People are treating this week’s autonomous AI writeups as proof that offense finally grew a brain. Unit 42’s look at the Cairn framework, plus a US retailer that folded after the attacker switched from hand-typed commands to generated scripts, makes that reaction easy. Your cybersecurity team should be more worried about the boring listeners that still answer unauthenticated. A GPU cluster manager with a trivial auth bypass is already seeing exploit attempts. A container registry that lets anonymous users overwrite every private image is a supply-chain incident waiting on a port scan. If that program spent November chasing agentic attackers while GPUStack, Quay, and Apache httpd sat on default-trust, you optimized for the press cycle.

The Agent Story Is Covering for Open Listeners

The Cairn writeup is catnip for every briefing deck that already had “agentic” in the title. Open-source agent framework. Autonomous intrusion against semiconductor, defense, and civic targets. You can feel the budget meeting forming. Dark Reading’s retailer piece adds a cinematic beat: typed commands fail, generated scripts land, lateral movement in minutes. That sequence is real. It’s also a convenient way to ignore the systems that never asked for a password.

SANS ISC is watching exploit attempts against CVE-2026-102895, a trivial authentication bypass in GPUStack. GPUStack is open-source software that manages clusters of GPUs, which is another way of saying it sits in front of the most expensive compute you bought this year. Every version before 2.2.0 is in scope. The 2.2.0 fix shipped at the end of June. The bug became public at the end of July. The CVE number arrived on November 4. Exploit attempts are showing up now. That lag is how internet-facing admin planes die.

You don’t need a reasoning loop to hit an unauthenticated cluster API. You need a scanner and a default install. The retailer attacker reached for generated scripts after the slow path failed. GPUStack offers a faster path: skip identity entirely. If that box is reachable from a developer VPN, a CI runner, or a “temporary” public IP that never went away, the autonomous-agent narrative is theater. The cluster already trusted strangers.

Read that timeline again. Patch in June. Public discussion in July. CVE in November. Probing in November. Plenty of teams will swear they follow AI security guidance while the thing that schedules the jobs still has an auth hole from last summer. Security hardening that starts at the model card and skips the orchestrator is a posture document, not a control.

Your Private Images Were Never a Tenancy Boundary

Red Hat’s Quay flaw is uglier because it hits the place you store the thing the GPU is supposed to run. An attacker who can reach a Quay registry can read and overwrite private container images in every repository. Anonymous access is on by default. While that default holds, the attacker needs no account. Turn anonymous access off and the bug still works for anyone with a valid login. Red Hat shipped fixed builds for eight Quay versions. You still have to install them, and you still have to prove anonymous is actually off.

Overwrite-all-private-images is supply chain with a friendly web UI. Poison the image, wait for the next deploy, watch production pull your implant. Threat detection that only watches running containers will miss the swap. Incident response that only rotates app secrets will miss the registry credential that published the new tag. Defense in depth that ends at the cluster network policy never inspects who was allowed to PUT a manifest.

Operators keep filing this under “platform,” which is how it escapes the same SLA you give internet apps. Registries are identity systems. They mint trust for every node that does a pull. If anonymous can rewrite that trust, your SBOM process is a PDF.

HTTP/2 Turned a Race Into Remote Code Execution

Apache httpd got a critical RCE of its own this week, CVE-2026-119618, a mod_http2 race condition. Unauthenticated attackers can execute code on servers with HTTP/2 enabled. Anthropic and Google found it. Sit with that for a second. The labs driving the agent panic also just showed you that the web server under a huge fraction of the internet still has an unauthenticated path to a shell if HTTP/2 is on and the patch is not.

You enabled HTTP/2 because a performance ticket said so. You didn’t put that listener on the same patch SLA as the VPN. Race conditions in multiplexed protocols are nasty to detect with a WAF signature and easy to retry until they win. If that httpd is reverse-proxying the GPU UI or the Quay hostname, the race and the registry bug are one chain. A firewall allow to 443 does not parse HTTP/2 frames for you.

Your Cybersecurity Playbook Is Tuned for Scripts, Not Sockets

Most cyber security programs this month will add a slide about autonomous attackers and a hunting query for suspicious Python. Fair. Cairn-style agents and generated C2 snippets will show up in some of your tenants. The miss is what your threat-protection stack already ignores: management APIs that never demanded a token, registries that confuse “private” with “please don’t look,” and HTTP/2 listeners you forgot were code execution surfaces.

