Evolve on Sundays: When AI Agents Crossed the Boundary

1. AI cybersecurity evaluations reached real organizations

Anthropic reviewed 141,006 cybersecurity evaluation runs and found three incidents in which Claude models reached the internet and gained unauthorized access to three organizations.

The headline version—“AI agents escaped and attacked real companies”—is directionally alarming but technically incomplete. Anthropic's review describes three different failure paths, three different model responses, and a shared infrastructure mistake: the models were explicitly told that their capture-the-flag environments had no internet access, but a misunderstanding between Anthropic and its evaluation partner, Irregular, left a live path open.

That difference matters. The Claude models did not decide to abandon their assigned task and select unrelated victims. They continued trying to capture a fictional flag while holding a false belief about which systems were part of the exercise. The harm was real, but understanding the failure requires separating the objective, the model's situational interpretation, and the controls surrounding it.

2. Coordinated attacks disrupted more than 30 water systems

Minnesota activated statewide cyber incident response after attackers targeted operational technology at more than 30 community water systems. Reported actions included changing programmable logic controller passwords, modifying network settings, disconnecting equipment, and forcing some operators to switch temporarily to manual operation.

CISA subsequently warned of increasing activity against internet-exposed PLCs in the water and wastewater sector. The agency urged operators to remove operational technology from direct internet exposure, use VPNs or secure gateways where remote access is essential, replace default credentials, and restrict access by source address.

The exposure problem is larger than one state. In a July 30 snapshot, Censys identified 4,148 exposed Rockwell/Allen-Bradley hosts, 4,117 Siemens SIMATIC S7-1200 hosts, and 2,072 Schneider Electric hosts. Censys emphasized that these were exposure counts—not confirmed victims—and that its Schneider Electric figure was vendor-wide rather than limited to PLCs. Undocumented cellular modems installed by operators, vendors, or integrators can create paths that do not appear in the organization's normal asset inventory.

Why it matters: water and wastewater environments turn a digital configuration change into a physical operational problem. For Gulf countries and the wider Middle East, where treatment, distribution, and desalination are foundational services, OT exposure is a direct resilience issue.

Week-ahead action: inventory PLCs, HMIs, engineering workstations, gateways, and cellular modems; remove direct exposure; replace default credentials; verify manual operating procedures; and test whether operators can recover access when device passwords or addresses are changed.

3. OWAReaper turned a malicious email into durable mailbox access

Proofpoint described a Russian state-sponsored campaign exploiting CVE-2026-42897 against on-premises Microsoft Exchange Outlook Web Access. The cross-site scripting flaw allowed attacker-controlled JavaScript to run when a user opened a crafted email in OWA—without requiring a link or attachment.

The resulting OWAReaper backdoor executed inside the reading pane. It could collect account information, attempt credential theft, abuse Outlook add-in permissions to obtain OAuth tokens, and modify server-side folder permissions. Those permission changes could preserve mailbox access even after the victim's password was changed or endpoint was rebuilt.

The attackers also used multiple command-and-control and exfiltration paths, including GitHub commit searches, email messages, HTTPS, and a DNS fallback. The design shows how a webmail compromise can survive remediation focused only on the user's device.

Why it matters: email is not merely a delivery channel. In browser-based enterprise applications, the message renderer, mailbox permissions, OAuth tokens, add-ins, and offline caches form an application platform with their own persistence paths.

Week-ahead action: patch affected on-premises Exchange systems, hunt for the published indicators, review mailbox and folder permissions, audit high-privilege add-ins and OAuth grants, and do not treat password rotation or endpoint reimaging as complete remediation.

4. AWS connected major npm compromises to North Korea

Amazon attributed compromises involving the popular debug, chalk, axios, and related npm packages to the North Korea-linked Sapphire Sleet group with medium confidence.

The campaign relied on social engineering maintainers and then publishing malicious releases through trusted accounts. Amazon said the attackers tested techniques through smaller packages before moving toward widely used dependencies. The company also highlighted a broader evolution: malicious functions distributed across multiple packages, externally retrieved payloads, environment-aware execution, long-term contributor personas, and package names chosen to exploit errors made by AI coding tools.

Why it matters: package ecosystems distribute trust at software speed. A maintainer account can become an entry point into thousands of development and production environments, while automation may install an update before defenders understand that ownership has changed.

Week-ahead action: require phishing-resistant MFA for maintainers, pin and delay dependency updates, verify provenance, alert on publisher and ownership changes, inspect install scripts, and prevent coding agents from installing newly discovered or hallucinated packages without approval.

5. Exploited management-plane flaws demanded more than routine patching

Cisco disclosed active exploitation of CVE-2026-20316 in Secure Firewall Management Center. Static credentials for a low-privilege account allowed unauthenticated remote access to affected systems and could be chained with other vulnerabilities to escalate privileges. Cisco released fixes and indicators of compromise but no workaround.

Arista separately patched CVE-2026-16812, a maximum-severity unauthenticated command-injection flaw affecting on-premises VeloCloud Orchestrator. Successful exploitation could compromise the orchestrator, its managed data, and potentially connected edge devices. Hosted and dedicated deployments had been patched before public disclosure.

Why it matters: management systems sit above the devices they control. Compromise of a firewall manager or SD-WAN orchestrator can expose configuration, credentials, certificates, network topology, and a path toward many downstream assets. Installing an update does not remove an attacker who arrived before the patch.

Week-ahead action: apply the vendor fixes, restrict management interfaces to administrative networks, use the published indicators, review configuration and administrator changes, rotate exposed credentials and certificates, and rebuild compromised instances when integrity cannot be established.

6. A fake Teams support call reached ransomware in under 17 hours

Sophos documented a campaign in which attackers used external Microsoft Teams accounts to impersonate IT support staff. Targets were persuaded to open Microsoft Quick Assist or install remote-management software, after which the attackers established persistence, deployed additional access tools, moved laterally, and in at least three cases deployed Chaos ransomware.

In one incident documented by Sophos, less than 17 hours passed between initial access and ransomware deployment. Most of the social-engineering calls lasted only a few minutes.

Why it matters: employees associate collaboration platforms with coworkers and approved business activity. Attackers exploit that inherited trust, then use legitimate remote-support tools that may not trigger the same controls as malware.

Week-ahead action: restrict or label external Teams communication, require a separate verification channel for support requests, control Quick Assist and remote-management tools, alert on unexpected installations, and rehearse containment for identity-led attacks that can reach encryption within one working day.

7. Amgen's cloud breach exposed health and proprietary information

Amgen disclosed that attackers exfiltrated data from cloud environments operated by third-party service providers. The company said the stolen material included proprietary information, patient protected health information, and other data. It was still determining whether confidential business information, intellectual property, research and development material, and additional patient information were affected.

Amgen classified the incident as material on July 29 based on the volume and potential sensitivity of the files. It had not disclosed the cloud providers, intrusion method, affected population, or responsible actor by the end of the coverage window.

Why it matters: outsourced infrastructure does not outsource accountability. Sensitive data spread across multiple provider environments can leave identity, logging, retention, and incident-response responsibility divided among organizations precisely when investigators need a unified view.

Week-ahead action: map sensitive information across SaaS and cloud providers, confirm centralized identity and phishing-resistant MFA, collect provider audit logs, test contractual notification paths, and verify that access can be revoked across every connected environment during an incident.