{"slug": "ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description", "title": "AI at the Wheel: When Hacking Stops Needing a Human\" published: false description: \"Five threats from late May 2026 mark an inflection point.", "summary": "A cluster of cybersecurity incidents disclosed in late May 2026 marks a shift from AI as a hacking tool to an autonomous operator that decides and acts independently. Sysdig's Threat Research Team documented the first known \"AI-agent-driven\" intrusion, where a large language model agent autonomously ran the entire post-exploitation phase of an attack, completing a four-stage pivot from initial access to data exfiltration in under an hour. Additional incidents, including the ChatGPhish attack disclosed by Permiso Security and the JINX-0164 cluster identified by Wiz, demonstrate AI operating as both an autonomous agent and an attack surface that requires no code execution.", "body_md": "— AI is crossing from a hacking tool to an autonomous operator that decides and acts on its own. A field analysis.\n\nFor two years, \"AI in offensive security\" mostly meant one thing: a faster human. Attackers used large language models to write phishing emails, draft malware, translate lures, or summarize stolen data. The model was a power tool. A human still held it.\n\nA cluster of incidents disclosed in late May 2026 quietly broke that assumption. In at least one case, the human let go of the wheel — and the attack kept driving.\n\nI publish an independent, OSINT-based CTI archive (TLP:GREEN), and over the past week I released five reports in four languages that, read together, sketch the same arc: **AI is moving from a tool you point at a target to an operator that picks the target's locks by itself.** Here is the field view.\n\nIt helps to think of AI's role in an intrusion as a spectrum, not a switch.\n\nMost of 2026's headlines still live in the first bucket. What makes this batch notable is that it spans all three — and includes the first credible public case of the second.\n\nThis is the headline. Sysdig's Threat Research Team documented an intrusion where a **large language model agent autonomously ran the entire post-exploitation phase** — what they described as the first \"AI-agent-driven\" intrusion they've recorded.\n\nThe entry point was a pre-authenticated RCE in an internet-exposed Marimo notebook (`CVE-2026-39987`\n\n, CVSS 9.3, now on the CISA KEV list). The flaw is almost embarrassingly clean: the `/terminal/ws`\n\nWebSocket endpoint skips authentication validation that its sibling endpoints perform, so a single unauthenticated request yields a full PTY shell.\n\nWhat happened after the shell is the point. An LLM agent ran a four-stage pivot:\n\nThe whole chain, from initial access to exfiltration, finished in **under an hour**. The agent branched on the output of each command, retried failed paths while keeping context, and selected the exact secret it needed. That is human-grade judgment fused with machine-grade speed.\n\nThe uncomfortable implication for defenders: a patch blocks the *entry*, not the *operating speed*. A sub-two-minute database dump structurally outruns the average human SOC response window. The unit of response moves from minutes to seconds.\n\nIf Marimo is \"AI as operator,\" **ChatGPhish** (disclosed by Permiso Security) is \"AI as attack surface\" — and it requires no code execution at all.\n\nThe mechanism is indirect prompt injection through a renderer trust gap. When a user asks ChatGPT to summarize a web page, the `chatgpt.com`\n\nrenderer trusts the Markdown links and images that came from that untrusted third-party page as if they were the assistant's own output. It auto-fetches the images and renders the links as live, clickable elements inside the trusted UI.\n\nThat yields three primitives: UI-redress phishing links that look like ChatGPT's own answer, spoofed \"account security\" alerts wearing the assistant's visual trust, and a QR-code pivot rendered from an attacker bucket that bypasses every desktop URL defense (the destination only resolves after you scan it on a second device). Even the auto-fetched images alone leak the victim's IP, User-Agent, and Referer.\n\nNo memory corruption. No privilege escalation. The single fact that *the model cannot distinguish its own output from external content* is enough to enable phishing, reconnaissance, and a device pivot. As of disclosure, the vendor had replied \"could not reproduce,\" so treat it as live.\n\nThe lesson generalizes well beyond one product: **AI output must be the start of verification, not the end of trust.**\n\n**JINX-0164** (named by Wiz) is a financially motivated cluster targeting crypto organizations on macOS since at least mid-2025. Its kill chain reads like a tour of every trust relationship a developer depends on:\n\n`coreaudiod`\n\n(saved as `ChromeUpdater`\n\n, persisted via `launchctl`\n\n) — `AUDIOFIX`\n\n(a Python infostealer) plus `MINIRAT`\n\n(a Go backdoor).