--- title: "🛡️ Chainalysis Admits \"Offensive Agentic\" Breach of Internal Systems: Brotli's HTTP2Shell Patch Sat Idle for Eight Months | AI Security Daily" description: "Blockchain analytics firm Chainalysis publicly admitted that external attackers used \"offensive agentic techniques\" to gain unauthorized access to internal systems, leaking customers' names and email addresses, and the company directly warned everyone to beware of follow-up phishing." canonical_url: "https://blog.markkulab.net/en/ai-security/ai-security-2026-11-04" author: "Mark Ku" author_url: "https://blog.markkulab.net/en/author/mark-ku" site: "Mark Ku's Tech Notes" date_published: "2026-11-04T02:00:00.000Z" category: "AI Security Daily Report" tags: ["ai-security", "podcast", "AI 資安", "AI資安", "Chainalysis", "agentic攻擊", "HTTP2Shell", "Brotli", "CVE_2026_111497", "GitHubCopilot", "MCP"] language: "en" license: "CC BY 4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" attribution: "when reusing or quoting, credit the author and link back to the original" --- # 🛡️ Chainalysis Admits "Offensive Agentic" Breach of Internal Systems: Brotli's HTTP2Shell Patch Sat Idle for Eight Months | AI Security Daily ## Opening Blockchain analytics firm Chainalysis has publicly admitted that external attackers used "offensive agentic techniques" to gain unauthorized access to internal systems, leaking customer names and email addresses, and the company is explicitly warning everyone to watch out for follow-up phishing. Today I want to walk you through three things: exactly what data this AI-driven intrusion touched, a Brotli remote code execution bug called HTTP2Shell that an AI agent dug up in a single afternoon, and why the AI coding assistants on your dev machines have become an attack surface your scanners can't see. I'll tell you how to inventory it shortly. ## Today's AI Security Highlights ### 1. Chainalysis Breached via "Offensive Agentic" Techniques, Basic Customer Data Leaked - **What happened**: On October 30, blockchain analytics firm Chainalysis disclosed that external attackers used "offensive agentic techniques", meaning AI agents driving the attack workflow autonomously, to gain unauthorized access to internal systems and tools. The accessed data included non-sensitive customer information such as user IDs, names, email addresses, and organizational role labels. According to Infosecurity Magazine, the company said it found no evidence of plaintext passwords, MFA secrets, or session tokens being exposed, and clarified that the incident is unrelated to the Binance event. The vulnerability has been patched and systems hardened. - **Scope of impact**: Affected parties are Chainalysis platform account holders. Names, emails, plus organizational role labels are the perfect combination for targeted phishing. When attackers know who the admins are and who owns what, fake password resets and MFA prompts become significantly more effective. - **Defensive recommendations**: If your company is a customer, follow the official guidance and enable two-factor authentication. Add this to this week's reminders: never approve password reset emails or MFA prompts you didn't initiate yourself, and confirm through internal channels instead. At the same time, add a monitoring rule on your email gateway for lookalike sender domains impersonating the brand. - **Source**: Infosecurity Magazine () ### 2. HTTP2Shell: An AI-Discovered Brotli RCE Whose Patch Sat Upstream for Nearly Eight Months - **What happened**: HTTP2Shell (CVE-2026-111497) is a remote code execution vulnerability in the Brotli compression library, discovered by an OpenAI agent during a high-compute red team exercise in late September. The awkward part: the underlying fix actually landed in the Brotli source code back on February 27, but because it wasn't recognized as a security patch, it went nearly eight months without a release or advisory. Help Net Security published an analysis on November 3. - **Scope of impact**: Brotli is pulled in by widely used components including Node.js, Bun, Envoy, and Python, which means everything from your frontend gateway to your backend services may depend on it indirectly. The real risk here is visibility: the code was fixed but no advisory was published, so during that window your SCA and vulnerability scanning tools would never have told you that you were running an affected version. - **Defensive recommendations**: Start by using your SBOM or