GADGET CYBER NEWS WEEKLY

AI, Core Infrastructure and Control

Week ending 15 July 2026 | Five-minute briefing for CISOs

Figure 1. This week in one picture: enterprise AI, vendors, identity and core infrastructure now share the same control surface.

Signal in one sentence: This week is not about AI being clever. It is about AI becoming operational. The security question is shifting from can the model answer a question to what can the system around the model see, decide, trigger and change. That matters because attackers, vendors, governments and boards are all converging on the same prize: control.

The humour is that every vendor deck now says agentic AI. The seriousness is that some of those agents can read data, call tools, create tickets, write code, open pull requests, query identity stores and influence business workflows. Somewhere, an old firewall is whispering, I was easier to understand.

What happened this week

The most important AI security story came from Australia. On 13 July, ASD described AI model harnesses as the orchestration layer around models: planning, tool use, output verification and multi-agent coordination. ASD was blunt that the harness can be as important as the model itself, especially for complex tasks such as vulnerability discovery and exploit development (Australian Signals Directorate, 2026a).

That is a big conceptual shift for CISOs. For years, the model was treated like the risky object. Now the risky object is the engineered system wrapped around the model. A mid-tier model with a superb harness, access to tools and a pile of credentials can be more operationally dangerous than a glamorous frontier model sitting politely in a sandbox.

The United States moved in the same direction. The White House launched the Gold Eagle initiative on 14 July, presenting it as a new model for AI-enabled vulnerability coordination across government and critical infrastructure. The idea is to use frontier AI to reduce duplicative scanning, prioritize vulnerability remediation and move faster than adversaries (The White House, 2026). The phrase wartime footing appeared in the announcement. Marketing departments everywhere briefly considered, then wisely abandoned, the phrase patch harder.

Meanwhile, the patch tempo went from uncomfortable to caffeinated. KrebsOnSecurity reported Microsoft fixed at least 570 security holes in July and attributed the swollen patch count to vulnerability discoveries aided by artificial intelligence (Krebs, 2026). SecurityWeek put the July Microsoft tally at 622 vulnerabilities, including exploited zero-days in Active Directory and SharePoint Server (SecurityWeek, 2026a). Different counts, same board-level conclusion: AI is increasing the throughput of vulnerability discovery, which means patch governance is now a capacity planning problem, not just a technical hygiene task.

The vendor layer also had a rough week. SonicWall warned that attackers were exploiting two SMA 1000 zero-days, including a code injection flaw that could enable administrator command execution (The Hacker News, 2026a). SecurityWeek also flagged a critical ServiceNow AI platform defect that could allow remote attackers to execute arbitrary code (SecurityWeek, 2026b). This is the week in miniature: AI platforms, remote access devices, identity services and collaboration systems are not supporting cast. They are production control planes.

Signal	Why it matters	CISO translation
AI model harnesses are now central	Planning, tool use, verification and multi-agent coordination determine what AI can actually do.	Inventory AI workflows by authority, data access and action rights. Do not govern only the model.
Patch counts are surging	AI-assisted discovery compresses the vulnerability lifecycle and increases remediation load.	Move from monthly patch theatre to risk-based, always-on exposure management.
Remote access and AI platforms are hot	SonicWall, SharePoint, Active Directory, ServiceNow and similar systems sit close to identity and operations.	Treat exploited core vendors as incident triggers, not routine tickets.
Governments are formalising AI cyber roles	Gold Eagle and Australia’s National Office of AI point to national-level AI security governance.	Expect more policy, more scrutiny and more board questions about AI control.

Figure 2. Targeting map: the actors change, but the motives still revolve around access, influence, revenue and leverage.

Who is targeting whom, and why?

