Category: Learning

Why these issues matter

AI agents can connect business systems, use tools, and act with delegated permissions. That makes the security of an agent platform depend on more than its model: identity, integrations, credentials, and cloud permissions all matter.

On October 2, 2026, Amazon Web Services (AWS) published Security Bulletin 2026-124-AWS, detailing three security vulnerabilities in Loom for AWS, an open-source AI agent orchestration platform developed by AWS Labs. The CVSS 10.0 (Critical) rating applies specifically to CVE-2026-103956.

The practical takeaway is straightforward: organizations using Loom for AWS should upgrade to version 1.7.0 or later, then review credentials and activity that may have been exposed. AWS addressed CVE-2026-103956 in version 1.6.1; version 1.7.0 addressed CVE-2026-103957 and CVE-2026-103958. Ensure any forked or derivative implementations include all three fixes.

The three issues affect different parts of the platform:

• CVE-2026-103956: An authentication bypass that could allow unauthenticated network clients to gain administrative control over the agent control plane in deployments without a configured identity provider. The CVE record rates this vulnerability CVSS 10.0 (Critical).
• CVE-2026-103957: An OAuth2 credential and access-token disclosure vulnerability involving outbound requests during OAuth2 discovery.
• CVE-2026-103958: A server-side request forgery (SSRF) vulnerability in MCP tool-server and A2A remote-agent connection handling.

Depending on the deployment and permissions involved, the consequences could extend beyond Loom itself to integration credentials, access tokens, internal services, and cloud workload credentials.

This article explains the conditions behind each issue, what could be at risk, and the steps organizations can take to reduce exposure.

How the vulnerabilities could be exploited

CVE-2026-103956: Authentication bypass

In Loom versions earlier than 1.6.1, a network-reachable deployment without a configured identity provider could allow an unauthenticated attacker to obtain administrative control of the agent control plane through requests to the application API.

Potential attack path:

• Access the exposed application API without proper authentication.
• Register unauthorized tool servers or access stored integration credentials.
• Modify IAM role policies attached to managed agent roles.

Potential impact: Unauthorized control of AI agent integrations, credential exposure, and increased cloud privileges.

Security focus: Identity-provider configuration, API authentication, and IAM privilege boundaries.

CVE-2026-103957: OAuth2 token and secret disclosure

In Loom versions earlier than 1.7.0, an authenticated user with the mcp:write or a2a:write scope could configure an OAuth2 discovery URL whose returned document directs the backend to send OAuth2 client secrets or another user’s access token to a third-party-controlled endpoint.

Potential attack path:

• Abuse integration configuration permissions.
• Influence the OAuth2 discovery response.
• Cause the backend to disclose client secrets or another user’s access token to an external destination.

Potential impact: Compromised integrations, unauthorized access to connected services, and potential account or data exposure.

Security focus: OAuth2/OIDC discovery, token handling, and destination validation.

CVE-2026-103958: SSRF and access to internal services

In Loom versions earlier than 1.7.0, an authenticated user with the mcp:write or a2a:write scope could supply a crafted connection address when registering, updating, or testing a tool server or remote agent. This could cause Loom to send requests to internal network locations, including the application container’s credential endpoint, and read the responses.

Potential attack path:

• Abuse tool-server or remote-agent connection configuration.
• Direct backend requests toward internal services.
• Read responses from reachable endpoints, potentially including workload credential services.

Potential impact: Internal service exposure, sensitive information disclosure, and potential access to workload credentials.

Security focus: URL validation, outbound network controls, and workload credential endpoint protection.

Affected issues and fixed versions

Use this summary to compare the three issues. CVSS values and severity labels are retained from the supplied draft.

What these issues mean for organizations

Together, the vulnerabilities show how identity and integration controls can shape the impact of an AI agent compromise.

• Identity and administrative control: Authentication failures can expose agent control planes and connected integrations to unauthorized access.
• Integration credential exposure: Leaked OAuth2 secrets or access tokens can compromise connected business applications.
• Internal service access: SSRF vulnerabilities may allow attackers to reach internal services that are not directly exposed to the internet.
• Excessive cloud permissions: Compromised agents or workload credentials may expose cloud resources if IAM permissions are overly broad.

Organizations should enforce strong authentication, secure credential handling, restrict network access, apply least-privilege IAM policies, and monitor suspicious activity. These risks represent potential impacts, not proof of an actual compromise.