dependency manifest to pull out every place Brotli is used and which version, then schedule upgrades. Until a proper patch is in place, you can follow the article's approach and add runtime rules that block behavior that shouldn't occur, such as a compression handling flow spawning a new process, as a virtual patching mitigation. - **Source**: Help Net Security () ### 3. AI Coding Assistants as a New Attack Surface: Copilot RCE Patched, Two Other Cases Not Treated as Vulnerabilities - **What happened**: Security research firm Adversa AI's November roundup on AI coding agents notes that a single trailing dot in a filename was enough to make Copilot inside Visual Studio and SSMS write its own MCP settings and configuration files, leading to command execution. Microsoft rated CVE-2026-103572 as Important and has patched it. MCP is the interface protocol AI agents use to connect to external tools, so rewriting the config file effectively means rewriting tool permissions. The article does not carry a publication date. - **Scope of impact**: The other two reports ended differently. Anthropic classified a report about sub-sessions bypassing hook consent as Informative, and GitHub confirmed the Copilot CLI finding but did not treat it as a vulnerability, shipping the fix only in 1.18.33 with no CVE and no advisory. No CVE means scanners won't flag older versions, so the risk on developer machines falls entirely on your own inventory capabilities. - **Defensive recommendations**: Add AI coding assistants on developer laptops to your asset inventory, confirm that Visual Studio and SSMS have Microsoft's patch applied and that Copilot CLI is upgraded to 1.18.33 or later, and periodically review agent MCP configuration files for unexpected modifications. - **Source**: Adversa AI () ### 4. Security Budgets Are Up but Nobody Owns Shadow AI: 46% Believe Unapproved AI Is Connected to Company Systems - **What happened**: Security vendor DNSFilter released a report on November 3 noting that while enterprises have increased security spending, they haven't closed the shadow AI governance gap. In the survey, 46% of IT and security staff believed their company systems were already connected to unapproved AI applications, and one in five respondents said unapproved AI integrations had already caused a security incident. Cybersecurity Dive covered the report on November 4. - **Scope of impact**: This one has nothing to do with company size. As long as employees can install browser extensions on their own, wire up SaaS integrations, or plug an API key into a development environment, you'll have invisible data exfiltration paths. The protection you paid for can't cover connections you don't know exist. - **Defensive recommendations**: The order matters: inventory first, then control. Pull the AI applications and integrations actually in use from your network egress logs and SaaS OAuth authorization lists, then set policy and access controls. Don't do it backwards by issuing a ban first. - **Source**: Cybersecurity Dive () ## Closing The one thing worth remembering today is that no CVE and no advisory does not mean no risk. The Brotli fix sat unnoticed for eight months, and the Copilot CLI fix never got an identifier. In both cases your scanner would never have warned you. Do one thing today: list out your AI-related assets, including coding assistants on dev machines, SaaS AI integrations, and OAuth authorizations. See it first, then talk about controlling it. See you tomorrow. --- ## About this article and its author Originally published on [Mark Ku's Tech Notes](https://blog.markkulab.net/en/ai-security/ai-security-2026-11-04) License: [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — when reusing or quoting, credit the author and link back to the original ### About the author **[Mark Ku](https://blog.markkulab.net/en/author/mark-ku)** — Software engineer - 10+ years as a software engineer - Built North-American e-commerce and AI SaaS subscription billing ### Free tools built by the author All of these are free to use: - [Free PDF Sign Tool](https://blog.markkulab.net/en/tools/pdf-sign): Online PDF sign tool — draw, type, or upload a signature, then drag, resize, and download. Everything runs in your browser; nothing is uploaded. - [VS Code Refactory](https://blog.markkulab.net/en/tools/refactory): Refactory is a VS Code refactoring extension: 34 actions plus a 37-rule code-smell inspection layer with a Code Health