From AI Bots to Fake Recruiters, Attackers Are Borrowing the Tools You Already Trust (ft. Vicente Diaz)

From Claude Code to EDR evasion scripts, this week's signals share one trait. The attacker's R&D budget shrank while the defender's attack surface grew.

Jun 08, 2026

INTRODUCTION

Adversaries stopped building bespoke tooling this week. They started borrowing yours instead.

Attackers tricked Meta’s own AI support bot into handing over high-profile Instagram accounts, including the Obama White House page, and built Python scripts that systematically test malware samples against Sophos, CrowdStrike, and Defender, turning EDR into a free QA lab. A flaw in Anthropic’s Claude Code GitHub Action let a single malicious issue hijack any public repository running the workflow. And Chinese intelligence officers posed as recruiters on professional networks to target government and military personnel across Five Eyes nations with access to classified information.

The common thread is a cost inversion. Defenders spent years deploying AI assistants, automated workflows, and endpoint agents to reduce operational burden. Attackers now treat that same infrastructure as free tooling, using defenders’ own investments to lower the price of reconnaissance, evasion, and access. Which of your automation investments are you sure the adversary is not also using?

This week marks a new chapter for The Monday Brief. We are launching a recurring guest perspective, and we could not ask for a stronger voice to open it. Vicente Diaz is a threat intelligence expert with more than fifteen years tracking sophisticated adversaries, across roles at VirusTotal and Google, Kaspersky’s Global Research and Analysis Team, and S21sec. He brings a hunter’s instinct for telling what is genuinely new from old tradecraft in new clothes, and that lens runs through all four signals below.

If you enjoy reading our newsletter, share it!

Thanks for supporting The Monday Brief.

WEEKLY SIGNALS ANALYSIS

Defender automation now reduces attacker costs, not just defender costs. Audit every AI-powered workflow that accepts external input, from GitHub Actions to support bots, and confirm that none can execute privileged actions without a human gate on untrusted triggers.
EDR is no longer an obstacle. It is a testing harness. Assume your endpoint tooling is a known quantity to sophisticated adversaries. Layer behavioral analytics and deception-based detection behind EDR rather than relying on signature-based blocking alone.
Professional networking platforms have become mature intelligence collection surfaces, not just career tools. The tactic is not new, but the Five Eyes advisory shows how targeted and operationalized it has become against security cleared and sensitive personnel. Review your personnel security posture for employees with classified, privileged, or policy-relevant access.
AI coding assistants inherit the permissions of the developer who installed them. Treat MCP-connected tools like Claude Code as privileged service accounts. Apply least-privilege controls, network segmentation, and egress restrictions to any AI agent with access to repositories or internal APIs.

THIS WEEK’S SIGNALS

Signal 1: Meta’s AI Support Bot Became an Account Takeover Tool

Why it matters: Attackers discovered they could manipulate Meta’s AI support assistant into resetting account credentials for high-profile Instagram accounts, including the Obama White House and the Chief Master Sergeant of the U.S. Space Force. This is not a theoretical jailbreak paper. It produced real-world account takeovers that were publicly visible before Meta intervened.

What is being misread: The industry is treating this as a social media embarrassment. The deeper problem is architectural. Meta built an AI bot that could execute account recovery actions based on conversational input, and attackers found a way to bypass the verification process that was supposed to constrain it. The system was designed to reduce support costs, so it was given the authority to act. That authority became the vulnerability. Any organization deploying AI agents with write access to identity systems faces the same structural flaw.

Guest Perspective (Vicente Diaz) We’ve been dealing with the massive headache of social engineering for years. It’s been behind some of the most successful (and downright embarrassing) attacks, giving them keys to the kingdom without needing any technical sophistication. Now, as everyone rushes to replace everything with AI, we’ve just built a brand-new exposure vector. Instead of tricking a human, attackers have to trick an LLM. This introduces a whole new level of trouble, especially because the way our AI automatisms are implemented usually lack any traceability, in other words, we have no idea what’s happening behind the scenes until users wake up locked out of their accounts. We are barely scratching the surface of what happens when you rush the deployment of automated workflows while we’re overlooking basic security accountability aspects such as agent-specific roles, authentication, and ACLs. To make it more thrilling for everyone, models are non-deterministic at their core.