The answer is less tidy than a threat matrix would like. PRC-linked actors continue to matter because long-term access to telecommunications, cloud, transport, water and managed service pathways creates options in a crisis. ASD and CISA have repeatedly framed this as pre-positioning in critical infrastructure, not smash-and-grab espionage (Australian Signals Directorate, 2024; CISA, 2024). In less diplomatic language: if you can quietly stand in the switch room before the storm starts, you do not need to kick the door in later.

Russia-linked activity this week had a very practical flavour. The joint router advisory described FSB Center 16 actors scanning for poorly configured and vulnerable internet-facing networking devices, primarily routers, and using weaknesses such as default SNMP community strings and older Cisco vulnerabilities (CISA, 2026a). The target set included communications, energy, financial services, government facilities, healthcare and defence-related environments. That is not a random list. It is a map of national continuity.

Iran-linked actors remain important in the Middle East context and for Western organisations with exposure to energy, water, government, defence or symbolic targets. The Hacker News reported new Cavern C2 activity attributed to an Iranian MOIS-affiliated group targeting Israeli organisations (The Hacker News, 2026b). The lesson for CISOs outside the region is not that every Iran-linked campaign will target them directly. It is that geopolitical cyber operations often spill through suppliers, subsidiaries, shared platforms and copycat tooling.

North Korea-linked actors remain financially motivated, but that phrase undersells the strategic effect. SecurityWeek reported that North Korean hackers targeted open source developers in the PolinRider campaign, compromising more than 100 legitimate open source packages and repositories (SecurityWeek, 2026c). Earlier reporting tied DPRK actors to AI framework and software supply chain attacks. If your enterprise AI program depends on open source packages, developer identities and automated build pipelines, DPRK activity is not just a crypto exchange problem. It is a software trust problem.

Finally, cybercrime and hacktivism are filling the gaps between state aims and criminal incentives. The U.S., U.K. and E.U. sanctions activity around First VPN and Russian cyber networks shows how enabling infrastructure, proxy networks and ransomware support services blur the line between crime, state tolerance and strategic disruption (The Hacker News, 2026c). If the internet had a procurement department, it would fail due diligence.

Actor set	Primary targets this week	Why they care
PRC-linked actors	Telcos, routers, cloud, managed services, transport, water and government-adjacent networks.	Strategic access, pre-positioning and the ability to hold critical services at risk.
Russia-linked actors	Routers, communications, energy, finance, healthcare, government facilities and logistics.	Espionage, coercion, disruption and signalling during geopolitical pressure.
Iran-linked actors	Regional adversaries, water, energy, banks, symbolic sites and public-facing targets.	Retaliation, influence, public pressure and regional strategic advantage.
DPRK-linked actors	Banks, crypto, developers, AI frameworks and software supply chains.	Revenue, sanctions evasion, espionage and access to technology ecosystems.
Cybercrime plus hacktivists	Identity, ransomware victims, DDoS targets, data-rich organisations and exposed vendors.	Profit, attention, disruption and opportunism when defenders are distracted.

Figure 3. Enterprise AI control map: the harness, tools, data, identity and logs are now the real governance perimeter.

Enterprise AI is becoming a control plane

Darktrace’s State of AI Cybersecurity 2026 survey of more than 1,500 security leaders found that 92 percent were concerned about the security implications of AI agents across the workforce, while 44 percent were very or extremely concerned about third-party LLMs. The same research said generative AI is now part of 77 percent of security stacks, yet governance remains uneven (Darktrace, 2026). The short translation: AI is everywhere, but the operating manual is still being written in pencil.

This is why the new ASD language about model harnesses matters. A harness can coordinate models, tools, output verification and multi-step activities. In a defender’s hands, that can accelerate vulnerability discovery, triage and remediation. In an attacker’s hands, it can compress reconnaissance, exploitation, credential theft and lateral movement. The difference is not magic. It is governance, telemetry, authorization and intent.

