=========================================== SAGE INTELLIGENCE BRIEF Saturday, June 13, 2026 =========================================== LEAD STORY Velvet Ant spent nearly a decade inside air-gapped Linux infrastructure by replacing PAM and OpenSSH binaries with nine distinct backdoored versions, harvesting credentials directly from the authentication layer itself. Sygnia's disclosure confirms the operational pattern: no new processes, no EDR flags, no anomalous traffic, because the attacker owned the mechanism that checks who's allowed in. The fix here is binary integrity verification on every Linux host, and it has to happen carefully, because replacing a live PAM module without proper sequencing locks you out. --- CONNECTING THE THREADS **Management plane as the primary attack surface.** I flagged this in early June when SD-WAN Manager exploitation confirmed attackers had moved up the abstraction stack deliberately. Tonight's Velvet Ant disclosure takes that one level deeper: they went below the application layer and compromised the OS authentication primitives themselves. PAM and OpenSSH aren't "applications" in the EDR sense. They're the floor. The consistent thread across BIG-IP, NX-OS and now PAM is that infrastructure components sitting outside standard endpoint telemetry are the preferred persistence layer for sophisticated actors. **Known-CVE exploitation pipelines targeting internet-facing management tiers.** I've been watching the pattern where packaged exploit toolkits lower the bar for less-skilled affiliates hitting known CVEs. Tonight's PeopleSoft story confirms a second, parallel track: nation-state and organized criminal actors are hitting unpatched management-tier interfaces weeks before vendors issue advisories. CVE-2026-35273 was being actively exploited for at least two weeks before Oracle published anything. Combined with last week's read that internet-facing ERP management surfaces must be treated as presumptively compromised, the posture shift here is durable: zero-day windows on COTS enterprise software are long enough that network isolation of management tiers is the only reliable compensating control. **AI agent trust boundaries collapsing.** I've been watching agentic infrastructure expand rapidly across Azure, Google and third-party tooling. Tonight's Agentjacking disclosure shows the practical consequence: AI coding agents read attacker-controlled error event fields as authoritative system guidance and execute arbitrary commands with full developer privileges. The NanoClaw/JFrog integration, Azure Container Apps Sandboxes and the general rush to wire AI agents into enterprise data sources are all happening faster than the trust model for external data ingestion has been defined. That gap is now confirmed exploitable at scale. --- IT INFRASTRUCTURE ARCHITECTURE **GitHub outages persist as AI coding traffic surges** GitHub suffered repeated downtime events this week, and Microsoft's own post-incident framing confirmed the platform was caught off guard by the volume of AI-assisted coding traffic it had been actively promoting. For any team running CI/CD pipelines on GitHub Actions, this is a reliability signal worth including in SLA conversations with dev teams. Source: https://www.theregister.com/software/2026/06/12/github-outages-persist-as-ai-coding-drives-traffic-surge/5255125 **Fired IT worker gets 21 months for sabotaging school district infrastructure** An Iowa IT worker, after termination, used retained access to sabotage his former employer's network. The case is straightforward: termination procedures that don't include immediate credential revocation and access audit are an operational gap, not just an HR gap. Every MSP managing client offboarding should be reviewing this against their own runbooks. Source: https://www.theregister.com/security/2026/06/12/fired-it-worker-jailed-for-21-months-after-sabotaging-old-school-district/5254983 **Slack eliminates SSH in EMR pipelines, migrates 700+ jobs to REST-based architecture** Slack replaced SSH-based execution across 700+ Amazon EMR pipeline jobs with a REST-driven orchestration layer. The operational payoff is auditability and access control: REST-based calls are loggable, policy-enforceable and don't require managing SSH key distribution across pipeline infrastructure. For teams still running SSH-anchored automation pipelines, this is a credible migration blueprint. Source: https://www.infoq.com/news/2026/06/slack-ssh-rest-quarry-migration/ --- CYBERSECURITY & COMPLIANCE **Velvet Ant backdoored PAM and OpenSSH binaries for nearly a decade** Nine distinct backdoored versions of PAM and OpenSSH were planted on Linux hosts inside an air-gapped network, each either accepting a hardcoded secret password or harvesting real credentials silently. The attacker's pivot into the isolated segment ran through an internet-facing web server used as a relay, consistent with Velvet Ant's prior use of F5 BIG-IP appliances and Cisco