Think Red (Douglas McKee): The support bot has the keys. It can reset credentials, change recovery emails, and unlock accounts. All I need to do is talk to it the right way. I do not need to phish the account holder. I do not need to SIM-swap their phone. I need a Telegram channel with the right prompt template and five minutes of patience. The bot validates my request based on conversational plausibility, not identity proof. Every company racing to deploy AI support agents with write access to user accounts is building me the same door.

Act Blue (Ismael Valenzuela): Any AI agent with the ability to modify account state is a privileged identity, full stop. Inventory every customer-facing AI bot in your environment and map the actions it can take without a human in the loop. Immediately restrict credential reset, ownership transfer, and recovery email changes so they require out-of-band verification that the bot cannot complete on its own. But do not stop there. Instrument these bots with anomaly detection that flags prompt patterns associated with social engineering, such as urgency language, impersonation of authority, and requests that bypass normal user flows. The principle is simple. If an AI agent can do something a malicious insider could do, it needs the same controls you would apply to a malicious insider.

Supporting sources:

Signal 2: Attackers Automate EDR Evasion Testing With Python and Commercial AI

Why it matters: Threat actors are using Python scripts to systematically test malware payloads against EDR agents from Sophos, CrowdStrike, and Windows Defender before deployment. Combined with Anthropic’s own data showing 832 banned accounts using Claude for attack development across the MITRE ATT&CK framework, AI-assisted offensive tooling is no longer experimental. It is becoming a measurable part of attacker workflows.

What is being misread: Most defenders assume EDR evasion requires deep expertise in reverse engineering and binary analysis. That assumption made EDR a reliable last line of defense. Automated evasion testing collapses that advantage. The attacker does not need to understand how your EDR works internally. They just need a script that submits variants until one passes. The EDR product becomes a free oracle that tells the attacker exactly when they have succeeded. This transforms endpoint detection from a security control into an iterative feedback mechanism for the offense.

Guest Perspective (Vicente Diaz) To be honest, this isn’t exactly breaking news, attackers have always done this. I remember the days of VirusTotal-like services that (supposedly) didn’t share samples with vendors, whose sole purpose was to let attackers check if their malware would flag. Sophisticated actors have always built this kind of testing into their pipelines (with some historical mistakes resulting in brand new samples ending up in AVs’ hands). The real shift here is these capabilities becoming highly democratized. We live in an era of more fragmented, opportunistic threat actors who rely on rapid, dynamic, disposable tooling. This kind of quick-and-dirty, automated QA testing fits their workflow perfectly. They just need to stay one step ahead of the laziest defenders. For the vast majority of their attacks, letting the EDR product grade their homework until it passes is more than enough.

Think Red (Douglas McKee): Your EDR agent tells me everything I need to know. I submit a payload, it blocks it, and now I know exactly what triggered the detection. I modify one function call, resubmit, and check again. Fifteen iterations later, I have a clean binary. The whole process takes less time than your SOC shift change. I am not reverse-engineering your detection rules. I am just letting your product grade my homework until I get an A. The AI writes the variants. The script runs the test loop. I drink tea.

Act Blue (Ismael Valenzuela): The tradecraft is old. What changed is the speed and scale, with AI now writing the variants and a script running the test loop. So plan for evasion as a given, not an edge case. EDR alone is not enough when the attacker has already tuned their payload against your specific product. Deploy behavioral detection that operates on execution patterns rather than static signatures, focusing on sequences like process injection followed by credential access followed by lateral movement. Ensure your EDR telemetry feeds into a SIEM or XDR platform where correlation rules can catch multi-step attack chains that individual endpoint alerts miss. But do not stop there. Implement canary processes and honey credentials that trigger alerts when accessed, regardless of whether the accessing binary evades EDR. If the attacker spends all their effort making the payload invisible to your endpoint agent, a tripwire at the credential store or the domain controller catches them at the objective rather than the entry point.

Supporting sources:

Signal 3: Claude Code GitHub Action Flaw Turned a Single Issue Into Full Repository Takeover

Why it matters: A security researcher discovered that Anthropic’s Claude Code GitHub Action could be hijacked by opening a single malicious GitHub issue on any public repository running the workflow. Because Anthropic’s own repository used the same configuration, a successful attack could have pushed malicious code into the Claude Code supply chain itself. AI coding assistants are now integrated deeply enough into CI/CD pipelines that a flaw in one tool’s workflow configuration creates a self-replicating supply chain risk.

