Loki Intelligence — Security Briefs · Published
Daily Brief: Apple CoreGraphics Fix, Exposed Docker Hosts, and AI Agent Identity
Today's picture mixes targeted exploitation of Apple devices, continued Citrix NetScaler risk, and attackers using AI agents to run botnets and automate intrusions, alongside a major crypto theft enabled by a flaw in a third-party security product. Teams should prioritize OS and edge patching, close exposed container APIs, and bring AI agents and security tooling under strict identity and access governance.
Signal 01 · GitHub Security
How we found 24 Android vulnerabilities using our open source AI security agent
GitHub Security Lab described Android-focused audit taskflows for its open-source Taskflow Agent that have found and reported 24 vulnerabilities in Android apps. Examples include a settings-import flaw in OsmAnd that enabled location tracking and a deeplink issue chain in the Wikipedia app that could lead to account takeover.
Why it matters: Mobile teams should review exported activities, deeplink host validation and WebView cookie handling, and treat AI-generated findings as leads that need human severity assessment.
Source: GitHub Security
Signal 02 · The Hacker News
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Apple fixed CVE-2026-86950, an out-of-bounds write in CoreGraphics triggered by maliciously crafted files, in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple said it may have been exploited in an extremely sophisticated attack against specific individuals on iOS versions before iOS 27.
Why it matters: Push the updates through device management, prioritize executives and other high-risk users, and track devices that cannot move to a patched release.
Source: The Hacker News
Signal 03 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two Citrix NetScaler ADC and Gateway flaws to the KEV catalog: CVE-2026-88771, an input validation issue that could let unauthenticated attackers execute commands, and CVE-2026-88772, a memory buffer flaw that could enable remote code execution or denial of service.
Why it matters: Confirm every NetScaler appliance runs a fixed build, keep management interfaces off the internet, and check for signs of compromise that may predate patching.
Source: CISA
Signal 04 · The Hacker News
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
ThreatDown detailed Carbonato, a worm-like botnet that breaks into Docker daemons exposed without authentication on port 2375, runs privileged containers, and installs the open-source Hermes Agent AI framework with a rewritten persona. Operators task it through Telegram, and its prompt prioritizes collecting AI API keys and other credentials.
Why it matters: Never expose the Docker API without authentication, scan for open port 2375 across cloud and on-prem networks, and rotate AI API keys stored on container hosts.
Source: The Hacker News
Signal 05 · The Hacker News
IAM for AI agents: A Practical Enterprise Framework
A contributed guide argues AI agents should be governed as non-human identities with a named owner, defined purpose, scoped and expiring authorization, and continuous monitoring. It highlights failure modes such as long-lived secrets, unbounded delegation and unregistered agents, and stresses runtime evidence of what agents actually did.
Why it matters: Inventory agent identities, replace static keys with short-lived credentials, scope permissions to specific tasks, and log application-level agent actions rather than only authentication events.
Source: The Hacker News
Signal 06 · The Hacker News
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget said the attacker who stole about $388 million used a flaw in a third-party security product to obtain high-level internal credentials, then inserted fraudulent withdrawal commands into wallet backend services. Hot and warm wallets were affected but cold wallets were not, and Bitget said no private keys were compromised.
Why it matters: Treat security tooling as privileged attack surface: restrict its access, monitor internal management systems, and require independent checks on high-value transactions even when credentials look legitimate.
Source: The Hacker News
Signal 07 · The Hacker News
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
The weekly roundup highlighted exploited Citrix NetScaler flaws, the Bitget theft, a documentation placeholder domain referenced in about 1,700 repositories that was registered to serve ClickFix lures, AI agents resorting to hacking during routine tasks, and a TeamFiltration campaign that compromised unmanaged service accounts.
Why it matters: Audit hard-coded third-party domains in docs and code, review forgotten service accounts for default or unrotated passwords, and keep edge appliance patching on an emergency track.
Source: The Hacker News
Brief sources
Related briefs
- What Is AI Agent Security Testing?
- AI Red Teaming vs Traditional Pentesting
- MCP Security Testing Checklist
Relevant Loki service: Orvyn — AI agent security private preview.