Nobody attacked the model. Three campaigns disclosed between June 16 and July 29, 2026 reached the same surrounding layer by different routes: credentials, stored context, and trust relationships around enterprise AI systems.
The Week's Signal
On a default AWS EC2 deployment, one unauthenticated HTTP request was enough.
CVE-2026-59726 affects Ruflo before version 3.16.3, where the platform's MCP bridge is exposed without authentication in the default deployment. The GitHub advisory, published July 1, 2026, records the impact as unauthenticated tool invocation, shell access, the ability to read provider API keys from the container environment, and poisoning of the AgentDB learning store. Noma Security's writeup on July 29 validated the chain end to end against a default AWS EC2 deployment.
The word doing the work there is default. This was not a misconfiguration an operator introduced. It was the shipped posture.
Two other campaigns disclosed over the same six weeks read as unrelated until you line up what each one actually took. On June 16, JetBrains disclosed that 15 third-party plugins had been stealing AI provider API keys from its Marketplace. JetBrains removed the plugins, banned seven publisher accounts, and remotely disabled the plugins on installed instances. StepSecurity's analysis puts the campaign at roughly eight months and around 70,000 installations, and records the attacker's collection server as still responding when they checked it on June 19.
Then on July 20, Island published research on the FakeGit campaign, describing roughly 7,600 malicious GitHub repositories created by about 6,600 profiles. More than 800 of those repositories posed specifically as AI Skills or MCP servers. Delivery ran through malicious archives staging LuaJIT-based loaders, SmartLoader and the StealC information stealer. Island measured more than 14 million GitHub Release downloads across approximately 200 campaign repositories.
Three different operators. Three different delivery routes. One target class: the credentials and stored context that enterprise AI systems run on.
The Incident Ledger
Ruflo, CVE-2026-59726, versions before 3.16.3. The exposure begins at the MCP bridge, the component that brokers connections between the agent runtime and the tools it is permitted to call. In affected versions that bridge listens without authentication in the default deployment, which makes initial access a single HTTP request to a reachable port rather than anything resembling an exploit chain (T1190 - Exploit Public-Facing Application). What follows is unauthenticated tool invocation and shell access on the host. Credential access is the next step and its mechanism is specific: the provider API keys are read out of the container's environment variables, not recovered from files on disk (T1552 - Unsecured Credentials). Stored conversations are dumped from the platform's MongoDB backing store (T1213.006 - Databases). The last step is the one without a clean precedent. Ruflo maintains an AgentDB learning store that agents read on subsequent runs, and the same access permits writing to it (T1565.001 - Data Manipulation: Stored Data Manipulation). An attacker who leaves does not need to stay resident. What they wrote is read back by the system on its own schedule.
JetBrains Marketplace, 15 plugins, disclosed June 16, 2026. Initial access here is the install, and the install was voluntary. The plugins presented as AI coding assistants, a category developers were actively looking for, which is why the campaign needed no exploit at any point (T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain). The theft mechanism is worth stating precisely, because it is not credential harvesting in the usual sense. Per JetBrains, the plugin captured the API key at the moment the user typed it into the plugin's own settings panel and clicked Apply, then exfiltrated it (T1056 - Input Capture, T1041 - Exfiltration Over C2 Channel). Nothing was searched for. The key was handed over through the interface built to receive it. Two figures set the shape of this one: roughly eight months of operation, and around 70,000 installations, which is an install count rather than a verified count of distinct developers. JetBrains removed the plugins, banned seven publisher accounts, and remotely disabled the plugins already deployed. StepSecurity found the attacker's collection endpoint still responding on June 19.
FakeGit, roughly 7,600 repositories, published July 20, 2026. This campaign built a population rather than a payload. About 6,600 profiles created roughly 7,600 repositories, of which more than 800 posed specifically as AI Skills or MCP servers. That population gave the network the surface characteristics developers and tools read as trust signals: plausible authorship, plausible activity, plausible naming. Delivery ran through malicious archives triggering a multi-stage chain, with LuaJIT-based loaders staging SmartLoader and then StealC (T1204.002 - User Execution: Malicious File, T1059 - Command and Scripting Interpreter). StealC's function is credential and token collection from the host it lands on (T1555 - Credentials from Password Stores). The distribution mechanism separates this from conventional typosquatting. Island describes the operators using a technique they call AgentBaiting: the repositories were structured so that AI coding assistants, asked by a developer to find a library for a given task, would surface and replicate them. The assistant was doing what it was instructed to do. The repository population was arranged so that doing so produced the attacker's outcome. Island measured over 14 million Release downloads across approximately 200 of the campaign's repositories.
