teams. Candidate take-home submissions, client branches, vendor deliverables and forked libraries all arrive as repositories that someone clones and opens with an agent already attached. The agent runs at the developer's own privilege, which on a delivery machine usually means SSH keys, cloud credentials, environment files and VPN reach into a client network. Under a services agreement, that turns one workstation compromise into a customer notification obligation.
ActionUpgrade serena-agent to 1.7.0. Build an inventory of MCP servers on developer endpoints, since these are installed by individuals rather than issued by IT and most organisations have no list at all. Make it policy that untrusted repositories are cloned and reviewed before an agent is pointed at them. Treat agent configuration directories as executable content in code review, alongside build scripts. Alert on coding assistants spawning unexpected child processes or opening new local listeners.
SourceGitLab Threat Research Group (17 August 2026).
4
Rapid7 recovered a crypto fraud operator's working directory, and the development logs show coding assistants doing the engineering
Rapid7 Labs published an analysis on 17 August 2026 by Anna Širokova and Jan Recinsky of an operation it tracks as ASTERIX, found through an inadvertently exposed web directory holding the operator's datasets, tooling, malware and development logs. The target lists covered roughly 885,000 phone numbers across 54 countries, the largest being 316,002 German mobile numbers. Validation tooling queried cryptocurrency exchange interfaces to confirm which numbers belonged to account holders, at roughly a 13.6 per cent hit rate, producing about 43,066 confirmed holders from the German list alone. Those enriched leads fed branded phishing email carrying fabricated verification codes, then a voice call in which the operator cited the same details to impersonate exchange support, then counterfeit wallet applications that harvested recovery phrases. The AI involvement is development assistance rather than autonomy. The logs show GitHub Copilot and Claude Code used for back-end development, project scaffolding, data processing and infrastructure configuration, including the phone-validation pipeline and working around rate limiting. When one assistant declined to help obfuscate malware, the operator moved to a different provider and submitted a structured jailbreak prompt.
Why it matters for IndiaThe significant figure is 13.6 per cent, not 885,000. Bulk lists have always been cheap. What was expensive was the engineering to turn a list into confirmed account holders with enough context to make a convincing call. Indian exchanges, fintechs, wallet providers and bank support desks face the same construction, and the standard advice to customers, that they should verify who is calling, fails against a caller who can already quote a real-looking verification code and recent account details. The provider-hopping is the point for security teams: refusal by one model was a delay, not a control, and no risk register should record a vendor's safety behaviour as a defence.
ActionRate-limit and authenticate any interface that reveals whether an account exists for a given phone number or email, since enumeration is the first stage of this pipeline and the cheapest to disrupt. Alert on validation-shaped traffic, meaning high-volume lookups with little follow-on activity. State in every customer message that staff will never ask for a verification code or a recovery phrase, and publish one support number customers can check against. Monitor app stores and advertising networks for counterfeit applications carrying your brand, and register takedown contacts in advance rather than during an incident.
SourceRapid7 Labs (17 August 2026).
AI defender tip: Google's Threat Intelligence Group published a useful counterweight on 18 August 2026. Its Agentic Vulnerability Discovery Harness, an agent pipeline that has run inside Mandiant for ten months with human validation of every finding, produced more than a hundred confirmed critical vulnerabilities in two days during one incident response engagement against stolen corporate repositories, and twelve CVEs have been assigned from its output. Read that as a clock, not a product claim. If a copy of your source code left the building today, the window in which an attacker can find exploitable flaws in it is now measured in days, and the same class of tooling is available to you beforehand. So pick one system that matters and establish two things about it. How quickly could you find and fix flaws in your own code if an outsider held a copy of it. And which inputs does that system read without a human seeing them first: a repository from a client, a page an assistant summarises, a project file, a scan result from an unfamiliar controller. Each of those is a path where the effort an attacker used to need has already been removed, while the boundary you are relying on was built when it had not been.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
