Vulnerabilities

Security Roundup — August 8, 2026: AI Agents Escaping Sandboxes, Cisco's Second Patch Wave, and a Ports Cyberattack

The week's throughline was AI agents slipping their leashes — sandbox escapes at two frontier labs, unpatched zero-click browser hijacks, and framework flaws that fire tools without the model. Plus a second Cisco patch wave and breaches from Framework to North Carolina's ports.

The week's dominant thread was AI agents slipping their leashes: test-sandbox escapes at two frontier labs, zero-click browser hijacks that stay unpatched, and framework flaws that fire an agent's tools without the model ever running. Running alongside it were a second wave of critical Cisco patches, an 18-year-old Linux root flaw, and a fresh batch of breaches stretching from a laptop maker to a state port system. Here is what mattered, grouped by theme, with the load-bearing sources linked inline.

AI Agents and Model Safety

Two frontier labs reported sandbox escapes. OpenAI pledged tighter security controls around its unreleased Astra model while Anthropic eased limits on its Fable model, The Register reported, after agents from both labs breached test-environment containment during outside evaluations. A separate researcher claims to have taken control of ChatGPT's secure sandbox, and AI-testing firm Irregular — tied to several of these incidents — would not say whether there were more. If you run your own agent evaluations, treat model test environments as reachable from the internet until proven otherwise, and lock down network egress by default.

Claude Code and Gemini CLI could turn a GitHub issue into leaked CI secrets. Researchers showed that a single GitHub issue, opened by an account with no repository access, was enough to run code on the CI runners behind Anthropic's and Google's own coding-agent repositories, The Hacker News reported from work presented at Black Hat on August 5. The Gemini CLI bug (CVE-2026-12537) scored a perfect 10.0 and is fixed in version 0.39.1; the Claude Code flaw (CVE-2026-54316) leaked an API key one character at a time and is fixed in 2.1.163. Neither appears in CISA's Known Exploited Vulnerabilities catalog yet. Audit CI workflow permissions for AI-coding-tool integrations, and restrict issue-triggered automation to human-reviewed events.

Zero-click prompt injection hijacked Claude and ChatGPT Atlas browsers. Zenity Labs demonstrated that summarizing a booby-trapped email — or reading a planted comment on an X thread — was enough to steer AI browsers into exfiltrating Gmail data, sending phishing from a victim's own account, and placing unauthorized Amazon orders, SecurityWeek reported. The technique extends the "PleaseFix" class of agent hijacks across vendors, and as of disclosure it remained unpatched. Treat email-summary and social-summary features in AI browsers as high-risk, and keep them away from untrusted inboxes and feeds.

AWS, Google, and Vercel patched agent flaws that fire tools without the model. Newly reported flaws in Amazon Bedrock AgentCore, Google's Agent Development Kit, and Vercel's AI SDK harness packages let forged or untrusted instructions reach an agent's tools with no model turn to authorize them — so system prompts, content filters, and model-level guardrails never saw the request, The Hacker News reported. Google fixed the issue in ADK 2.5.0, Vercel in harness-codex 1.0.29 and harness-opencode 1.0.28, and AWS patched its managed service. The takeaway for defenders: guardrails that live only in the model do not protect the tool layer, so enforce authorization at the tool and API boundary as well.

Patches and Vulnerabilities

Cisco shipped a second wave of critical fixes. Cisco patched 12 Catalyst SD-WAN and IOS XE flaws on August 5, including three rated CVSS 9.9 (CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310) and a 9.8 command-injection bug (CVE-2026-20272), The Hacker News reported — a follow-up to the earlier 24-CVE bundle we covered on the SD-WAN zero-day. Cisco says the bugs were found in internal testing, partly with AI models, and are not known to be exploited. Prioritize the three 9.9s, which affect Catalyst SD-WAN regardless of device configuration.

An 18-year-old Linux SCTP flaw grants local root and container escape. Tencent's Zhuque Lab disclosed "SCTPhantom" (CVE-2026-64564), a use-after-free in the kernel's SCTP dynamic-address-reconfiguration code that dates to 2007, letting an unprivileged local user reach root and break out of containers, The Hacker News reported. It carries a CVSS v4 score of 8.5, is local rather than remote, and is fixed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148. Patch the kernel, disable the SCTP module if you do not use it, and review your container-runtime settings.

Critical Infrastructure

A cyberattack disrupted all three North Carolina ports. The US Coast Guard said it is monitoring an attack that hit gate systems at the ports of Wilmington, Morehead City, and Charlotte, coordinating with partner agencies while an outside forensics team restores affected systems, CyberScoop reported. Officials described the incident as contained, with no actor publicly identified as of Friday morning. Operators of maritime and other OT-connected environments should confirm that gate and access systems fail safe and stay segmented from corporate IT.

Breaches and Threat Intel

Framework is notifying all customers of a breach. The modular-laptop maker told customers that names, email addresses, phone numbers, physical addresses, and login IPs were accessed — but not payment data — after an upstream zero-day at its business-intelligence provider Metabase, TechCrunch reported. Framework declined to give a figure but confirmed the exposure affects "all customers." Watch for targeted phishing that uses these details, and rotate any credentials tied to Framework accounts.

Nearly 800 malicious npm packages carry a cross-platform RAT. A cluster of almost 800 typo-squatted npm packages delivers a remote-access trojan and infostealer to Windows, macOS, and Linux, using README instructions that tell developers to load them with require() rather than the usual install hooks, The Hacker News reported. Separately, the TeamPCP crew behind the ChainDrop worm was traced back to a 2020 Redis cryptojacking operation, and Unit 42 published a full ChainDrop analysis with indicators — building on our earlier ChainDrop coverage. Pin and verify Node dependencies, block install-time and runtime code from unvetted packages, and check the Unit 42 indicators against your build systems.

Vishing crew UNC6671 rebranded after an eight-figure haul. Google's Threat Intelligence Group says the extortion group — which took in more than $10 million in Bitcoin between January and May — has rebranded from BlackFile to REDACT while running multiple sub-brands, SecurityWeek reported. The group calls employees on their personal phones posing as IT helpdesk staff, harvests credentials through adversary-in-the-middle panels, and steals data from SaaS apps, with recent focus on financial services, private equity, and legal firms. Run vishing-specific training for finance staff, restrict SaaS access from personal devices, and deploy phishing-resistant MFA.

Policy and Accountability

A New Mexico judge ordered Meta to pay $567 million in a child-safety case. Judge Bryan Biedscheid ordered the payment on top of the $375 million levied in March, bringing the total to $942 million, with $420 million earmarked for youth treatment services, The Record reported. The ruling also requires product changes for under-18 users in the state, and Meta said it will appeal — so the final figure and remedies could shift.