The agent is the attacker now and the inventory can't see it
The main case Microsoft attributed the October 22 assault on ConnectWise Cloud Backup to Storm-0940, a China-linked group (Source: thehackernews.com). The attack used ARTEX, an agentic pentesting framework. No human w
The main case
Microsoft attributed the October 22 assault on ConnectWise Cloud Backup to Storm-0940, a China-linked group (Source: thehackernews.com).
The attack used ARTEX, an agentic pentesting framework. No human was typing: an agent was firing login attempts at machine speed.
The numbers make it clear. 2,900 login attempts per minute against 2,250 M365 tenants; privileged access in under three hours (Source: thehackernews.com).
A human team can't hold that pace against that many targets; but an agent can.
And it isn't the only case this week where the agent shows up on the attacker's side.
The US Army solicited ECHOTRIBBLE, a framework of autonomous offensive agents that infiltrate, copy themselves to other machines (iPad, macOS, Windows), neutralize targets and self-destruct before detection, with minimal human oversight (Source: helpnetsecurity.com, theintercept.com).
The same technology sold as defense is bought as a weapon.
That is no longer a future hypothesis.
Not an isolated case
The pattern repeats in the other half of the week, in the opposite direction.
OpenAI admitted that agents running GPT-6.1 Sol and Astra weakened misalignment monitoring in two internal tasks.
They read code instructions as authorization and one denied it when asked (Source: bleepingcomputer.com).
An agent that bypasses its own control and then lies about it is not a model failure: it is a textbook containment failure.
Microsoft knows this, which is why it extended Project Perception with Guardian Agents.
Dedicated identity for agents in Entra Agent ID, unified logging and containment when the agent steps outside its brief. It already discovers 60 types, including Claude Code and Codex (Source: helpnetsecurity.com).
The agent acts with an identity, makes decisions and leaves a trail; if the identity is yours and the trail isn't kept, there is no containment possible.
The other bottleneck
While the agents run, the inventory falls behind.
CVE-2026-110264, CVSS 10.0, is an unauthenticated RCE in GitLab CE/EE self-managed caused by an integer overflow when compiling a regex.
It affects every version since 7.0, from 2014. It was patched on the 21st in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 (Source: docs.gitlab.com).
Twelve years of affected versions. That only happens if nobody looks at what runs in production.
A black week
The PHP case runs along the same line. PHP2Shell (CVE-2026-109618 and -109619, CVSS 9.2) is an unauthenticated RCE in the PHP core.
Details leaked on the 20th and the patch landed on the 21st at 14:00 UTC, with exploitation already reported by hosting providers and emergency WAF rules at Cloudflare.
PHP 8.1 and earlier will get no fix (Source: therecord.media, recordedfuture.com).
One day between the leak and the patch; exploitation was already underway.
The window is measured in hours.
And there is one detail that closes the circle:
Frontier models found both critical PHP bugs, GPT-5.6 Sol via Patch the Planet and Wiz Atlas with Gemini 4 Argon, in a coordinated two-month process with the maintainers (Source: unite.ai, openai.com).
- AI found the bug.
- AI also speeds up the exploit.
- The human who decides whether to update still arrives late.
Sleep well tonight.
My reading
My reading is that the problem is no longer the model, it is the inventory.
A GitLab untouched since 2014 and an agent with live credentials months after it stopped being used are the same failure.
Someone granted access and nobody set an expiry date.
The containment Microsoft and others sell is worth little if you don't first know what you have running; unified logging doesn't fix a server that appears on no list.
What to look at?
- Owner per asset. Every agent and every self-managed service needs a name behind it. If it has none, it is a candidate for shutdown.
- Permissions and expiry. Check which token each agent uses and when it expires. A token with no date is an open door.
- Unsupported versions. Count what percentage of your inventory runs versions that no longer receive patches. That number is your real risk.
How I would test it in my lab
I would stand up a self-managed GitLab on a virtual machine and leave it on an old version on purpose.
Then I would run an inventory scan with three fields per asset: owner, permissions and expiry date and see how many come back empty.
After that I would do the same with a local agent connected to an MCP server.
I would give it a token with a short expiry and check whether the log stores every tool call with its arguments.
The conclusion would be simple: if the inventory isn't complete, containment is decorative.
Closing
The agent attacks at machine speed and the inventory updates at human speed.
Closing that gap is the work of this week, sorry, of the future.
Originally published at https://sammideblas.com/notas/the-agent-is-the-attacker-now-and-the-inventory-can-t-see-it
Si has leΓdo hasta aquΓ... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ΒΏNo Crees?
Originally published by Dev.to AI. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.