A fact-based update for security and risk professionals, focused on how AI is reshaping the threat landscape and the defensive stack.

🔐 Core Security Intelligence

PromptSpy: First Android Malware to Leverage Gemini at Runtime

Researchers at ESET have identified PromptSpy, the first documented Android malware to integrate an LLM (Google Gemini) directly into its execution flow for persistence. The malware sends the device’s UI element data to Gemini, which then returns JSON instructions to the malware. These instructions tell PromptSpy exactly where to “tap” or “swipe” using Android Accessibility Services to ensure the app remains in the “recent apps” list and survives reboots.

• Why it Matters: This marks a transition from AI being used to write malware to AI being used to run it. By offloading decision-making to an LLM at runtime, the malware can adapt to different UI layouts and OS versions without hardcoded logic.
• Defenses: Organizations should strictly monitor for mobile apps requesting excessive Accessibility Services permissions. Mobile Threat Defense (MTD) solutions should be configured to flag anomalous API traffic to LLM endpoints from non-productive applications.
• Expert Insight: “The malware saves both its previous prompts and Gemini’s responses, allowing the AI to understand context and coordinate multi-step interactions.” — ESET Research.
• Source: SecurityWeek

Critical RCE in Microsoft Semantic Kernel Python SDK (CVE-2026-26030)

A critical Remote Code Execution (RCE) vulnerability has been disclosed in the Microsoft Semantic Kernel Python SDK, a widely used framework for building AI agents. Tracked as CVE-2026-26030 (CVSS 9.9), the flaw allows an attacker to execute arbitrary code via a specifically crafted payload targeting the kernel’s plugin execution logic.

• Why it Matters: Semantic Kernel is a foundational piece of the “Agentic AI” stack. A CVSS 9.9 vulnerability here means that any autonomous agent built on this SDK version could be fully compromised by a remote attacker, leading to unauthorized data access or system takeover.
• Defenses: Immediately update all Python environments utilizing Semantic Kernel to the latest patched version. Implement strict sandboxing for AI agents to limit the impact of potential kernel-level compromises.
• Expert Insight: “This SDK is a key component for building AI applications; an RCE here is a direct threat to the integrity of the autonomous workflows they manage.” — Industry Intel.
• Source: Digg / Cybersecurity Brief

Microsoft Copilot Bug Exposed Confidential Emails for Weeks

Microsoft has addressed a high-profile vulnerability in Microsoft 365 Copilot that inadvertently allowed the AI to read and summarize confidential customer emails it should not have had access to. The bug affected the way Copilot parsed tenant-level permissions during summarization tasks.

• Why it Matters: This incident highlights the “Inference Risk” in enterprise AI—where the AI’s ability to cross-reference data can bypass traditional folder-level permissions if the orchestration layer is not perfectly secured.
• Defenses: Conduct a “least-privilege” audit of data sources connected to M365 Copilot. Utilize Microsoft Purview to ensure sensitive labels (e.g., “Highly Confidential”) are correctly recognized by AI services.
• Source: BBC News

🧭 Adjacent Cybersecurity Developments

Chrome Zero-Day (CVE-2026-2441) Actively Exploited

Google has released emergency updates to patch CVE-2026-2441, a high-severity use-after-free vulnerability in the CSS engine.

• Context for AI: As AI agents increasingly use “headless” browsers to perform web reconnaissance or automate tasks, browser zero-days become a primary vector for “Agent Hijacking,” where an attacker compromises the agent by serving it a malicious HTML page.
• Source: The Hacker News

BeyondTrust Critical RCE (CVE-2026-1731) in KEV

CISA has added a critical RCE in BeyondTrust Remote Support to its Known Exploited Vulnerabilities (KEV) catalog.

• Context for AI: Unit 42 has observed attackers using custom Python scripts to automate temporary account takeovers following this exploit—a technique that is increasingly being integrated into AI-driven attack toolkits to minimize forensic footprints.
• Source: Unit 42

🌱 Emerging Signals

• DHS Shutdown Impact on CISA: Practitioners are concerned that the partial DHS shutdown (since Feb 14) is limiting CISA’s ability to provide real-time guidance on AI-driven threats, potentially widening the exploitation window for new malware like PromptSpy.
• “Emoji Code” Evasion: Emerging reports suggest cybercriminals are beginning to use emoji-based obfuscation in scripts to evade traditional NLP-based security filters that are trained primarily on standard alphanumeric text.

📊 At-a-Glance Summary Table

Categories: Cybersecurity Blog, Cybersecurity News

Tags: AISecurity, Malware, MicrosoftCopilot, NIST, PromptSpy, SemanticKernel, ThreatIntel, ZeroDay