NX-OS CVE-2024-20399 for infrastructure-layer persistence. Run binary integrity checks against known-good hashes on every Linux host; don't start with password resets. Source: https://thehackernews.com/2026/06/china-linked-hackers-backdoored-linux.html **Agentjacking: AI coding agents execute attacker commands via Sentry error events** Tenet Security validated an 85% exploitation success rate across 100+ controlled tests, using nothing but a publicly exposed Sentry DSN to inject malicious instructions into error events that AI coding agents treat as trusted guidance. Exfiltrated data included environment variables, Git credentials, private repo URLs and developer identities. Sentry has declined full remediation, calling it "technically not defensible." Treat any MCP-connected external service as an untrusted data source and lock down AI agent execution permissions now. Source: https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html **PeopleSoft CVE-2026-35273 actively exploited, no full patch available** ShinyHunters has been hitting roughly 300 PeopleSoft endpoints across 100 organizations since at least May 27, with one confirmed victim losing 48 GB of data over an outbound SSH connection to 176.120.22.24. Higher education represents 68% of confirmed victims, which reflects exposure density rather than targeted selection. Apply Oracle's stopgap mitigation immediately, block outbound SSH to 176.120.22.24 and pull the Mandiant and Rapid7 IOC sets. Source: https://arstechnica.com/security/2026/06/peoplesoft-0-day-affecting-hundreds-of-organizations-steals-gigabytes-of-data/ **Microsoft June 2026 Patch Tuesday: approximately 200 CVEs, three zero-days** The largest Patch Tuesday on record. Three zero-days are included in the batch, and the Surface hardware brick-by-packet flaw that Microsoft mostly repaired this week was discovered by Copilot probing its own vendor's documentation. Prioritize this weekend; the volume alone creates triage fatigue risk. Source: https://www.techtarget.com/news/ --- CLOUD PLATFORMS & STRATEGY **Pinecone integrates with Microsoft OneLake for direct enterprise data access by AI agents** Pinecone's Nexus knowledge engine now connects directly to Microsoft OneLake, letting AI agents query enterprise data without a separate ingestion pipeline. Combined with the Azure Container Apps Sandboxes going into public preview for running untrusted agent code, Microsoft's agentic data access stack is assembling quickly. The architecture question for Azure shops is whether they're comfortable with a vector DB vendor having direct OneLake access before governance controls for AI agent data access are mature. Source: https://www.infoq.com/news/2026/06/pinecone-ai-agents-onelake/ **Azure Container Apps Sandboxes enters public preview for untrusted AI agent code** Microsoft published the ARM resource type for sandboxed AI agent execution in Azure Container Apps. This is a direct response to the operational reality that agent-executed code can't be assumed clean. For teams deploying any agentic workflows on Azure, this is the isolation primitive to evaluate before those workloads hit production. Source: https://www.infoq.com/news/2026/06/untrusted-ai-agents-sandboxes/ **KPMG AI report flagged for hallucinated citations** GPTZero's analysis found that only 5 of 45 citations in a KPMG AI report matched their sources. If a Big Four firm publishing on AI is shipping hallucinated citations in client-facing work, the credibility problem for AI-generated professional output is broader than vendor demos. Any AI-assisted research or reporting going to clients or execs needs a citation verification step in the workflow. Source: https://www.theregister.com/ai-and-ml/2026/06/12/kpmgs-ai-report-turns-into-a-demo-of-ai-hallucinations/5255029 --- NETDEVOPS & NETWORK AUTOMATION **WebMCP enters Chrome origin trials for AI agent web actuation** Google's WebMCP standard lets AI agents interact with web-based interfaces through a defined browser API. It's in origin trials in Chrome 149 now. For network teams managing web-based device management consoles, this is the first browser-native vector for AI agents to interact with those interfaces directly. The security model for browser-based management plane access needs to account for this. Source: https://www.infoq.com/news/2026/06/webmcp-web-agent-standard-chrome/ No additional notable developments tonight. --- AI IN INFRASTRUCTURE & AIOPS **NanoClaw integrates JFrog registries to secure AI agent package downloads** NanoClaw is adding JFrog registry verification to AI agent package acquisition flows, applying artifact security controls to the agent software supply chain. The underlying principle, don't give AI agents access to unverified package sources, is the same one that applies to any automated deployment pipeline. This is the right architectural instinct, and it signals that AI agent supply chain security is becoming a distinct product category. Source: