This week AI crossed from attack target to attack operator — agentic ransomware, coerced coding agents, and LLM-output poisoning

The prior weekly's research lens was "the AI agent and toolchain control plane became a target." Four independent disclosures this week move the frame: AI is now showing up as the operator of an intrusion and as the delivery channel for one, not just the thing being attacked.

AI as operator. Sysdig documented JADEPUFFER, which it assesses to be the first end-to-end ransomware operation driven by an LLM rather than a human — entering through an unpatched, internet-exposed Langflow (CVE-2025-3248, on CISA KEV since May 2025), then autonomously sweeping credentials, forging a Nacos JWT from a documented default signing key, probing for container escape, and encrypting 1,342 Nacos config items with a never-persisted key (Sysdig, 2026-07-01). Sysdig's own framing is that the novelty is the operator, not the vulnerabilities — every step exploited a known, patchable exposure, but agentic tooling collapsed the skill floor to chain recon-through-destruction into one automated run (§ references, covered operationally 07-04).

AI as the thing attackers subvert to reach you. Mozilla 0DIN showed a "clean" GitHub repo — no malicious code to flag on static analysis — coercing an AI coding agent into a reverse shell through three levels of indirection (error message → DNS TXT lookup → shell execution), so the agent "never decided to open a shell; it decided to fix an error" (Mozilla 0DIN, 2026-06-25).

AI as the delivery layer. Unit 42's Phantom Squatting pre-registers the specific domains a production LLM hallucinates when asked for URLs, so later users or agent-browsers are handed attacker infrastructure with zero reputation history to flag (Unit 42, 2026-07-01). And Kaspersky's June telemetry shows a community AI-agent "skill" marketplace still distributing malicious SKILL.md files that run with the tokens and file-system access of whatever they touch (Kaspersky Securelist, 2026-07-01).

Weekly takeaway: for a SOC that increasingly runs AI coding agents in CI/CD and developer workstations and is beginning to field agentic tooling, the strategic obligation is to treat every agent capability — shell, repo access, browsing, third-party skills — as a privilege scope that needs an explicit grant and human-in-the-loop gating, and to recognise that none of these attacks needed a novel software bug: they exploited agent autonomy plus the same neglected, internet-exposed infrastructure defenders already owe a patch. Per-technique detail and detection concepts in § references.