Telemetry from Gen’s H1 2026 Threat Report shows AI agents being stopped while trying attacker-style moves inside workstations, cloud systems, and enterprise environments.
A trio of newly named implants tied to a SOHO-router campaign shows how edge devices can be turned into reusable covert plumbing, not just one-time victim machines.
The malware’s value is no longer just access: its newer functions point to compromised infrastructure that can proxy traffic, relay commands, and widen the attacker’s control options.
A proof-of-concept around agentic coding tools shows how repository content, setup logic, and hidden instructions can be chained into remote shell execution.
Reverse shells turn a basic network rule on its head, showing why outbound behavior can matter more than inbound filtering alone.