Cybersecurity briefing — 2026-08-06

Here is the short version for today.

• Imported Agents Become Server Commands in Paperclip
• One Stolen Login Opened 165 Snowflake Customers
• npm Worm Now Spreads Through Stolen Tokens
• Local Linux Users Can Reach Root Through OVS Datapath
• Trusted Remote-Admin Tools Become Stealth Persistence
• Cloaked Mac Lures Beat Content-Based Detection
• Leaked n8n Tokens Became Live Access Keys
• Water OT Campaign Reaches Seven States
• AI Floods Triage and Shrinks Patch Windows
• AI Agents Can Carry Poisoned Trust Across Runs
• Internal API Boundaries Fail Open to Code Execution
• Enclave Attestation Still Depends on Client Code
• Chrome Passkeys Become Reusable After Windows Malware
• Omada Onboarding Flaws Can Hand Over Entire Fleets
• AI Security Turns Toward Rapid Response