A concrete example arrived earlier this month when researchers reported an agentic ransomware attack using Langflow. The Hacker News reported that JADEPUFFER exploited CVE-2025-3248 in an exposed Langflow instance to automate intrusion, credential theft, encryption and database wiping (The Hacker News, 2026d). Sysdig assessed the case as a documented agentic ransomware operation, driven end-to-end by a large language model (Sysdig, 2026). Even if defenders debate the exact level of autonomy, the direction of travel is clear. The attacker no longer needs to be brilliant if the workflow is.

The enterprise risk is not only malicious AI. It is also well-meaning AI with excessive permissions. A sales team’s AI assistant that can read customer data is a privacy issue. A finance agent that can modify payment workflows is a fraud issue. A DevOps agent that can deploy infrastructure is an outage issue with a cheerful productivity label. Helpful systems become dangerous when helpfulness is not bounded.

CISO move: If an AI workflow can read sensitive data, write to production, call APIs, create accounts, alter tickets, approve workflows or influence regulated decisions, it belongs in the control register. Naming it a pilot does not make it safe. It merely makes the incident report funnier.

Vendor and core infrastructure issues

The vendor story this week is that enterprise dependency has become strategic geography. Remote access appliances, identity platforms, SaaS workflow engines, AI development frameworks and managed service providers are the points where a single compromise can become many compromises. The July SonicWall and Microsoft activity reinforces the same theme as the Russian router advisory: edge and control-plane technologies are small doors into very large rooms.

The Model Context Protocol, or MCP, is another signal. SecurityWeek reported that the next MCP specification is moving toward enterprise-scale cloud-native deployments, while also introducing security questions around state identifiers, workflow hijacking and cross-tenant actions (SecurityWeek, 2026d). MCP exists because tools need a standard way to connect AI systems to real capabilities. That is useful. It is also why authentication, authorization, tenant isolation and logging cannot be afterthoughts. Connecting AI to tools is not integration. It is delegation.

Figure 4. Control-plane intrusion path: the attacker’s goal is often authority, not just malware execution.

Control surface	What can go wrong	Defensive question
AI agents and harnesses	Tool calls, memory, plugin access and multi-agent workflows can produce unexpected or unauthorized actions.	Who owns the agent, what can it do, and where are the logs?
Remote access and edge devices	Old credentials, exposed management interfaces and vulnerable firmware provide durable access.	Would exploitation trigger incident response, or only a patch ticket?
Identity and federation	Compromised sessions and privilege escalation move attackers faster than malware signatures can follow.	Can we detect abnormal use of legitimate access?
SaaS and workflow platforms	Automation permissions can turn one vendor flaw into business process manipulation.	Which SaaS systems can approve, route, pay, publish or delete?
Developer and AI supply chains	Poisoned packages, compromised maintainers and AI framework dependencies can reach production through normal build paths.	Can we block untrusted execution before it runs?

Figure 5. Australia FY2024-25 in review and the next threat turn for AI, FOCI and critical infrastructure.

Australia: from AI policy to national operating discipline

The local Australian signal is unusually coherent this week. On 15 July, IT Brief reported the creation of a National Office of AI to coordinate standards, governance and industry engagement across portfolios (IT Brief Australia, 2026a). That sits beside the June Microsoft and Australian Government digital resilience memorandum, which covers secure cloud, cybersecurity, AI and critical infrastructure protection (IT Brief Australia, 2026b). Together, they suggest AI policy is moving from “innovation theatre” to national capability management.

The last Australian financial year explains why. ASD’s 2024-25 Annual Cyber Threat Report says state-sponsored cyber actors continue to target Australian governments, critical infrastructure and businesses for state goals, including the possibility of degrading or disrupting critical services during moments of strategic advantage. It also says ASD notified critical infrastructure entities of potential malicious activity more than 190 times, up 111 percent from the previous year (Australian Signals Directorate, 2025). That is not a background hum. That is the smoke alarm asking why everyone is still in the meeting room.

