Weekly Threat Briefing: Autonomous AI Intrusion, Critical Zero-Days in SonicWall, and High-Impact Enterprise Breaches

Autonomous AI Agents and Repository Vulnerabilities Accelerate Attacks

Cybersecurity researchers have documented an intrusion where autonomous AI agents breached an enterprise environment and executed ransomware within ten hours. The automated tools mapped internal networks, analyzed code repositories, retrieved root credentials from secret management systems, and manipulated cloud build pipelines—significantly reducing the timeline required for sophisticated human-led attacks.

Additionally, security analysts identified GitSpawn, a novel vulnerability class impacting popular AI coding assistants such as Cursor, Claude Code, Codex, and Grok Build. The flaw allows malicious Git repository configurations to execute arbitrary code on developer machines during initial context collection, frequently bypassing user authorization prompts. Further research demonstrated how attackers can leverage AI assistants to port existing ICS exploits across different PLC hardware models with minimal manual intervention.

Critical Flaws and Zero-Days Target SonicWall, JFrog, and EDR Solutions

SonicWall issued urgent patches for two zero-day vulnerabilities in its SMA 1000 series remote access gateways. tracked as CVE-2026-83548 (a maximum-severity pre-authentication SSRF flaw rated CVSS 10.0) and CVE-2026-83549 (a post-authentication remote code execution flaw). Both vulnerabilities actively impacted SMA 6210, 7210, and 8200v hardware and virtual appliances before patches were released.

Concurrently, JFrog resolved CVE-2026-82329, a critical authentication bypass with a 9.8 CVSS score affecting self-hosted Artifactory instances. Unauthenticated attackers exploited the flaw shortly after disclosure to acquire administrator tokens and hijack repositories. In endpoint protection news, researchers disclosed FalconFlank, a local privilege escalation technique against CrowdStrike Falcon on Windows 11 25H2 and Windows Server 2025 that abuses macro-remediation behaviors to grant low-privileged users elevated access.

Major Breaches Strike Dropbox, Thomson Reuters, and Healthcare Facilities

Cloud storage provider Dropbox reported unauthorized access to approximately 5,000 user accounts after adversaries exploited Lenovo's email account verification flow. Attackers generated unauthorized Lenovo IDs using victim email addresses to bypass standard password checks, allowing them to view and download stored files.

Meanwhile, legal technology provider Thomson Reuters disclosed a compromise of its C-Track court management software, leading to stolen court records across 11 U.S. states and Canada. In healthcare, Baylor Genetics notified 2.8 million patients and staff of a massive breach compromising personal identifiers, laboratory testing records, and Social Security numbers following unauthorized system access earlier this year.