⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits  Ravie Lakshmanan  Sep 14, 2026 Cybersecurity / Hacking AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy. Here’s what mattered this week. ⚡ Threat of the Week OpenAI Agents Behind May 2026 Attack on RubyGems — The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to researchers. The event was driven by a cluster of OpenAI agents that engaged in en masse publication of thousands of packages to RubyGems in May and June 2026. "The swarm behaves extremely similarly to the German-wiki agents we previously found," researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said. The development came as Anthropic owned up to yet another incident in which its models accessed third-party systems without authorization. The new AI trespass dates back to January 2026. It involved an early version of Claude Opus 4.6 that was given a Capture the Flag (CTF) challenge. "The model discovered a machine belonging to a third party that it was able to access, and stated that it believed this third party was part of the CTF," it said . "Inside the machine, the model found a file listing a password, which it used to gain admin access to the system." The model went on to collect more credentials, altered a system setting to make the system easier to reach, and read personal information belonging to one individual connected to that unnamed organization. It may have done more but for the fact that it exhausted its allotted computing budget, causing the session to come to an end. Many incidents involving agents from frontier AI labs acting against their programming to escape restrictions in pursuit of their goals have heightened concerns over the increasing capacity of AI models and developers' ability to contain them. While AI developers have a responsibility to build guardrails that prevent models from conducting harmful actions, the incidents also highlight the responsibility of companies performing these evaluations to set up their testing environments properly. While AI companies routinely highlight their models capabilities, much less is said about accountability if those safeguards prove insufficient, or about who bears the consequences when increasingly capable systems are misused despite those controls. OAuth & MCP Investigation Checklist: 4 Steps to Assess Risk OAuth grants enable data sharing across apps, AI tools, and MCP servers, and most go unreviewed. Learn four steps for finding risky grants and closing the gaps before they turn into a security incident. Get the Guide ➝ 🔔 Top News Anthropic and Google Detail Abuse of AI — Threat actors are increasingly integrating AI capabilities into multiple stages of an attack lifecycle with an aim to automate and scale their operations. "Over the past quarter, threat actors have moved beyond simple prompt-based LLM interactions to integrate AI capabilities into multiple stages of an attack lifecycle," Google Threat Intelligence Group (GTIG) said. "While traditional script-based automation has long been a staple of threat actor operations, groups are increasingly upgrading these workflows, creating highly autonomous systems capable of reasoning through complex tasks and making dynamic decisions without the need for human oversight." GTIG said it "has not yet observed threat actors deploying fully autonomous pipelines against targets in the wild," with the adversarial adoption of agentic AI signaling "a gradual maturation of tradecraft," as adversaries employ commercial and open-weight models to turn public disclosures and patch delays into working N-day exploit code, refining their tooling, and progressing "toward constructing functional, multi-stage exploit chains." Threat Actors Exploit New Vulnerability Chain — Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The exploit chains together two Google Chrome flaws (CVE-2026-85046 and CVE-2026-87491) and one in Microsoft Windows Advanced Local Procedure Call (CVE-2026-85880) to deliver a previously undocumented exploit kit called BlueMoon. The exploit chain has been put to use by four espionage-focused clusters, three of them assessed to be China-aligned. Proofpoint said it observed less than 20 organizations targeted globally as part of the campaigns. The episode fits a recurring pattern in which otherwise separate China-linked threat actors obtain access to the same offensive tooling at about the same time, raising questions about a digital quartermaster that supplies them with the same tool, or if it's being sold to multiple threat actors as a service. Disgruntled Researcher Drops New Microsoft Defender PoC — The disgruntled security researcher known as Chaotic Eclipse has dropped a proof-of-concept (PoC) for yet another zero-day in Microsoft Defender. The vulnerability, codenamed ShieldCrash, is assessed to be a patch bypass for CVE-2026-69414 (CVSS score: 7.8), also called ShieldBreak, which the researcher reported last month. ShieldBreak itself was a bypass for another Defender flaw called RoguePlanet (CVE-2026-50656). The release of this new zero-day is the latest in a long back-and-forth between the security researcher and the software giant over the company's alleged handling of their bug reports. The researcher has since revealed himself to be Abdelhamid Naceri , a former Microsoft employee who said he was fired in September 2024 over concerns that he "put the company and customers at risk by sharing vulnerability information with external parties." Naceri has been previously credited with CVE-2021-41379 and CVE-2021-24084 . Xinbi Guarantee Goes Down in Law Enforcement Action — The U.S. Department of Justice (DoJ) announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered scam services, including seizing Telegram channels used to run the service, confiscating two cryptocurrency wallets, and deploying the Scam Center Strike Force to Madagascar to help disrupt 13 scam compounds run by Chinese organized crime syndicates. The Treasury Department announced sanctions on the Chinese-language platform, Xinbi Guarantee, and two businesses it accused of supporting the marketplace's operations: Anwen Technology, the Cambodia-based developer of a cryptocurrency payment app called XinbiPay, and SafeW Technology Co., maker of an encrypted messaging application allegedly used by Xinbi's money-laundering and merchant networks. "Xinbi runs an escrow-backed marketplace that connects scam syndicates with vendors selling stolen data, fake identity documents, deepfake tools, and cash-out services, settling primarily in USDT on TRON," TRM Labs said . The marketplace is estimated to have processed over $36 billion in transactions since 2022, particularly driven by the decline of sanctioned Huione Guarantee and Tudou Guarantee. Zero-Click WeChat Worm Could Hijack Accounts and Spread via Single Call — Calif researchers disclosed details of a critical vulnerability in Tencent-owned WeChat that could be used to create a worm, dubbed WeWorm, that's capable of spreading through calls across both Android and iOS, even without the recipient answering the call. A fix for the vulnerability was pushed by Tencent on August 21, 2026, for Android (8.0.77) and iOS (8.0.76). The exploit essentially takes control of a victim's WeChat account within seconds, which then calls another contact and repeats the process without user interaction. Declining the call, however, stops the infection, but answering it or allowing it to ring allows the infection to spread. "Exploitation takes only seconds, and gives us full control of the WeChat account," Calif said. "We can read and send messages, make calls, and act on the victim's behalf." A key prerequisite is that the exploit requires the attacker to be on the victim's friends list. In a hypothetical attack scenario, an attacker could exploit another app, gain root access using techniques like those in OEMpocalypse to take over the victim's WeChat app, and use it to initiate the attack. There is no evidence the WeChat flaw was exploited in the wild. Google Play Early Access Becomes a Security Blind Spot — Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. "The same feature that shields developers from unfair criticism also strips users of the earliest warning that an app cannot be trusted," Bitdefender said. The company's analysis found thousands of Early Access apps that appeared to include fake casino and reward games, and potentially misleading utilities and applications using recognizable third-party trademarks. Many of these apps are promoted through TikTok, Facebook, and other social platforms, including advertisements featuring AI-generated deepfakes of celebrities and other public figures. Some of these apps have been found to seek unusual permissions (e.g., a QR code scanner prompting to replace the official Android launcher) and engage in clickjacking. The findings are concerning because Early Access eliminates one of the mechanisms users normally rely on to identify sketchy software: bad reviews and poor ratings. Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices — Bad actors are deploying a Linux rootkit on hacked F5 BIG-IP APM devices to intercept PHP file