Weekly Threat Roundup: Ransomware Dev Gets 13 Years, AI Agents Under Attack, SAP Flaw Demands Emergency Patching

A busy week in security. Here is what you might have missed.

Raindrop bags $35M to watch your AI agents misbehave

Raindrop has closed a $35 million Series A, on top of a $15 million seed round last year. The company monitors autonomous AI agents for silent failure modes — the kind that don't throw errors, they just quietly do the wrong thing. The pitch is that as agentic systems proliferate, nobody actually knows when they break. Raindrop wants to be the thing that notices.

Mandiant's new AI risk report: agents are now running full intrusions

Mandiant's 2026 AI Risk and Resilience report makes for uncomfortable reading. Attackers have stopped using AI as a research assistant and started letting autonomous agents run entire attack chains. The report documents a hijacked coding assistant that helped propagate a self-spreading worm across roughly 100 repositories, and a compromised CI/CD credential that let an attacker co-debug data exfiltration tools with an LLM in real time.

There's also a new category of weirdness worth flagging: financial damage from runaway AI reasoning. One case involved a corrupted input value that sent an accounting agent into an infinite reasoning loop, burning through over 15,000 API calls and racking up around $50,000 in cloud costs in under an hour. No attacker required for that last one — just a bad value and an agent with no off switch.

LLM-written npm malware funds a bug bounty side hustle

CrowdStrike has linked an npm information stealer called PhantomRaven to a financially motivated threat actor who also appears to operate as a bug bounty hunter. The malware, spread through typosquatted packages, shows strong signs of being LLM-authored — verbose comments, placeholder code, the usual tells. It harvests system data and CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI.

Here's the twist: there's no evidence the stolen credentials are being sold. CrowdStrike's assessment is that the operator uses the access purely to report breaches for bounty payouts. Security theatre as a business model.

Black Axe leaders extradited to face US fraud charges

Five senior members of the Cape Town chapter of Nigerian crime syndicate Black Axe have been extradited from South Africa to New Jersey. They face wire fraud and money laundering conspiracy charges spanning 2011 to 2021, covering romance scams, advance-fee fraud, and business email compromise against American victims. All five were arrested in South Africa in 2021 and have now had a decade's worth of charges waiting for them on arrival.

Ukrainian developer sentenced to nearly 13 years for ransomware

A Zurich court handed a Ukrainian IT specialist a 13-year prison sentence for developing ransomware used against multiple companies, including Stadler Rail. He has been identified as the primary developer behind the LockergOga, MegaCortex, and Nefilim ransomware families — though the court noted he was more of a technical contractor than the person calling the shots. Total estimated damages across the campaign sit at around $123 million. The verdict is subject to appeal.

NIST and CISA publish token security guidance for federal agencies

A joint NIST/CISA report is now final, giving federal agencies and cloud providers concrete implementation guidance on securing the signed tokens that underpin SSO, federation, and API access. It covers token validation, secrets management, and detection at scale. The document builds on NIST's existing security controls framework and reflects feedback from CISA's Joint Cyber Defense Collaborative. Dry but necessary reading if you run identity infrastructure.

Critical SAP flaw allows unauthenticated RCE — patch now

CVE-2026-44756, dubbed OVERPASS by the researchers at Onapsis who found it, is a maximum-severity memory corruption vulnerability in SAP's Extended Passport processing code. Critically, it fires before any authentication check occurs, meaning unauthenticated attackers can reach it over HTTP, HTTPS, and NGRFC. Researchers from Pathlock and nullFaktor confirmed remote code execution in lab testing.

The scope is broad — S/4HANA, NetWeaver, Business Suite, and more are all affected. Public technical writeups appeared within 48 hours of the patch dropping, which compresses the window considerably. SAP is calling for emergency patching of any internet-facing systems.

WordPress plugin flaw used to mass-upload webshells

Defiant has blocked over 100,000 exploit attempts targeting a critical file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin. The flaw lets unauthenticated users bypass file-type restrictions and upload PHP webshells because the plugin validates file extensions using a list supplied by the attacker rather than its own configuration. Version 2.0.3.2 fixes the issue. If you run this plugin, check your uploads directory for unexpected PHP files before updating.

TP-Link Tapo camera lets attackers skip the password entirely

OPSWAT found two vulnerabilities in the TP-Link Tapo C200 security camera. The more serious one is an authentication bypass — an attacker on the same network can replay a value from the camera's own challenge-response handshake to gain admin access without any credentials. The second bug crashes the camera's HTTPS service by sending oversized Wi-Fi credential data during onboarding. Both issues, CVE-2026-15315 and CVE-2026-15316, are patched in firmware V5_1.4.6, released in August.

Plugin4Shell: zero-click AI agent takeover via auto-updates

Researchers at Air's security lab have disclosed Plugin4Shell, a zero-click vulnerability affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The flaw abuses how these agents handle plugin auto-updates. An attacker who controls a plugin's repository can name a branch after a pinned commit hash, causing git to resolve to the malicious branch instead of the legitimate commit — bypassing SHA-pinning checks entirely. Background updates then silently push the malicious version to all installed instances, no user interaction needed.

Anthropic and OpenAI have shipped fixes for Claude Code and Codex. Microsoft has not yet patched Copilot. Google says the deprecated Gemini CLI will not be patched at all, which is a reasonable response to deprecation but a somewhat blunt one for anyone still running it.