FOCI also moved from policy jargon to practical cyber governance. Home Affairs defines Foreign Ownership, Control or Influence risk as the ability for vendors to be directed through direct ownership, foreign domestic laws or outside influence. Its guidance warns that procuring technology vendors subject to FOCI can expose organisations to undue influence, unauthorised access, bulk data exfiltration, theft of intellectual property or sabotage (Department of Home Affairs, 2026a). Cyber.gov.au’s procurement guidance adds that outsourced AI applications and cloud services may be located offshore and subject to lawful or covert data collection without customers’ knowledge (Australian Signals Directorate, 2026b).

The board translation is simple. Vendor risk is no longer just whether the supplier has SOC 2, ISO 27001 and an impressive portal with too many pie charts. It is also where the supplier is owned, where the data goes, who can compel access, what subcontractors sit underneath it, what privileged paths it needs, and whether the organisation can keep operating if that vendor is degraded, sanctioned, restricted or compromised.

Board translation: The next mature conversation is not “do we use AI?” It is “which AI dependencies are now critical infrastructure for our business, who controls them, where are they hosted, and what happens when they fail on a Friday afternoon?”

What to watch next

The next big cyber threats are less likely to arrive as a single cinematic villain and more likely to arrive as a convergence problem. AI will speed up vulnerability discovery and attack adaptation. Vendors will put more business authority into platforms. Critical infrastructure will keep relying on complex cloud, telco, energy and data centre dependencies. FOCI scrutiny will push procurement teams into national security conversations they did not ask for but definitely needed. And attackers will continue using ordinary systems in extraordinary combinations.

Next threat	What it will look like	Why it matters
AI agent abuse	Agents manipulate workflows, call tools, collect secrets or trigger business actions through legitimate integrations.	The blast radius depends on authority, not model size.
Autonomous vulnerability exploitation	AI-assisted discovery turns advisory detail into working exploit logic before slow patch programs can respond.	Exposure management becomes a tempo problem.
AI framework and package poisoning	Open source packages, AI frameworks, model plugins and developer tools become initial access channels.	Developer trust becomes production risk.
Vendor control-plane incidents	Compromise of identity, SaaS, remote access or AI platforms cascades across customers.	Third-party risk becomes operational continuity risk.
FOCI-driven procurement scrutiny	Cloud, data centre, AI, telecom and managed service decisions are reviewed through ownership and jurisdiction lenses.	Cyber due diligence merges with national security due diligence.
Blended state and crime pressure	Ransomware, DDoS, credential theft, influence operations and state-linked infrastructure reuse overlap.	Attribution may be slow, but containment decisions must be fast.

The leadership move is to stop treating AI security as a new annex to the cyber strategy. It belongs in identity governance, vendor risk, procurement, incident response, data protection, software supply chain assurance and business continuity. The agent that books a meeting is not the same risk as the agent that changes an invoice, deploys a container or summarizes privileged legal advice. Same acronym, different blast radius.

Closing thought

This week’s newsletter can be reduced to one sentence: control is becoming the premium asset. State actors want it for leverage, cybercriminals want it for monetisation, vendors want it for platform stickiness, and businesses want it for productivity. The CISO’s job is to ensure that when control moves, it moves deliberately, visibly and reversibly. That is less glamorous than saying “AI transformation”, but it is far more useful when the router, agent or vendor portal starts behaving like it has had three coffees and a secret agenda.

References

Australian Cyber Security Magazine. (2026, July 15). Australian critical infrastructure urged to tighten router security after Russian cyber warning. https://australiancybersecuritymagazine.com.au/australian-critical-infrastructure-urged-to-tighten-router-security-after-russian-cyber-warning/

Australian Signals Directorate. (2024, March 20). PRC state-sponsored cyber activity: Actions for critical infrastructure leaders. https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/prc-state-sponsored-cyber-activity_actions-for-critical-infrastructure-leaders

Australian Signals Directorate. (2025, October 14). Annual cyber threat report 2024-2025. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025

