2026 年 10 月安全回顧：遭濫用的合法權限與分發、AI 執行邊界

Executive Summary

Security information collected in October 2026 covered seemingly different incidents involving perimeter device breaches, authentication and token abuse, software supply chain tampering, and AI agents. Comparing these cases shows that the critical question is not just how attackers gained access. How far they could subsequently act through legitimate privileges, distribution channels, and automation shaped the scope of the damage.

Defenders should not equate successful authentication with legitimate use, judge software to be safe solely by its name or signature, or infer autonomy or successful compromise merely because a report says that "AI was involved."

Perimeter Devices and Authentication: Distinguish successful initial access from subsequent configuration changes, key extraction, and token abuse using separate evidence.
Software Supply Chain: Beyond hashes of distributed software, track when startup hooks, extensions, and web scripts execute and which privileges they use.
Offensive Use of AI and Defensive Research: Do not compare assessments of real-world compromises, capability experiments in isolated labs, and publicly released detection engine implementations using the same metrics.

This article is a cross-sectional comparison of public materials collected in October 2026. Collection dates do not necessarily coincide with the dates of attack occurrences or observation periods, and this is not a statistic showing overall increases or decreases in global incidents.

Perimeter Devices and Authentication: Distinguish What Happened After Access

Even for vulnerabilities in the same product family, the stages confirmed in public disclosures vary significantly.

Cisco Catalyst SD-WAN Manager (CVE-2026-76504): An authentication bypass using URI encoding that allows unauthenticated sources to reach the management API. Cisco became aware of active exploitation in September, and specific operations after compromise have not been publicly disclosed. Cisco Security Advisory
KeyDrift in Cisco SD-WAN (CVE-2026-20127): Detailed by Cisco Talos on October 28, this case followed exploitation of a separate vulnerability, CVE-2026-20127. Implants were placed inside management processes, and Talos confirmed their ability to extract data assessed with high confidence to be IPsec keys. However, the available evidence does not establish that the extracted keys were exfiltrated from every affected environment. Talos KeyDrift Analysis

The former deals with unauthorized access conditions to the management API, while the latter addresses observed subsequent malware capabilities. Requests bypassing authentication, configuration operations, process injection, and access to keys must be judged on separate evidence; applying a patch for one does not guarantee the resolution of another vulnerability or the revocation of already exfiltrated credentials.

The broken trust boundaries also differ across three cases involving authentication and tokens.

TA419's Microsoft 365 AiTM Phishing: After targets reply to messages impersonating experts, they are directed to fake OneDrive sites or similar pages. The attackers aim to relay passwords and MFA codes to the legitimate authentication service and capture session cookies. Although Proofpoint's list of targets includes people with ties to Japan, the activity detailed in this report focused primarily on US AI policy experts. The number of compromised organizations and the extent of subsequent use of captured sessions remain unconfirmed. Proofpoint Analysis
Docker Hub (CVE-2026-105445): An issue in which an attacker's own PAT could be reassigned to act with a target user's privileges when an account was converted into an organization. Docker's validation demonstrated the possibility of registry authentication and image manipulation, but this did not involve a takeover of the Web UI or 2FA itself, and no active exploitation has been reported. Docker Advisory
SAP Cloud SDK for Python (CVE-2026-89111): A vulnerability in multi-tenant configurations where an attacker-controlled tenant_subdomain is incorporated into the destination for OAuth2 token requests, potentially sending the client ID and secret to an attacker-controlled server. The official advisory lists two affected ranges: versions earlier than 0.45.2, and versions from 0.53.0 up to but not including 0.55.1. The fixed versions are 0.45.2 and 0.55.1. No active exploitation has been publicly disclosed. SAP Advisory

Given these differences—session relay, token ownership transfer, and flaws in controlling credential transmission destinations—simply implementing MFA does not serve as a universal countermeasure. Controls tailored to each boundary are necessary, such as phishing-resistant authentication, approval checks during privilege transfers, and restrictions on credential transmission destination endpoints.

Even with legitimate distribution channels, trust collapses the moment code is executed

Several cases in the October collection required investigation of when compromised software executed and what triggered that execution before the impact could be assessed.