What organizations should do now

Prioritize these actions if your organization uses Loom for AWS:

1. Upgrade Loom: Upgrade to the latest available release that incorporates all three fixes. At minimum, version 1.7.0 addresses CVE-2026-103957 and CVE-2026-103958, while version 1.6.1 addresses CVE-2026-103956. Ensure maintained forks and derivative implementations include the fixes.
2. Secure authentication: Until upgrading, ensure that an Amazon Cognito user pool or an active external identity provider is fully configured before the backend is reachable beyond loopback. Confirm that LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV is unset in deployed, non-development environments.
3. Restrict privileged scopes: Until upgrading, limit mcp:write and a2a:write permissions to trusted administrators. This reduces exposure but does not replace the code fixes.
4. Rotate credentials and tokens: After upgrading, rotate OAuth2 client secrets used by MCP/A2A integrations and revoke and reissue access tokens that were active during the affected period. If container-role credentials may have been accessed, rotate the relevant IAM role session credentials.
5. Review and validate: Review AWS CloudTrail and application logs for suspicious IAM policy changes, unauthorized tool-server registrations, unexpected credential use, and unusual outbound requests. Verify the fixes in production and retest the relevant security controls.

How CLEAR INFOSEC can help

A focused security assessment can help teams identify exposed Loom deployments, evaluate related controls, and prioritize remediation. The engagement can follow five steps:

Context and scoping

Align stakeholders and testing assumptions; define objectives, scope, success criteria, rules of engagement and constraints.

Output: Approved scope and engagement plan.

Locate and enumerate

Build the asset and attack-surface inventory across AI agent and AWS assets, configurations, integrations, identities, services, technologies and permissions.

Output: Asset inventory and exposure map.

Exploit and evaluate

Validate vulnerabilities through controlled testing; confirm exploitability and business relevance, capture evidence, and maintain safe execution.

Output: Validated findings and proof of impact.

Analyze and advise

Analyze root causes, risk, and attack paths; prioritize findings by severity and business impact; provide practical remediation guidance.

Output: Risk analysis and prioritized recommendations.

Retest and report

Verify remediation through retesting; confirm closure and residual risk status; deliver final evidence, summary, and executive reporting.

Output: Retest results and final report.

Continuous testing cycle: Assess → Remediate → Retest → Reassess

Conclusion: secure the connections behind AI agents

CVE-2026-103956, CVE-2026-103957 and CVE-2026-103958 show that AI agent security extends beyond model safety. Authentication, tool registration, OAuth2 integrations, outbound requests and cloud execution permissions all form part of the security boundary.

For organizations using Loom for AWS, upgrading to a fixed release is the primary remediation. A structured security assessment can complement that work by identifying exposed deployments, validating access controls, evaluating potential credential exposure and confirming that remediation is effective.

At CLEAR INFOSEC, we help organizations assess cloud environments, test application security controls and strengthen the protection of AI-enabled infrastructure.

Sources and further reading

• AWS Security Bulletin 2026-124-AWS: Loom for AWS vulnerabilities
• CVE-2026-103956: NIST National Vulnerability Database
• CVE-2026-103957: CVE.org
• CVE-2026-103958: CVE.org
• Loom for AWS v1.7.0 release notes

AI-Powered Cyberattacks Are No Longer a Future Threat

Artificial intelligence has become one of the biggest opportunities in technology—and one of the fastest-evolving tools in cybersecurity. But the same capabilities that help businesses automate processes, analyze data, write software, and improve productivity can also help attackers move faster. Threat actors are already using AI to improve phishing campaigns, generate malicious code, conduct reconnaissance, analyze information, automate workflows, and adapt their operations. Google Threat Intelligence reported in 2026 that adversaries are moving toward the industrial-scale use of generative AI within cyber operations, including vulnerability discovery, exploit development, initial access, and operational support.

Microsoft has similarly reported that threat actors are operationalizing AI throughout the cyberattack lifecycle, while experimentation with agentic AI is beginning to enable more iterative decision-making and task execution. Microsoft notes, however, that fully agentic attacks are not yet operating at scale. That distinction is important. The threat isn’t necessarily an army of completely autonomous AI hackers today. The more immediate concern is that AI is compressing the time, cost, and expertise required to conduct cyberattacks. And that changes the defensive equation.

What Are AI-Powered Cyberattacks?

AI-powered cyberattacks are cyberattacks in which artificial intelligence is used to improve one or more stages of an attack. AI can help attackers process information, generate convincing communications, analyze code, automate repetitive tasks, identify potential vulnerabilities, or adapt attack workflows. Instead of replacing the attacker entirely, AI often acts as an accelerator. A conventional attacker may need hours to research a target, write a phishing message, analyze information, or modify a script. An AI-assisted attacker may be able to perform portions of those activities much faster and at greater scale. This creates a new cybersecurity challenge: The attack techniques may not be entirely new—but the speed, scale, personalization, and adaptability can be.

How AI Is Changing the Cyberattack Lifecycle

AI can potentially influence almost every stage of an attack:

Reconnaissance

AI can help attackers process publicly available information and organize target intelligence faster.

