📰 The CyberSignal Daily — August 9, 2026

The AI-agent attack surface took the brunt of yesterday's news: a zero-click hijack class jumped vendors to steer both Anthropic's Claude and OpenAI's ChatGPT Atlas from ordinary emails and X posts, while AWS, Google and Vercel raced out patches for agent frameworks that could fire tools with no model in the loop — skipping every model-side guardrail. Underneath the AI story ran the usual infrastructure grind: Cisco shipped fixes for a dozen Catalyst SD-WAN and IOS XE flaws (three at CVSS 9.9), a maximum-severity Metabase zero-day is being exploited in the wild, and OpenAI and Anthropic visibly diverged on frontier-lab safety posture. The through-line: guardrails that assume the model is in the loop are exactly the ones attackers are learning to route around.

Vulnerabilities

Cisco's newest hardening release fixes 12 vulnerabilities across Catalyst SD-WAN and IOS XE, with three rated CVSS 9.9 and a fourth at 9.8. Cisco says none are being exploited yet, which turns this into a patch-priority exercise rather than an emergency scramble.

That "not yet exploited" window is the whole opportunity. Take the criticals first, then schedule the rest by exposure — internet-facing SD-WAN controllers and management planes ahead of everything else — before proof-of-concept code closes the gap.

→ Read the full story

AI Security

A zero-click class of attack has jumped vendors. Zenity's research shows malicious instructions hidden in ordinary emails and X posts can quietly steer the AI browsers from both Anthropic's Claude and OpenAI's ChatGPT Atlas — no click required, and no confirmed patch from either company at disclosure.

This is prompt injection graduating from a single-product quirk to a cross-vendor pattern, and the "zero-click" part is what should worry defenders: the payload rides in content the agent reads on your behalf. Until fixes land, constrain what these browsing agents can act on, keep them away from sensitive accounts, and treat any AI browser as an untrusted intermediary.

→ Read the full story

Vulnerabilities

Metabase warned that a maximum-severity flaw in its business-intelligence platform is under active exploitation as a zero-day. The bug scores CVSS 10.0, carries no CVE identifier yet, and lets an unauthenticated remote attacker inject arbitrary SQL into the application database — a path to full admin access with no credentials.

BI tools sit directly on top of an organization's most sensitive data, so an unauthenticated pre-auth flaw here is about as bad as it gets. If you run Metabase, patch immediately, restrict its network exposure, and hunt for unexpected SQL activity or new admin accounts while you do.

→ Read the full story

AI Security

Researchers showed that AI agents built on frameworks from AWS, Google and Vercel could be made to execute their tools with no model turn in the loop — skipping the model-side guardrails that are supposed to vet every action. All three vendors have since shipped patches.

The lesson generalizes beyond these three: if your security controls live only in the model's reasoning step, an attacker who can trigger tools directly walks straight past them. Upgrade to the fixed framework versions, then verify that tool execution in your own agents can't be invoked outside the guarded path.

→ Read the full story

Policy & AI

Three developments point the same way: OpenAI is tightening controls around its Astra model while Anthropic loosens them around Fable, a researcher claims to have taken control of a ChatGPT sandbox, and Irregular — the firm tied to recent AI-testing incidents — won't say whether there were more. Together they mark a visible divergence in how the frontier labs are handling safety.

For defenders, the takeaway is to stop assuming uniform vendor safety. If your stack spans multiple model providers, their guardrails, sandboxing, and disclosure practices are drifting apart — so evaluate each one on its own merits rather than treating "frontier lab" as a single trust tier.

→ Read the full story

Strip the vendor names off yesterday's headlines and the same fault line runs through nearly all of them: the guardrail that assumes the model is in the loop. Zenity's zero-click research steers Claude and ChatGPT Atlas by feeding instructions to the agent as it reads. The AWS, Google and Vercel flaws let tools fire with no model turn at all. Even the Rovo data-leak story from the wire is the same shape — an AI assistant coaxed into acting against its own user. The industry spent two years building safety into the model's reasoning step; attackers spent yesterday demonstrating how to route around it.

The infrastructure stories aren't a separate track so much as the reminder of what's at stake when the routing works. Cisco's dozen fixes, the Metabase 10.0 zero-day, and LoadMaster's arrival on CISA's must-patch list are all about the control-plane systems that sit above everything else — and an AI agent with broad access is now one more control plane on that list. Patch discipline and agent discipline are converging into the same job.

Then there's the trust question the frontier-lab split makes concrete. OpenAI tightening Astra while Anthropic loosens Fable is a small signal with a large implication: "frontier lab" is not a uniform safety tier, and multi-provider stacks inherit whichever posture is loosest. The defensible move is to stop treating the model as the last line of defense at all — put deterministic controls around tool execution and data access, and assume the reasoning step can be talked out of anything.

Stay sharp. Stay ahead.

Till next time,

The CyberSignal Team

Our News Site | Get the Weekly Briefing