Three of this edition's four items are configuration failures rather than model failures. A model registry left reachable from the internet with a cloud role attached to it. An inference server bound to every network interface so that a container could talk to it. An editor that let text from a repository rewrite the settings governing its own outbound traffic. Not one of the three required anything to be understood about how a model reasons. The fourth item is a count rather than a technique: Palo Alto Networks went looking for AI-enabled malware and found that almost all of it has never left a sandbox. Taken together, the four say that the AI security work in front of most Indian teams this month is ordinary infrastructure security, applied to assets nobody has yet entered in the register.
1
A model registry flaw is being exploited to steal cloud credentials, and it reached CISA's exploited list two days after the identifier was issued
CVE-2026-64849 is an unauthenticated server-side request forgery in MLflow's model-registry webhooks, scored 9.3, affecting versions prior to 3.15.0, and it defeats a protection that was added in 3.10.0. watchTowr documented exploitation in the wild: an exposed MLflow host is used to reach the cloud metadata service, and the instance credentials and secrets are taken from there. On watchTowr's account, scanning of internet-facing instances began within hours of the identifier being assigned on 17 August 2026, and concentrated on cloud-hosted deployments. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 19 August 2026, with a remediation deadline of 2 September for United States federal civilian agencies.
Why it matters for IndiaMLflow arrived in most Indian organisations as a research tool. A data scientist stood it up on a cloud instance to track experiments, it became the place model artefacts live, and it was never rebuilt to the standard server image or brought into the patch cycle. The value at stake is not the host. It is the object-store credential, the registry contents, and an instance role that is almost always wider than the workload requires. Banks, insurers, telecom operators and GCC data-science teams should work on the assumption that they run more than one instance, and that at least one of them is not on the asset list. CERT-In's direction on rapid remediation of internet-exposed flaws applies whether or not anyone ever classified this system as production.
ActionUpgrade to 3.15.0 or later. Find your instances by scanning your own address ranges rather than by asking teams what they have deployed. Remove internet exposure and put access behind authentication. Block the cloud metadata endpoint from MLflow hosts at the network layer, and reduce the instance role to what the workload actually needs. Because exploitation preceded the KEV listing, treat any exposed instance as potentially compromised: review webhook configuration and outbound requests in the audit logs, and rotate every credential the host could reach.
SourceThe Hacker News (18 August 2026); CISA Known Exploited Vulnerabilities catalogue (19 August 2026); SecurityWeek (20 August 2026); BleepingComputer (20 August 2026), reporting watchTowr research.
2
An ordinary webpage could take over a developer's local AI agent, and the change it made survived every restart
Oasis Security disclosed the finding on 25 August 2026, credited to Elad Luz and Ofek Itach and now tracked as CVE-2026-65105. The cause is a deployment decision rather than anything in the model. NemoClaw's OpenShell sandbox runs inside a Docker container, which cannot reach a service listening only on loopback, so the installation starts Ollama bound to all interfaces on port 11434 instead. Ollama's API carries no authentication, and the host-header protection that would otherwise cover it only holds when the bind address is loopback. With the service on every interface, a DNS rebinding technique allows a page the developer merely visits to send unauthenticated requests to that local API. From there the model's chat template can be rewritten, which is the layer that turns a conversation into the text the model actually reads. An instruction placed at that layer belongs to the model rather than to any session, so nothing calling the API can see it, no guardrail or operator view sits below it, and it persists across restarts. The same class of weakness was recorded against Ollama itself as CVE-2024-28224 in March 2024. No exploitation had been reported at publication. The remediation account is worth reading carefully rather than summarising. Oasis reported that macOS and Linux were fixed in NemoClaw v0.0.35, that the Windows and WSL installation path had no complete fix at the time of disclosure and instead carried a warning added in v0.0.34, and that by v0.0.106 the proxy refuses non-loopback Ollama backends by default. Reporting on 25 August also states that NVIDIA has remediated the issue in the current NemoClaw release. The platform matrix in the public accounts is not fully consistent, so verify the behaviour of the build you actually run rather than relying on a version number alone.
Why it matters for IndiaLocal inference is what the careful teams chose. Indian firms run models on their own hardware precisely so that client code, customer records and regulated material do not leave the premises, which is the reasonable reading of both Digital Personal Data Protection Act obligations and most client contracts. This finding therefore lands on those teams rather than on the ones sending everything to a hosted API. The persistence is the part to note. The usual response to an agent behaving strangely is to restart it or clear the conversation, and neither of those touches the template.
ActionUpdate NemoClaw, then confirm for yourself whether anything is listening on port 11434 beyond loopback, on developer machines and on shared inference hosts alike. Put a host firewall in front of local inference APIs rather than relying on the service to protect itself. Record a hash of the model templates you deploy and compare it periodically, because a changed template will not appear in any prompt-level log. Treat a local model server as a service that needs authentication, network policy and change monitoring, not as a desktop utility.
SourceOasis Security via Cyera research write-up (25 August 2026); The Hacker News (25 August 2026); Security Boulevard (25 August 2026); SiliconANGLE (25 August 2026); CSO Online (25 August 2026).