LiteLLM 1.107.0: Malicious code was mixed into PyPI wheels and Docker images distributed from the official release workflow. According to the official root cause analysis, a master key exposed in a public repository in May 2026 and left unrevoked was the starting point for the privilege abuse in October. Code embedded in Python startup hooks can execute without an explicit import of LiteLLM. However, successful exfiltration of secrets has not been confirmed in every environment that downloaded the affected software. LiteLLM Official RCA
Modified Claude Code Extension on Cursor Marketplace: Two modified versions for Windows and macOS were distributed for about 11 hours on October 29, and code was identified that attempted to send beacons, add SSH keys, and establish persistence. The initially cited "up to 5,000 users" is the number of users with potential exposure, not the number of users whose systems were actually compromised via SSH. Cursor Security Advisory
Convertr Plausible CE Script Tampering: Magecart-style payment card skimming code was mixed into the analytics script on a Plausible CE server operated by Convertr and delivered to merchant checkout screens. Whether a Plausible vulnerability suspected as the entry point was actually exploited remains unconfirmed because server logs were not available for verification. Sansec Convertr Analysis
Polymarket External Monitoring Script Tampering: The active web sessions of some users visiting the site were abused to sell their positions and transfer funds. Polymarket stated that the total compensation of 3,900,000 USD comprised 2,700,000 USD associated with the attack and 1,200,000 USD attributable to trading suspensions. Treating the entire amount as stolen funds is therefore inaccurate. Polymarket Incident Information

Even under the same umbrella of "supply chain attacks," the execution boundaries vary widely, including Python startup hooks, editor extensions, checkout screen JavaScript, and active web sessions. Investigations must preserve not only hashes of distributed software but also acquisition, update, and load times, execution hosts, secrets and session privileges available in those environments, and communication and activity histories.

As foundational research related to this premise, Trail of Bits evaluated 25 package managers under conditions simulating malicious repositories. Under these experimental conditions, the only two that verified the integrity of all downloads by default were Go and vcpkg. This testing was limited to one version per tool, one package per tool, and primarily Ubuntu, and does not represent a safety ranking across all environments. The existence of a lockfile does not by itself establish that tampering will be detected and installation stopped; those mechanisms need to be checked separately. Trail of Bits Research

Do Not Treat AI's "Involvement," "Success," and "Defensive Capabilities" as the Same Thing

Comparing three AI-related reports clarifies the differences in the types of evidence and the scope that can be demonstrated.

DIVD Report on Zammad Zero-Day Chain Compromise: This compromise chained two zero-days in the Zammad support platform, where session hijacking, root privilege acquisition, and data exfiltration were confirmed, and AI agents were assessed to have been involved in the attack progression. The model used, the privileges available to its tools, and the instructions provided by humans remain unknown. It cannot be conclusively stated that the recommended migration to Zammad 7 completely remediates both CVEs, and the remediation status requires individual verification. DIVD Case Information
Anthropic Research on Self-Replicating Capability: This was an isolated experiment using eight simulated Android nodes with unauthenticated ADB, not the discovery of a worm spreading in the wild. GLM-5.2 achieved deployment to all eight nodes in four out of five trials. However, inference for GLM-5.2 itself ran on a separate server, while the inference environment set up on each node ran Llama3.1-8B. The evaluation system launched the next agent after validation checks, including accuracy checks, had passed. This therefore did not demonstrate GLM-5.2 itself running inference and self-replicating on each node. Separate distributed inference testing on real Android TV box hardware is also distinct from self-propagation. Anthropic Research
Cisco's Release of Project Quarry: This implementation evaluates AI agent messages, tool calls, and results chronologically, representing multi-step attacks using a DSL and finite-state automata. However, it is currently in alpha, and there are no published benchmarks for generalizable detection accuracy. The example involving 17,600 actions is also a counterfactual illustration, not evidence of successful detection when applied to actual incident data. Cisco Technical Explanation

These three examples represent an "actual compromise reported by a victim," a "capability experiment in an isolated lab," and the "public release of a detection engine," respectively. Because the standards of evidence differ, it is not possible to line up their metrics to discuss the success rate of AI attacks or the operational effectiveness of defenses.

Implications for Defense and SOCs

Rather than increasing individual alerts for every new technology name, the priority should be on being able to observe the moment permissions are granted and the paths through which those permissions are used. Connect cross-service evidence, ranging from perimeter device API operations to internal authentication and management processes, service account tokens to downstream APIs, and software acquisition to startup hooks or web session manipulation.

In addition, patch application, the removal of malicious distributions, and MFA configuration should not be treated individually as completion conditions for incident response. It is necessary to inspect keys and tokens that may have already been exfiltrated, remaining persistence, and downstream operation history. Keeping only evidence from the distribution stage risks missing distribution sites that were later restored to a clean state or malicious packages carrying valid signatures.

Even in AI-assisted activity monitoring, model names or User-Agent strings alone are insufficient. Focus on the sequence of operations: target selection, API requests, tool execution, result verification, and human approval. When experimenting with mechanisms like Quarry, the prerequisite is to first measure your organization's log retention conditions, the differences from normal agent operations, detection accuracy, and execution costs.

The October cases show that attackers do not always create entirely new entry paths. Checking what normally trusted connections and processes execute, and under whose privileges is a reliable starting point for reducing missed compromises.