Why This One Matters
Most coverage of AI security this quarter has been about model behaviour: what a sufficiently capable system might do, how far an agent might go, where autonomy becomes a risk in itself. That conversation is live and it is not misplaced.
It is also not what happened here.
Every one of these three is a conventional compromise. An unauthenticated service reachable by default. A malicious package in a trusted marketplace. A poisoned repository population in a public registry. A security team from 2015 would recognise all three mechanisms without a briefing. What changed is not the technique. It is what now sits behind these familiar failure modes: the keys to the model, the record of what the organisation has been asking it, and the store the agent will trust on its next run.
The structural point is about entry routes, not autonomy, and the three cases divide cleanly on which route they took.
Ruflo is an exposure problem in the ordinary sense. An MCP bridge is a listening service, and this one was reachable by default on a standard cloud deployment. Every control that applies to an unauthenticated internet-facing service applied to it. The difficulty is that it plausibly entered the organisation without passing the asset register, because a team stood up an agent platform to try something and the thing they stood up happened to listen.
JetBrains and FakeGit are not that. They are developer-endpoint and software-distribution problems, and calling them internet-facing exposure would be wrong. The entry route is a trusted channel: a marketplace, a package registry, and in FakeGit's case an AI assistant acting as an intermediary between the developer and the registry. What they share with Ruflo is not the network position. It is that the governing control is a convention rather than an enforced boundary, and that the thing eventually reached is the same credential and context layer.
Two different gaps, then, with the same destination. That distinction matters because the fixes are not interchangeable, and a programme that treats all of this as one "AI security" initiative will apply the wrong control to two of the three.
The Mechanism
Strip out the specifics and the three converge on a shape.
Reach something the governing control does not cover. For Ruflo this is the default-listening MCP bridge, reachable and unauthenticated (T1190 - Exploit Public-Facing Application). For the plugin and repository campaigns it is the developer endpoint, reached through a trusted distribution channel rather than the network (T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain).
Take the credential where it already sits, or where it is handed over. None of the three needed privilege escalation. Ruflo's chain read provider keys from the container environment (T1552 - Unsecured Credentials). The JetBrains plugins captured the key at the point of entry in their own settings UI (T1056 - Input Capture). FakeGit's stealer collected from the credential stores on a developer machine (T1555 - Credentials from Password Stores).
Leave over a channel that looks like the product working. LLM API traffic, plugin telemetry and package fetches are all high-volume, outbound and expected. An organisation with no baseline for what its AI tooling normally talks to has no basis on which to call any of it anomalous (T1041 - Exfiltration Over C2 Channel, T1071.001 - Application Layer Protocol: Web Protocols).
The Ruflo chain adds a fourth step the other two do not have, and it is the one worth sitting with. Writing to the AgentDB learning store converts a point-in-time compromise into an effect that recurs without the attacker present (T1565.001 - Data Manipulation: Stored Data Manipulation). Conventional incident response assumes that evicting the intruder and rotating the credentials closes the incident. A poisoned store is read back afterwards, on the system's own schedule, as legitimate context. The eviction is complete and the effect continues.
Analytical ATT&CK Mapping
This table is an analytical mapping, not an incident report, and the basis differs by campaign. The JetBrains and FakeGit rows describe behaviour in campaigns that ran against real victims. The Ruflo rows describe a chain researchers validated against a default deployment; no in-the-wild exploitation of CVE-2026-59726 has been reported. Each row is labelled accordingly.
The Prevention Gap
Ask a security team whether unauthenticated services reachable from the internet are permitted and the answer is no. Ask whether third-party code from public marketplaces is reviewed before it runs on a developer endpoint and the answer is that there is a process. Ask whether outbound traffic from engineering systems is baselined and the answer is that there is a tool for it.
All three answers are true. None of them applied here, and they failed for two different reasons.
Ruflo failed on scope. The control set that governs an unauthenticated listening service is mature and well understood. It was not applied because the asset was not classified, and it was not classified because of how it arrived.
