Week two of June 2026 pushes the attack surface in three directions at once: downstream into developer desktops, outward into network edge gear, and upward into the AI agents themselves. The common thread — credentials and code that defenders implicitly trust — is exactly what attackers are monetizing.
Quick Answer
The week’s must-dos: revoke and regenerate GitHub tokens used in VS Code (a one-click theft technique was disclosed), check Cisco SD-WAN exposure to CVE-2026-20245 — the seventh SD-WAN zero-day of 2026, root command execution — and update the WordPress Kirki and Burst Statistics plugins, both under active attack. Bigger picture: a study testing 100 AI agents found widespread security gaps, and Willow and Offroad each raised $7M to build the agent-security and identity layer the market suddenly realizes it needs.
Critical: VS Code One-Click GitHub Token Theft
A researcher disclosed a technique against Microsoft’s VS Code that steals a developer’s GitHub authentication token with a single click — no further interaction after opening a malicious link or installing a crafted extension. The poison is in the plumbing: VS Code stores GitHub credentials locally for its integrated auth flows, and a malicious path to those secrets means read/write access to every repository the victim can touch, including CI/CD pipelines and production-adjacent code.
At the time of reporting the flaw was unpatched and the PoC was disclosed without coordinated release, which makes the defensive moves immediate and mechanical:
- Audit installed VS Code extensions — remove anything unverifiable or unmaintained;
- Revoke and regenerate all GitHub tokens that VS Code or its extensions use;
- Watch GitHub audit logs for anomalous repo access, PAT creation, or workflow edits;
- Prefer ephemeral, environment-injected tokens over editor-stored credentials;
- Treat developer tooling as production infrastructure — it is one `git push` away from it, as the node-ipc incident and wider supply chain crisis already proved.
High: Cisco SD-WAN’s Seventh Zero-Day of 2026
CVE-2026-20245 allows arbitrary command execution as root on affected SD-WAN devices and remains the seventh Cisco SD-WAN zero-day exploited this year. As we noted in last week’s intel, there was no patch at disclosure, so the playbook is architectural: keep management interfaces off the internet, segment the SD-WAN control plane from everything else, monitor controller command logs, and press Cisco TAC for emergency fixes. Edge devices as the breach point is the year’s most reliable pattern — the same geometry behind the BlueHammer/RedSun perimeter compromises and the broader 2026 zero-day surge.
WordPress Under Fire: Kirki and Burst Statistics
Two widely deployed plugins are being actively exploited in the wild — not theoretically scanned, actively attacked:
- Kirki Customizer Framework — privilege escalation that can hand attackers administrative access;
- Burst Statistics — authentication bypass enabling full site takeover.
Patches are available, which turns this from an emergency into a fifteen-minute chore with a deadline. Update both if installed, then check the `wp_users` table for unfamiliar admins and diff user roles for elevation. WordPress plugin exploitation remains one of the highest-ROI attack vectors on the internet precisely because patch latency is measured in weeks for most estates.
100 AI Agents Tested: The AI Risk Quadrant
A comprehensive study put 100 AI agents through security testing and ranked them on an AI Risk Quadrant across three axes: how easily the agent can be compromised, the blast radius if it is, and the strength of built-in defenses. The headline finding is blunt: most agents showed significant security gaps.
This is the empirical backing for what the frameworks have been warning about all year — the agentic attack surface is real, and it is growing faster than most security programs are adapting. If you deploy agents in any business process, the study’s three axes make a usable scorecard: inventory your agents, rate each on compromise-likelihood, impact, and existing controls, and remediate the top-right quadrant first. The OWASP Top 10 for Agentic Applications and guidance on securing multi-agent systems are the templates; threats like agent persistence attacks are what you’re defending against.
Also This Week: Voice Hijack and the Agent-Security Funding Wave
Two stories we flagged in week one developed further. The Gemini voice assistant notification hijack — steering assistant actions via crafted messages, from smart-home control to Zoom calls — hardened the case that notification channels are implicit trust boundaries. And the funding market confirmed agent security is now its own category: Willow (formerly Webrix) emerged from stealth with an enterprise platform for governing AI agent access, and Offroad raised $7M to apply autonomous agents to identity risk — security AI securing AI, the meta-pattern of 2026.
The Week at a Glance
| Priority | Action | Covers | Effort |
|---|---|---|---|
| Critical | Audit VS Code extensions; revoke & regenerate GitHub tokens | One-click token theft | ~30 min |
| High | Verify Cisco SD-WAN exposure; segment management planes | CVE-2026-20245, root RCE | ~15 min + change window |
| Medium-High | Update Kirki & Burst Statistics; audit admin users | Active WP exploitation | ~10 min |
| Medium | Score your AI agents on the Risk Quadrant axes | 100-agent study | ~1 hour |
| Ongoing | Inventory assistant/voice-AI integrations and notification flows | Gemini hijack class | 30 min initial pass |
Frequently Asked Questions
How does the VS Code GitHub token theft work?
The technique abuses VS Code’s extension and auth architecture: a malicious link or crafted extension reaches the GitHub authentication token stored locally by the editor, exfiltrating it with a single click. The stolen token grants the attacker the same repository read/write access as the victim developer — including CI/CD-adjacent code.
Why does Cisco SD-WAN keep shipping zero-days?
SD-WAN controllers concentrate routing policy, encryption keys, and management access on internet-adjacent appliances — a high-value, high-exposure combination. Seven exploited zero-days in 2026 reflects attackers’ focus on edge infrastructure as the primary breach point; segmentation and management-plane hygiene are the mitigations that survive every individual CVE.
Which WordPress plugins are being exploited this week?
Kirki Customizer Framework (privilege escalation to admin) and Burst Statistics (authentication bypass to site takeover). Both have patches available — update immediately if installed, then audit for unauthorized admin accounts and role changes.
What did the 100 AI agents security study find?
Most of the 100 agents tested showed significant security gaps. The study’s AI Risk Quadrant rates each agent on vulnerability, impact, and defense strength — a practical scoring model organizations can replicate to prioritize which of their own agents to harden first.
References
- Researcher disclosure — VS Code GitHub token theft technique (PoC, uncoordinated)
- Cisco — SD-WAN security advisory, CVE-2026-20245
- WordPress — Kirki Customizer Framework & Burst Statistics plugin advisories
- AI Risk Quadrant — 100-agent security study
- Hmmnm — Weekly Threat Intel June 2026 · W1
- Hmmnm — Agentic AI Security: The New Attack Surface
- Hmmnm — OWASP Top 10 for Agentic Applications 2026
- Hmmnm — Securing Multi-Agent Systems
- Hmmnm — node-ipc Supply Chain Attack 2026
- Hmmnm — Software Supply Chain Security
- Hmmnm — AI Agent Persistence Attacks
- Hmmnm — Defender Becomes the Door: BlueHammer & RedSun