What is being misread: Organizations are evaluating AI coding assistants based on the quality of their code output, not on the permissions they inherit. Claude Code connects to external services through Model Context Protocol, giving it access to GitHub, Jira, Confluence, databases, and internal APIs. Developers treat these connections as productivity features. Attackers treat them as pre-authenticated lateral movement paths. The broken mental model is that an AI assistant operates within the developer’s intent. In reality, it operates within the developer’s permissions, and those permissions are exercised by whatever input the AI processes, including input from untrusted sources like public GitHub issues.

Guest Perspective (Vicente Diaz) Yet another successful supply chain attack. We already witnessed the massive impact of the GitHub “incident” last month, proving just how devastating these attacks can be. But when a supply chain flaw hits an AI model, the toll feels much heavier. If code gets compromised, the fix is usually “straightforward”. If a model would ever get hijacked, the ripple effects are unpredictable — messing with automated pipelines, poisoned generated code, and erratic responses. While that’s not what happened here, I would like to use this to reflect on hidden supply chain vulnerabilities of LLMs, MCPs, and Agent-to-Agent (A2A) automatisms. It’s much harder to visualize and remediate than a standard bad dependency, but the root could trace back to the usual suspects: poorly managed credentials, API keys, and over-privileged tokens. This should be a wake-up call regarding the total lack of visibility we have into the actual blast radius of these models within our infrastructure and CI/CD pipelines. Right now, that traceability is close to zero.

Think Red (Douglas McKee): I go after AI-automated workflows because they do something incredibly useful for me. They turn text I control into action you trust. I do not need your credentials if the workflow already has them. One malicious GitHub issue can be enough to get the AI to act with the repository owner’s permissions. I am not trying to own your whole environment on day one. I just need one trusted commit in one project that downstream users already pull. If the target is popular enough, downstream consumers pull my changes automatically. One issue. Zero credentials. Maximum blast radius.

Act Blue (Ismael Valenzuela): The reality is that most development teams adopted Claude Code and similar AI agents without updating their CI/CD threat models. Start by auditing every GitHub Action in your organization that invokes an AI agent, and verify that none of them process content from untrusted triggers like issue creation or pull request comments with write permissions. Pin all AI-related actions to specific commit SHAs rather than mutable tags. But do not stop there. Implement branch protection rules that require human review for any commit generated by an automated process, and restrict the GITHUB_TOKEN scope in workflows to read-only unless a specific step genuinely requires write access. The lesson is broader than one vendor’s bug. Any AI tool that converts untrusted text into authorized action is an implicit delegation of trust to the attacker who controls that text.

Supporting sources:

Signal 4: Five Eyes Warns Chinese Intelligence Is Turning Professional Networks Into Low-Cost Collection Infrastructure

Why it matters: Five Eyes intelligence agencies issued a coordinated advisory warning that Chinese intelligence officers are posing as recruiters and headhunters on professional networking platforms to target government and military personnel with access to classified information. This is not a cyber intrusion. It is a human intelligence operation conducted at scale through the same platforms employees use for legitimate career development. The targeting is precise, focusing on individuals with security clearances, defense sector experience, or access to sensitive policy discussions.

What is being misread: Security teams are treating this as an insider-risk awareness issue, but the bigger shift is cost and scale. The initial contact happens on LinkedIn or similar platforms. The relationship develops over weeks or months through normal professional conversation. The intelligence collection may never involve a corporate network at all. It can happen over personal email, phone calls, or in-person meetings arranged through what appears to be a consulting engagement or job interview. The architectural gap is that personnel security and cybersecurity operate as separate functions in most organizations, with no shared detection surface for the transition from social engineering to intelligence elicitation.

Guest Perspective (Vicente Diaz) We’ve seen this exact movie before with North Korean actors; this is just classic HUMINT moving with the times. Over the last few decades, espionage has scaled up across the board, and the traditional playbook of targeting the people who hold the data, directly or indirectly, will never go out of fashion. Honestly, I’m a bit skeptical about what the ultimate goal of this specific advisory is, it feels partly like sending a message. At the end of the day, there isn’t a fix for this, and cranking corporate paranoia rarely ends well. What is true is that the current job market is a mess. With companies laying off local talent and aggressively outsourcing remote roles to cheaper economies, attackers have the perfect opportunity to spin up fake recruiter personas.