JetBrains and FakeGit failed on enforcement. IDE extensions on developer laptops are frequently governed by convention rather than an enforced allowlist, and eight months of quiet key theft is what a norm produces when it is treated as a control. FakeGit is the sharper version, because a repository population built to be surfaced defeats reputation heuristics precisely by manufacturing reputation. Adding an AI assistant as the intermediary that selects the dependency does not create that problem, but it does remove the last human glance at the URL.
The measurable question underneath all of this is narrower than "are we secure about AI." It is two things. What is actually reachable from outside that belongs to this new category, and if something did run in a credential-holding context on a developer endpoint, would anything in the current control set have produced a signal.
Neither question is answerable from a policy document. Both are answerable from evidence.
What To Do Before The Next One
Enumerate the reachable half as infrastructure, not as an AI initiative. The useful scope is mechanical: services listening on ports that belong to agent platforms, orchestration frameworks, vector stores and MCP bridges, wherever they were stood up and by whoever. Treat the finding date as data. A component that became reachable in April and was never registered is a governance finding as much as a security one.
Treat the developer endpoint as its own problem, with its own control. Marketplace extensions and package installation are not solved by attack-surface discovery, because nothing about them is internet-facing from your side. What applies is an enforced allowlist rather than a convention, and awareness that an AI assistant now sits between the developer and the registry as a selector. That intermediary is not malicious and does not need to be treated as such. It does mean provenance checks that assumed a human read the repository page need revisiting.
Establish an outbound baseline for AI tooling before you need one, and treat stored agent context as a data store with a write path. All three campaigns exfiltrated over traffic that is legitimate in shape; the distinguishing information is destination and volume relative to normal, which is cheap to capture while nothing is wrong and close to impossible to reconstruct afterwards. And apply to an agent's memory or learning store the questions already applied to a database: who can write, what is logged when they do, and what would be checked if a compromise were suspected. The Ruflo chain is the argument for doing that now rather than after an incident, because the poisoning step is specifically what outlives the response.
On the evidence side, this is where the digiDations portfolio is built to help. It answers the two questions the previous section ends on. HELIOS™ answers the first question. It performs continuous internet-facing asset discovery across domains, subdomains, certificates, service fingerprints and open ports, with minute-level change detection, which is the difference between knowing what was exposed at the last review and knowing what became reachable on a Tuesday afternoon. ATLAS™ answers the second, against the endpoint side: it runs realistic attacker behaviour against the controls actually deployed and compares what the security stack reported through its Log Gateway with what was executed, producing evidence of which techniques were detected, which were prevented, which passed silently, and Sigma and Suricata rules for the gaps. For this cluster the relevant behaviours are ordinary: credential access from a developer-context process, staged loader execution, and outbound collection over web protocols. The value is not in the sophistication of the technique. It is in having an answer other than an assumption.
Written by digiDations Security Research Team
About digiDations
digiDations is an AI Native cybersecurity company building Autonomous Cyber Defense to help organizations replace security assumptions with measurable confidence.
Organizations invest heavily in cybersecurity, yet few can say with confidence that their defenses will withstand a real attack. digiDations addresses this challenge by continuously discovering exposures, correlating threat intelligence, validating defensive effectiveness, and simulating real-world adversary behavior through a single AI-native platform.
Powered by the Digital Mind AI Foundation and orchestrated by TARA AI, the Autonomous CTEM Agent behind Autonomous Cyber Defense, the digiDations platform combines HELIOS for External Attack Surface Management, ORION for Threat Intelligence, ATLAS for Security Validation, and APOLLO for Continuous Automated Red Teaming. Together, they continuously measure, improve, and adapt an organization's security posture, replacing periodic assessments with continuous evidence and giving security teams measurable confidence that their defenses will perform when it matters most.
To see how your AI agent platforms, MCP bridges and developer endpoints would hold up against credential access and stored-context manipulation of the kind this issue describes, the digiDations team is happy to walk through what that validation looks like.
Sources
- Ruflo, CVE-2026-59726 (primary): NVD entry, published July 9, 2026, and the GitHub Security Advisory, published July 1, 2026.
- Ruflo (vendor research): Noma Security writeup, July 29, 2026.
- JetBrains Marketplace plugin campaign (vendor disclosure): JetBrains, June 16, 2026.
- JetBrains (independent analysis): StepSecurity, June 2026.
- FakeGit / AgentBaiting (primary research): Island, published July 20, 2026.