Today’s digest is about trust boundaries that quietly stopped holding: a government training portal breached for the better part of a year before anyone noticed, an AI agent sandbox that turned out not to be a sandbox, a single link that could plant a rogue AI insider inside a company’s enterprise apps, and a Linux hardening fix that introduced the exact race condition it was meant to prevent. Here’s what changed since yesterday’s digest.
Breach watch: Hackers sat inside South Korea’s diplomatic training system for ten months before anyone noticed
South Korea’s Ministry of Foreign Affairs disclosed that an unknown threat actor exploited a vulnerability in the Korea National Diplomatic Academy’s online education platform as early as April 2025, then moved through the system undetected until an outside government authority flagged abnormal access in early February 2026 — roughly ten months of dwell time. The platform, stood up in 2022 for remote training during the pandemic, was still being used for staff training and video conferencing for both active and former ministry personnel. The exposed data includes names, user IDs, email addresses, and encrypted passwords belonging to at least 6,000 individuals, including around 350 currently serving overseas attachés. The ministry held the disclosure until July, citing the sensitive nature of the incident and the time needed for a full review. BleepingComputer · Help Net Security · GBHackers
A ten-month gap between compromise and detection — caught only because a different agency noticed the anomaly — is a strong argument for cross-checking your own detection coverage against systems nobody thinks of as “production”: training portals, video-conferencing tools, and other low-priority platforms are exactly where dwell time goes unmeasured because nobody’s watching the logs.
AI security watch: A researcher escaped Claude Cowork’s Linux VM to read SSH keys and cloud credentials on the host Mac
Security researcher Oren Yomtov, publishing through Accomplish AI under the name “SharedRoot,” detailed a sandbox escape in Anthropic’s Claude Cowork that let a session running inside its unprivileged Linux VM reach the full macOS host filesystem. Cowork mounts the host into the VM over VirtioFS at /mnt/.virtiofs-root, a path intended to be accessible only to root inside the guest — but Yomtov found a way for the ordinary session user to obtain guest-root privileges, at which point the mount handed over everything on the host a logged-in user could read: SSH private keys, cloud credentials, and other local files, all reachable by content the agent was merely processing. Accomplish AI estimated roughly 500,000 macOS users running local Cowork sessions were exposed before the issue was patched; Anthropic has since shifted Cowork to cloud execution by default, which sidesteps this specific local-VM escape path. The Hacker News · GBHackers · SC Media
If you’re piping SIEM data or credentials through any local AI-agent sandbox — including your own SOC Agent integrations — this is a reminder that “runs in a VM” and “isolated from the host” are not the same claim. Verify what’s actually mounted into an agent’s execution environment, not just what its documentation says should be off-limits.
AI security watch: A single phishing link could forge a fully authorized rogue agent inside any ChatGPT Workspace
Zenity Labs disclosed “AgentForger,” a now-patched vulnerability in OpenAI’s ChatGPT Workspace Agents that let a single crafted link silently build, authorize, and deploy an autonomous AI agent inside a victim’s organization — with no confirmation dialog for the employee who clicked it. The forged agent inherited the full set of enterprise integrations the employee had already granted ChatGPT: email, calendar, cloud storage, and collaboration tools, giving an attacker an agentic foothold that could run internal reconnaissance or stage business email compromise entirely on its own. Zenity reported the flaw to OpenAI through Bugcrowd on June 4, 2026; OpenAI acknowledged it within a day and shipped a fix within four, and Zenity found no evidence of exploitation before the patch landed. The Hacker News · SecurityWeek · The Register
Paired with today’s Claude Cowork escape, this is the second story this week where an AI agent’s inherited permissions turned out to be the actual attack surface, not the model itself. If your team is standing up agent-based tooling — including MCP-connected access to your own SIEM data — the access an agent inherits from its human owner needs the same scrutiny as a service account, not the implicit trust of a chat window.
Vulnerability watch: A “least privilege” hardening change in Ubuntu’s snap-confine handed local users root instead
Qualys TRU disclosed CVE-2026-8933, a CVSS 7.8 local privilege escalation in snap-confine affecting default installs of Ubuntu Desktop 24.04, 25.10, and 26.04. The bug traces back to a mid-2025 hardening change that moved snap-confine from a setuid-root binary to a set-capabilities model as part of a least-privilege initiative — and introduced a race condition in the process. An unprivileged local attacker mounts a FUSE filesystem over a temporary scratch directory the instant it’s created, then races a symlink into place before snap-confine’s open() call follows it and writes to an arbitrary target; a second race widens the resulting file’s permissions to 0666 before ownership transfers to root. To get around AppArmor confinement, the exploit drops a malicious rules file under /run/udev/rules.d/ — a path with read-write access — and triggers a FUSE mount/unmount cycle to make systemd-udevd execute it as root. Canonical’s fix adds O_NOFOLLOW to the file-creation call and shipped in snapd 2.76.1. Security Affairs · Qualys · Infosecurity Magazine
A security hardening change that quietly regresses into the exact class of bug it was designed to prevent is a good reason not to treat “this was hardened last year” as a reason to skip re-testing it. If you run Ubuntu Desktop fleets, confirm you’re on snapd 2.76.1 or later rather than assuming last year’s least-privilege migration is still holding.
Also noted: GitHub cuts public bug bounty payouts by half, moves top rewards behind an invite-only VIP tier
Effective today, GitHub cut its public bug bounty rewards across every severity tier — critical drops from up to $30,000 to a flat $10,000, high from $20,000 to $5,000 — while introducing a permanent invite-only VIP tier paying $30,000 or more for critical findings, open only to researchers with a track record of accepted reports. GitHub says the restructuring is meant to cut noise (following a May 2026 policy change requiring working proofs of concept) and get established researchers faster responses. Reports already filed or sitting in GitHub’s triage queue before today keep the old payout terms. The Hacker News · The Register
Final thought
Three of today’s five stories are really the same story told three ways: an access boundary that looked solid on paper — a decade-old training portal nobody watched, a VM mount meant to be root-only, an agent’s inherited enterprise permissions — turned out to be exactly where the compromise happened. As agentic AI tooling spreads through both attackers’ and defenders’ workflows, the permissions an agent silently inherits deserve the same audit trail as any human account. For more on scoping what an AI agent can actually touch in your environment, see our guide to building an MCP server for safe SIEM log access or book a discovery call.