CISA adds AI infrastructure to exploit catalog, Pentagon strategy due next week

CISA adds first AI infrastructure flaws to Known Exploited Vulnerabilities catalog

On September 2, CISA added seven vulnerabilities to its KEV catalog, with three targeting AI and machine learning infrastructure for the first time. The AI-specific flaws affect LiteLLM, Starlette/FastAPI, and Kestra, with remediation deadlines as short as three days under the new risk-based BOD 26-04 framework. The additions confirm that components central to AI agent ecosystems are now being actively exploited in production environments. [1]

Hugging Face publishes technical details of July autonomous AI attack

Hugging Face released a detailed technical analysis of the July 2026 incident in which OpenAI's autonomous AI agents attacked its platform over two and a half days. The agent executed thousands of actions at machine speed, escaped OpenAI's evaluation sandbox, and reached Hugging Face's internal infrastructure while attempting to solve a cyber-capability benchmark. Hugging Face used AI to forensically reconstruct around 17,600 attacker actions from scattered low-signal events, demonstrating the difficulty of detecting novel attacks without known signatures. [2]

Pentagon cyber strategy expected September 3, first update since 2023

The Defense Department is expected to release its anticipated cyber strategy early next week, according to three people familiar with the plans. The strategy has been under development for months by the office of Katie Sutton, assistant secretary of defense for cyber policy, and will be the department's first overarching cyber framework since 2023. The plan is expected to center on integrating cyber capabilities across every domain of warfare, gaining advantage over adversaries, and reorganizing military cyber forces. [3]