October 19, 2026

A Java remote code execution flaw in an exposed Kafka UI instance served as the confirmed initial access vector.

The same source IP scanned more than 600 other Wiz customer environments during the same period.

Through a compromised admin API key, the agent created a user prefixed pentest in the administrators group.

Names like pentest or redteam likely help pass the activity off as an authorized test and bypass guardrails.

The agent decrypts the text in its own execution environment, then treats the result as trusted context.

The theft and exfiltration to an attacker's server take 28 seconds, in autopilot mode with a permissive model.

The mai-code-1.1-flash model carries the chain through to the end in 50% of trials, according to Adversa AI.

Reported on September 17, the finding was confirmed by GitHub but not classified as a vulnerability, with no CVE and no fix.

Government agencies and services accounted for 27% of the activity observed in 2026.

This share was 17% in 2025.

The figures come from the annual edition of the Microsoft Digital Defense Report.

Published on 14 October 2026, the first edition has 56 pages and was developed by ISO/IEC JTC 1/SC 27.

The text covers attacks on data, models and the software around them.

Clause 5.3 explicitly extends zero trust to agent operations.

No new certification badge is created by this standard, which remains an implementation guide.