Australian Signals Directorate. (2026a, July 13). Frontier AI models and their impact on cyber security: An update on AI model harnesses. https://www.cyber.gov.au/about-us/view-all-content/news/frontier-ai-models-and-their-impact-on-cyber-security-an-update-on-ai-model-harnesses

Australian Signals Directorate. (2026b, June 9). Guidelines for procurement and outsourcing. https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-procurement-and-outsourcing

Australian Signals Directorate. (2026c, June 22). Five Eyes cyber security agencies statement: The AI shift in cyber risk. https://www.cyber.gov.au/about-us/view-all-content/news/five-eyes-cyber-security-agencies-statement

Cybersecurity and Infrastructure Security Agency. (2024, February 7). PRC state-sponsored actors compromise and maintain persistent access to U.S. critical infrastructure. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

Cybersecurity and Infrastructure Security Agency. (2026a, July 13). Improve router hygiene to protect against Russian state-sponsored targeting. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a

Cybersecurity and Infrastructure Security Agency. (2026b, July 14). CISA urges SharePoint hardening after new exploitations. https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations

Darktrace. (2026, February 3). The state of AI cybersecurity 2026: Unveiling insights from over 1,500 security leaders. https://www.darktrace.com/blog/the-state-of-ai-cybersecurity-2026

Department of Home Affairs. (2026, May 21). Foreign Ownership, Control or Influence risk assessment guidance. https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/technology-and-data-security/foreign-ownership-control-or-influence-risk-assessment-guidance

IT Brief Australia. (2026a, July 15). Industry welcomes Australia’s new National Office of AI. https://itbrief.com.au/story/industry-welcomes-australia-s-new-national-office-of-ai

IT Brief Australia. (2026b, June 11). Microsoft and Australia sign digital resilience deal. https://itbrief.com.au/story/microsoft-australia-sign-digital-resilience-deal

Krebs, B. (2026, July 14). Microsoft patches a record 570 security flaws. KrebsOnSecurity. https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/

National Institute of Standards and Technology. (2026, April 7). AI Risk Management Framework. https://www.nist.gov/itl/ai-risk-management-framework

SecurityWeek. (2026a, July 14). Microsoft patches record 622 vulnerabilities, including two exploited zero-days. https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/

SecurityWeek. (2026b, July 15). Vulnerabilities patched by Fortinet, Ivanti, ServiceNow. https://www.securityweek.com/vulnerabilities-patched-by-fortinet-ivanti-servicenow/

SecurityWeek. (2026c, July 6). North Korean hackers target open source developers in supply chain attacks. https://www.securityweek.com/north-korean-hackers-target-open-source-developers-in-supply-chain-attacks/

SecurityWeek. (2026d, June 26). New enterprise-ready MCP specification brings new security challenges. https://www.securityweek.com/new-enterprise-ready-mcp-specification-brings-new-security-challenges/

Sysdig. (2026, July 1). Agentic ransomware for automated database extortion. https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion

The Hacker News. (2026a, July 15). Two SonicWall SMA 1000 zero-days exploited, one could enable admin commands. https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html

The Hacker News. (2026b, July 6). Iran-linked hackers use new Cavern C2 framework to target Israeli organizations. https://thehackernews.com/2026/07/iran-linked-hackers-use-new-cavern-c2.html

The Hacker News. (2026c, July 14). U.S. sanctions First VPN service and malware cryptor seller over ransomware support. https://thehackernews.com/2026/07/us-sanctions-first-vpn-service-and.html

The Hacker News. (2026d, July 2). AI agent exploits Langflow RCE to automate database ransomware attack. https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html

The White House. (2026, July 14). White House launches Gold Eagle initiative for unprecedented cybersecurity vulnerability coordination. https://www.whitehouse.gov/releases/2026/07/white-house-launches-gold-eagle-initiative-for-unprecedented-cybersecurity-vulnerability-coordination/