dashboard, across 18 languages, backed by 534 tests. It learns your repo's conventions: where interfaces live, where DI is registered, whether 'use client' belongs. It ranks files by git churn × complexity so you know what to fix first, and hands any smell to the Claude Code already on your machine. Free to use, and your source never leaves your computer. - [DB-Kit Database Manager](https://blog.markkulab.net/en/tools/db-kit): DB-Kit is a lightweight, cross-platform database manager built with Tauri + Rust + React. Manage MySQL, MariaDB, PostgreSQL, SQL Server, Oracle, SQLite, MongoDB, Redis, Kafka, Elasticsearch and RabbitMQ from one consistent interface: passwords encrypted in the OS keychain, SSH tunnels, full CRUD, a visual query builder, stacked multi-statement result sets, cross-connection data transfer, schema & data compare with sync SQL and schema snapshots, Excel / CSV import & export, visualized execution plans, ER diagrams, scheduled backups, SQL stress testing with p50–p99 latency percentiles, a 15-rule SQL review engine, Review & Run (AI review plus per-statement backups and an auto-generated rollback script), Kafka message browsing with monitoring & alerts, an SSH terminal with SFTP / FTP, Docker / Kubernetes, remote desktop (RDP / VNC / RustDesk), file / folder compare, stored procedure integration tests, six UI languages, a built-in AI assistant (a local CLI or any Anthropic / OpenAI-compatible API; natural-language SQL, AI review and tuning advice) and the dbk CLI. Free and open source (MIT), with installers for Windows, macOS and Linux. - [VS Code Super Mermaid](https://blog.markkulab.net/en/tools/super-mermaid): Super Mermaid is a VS Code extension for beautiful Mermaid diagrams out of the box: auto-colored live preview, mouse pan & zoom, high-res PNG / SVG export, 21 templates and multiple themes. Free and open source (MIT). - [React Super Mermaid](https://blog.markkulab.net/en/tools/react-super-mermaid): react-super-mermaid is an open-source React component library: render beautiful Mermaid diagrams with a single , with built-in colorful / sketch themes, pan & zoom, in-diagram search, and high-res SVG / PNG export. Lightweight, SSR-safe, fully typed. Free and open source (MIT). - [Jira / Confluence Super Mermaid](https://blog.markkulab.net/en/tools/jira-super-mermaid): An Atlassian Forge app: write Mermaid syntax directly inside a Jira issue or a Confluence page and get flowcharts, sequence diagrams, state machines and Gantt charts. 11 diagram types, SVG / PNG export, light and dark themes, full CJK support. Runs on Atlassian: your diagrams live in your own site and the app calls no third-party service. Free, coming soon to the Atlassian Marketplace. - [Mermaid Live Preview](https://blog.markkulab.net/en/tools/mermaid-preview): Write Mermaid in your browser, see it render instantly, and share the whole diagram as a single link. No sign-up, nothing uploaded to a server, and mermaid.live share links work as-is. - [React Intl Phone Number](https://blog.markkulab.net/en/tools/react-intl-phone-number): react-intl-phone-number is an open-source React component: framework-agnostic and antd-free, with E.164 in/out, a searchable flag / country-code dropdown, configurable validation levels (strict / mobile-strict / loose), themeable CSS, and i18n — phone logic powered by google-libphonenumber. Lightweight and fully typed. Free and open source (MIT). - [Uptime Kuma Cluster](https://blog.markkulab.net/en/tools/uptime-kuma-cluster): Turn single-node Uptime Kuma into a highly available cluster: OpenResty + Lua smart load balancing, shared MariaDB state, health checks and automatic failover, plus cluster-management REST APIs. One Docker Compose command to start. Free and open source (MIT). - [AI Podcast Cut](https://blog.markkulab.net/en/tools/ai-podcast-cut): Drop in a recording and it removes fillers and stutters, levels loudness segment by segment, and sends a second agent to review every cut. Cut points snap to word boundaries and zero crossings, every splice gets a fade, and sentence-end breaths are preserved. Desktop app for Windows, macOS and Linux. MIT licensed; the Windows installer bundles ffmpeg. - [AI Video Cut](https://blog.markkulab.net/en/tools/ai-video-cut): Pick something in your video: type it (face, license plate, phone screen, logo), click points or drag a box, or let Claude Code / Codex pick it. AI Video Cut tracks it frame by frame, then mosaics or blurs it, recolors it, pins