Think Red (Douglas McKee): Your team patched every CVE this quarter. Good for them. I am not coming through the network. I sent a connection request from a recruiter profile at a plausible defense consultancy. Your analyst with TS/SCI clearance accepted it three weeks ago. We have had two phone calls about a “career opportunity.” By the third call, I am asking about program timelines and organizational charts. Nothing in your SIEM will fire. Nothing in your DLP will trigger. The information leaves through a conversation, not a file transfer.

Act Blue (Ismael Valenzuela): Personnel security and cybersecurity must share a detection surface, or this attack keeps operating in the gap between them. Brief all personnel with classified or privileged access on the Five Eyes advisory this week, with specific examples of the fake recruiter profiles and elicitation techniques described. Coordinate with your HR and counterintelligence teams to establish a reporting channel for unsolicited recruitment contacts that bypasses the normal IT help desk. But do not stop there. Rather than surveilling your own people’s personal accounts, point detection at the adversary’s infrastructure. Work with your threat intelligence function to track newly created recruiter personas impersonating your organization or its executives, and feed confirmed fake profiles back to the platforms and to your workforce as named, concrete examples. The principle here is that your most sensitive data can leave through a conversation that never touches a corporate system, and your security operations are unlikely to see it unless you instrument the human layer, not just the network layer.

Supporting sources:

MEME OF THE WEEK

When security budgets double, the AI agents go in, the EDR gets deployed, and the hacker still just searches LinkedIn for your cleared staff.

ROLE-BASED TAKEAWAYS

Executive / CISO / Board Level

AI agents are now a demonstrated account takeover vector. The Meta AI support bot incident produced real-world compromise of government-affiliated accounts. Direct your team to inventory every AI agent with write access to identity, credential, or account systems and confirm that none can execute sensitive actions without out-of-band human verification. Frame this for the board as reputational and regulatory risk, not just a technical gap.
The Five Eyes recruitment advisory requires a cross-functional response. Chinese intelligence operations targeting cleared personnel operate outside your SOC’s visibility. Establish a joint working group between cybersecurity, HR, and counterintelligence (if applicable) before your next board meeting. The exposure is not network-based, so network-based controls will not detect it.
Attacker tooling costs continue to collapse. Automated EDR evasion testing and AI-assisted attack development are now documented in the wild at scale. Expect endpoint tools to remain necessary but easier for capable attackers to pre-test unless they are supplemented with behavioral, identity, and deception-based detection. Budget accordingly for FY27.

Enterprise Architect

Design Principle Impact: AI agents must be treated as privileged service accounts, not user productivity features. The Claude Code GitHub Action flaw demonstrates that any AI tool processing untrusted input with the developer’s permissions creates an implicit privilege escalation path. Architect CI/CD pipelines so AI agents operate with read-only tokens by default and require explicit, scoped elevation for write operations.
New Constraint: External input and execution authority must never converge in the same automated process without a human gate. Whether it is a support chatbot resetting passwords or a coding assistant committing to a repository, the pattern is identical. Design systems so that any action triggered by external or untrusted input requires a separate authorization step that the triggering input cannot satisfy.

Security Operations

Implementation Watch Item: Audit all GitHub Actions and CI/CD workflows for AI-agent invocations (Claude Code, Copilot, Cursor) that trigger on issue creation, pull request comments, or other externally writable events. Flag any that run with write permissions.
Common Failure Mode: Teams assume that because an AI coding tool was approved by engineering leadership, its CI/CD integration was reviewed for security. In most organizations, these integrations bypass the normal change-review process because they are treated as developer tooling rather than infrastructure changes.
Monitoring Patterns: Watch for anomalous credential reset volumes from AI-powered support systems. Correlate support bot actions with IP geolocation and session metadata to identify reset requests originating from unexpected regions or following prompt patterns shared in underground channels.
Signal vs Noise Guidance: A single EDR evasion test from an internal red team is noise. A pattern of rapid-fire payload submissions against your EDR agent from an endpoint not associated with your security team, especially if followed by a clean execution of a previously blocked binary, is a genuine pre-attack indicator.
Take the adversary by surprise: Deploy honey credentials (fake API keys, cloud access tokens) in the same locations where legitimate developer credentials are stored, such as .env files, CI/CD secrets, and local config directories. The automated EDR evasion workflow described this week ends with credential harvesting. A canary credential that triggers an alert on use catches the attacker at their objective, regardless of whether their payload evaded your endpoint agent.

See you next Monday!

The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.

The Monday Brief

Discussion about this post

Ready for more?