Brute-force noise against SSH still pages somebody. Unauthenticated success against a GPU API often looks like a 200. Your SOC’s muscle memory is malware, phishing, and password spraying. GPUStack and Quay fail in a quieter way. They fail as design. Threat detection that never ingested the orchestrator audit log cannot tell you who scheduled the job. Incident response that has no playbook for “every image tag moved” will spend twelve hours on the node that pulled the bait.

This is a bad look for teams that spent 2026 writing AI acceptable-use policies and never listed GPUStack in the asset inventory. Stop asking whether the model is aligned. Ask whether the cluster manager is reachable, whether the registry still has anonymous on, and whether httpd with HTTP/2 is patched. Those questions are less glamorous. They close the holes this week’s bugs actually opened.

Lock the Orchestrator Before You Hunt the Model

You can do this without buying an “AI SOC.” The work is inventory, authentication, patching, and proving the old path is dead. Immediate first, then the boring loop that keeps it dead.

1. Inventory the AI-adjacent listeners this week. List every GPUStack or equivalent API, every container registry, every Apache httpd with HTTP/2 on, and every reverse proxy in front of them. Include “internal” hostnames reachable from VPN, CI, or a jump box. If you can’t name the owner and the last patch date, it’s internet-facing for someone.
2. Kill anonymous registry access and then verify tenancy. Disable anonymous on Quay and every clone of that pattern. Apply Red Hat’s fixed builds. Then, from an unauthenticated session and from a low-privilege account, try to list and pull a private repo you should not see. If either path works, you’re still open. Log every manifest PUT and tag move.
3. Patch the orchestrator and the web server like they are identity. GPUStack needs 2.2.0 or later. Apache needs the httpd build that closes CVE-2026-119618. If you can’t patch today, disable HTTP/2 on exposed httpd and pull GPUStack off the public interface. A change freeze that leaves unauthenticated RCE in place is a choice.
4. Put auth in front of the API, not only a network halo. Mutual TLS, SSO, or a break-glass identity onto the GPU UI and the registry. Network allowlists help; they are not authentication. If the only control is a firewall object, a stolen laptop on the right VLAN still owns the farm.
5. Hunt like the image and the job scheduler are the crown jewels. Look for new GPU jobs from unknown identities, registry pushes outside the CI service account, httpd crashes and restarts clustered in time, and 401/403 rates that suddenly become 200s on the cluster API. Fold those into incident response this quarter, not into a parking-lot backlog.

Ongoing, treat brute-force and spray traffic against those new listeners the way you treat SSH. Rate-limit, lock out, and page on unauthenticated bursts. An ipban-style control on the jump box or the reverse proxy is enough to raise the cost of the scan; IPBan Pro fits if you already sit Windows in front of the admin UI. The product is optional. The failure mode is not. Scanners will find GPUStack and httpd the same way they found Exchange and the VPN concentrator. Your job is to make the first unauthenticated probe loud, then make it fail.

Security hardening here is proving a negative: anonymous cannot pull, the old GPUStack build cannot answer, HTTP/2 on the unpatched binary cannot be negotiated. Screenshot the failed request. Keep it with the ticket. Defense in depth starts when that evidence exists, not when the model vendor publishes a usage policy.

Frequently Asked Questions

If GPUStack was patched in June, why are exploit attempts showing up now?

The 2.2.0 fix shipped at the end of June, the bug became public at the end of July, and the CVE was assigned on November 4. Plenty of clusters never moved, and scanners wait for a CVE string. If you’re still on anything older than 2.2.0, assume the listener has been touched.

Does turning off anonymous access fully fix the Quay flaw?

No. Red Hat says that with anonymous disabled, any valid account can still read and overwrite private images across repositories until you install the fixed builds. Disable anonymous, patch all eight affected streams you run, and then test a pull you should not be able to complete.

Should we disable HTTP/2 on Apache until we patch?

If you can’t ship the httpd build that closes CVE-2026-119618 today, yes, turn HTTP/2 off on internet-facing and reverse-proxy listeners. The race needs HTTP/2 enabled. Bring it back only after the patched binary is what answers the handshake.

Sources

• Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors
• Inside an AI Attack Against a US Retailer
• Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895)
• Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry
• Apache Patches Critical HTTP Server RCE Found by Anthropic, Google