Phishing and Social Engineering

Generative AI can produce more convincing messages, adapt language to different audiences, and help attackers create highly personalized social-engineering campaigns. Microsoft has observed campaigns using popular AI brands such as ChatGPT, Copilot, DeepSeek, and Claude as phishing lures. One campaign Microsoft identified in May 2026 involved thousands of emails designed to collect personal and payment information.

Exploitation

AI can assist with vulnerability research, code analysis, and exploit development. Google Threat Intelligence reported in May 2026 that it had identified a threat actor using a zero-day exploit believed to have been developed with AI.

Post-Compromise Activity

Once attackers gain access, AI can potentially help analyze data, identify useful information, automate repetitive tasks, and support decision-making. The result is an attack environment where defenders may have minutes or hours to react to activity that previously took significantly longer to execute.

Are Fully Autonomous Threat Actors Already Here?

This is where cybersecurity discussions often become exaggerated. AI-assisted attacks are already real. Fully autonomous cybercriminal operations at scale are still an emerging capability. Microsoft’s 2026 threat intelligence research describes early experimentation with agentic AI, where models support iterative decision-making and task execution. However, Microsoft says these efforts remain limited by reliability and operational risks and have not yet been observed at scale. Google’s Mandiant research similarly describes a shift toward adaptive AI tools and agents that can navigate systems with less human oversight.

So businesses should not wait for a hypothetical “fully autonomous hacker.” The security problem has already started. The real near-term risk is AI-augmented threat actors operating faster and more efficiently than traditional security processes can respond to.

Why AI-Powered Attacks Are Harder to Defend Against

Traditional security programs often depend on predictable indicators, known attack patterns, and human analysts manually investigating alerts. AI can make attacks more dynamic. An attacker can potentially generate different phishing content for different targets, alter tactics quickly, automate reconnaissance, and process information at machine speed. This creates three major challenges.
Speed: Attackers can automate activities that previously required significant human effort.

Scale: One attacker can potentially target more organizations, users, or systems.

Adaptability: AI-assisted workflows can change based on information discovered during the attack.

The defensive implication is straightforward: Security teams cannot rely entirely on slow, manual detection and response processes. They need better telemetry, automation, behavioral detection, threat intelligence, and human expertise working together.

How Can Businesses Defend Against AI-Powered Cyberattacks?

The answer is not simply “use AI.” Organizations need to strengthen the fundamentals while using AI to improve defensive capabilities.

1. Strengthen Identity Security

AI-assisted phishing can make social engineering more convincing. Organizations should therefore prioritize phishing-resistant authentication, MFA, strong identity governance, least privilege, privileged-access management, and continuous monitoring of unusual account activity. A compromised identity can give an attacker access without requiring traditional malware.

2. Improve Vulnerability Management

AI can potentially accelerate vulnerability discovery and exploitation. Organizations need equally strong visibility into their own attack surface. Regular vulnerability assessments, penetration testing, patch management, and exposure monitoring can help identify weaknesses before attackers exploit them.

3. Monitor Behavior, Not Just Signatures

AI-assisted attacks may change rapidly enough that static indicators become less useful. Security teams should monitor behavioral signals such as unusual authentication, abnormal data access, privilege escalation, lateral movement, unexpected process activity, and suspicious network connections. Behavior-based detection can help identify attacks even when the exact malware or technique is unfamiliar.

4. Deploy Continuous Threat Detection

AI-powered attacks can operate outside normal business hours and move quickly. A 24/7 Security Operations Center (SOC) or Managed Detection and Response (MDR) capability can provide continuous monitoring, investigation, threat hunting, and response. Clear Infosec’s MDR service provides 24/7/365 monitoring, expert-led threat hunting, human-led alert prioritization, contextualization, reporting, and incident response capabilities.

5. Test Your Defenses Against Realistic Attacks

Organizations shouldn’t assume their security controls work simply because they are deployed. Penetration testing and Red Team exercises can simulate realistic attack paths and identify weaknesses across people, processes, technology, applications, networks, and cloud environments.

6. Prepare for AI-Driven Incident Response

Detection is only useful if the organization can respond quickly. Incident response plans should define how security teams investigate suspicious activity, isolate systems, protect evidence, disable compromised accounts, contain lateral movement, and recover operations. Clear Infosec provides incident response capabilities including 24/7 threat detection and response, expert-led threat hunting, and security preparedness services.

AI vs. AI: Can Artificial Intelligence Help Defend Against AI Attacks?

Yes—but AI should be viewed as an additional defensive capability, not a replacement for cybersecurity professionals. Security teams can use AI to help analyze large volumes of alerts, identify anomalies, correlate security events, accelerate investigation, summarize threat intelligence, and support threat hunting. The advantage is scale. A human analyst cannot manually examine every event generated across a modern enterprise. AI can help reduce that workload by identifying patterns and prioritizing events that deserve human attention. The strongest model is therefore not:

AI vs. Human

It is: AI + Security Analysts + Threat Intelligence + Automation

Human expertise remains critical for context, business impact, investigation, judgment, and response decisions.