stickers and text to it, swaps a screen or poster for your own image or video, or removes it using background that other frames actually captured. Plus sequence editing, local captions and an AI assistant. Free, open-source (MIT) Windows desktop app (macOS / Linux experimental) that runs locally, nothing uploaded. - [open-pos restaurant POS](https://blog.markkulab.net/en/tools/open-pos): One computer and one receipt printer is enough to open the shop. Your data lives on your own disk, no subscription, no lock-in, MIT licensed. Money is integer New Taiwan dollars with tax split by the statutory formula, so sales + tax always equals the total. Printing goes straight over ESC/POS on TCP 9100, with no vendor driver. Tauri + Rust + SQLite desktop app, v1.0 in development. - [.NET e-commerce API template](https://blog.markkulab.net/en/tools/dotnet-ecommerce-api): An e-commerce backend API template built on .NET 10: Controller → Service → Repository layering, Autofac convention-based registration, SqlSugar for MySQL / MariaDB and SQL Server, Redis cache and message queue, Hangfire jobs, JWT auth, and an extensible payment provider module (ECPay, Newebpay). Apache 2.0. - [Open Token Monitor team AI usage](https://blog.markkulab.net/en/tools/open-token-monitor): Collect token usage and equivalent cost from every employee's AI coding tools into a hub you host yourself: PostgreSQL, org roster, dashboards compared by company and department, and a reports API. Electron and Rust/Tauri clients upload every 30 minutes. MIT licensed, one Docker command. - [ai-security-monitor defensive security](https://blog.markkulab.net/en/tools/ai-security-monitor): Your website is live. Who checks its certificates, security settings and known vulnerabilities? A self-hosted Security Hub brings website scans and host monitoring together, deduplicates findings and compares scans after fixes. ### Daily podcasts - [Mark's Tech Insights — Daily AI News](https://blog.markkulab.net/en/category/tech-news): Daily curated AI and tech trends. Catch the latest developments via audio summaries — covering AI applications, software architecture, DevOps, and engineering practice. — RSS: https://blog.markkulab.net/feed.xml - [AI股市蝦聊](https://blog.markkulab.net/en/category/ai-stock-chat): Every trading day, an AI-analyzed take on the Taiwan stock market, delivered as a two-host conversation covering the session and the next-day outlook. — RSS: https://blog.markkulab.net/ai-stock-chat/feed.xml - [開源好物日報](https://blog.markkulab.net/en/category/open-source-weekly): A daily two-host pick of free open-source tools surfaced from real Hacker News, GitHub, and Reddit buzz — what pain they solve and the fastest way to get started. — RSS: https://blog.markkulab.net/open-source-weekly/feed.xml - [AI 運動日報](https://blog.markkulab.net/en/category/sports-weekly): Two hosts talk NBA, MLB and world sport every day — scores, records and the stories behind them, from a Taiwanese fan perspective. — RSS: https://blog.markkulab.net/sports-weekly/feed.xml - [AI 國際新聞快報](https://blog.markkulab.net/en/category/world-news): A daily two-host briefing that makes sense of the past 24 hours in world news — geopolitics, the global economy, conflict and security, disasters and climate — from a Taiwanese perspective, neutral and fully sourced. — RSS: https://blog.markkulab.net/world-news/feed.xml - [地端 AI 實驗室](https://blog.markkulab.net/en/category/local-ai-lab): Every day, a two-host look at open-weight models and LoRAs you can actually run on your own machine: what they are for, whether your GPU can handle them, and how they compare — sourced from official model cards. — RSS: https://blog.markkulab.net/local-ai-lab/feed.xml - [AI 行銷日報](https://blog.markkulab.net/en/category/ai-marketing): Every day, two hosts break down the latest in AI for marketing, advertising, SEO/GEO and content marketing: practical, never sponsored, every story sourced. — RSS: https://blog.markkulab.net/ai-marketing/feed.xml - [AI 資安日報](https://blog.markkulab.net/en/category/ai-security): Every day, two hosts cover the latest where AI meets cybersecurity: LLM and AI agent vulnerabilities, prompt injection, model supply-chain risks and AI-powered attacks, from a defense-first angle with every story sourced. — RSS: https://blog.markkulab.net/ai-security/feed.xml ### Newsletter [Subscribe to the newsletter](https://blog.markkulab.net/en/subscribe) — Be the first to know about new posts. No spam, unsubscribe anytime.