`@velora-dex/sdk`\n\n(3 lines appended to `dist/index.js`\n\nthat fetch a shell script delivering MINIRAT on import).The TTPs overlap with North Korean clusters (BlueNoroff, Contagious Interview, UNC1069), but Wiz found no infrastructure overlap and stopped short of state attribution. That ambiguity is itself the signal: as DPRK tradecraft gets commercialized and imitated, \"who did it\" matters less than \"which trust was abused\" — recruitment trust, package trust, dev-infrastructure trust.\n\nNot every threat is exotic, and **Gogs** is the reminder. Rapid7 disclosed an unauthenticated-to-RCE chain (their rating: CVSS 9.4, no CVE yet) in the self-hosted Git service's \"Rebase before merging\" operation. A malicious branch name injects the `--exec`\n\nflag into `git rebase`\n\n, running an arbitrary shell command on the server. Any authenticated user can do it; on a default install, a user can register, create a repo, flip one setting, and own the box solo — with cross-tenant access to everyone else's private repos.\n\nIt was reported to the maintainer on 2026-03-17 and remains unpatched, with a public Metasploit module automating the whole thing against Linux and Windows. Roughly 1,141 instances sit directly on the internet.\n\nIt's a textbook argument injection — trusting user input in a shell argument. The reason it belongs in this list: self-hosted Git is the single trust anchor for source code, deploy keys, and CI tokens. In an era of supply-chain-first attackers (see JINX above), an unpatched Git server is a bridgehead. Interim mitigations until a patch lands: `DISABLE_REGISTRATION = true`\n\nand `MAX_CREATION_LIMIT = 0`\n\nin `app.ini`\n\n, plus removing internet exposure.\n\nThe Web3 entry rounds out the picture. The **KelpDAO LayerZero bridge** compromise is a study in how cross-chain security fails not in the smart contracts everyone audits, but in the **off-chain verification infrastructure** that quietly underpins them.\n\nWhen the integrity of a bridge depends on an off-chain verifier — a relayer, an oracle, a signing service — that component becomes a single point of failure. Compromise it, and asset theft follows directly, no on-chain exploit required. It's the same structural theme as the rest of this list: the riskiest dependency is the trusted component nobody is watching, whether that's an analytics notebook, an AI renderer, an npm package, a Git server, or an off-chain verifier.\n\nPut the five side by side and the pattern is hard to miss. Four of them are about **trust** — the trust we extend to AI output, to recruiters, to packages, to self-hosted infrastructure, to off-chain verifiers. One of them, Marimo, adds the new variable: **autonomy at machine speed.**\n\nThat combination is what makes the 2026 inflection real. We are leaving the world where AI was a faster pen for the attacker, and entering one where AI can be the attacker, the attack surface, or both in the same incident. Distributed egress, adaptiveness, and second-level speed are no longer advanced tradecraft — they're becoming default features of the threat.\n\nMy own framing hasn't changed, and this batch reinforces it: **an LLM is a spreadsheet, not an oracle.** It is astonishingly powerful as an instrument and catastrophic as an unverified authority — and that is exactly the line attackers are now operating along. The defensive starting point is symmetric:\n\nEach of these five is written up in depth (attack chains, IOCs, detections, mitigations, and a Korea-context assessment), published as TLP:GREEN and available in **English, Korean, Japanese, and Chinese**. The archive also tracks the broader 2026 trend lines — DPRK clusters, supply-chain attacks, AI/LLM security, and Web3 incidents.\n\n👉 **Full index and reports:** [CYBER-THREAT-INTELLIGENCE-REPORT (README, EN)](https://github.com/gameworkerkim/CYBER-THREAT-INTELLIGENCE-REPORT/blob/main/README_EN.md)\n\nIf you run exposed notebooks, self-hosted Git, crypto dev pipelines, or AI-assisted research workflows, the Marimo, Gogs, JINX-0164, ChatGPhish, and KelpDAO write-ups are the ones to start with.\n\n*Independent CTI archive · OSINT-based · TLP:GREEN. Feedback and corrections welcome via the repository's issues.*", "url": "https://wpnews.pro/news/ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description", "canonical_source": "https://dev.to/denniskim/ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description-five-threats-201j", "published_at": "2026-05-30 04:15:23+00:00", "updated_at": "2026-05-30 04:41:34.249665+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "large-language-models", "ai-tools"], "entities": ["Sysdig", "CISA", "Marimo", "CVE-2026-39987"], "alternates": {"html": "https://wpnews.pro/news/ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description", "markdown": "https://wpnews.pro/news/ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description.md", "text": "https://wpnews.pro/news/ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description.txt", "jsonld": "https://wpnews.pro/news/ai-at-the-wheel-when-hacking-stops-needing-a-human-published-false-description.jsonld"}}