3
Opening somebody else's repository in Amazon's agentic editor was enough to send local files to a stranger
Mindgard published the finding on 27 August 2026, authored by Fergal Glynn. Text placed in a repository steers the Kiro agent into reading sensitive local files and writing what it finds into the editor's own configuration; a later editor capability then turns that modified configuration into an outbound request to an endpoint the attacker controls. The vehicle is Kiro Powers, the bundles that carry MCP server configuration and contextual knowledge, together with steering files sitting in the workspace. Two developer actions are needed, and neither of them looks suspicious: opening the project through File then Open Workspace From File, rather than opening the folder directly, and afterwards sending the agent any message at all. No malicious prompt is typed by the user, and Mindgard assessed exploitation difficulty as low. The work was verified against Kiro IDE 0.7.45 on Windows, and Amazon fixed it in 0.8.140 following responsible disclosure; the current release is 1.0.337. No CVE has been assigned, and Mindgard records that Amazon's CNA team is still assessing eligibility.
Why it matters for IndiaOpening an unfamiliar repository is routine work in Indian services firms and GCC engineering teams. Client codebases, forked dependencies, vendor samples and candidate take-home submissions all arrive that way. Agentic editors generally reached those machines by individual choice rather than by IT issue, so most organisations cannot presently answer which version each developer is running. The failure does not sit at one point in the chain, it runs the whole length of it, and the middle step is the one worth internalising: the agent wrote to its own configuration, and that configuration later became network traffic.
ActionMove every Kiro installation to 0.8.140 or later, and prefer the current release. Build an inventory of agentic editors, MCP servers and Powers bundles on developer endpoints, since standard software asset management does not cover any of this. Treat agent configuration files and repository-carried steering files as executable content: put them under pull-request review and alert on modification. Do not let an agent write to its own configuration without a person approving the change. Machines used to open untrusted repositories should hold no standing credential worth exfiltrating.
SourceMindgard (27 August 2026); The Hacker News (27 August 2026).
4
Palo Alto Networks counted the AI-enabled malware in circulation and found that roughly ninety-seven per cent of it had never left a sandbox
Unit 42 published "The State of AI-Enabled Malware" on 25 August 2026, written by Sara McBroom. The team assembled 405 unique samples from WildFire analysis reports, VirusTotal Intelligence and published open-source research, using deliberately broad inclusion criteria: anything where AI was a working component, part of the delivery mechanism, or merely part of the name. Around 97 per cent of those samples were found only in research repositories, sandbox environments and security-validation platforms. Twelve, about 3 per cent, appeared on protected production endpoints, across organisations in three countries, in telemetry running from December 2024 to June 2025. Unit 42's detection finding is narrower than the headline suggests and should be read as written: its own products detected and blocked every sample that attempted to reach a customer environment, and none of them required a new detection method. The non-production majority divided into proof-of-concept and research code, security-validation submissions, and AI-themed brand abuse where the label was cosmetic. The production detections were largely familiar names: FunkSec ransomware in seven variants, the Oyster backdoor delivered as CleanBoost, the Rhadamanthys stealer, a trojanised recipe application and a COM-hijacking library. Unit 42 reported no concentration by sector or geography, and the report does not attribute any of this activity to targeting of India.
Why it matters for IndiaThis is a measurement rather than a forecast, and the useful part is the proportion. Indian boards are being asked to fund AI-specific malware defences on the strength of demonstrations, and demonstrated capability is running well ahead of deployed capability. The broad inclusion criteria mean the 3 per cent figure is, if anything, generous to the category. None of this says nothing is coming. It says that the defensible position for a CISO asked about AI malware this quarter is that conventional controls are currently catching what has been observed, and that the budget argument is stronger for detection engineering and patch cadence than for a new product line. One caution on reading it: this is one vendor measuring what its own sensors saw, over a telemetry window that closed in June 2025, so treat the proportion as a well-evidenced indication and not as a census.
ActionDo not stand up a separate AI-malware programme or an exception path for one. Confirm that existing controls genuinely observe script, binary, library and installer behaviour rather than resting on reputation. Keep sandbox detonation on the paths by which files enter the organisation. Watch for AI-themed brand abuse in software procurement and on developer machines, because a filename is the cheapest part of this to fake. Give leadership the proportion alongside the headline, and revisit the position when a comparable count shows it moving.
SourceUnit 42, Palo Alto Networks (25 August 2026).
AI defender tip: The connecting thread is placement. In three of these four cases nothing had to be understood about how a model reasons. A registry was reachable from the internet with a cloud role attached to it. An inference server was bound to every interface so that a container could reach it, and nothing else stood between it and a webpage. An editor allowed text from a repository to rewrite the settings that governed its own outbound traffic. These are the mistakes the industry has been making with databases, management interfaces and build runners for twenty years, and they are being repeated because the assets are new enough that nobody has settled who owns them. The exercise for this week takes an afternoon. List every place your organisation runs an AI component that is not simply a call to a hosted API: a registry, a vector store, a local inference server, an agent framework, an editor extension. For each one write down who patches it, what credential it holds, and what it is permitted to reach on the network. Most teams find the first column is empty, and that is itself the finding. Filling it in now costs a great deal less than doing so during an incident.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