Don’t Forget the New AI Attack Surface

There is another side to the problem. Businesses are increasingly deploying their own AI applications, copilots, AI agents, APIs, and third-party models. This creates a new attack surface. Google’s 2026 AI risk research identifies Shadow AI and limited visibility into AI assets as significant organizational risks. Organizations should therefore know:

Which AI systems are being used?

What data can they access?

Which tools can they call?

What permissions do their agents have?

Where is sensitive information being sent?

Who owns and monitors these systems?

An AI agent with excessive privileges can potentially become a high-impact security risk even if it was never designed to be malicious. AI security therefore needs to cover both sides: Defending against AI-powered attackers + Securing the organization’s own AI ecosystem

A Practical AI Cybersecurity Defense Strategy

Organizations preparing for AI-powered cyberattacks should focus on five areas:

Know: Maintain visibility into users, devices, applications, cloud assets, AI systems, APIs, and third-party services.

Protect: Strengthen identity, access controls, vulnerability management, endpoint security, network segmentation, and data protection.

Detect: Use continuous monitoring, behavioral analytics, threat intelligence, SIEM, EDR/XDR, MDR, and threat hunting.

Respond: Maintain a tested incident response capability that can quickly investigate, contain, and recover from attacks.

Improve: Continuously evaluate controls through vulnerability assessments, penetration testing, Red Teaming, incident reviews, and security assessments.

How Clear Infosec Can Help Defend Against AI-Powered Threats

AI is changing the threat landscape, but the fundamentals of effective cybersecurity remain the same: visibility, prevention, detection, response, and resilience. Clear Infosec provides cybersecurity services designed to address these areas, including Managed Detection and Response, Incident Response, Threat Hunting, Vulnerability Assessment, Penetration Testing, Red Teaming, and Cyber Resilience Assessment. Organizations can use these capabilities to strengthen defenses against both conventional and AI-assisted threats. MDR and threat hunting can provide continuous visibility and proactive detection. Vulnerability Assessment and Penetration Testing can identify weaknesses that AI-assisted attackers could potentially exploit.

Incident Response and DFIR can help investigate and contain incidents when defenses are bypassed. Clear Infosec’s Breach Readiness Review also evaluates threat exposure, security controls, incident response readiness, and provides a roadmap for improving cyber resilience.

Explore Clear Infosec MDR Services →

Explore Clear Infosec Incident Response →

The Bottom Line: Don’t Wait for Autonomous Attackers

AI-powered cyberattacks are already changing how threat actors operate. The most immediate threat isn’t necessarily a completely autonomous hacker capable of independently running an entire campaign. It is the AI-augmented attacker who can research faster, personalize phishing, automate repetitive tasks, analyze vulnerabilities, generate code, and adapt operations more quickly than traditional attack methods allowed. Organizations that wait for fully autonomous threat actors to become commonplace may already be behind. The right strategy is to build defenses that can operate at the same speed as the threat:

AI is increasing the speed of cyberattacks. Your cybersecurity operations need to increase their speed too.

Talk to Clear Infosec About AI-Ready Cybersecurity →

---

Frequently Asked Questions

What are AI-powered cyberattacks?

AI-powered cyberattacks use artificial intelligence to improve activities such as reconnaissance, phishing, social engineering, vulnerability research, malware development, data analysis, and attack automation.

Are autonomous threat actors real?

AI-assisted threat activity is already being observed. Fully autonomous threat actors operating cyber campaigns independently at large scale are still an emerging capability. Current research shows increasing experimentation with agentic AI and reduced human involvement.

How is AI changing cybersecurity threats?

AI is increasing the speed, scale, personalization, and adaptability of cyber operations. Attackers can use AI to automate repetitive activities and improve phishing, reconnaissance, vulnerability research, and other stages of the attack lifecycle.

How can businesses defend against AI-powered cyberattacks?

Businesses should strengthen identity security, vulnerability management, endpoint protection, behavioral monitoring, threat intelligence, continuous security monitoring, MDR, threat hunting, penetration testing, and incident response.

Can AI help defend against AI-powered attacks?

Yes. AI can help security teams analyze large volumes of security data, identify anomalies, prioritize alerts, correlate events, and accelerate investigations. Human analysts remain essential for context, judgment, and response decisions.

What is the role of MDR against AI-powered attacks?

MDR provides continuous security monitoring, threat detection, expert-led threat hunting, alert investigation, and incident response. This can help organizations identify and respond to AI-assisted attacks faster.