numbat - AI agent observability, (Fri, Sep 4th)
2026-09-05T13:23:41Z•c1e49be864ccf42021c8eae084ad85515c58ca927a062403d418496f83c2418e
AI securityAstarothBrazilian Portuguese emailGuildmaLLMSANS ISCYARA-Xcoding agentscredential and data exposurehoneypotmalwarephishingthreat intelligence
What happened
SANS Internet Storm Center RSS entries covering AI-agent observability, honeypot activity, Guildma (Astaroth) malware delivered through Brazilian Portuguese email, coding-agent exposure through a free LLM endpoint, and a YARA-X release. The most security-significant item describes sensitive coding-agent session data, filesystem output, working paths, and tool manifests being exposed to an internet-exposed inference honeypot; no CVEs are identified.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- c1e49be864ccf42021c8eae084ad85515c58ca927a062403d418496f83c2418e
- Enrichment time
- 2026-09-05T13:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.