https://www.theregister.com/ai-and-ml/2026/06/13/nanoclaw-integrates-jfrog-registries-to-secure-ai-agent-downloads/5255189 **Google Colab CLI opens remote notebook execution to developers and AI agents** Google's new Colab CLI lets developers and AI agents interact with remote notebooks programmatically. The enterprise relevance is that compute environments previously accessed only through a browser UI are now scriptable and agent-accessible. Any org using Colab in data or ML workflows needs to add Colab CLI access to their scope-of-access reviews. Source: https://www.infoq.com/news/2026/06/google-colab-cli/ --- HARDWARE, GPU & COMPUTE **SK Hynix plans 3x memory production increase by 2034** SK Hynix will triple wafer capacity by 2034, with the SK Group chair framing it as moving as fast as physically possible. For infrastructure planners, the signal is that HBM and high-capacity DRAM supply constraints are an eight-year problem, not a two-year cycle. AI compute expansion timelines need to be modeled against memory supply curves, not just GPU availability. Source: https://www.theregister.com/systems/2026/06/12/sk-hynix-to-triple-wafer-capacity-by-2034/5255151 **Amazon reports 2.5 billion gallons of water consumed by datacenters in 2025** AWS published its water usage figure for the first time with this level of specificity. For enterprise clients negotiating co-location contracts in water-stressed regions, water usage effectiveness is becoming a contractual and ESG disclosure variable, not just a sustainability talking point. Source: https://www.theregister.com/on-prem/2026/06/12/amazon-owns-up-to-using-25bn-gallons-of-h2o-in-its-bit-barns-last-year/5254748 --- NETWORK MANAGEMENT & MONITORING No notable developments tonight. --- MANAGED SERVICE PROVIDERS **Insider threat case reinforces MSP offboarding protocol gaps** The Iowa school district sabotage case is directly applicable to MSP operations: a terminated employee with retained access caused confirmed infrastructure damage. MSPs hold privileged access to dozens or hundreds of client environments and are the natural high-value target for an insider offboarding scenario. Access revocation, credential rotation and access audit at termination need to be SLA-grade commitments, not best-effort steps. Source: https://www.theregister.com/security/2026/06/12/fired-it-worker-jailed-for-21-months-after-sabotaging-old-school-district/5254983 **Novo Nordisk confirms clinical trial data stolen in cyberattack** Novo Nordisk disclosed that hackers stole clinical trial participant data, described as pseudonymized. For MSPs with healthcare or pharma clients, this is a reminder that pseudonymization doesn't satisfy breach notification thresholds in most jurisdictions, and client breach response playbooks need to reflect that. Source: https://www.theregister.com/security/2026/06/12/novo-nordisk-says-hackers-stole-clinical-trial-data/5254812 --- IT VENDOR ECOSYSTEM & M&A **ServiceNow acquires Armis for $7.75 billion** ServiceNow is buying Armis to integrate asset intelligence and exposure management directly into its platform. At $7.75B, this is a significant bet that enterprise buyers want unified IT operations and security posture management in a single platform. For anyone evaluating or renewing ServiceNow contracts, the Armis integration roadmap becomes a due diligence item immediately. Source: https://cybermagazine.com/cloud-security **Google files suit against Chinese phishing operation running AI-powered fraud** Google is suing the operators of "Outsider Enterprise," a Telegram-based operation accused of sending millions of AI-generated scam texts impersonating trusted brands. The litigation is notable because it's Google using its brand protection legal machinery against AI-assisted fraud infrastructure, establishing a precedent for brand-based legal action against AI fraud operations. Source: https://www.theregister.com/security/2026/06/12/google-fires-sueball-at-alleged-chinese-phishers-over-ai-powered-fraud-ops/5254841 --- EDGE COMPUTING & IOT No notable developments tonight. --- WHAT TO WATCH The Agentjacking disclosure is the story to track this week. An 85% exploit success rate against AI coding agents using nothing but a public DSN, with Sentry declining full remediation, means this class of attack is operational and accessible right now. The broader pattern is that every external service wired into an AI agent's context window is a potential injection surface, and there are no standards yet for how agents should evaluate the trustworthiness of data sources. --- CONVERSATION STARTER Tenet Security tested over 100 organizations and found that 85% of AI coding agents would execute attacker-injected commands pulled from a Sentry error event, with no phishing, no malware and no server access required. The attack surface is the AI agent's willingness to treat external service data as trusted instructions. ===========================================