Session CRT-20260917 — 17 September 2026 · Morning Edition

The evidence now falls into three distinct categories rather than one dramatic AI-threat narrative. GitSpawn and BragJack are vulnerability or proof-of-concept findings, while the Qwen3.5-27B work was a controlled model-modification experiment. The AEPD notification is the only reported production breach, but even there the claim that an AI agent executed the incident remains the notifier’s preliminary attribution. Nothing public establishes the agent’s degree of autonomy, the organization or provider involved, the affected data, or provider fault. The defensible shared concern is narrower: untrusted automation crossing externally unenforced authority boundaries. For enterprises, that supports isolated execution, deny-by-default egress, ephemeral identities, controlled extensions, human approval for consequential actions, adversarial testing, and complete action logging—not a claim that self-directed AI attacks have been demonstrated across all four cases.

Regulatorily, the Spanish notification is a signal to improve evidence preservation, not a precedent for presumed liability. Controllers should retain the awareness timeline, model and provider details, prompts, tool calls, approvals, permissions, credentials, affected systems and data, processor roles, containment measures, effects, and risk analysis. Article 33 and Article 34 duties still turn on risk to individuals and established notification thresholds; the notice does not itself establish autonomous causation, deficient security, or personal CISO liability.

The geopolitical picture also separated cleanly. A sharp regional ransomware increase primarily indicates expanding criminal activity. Greece’s VShell alert was pre-emptive and does not publicly confirm compromised infrastructure or technically connect the activity to CHOSEN BRICK. CHOSEN BRICK remains a separate espionage and transnational-repression operation associated with Iranian state-linked actors targeting dissidents, activists, and journalists. Iranian strategic pressure is a relevant backdrop, but shared geography and timing are not attribution.

We can now close the operational discussion by turning these evidence distinctions into architecture decisions: which exposures demand immediate containment and hunting, which AI deployments should fail a deployment gate, and which controls preserve proof rather than merely creating an appearance of remediation.

Tonight’s operational order is now sharper: Cisco SEG / CVE-2026-76461 remains the first containment priority, with self-managed GitLab / CVE-2026-85706 immediately behind it. For Cisco, the crucial warning is that installing a patch does not establish that an exposed appliance is clean. James’s sequence is to remove direct internet exposure, restrict management access, preserve configuration and security telemetry, and snapshot virtual appliances. If compromise indicators exist—or telemetry is too incomplete to exclude compromise—the safer course is rebuilding and rotating administrative secrets. The exact fixed build is still unconfirmed. Validation must cover mail flow, administrative accounts, and outbound connections, followed by 24 hours without recurrence before standing down.

GitLab has moved materially beyond yesterday’s uncertainty. Reproduction, targeted probing, and KEV inclusion now support immediate containment rather than watchful waiting: restrict public access and, where feasible, disable affected API paths while preserving evidence. The response provided here cuts off during the preservation guidance, so we should not infer additional GitLab procedures or stop conditions that were not recorded.

Just as importantly, the panel is separating actionable technical evidence from broader interpretations. The Spanish incident attribution, the AEPD reading, and the geopolitical assessment remain panel judgments pending independent verification; they should not displace the limited containment capacity needed for Cisco and GitLab. That discipline carries directly into the next decision point: PhantomRaven. We now need to distinguish what is actually verified about the typosquatted npm packages, preinstall execution, and credential or CI/CD targeting from what remains inferred, then turn that evidence into a proportionate developer-supply-chain response.

PhantomRaven gives us a clear developer-supply-chain decision point: the actionable risk is verified, while the more attention-grabbing authorship claim is not. The campaign used look-alike npm packages, remote HTTP dependencies, and a preinstall hook that launched node index.js. Its JavaScript searched Git and npm configuration, along with environment variables, for npm tokens, GitHub credentials, and secrets tied to GitHub Actions, GitLab CI, Jenkins, and CircleCI. Those behaviors—not speculation about how the code was written—define the defensive priority.

Two attribution boundaries matter. CrowdStrike assesses the operator as financially motivated and involved in bug-bounty hunting, but that remains vendor intelligence rather than code-level proof of identity. More importantly, the claim that the bespoke malware was LLM-generated has not been independently established. Without reproducible evidence such as prompts or model logs, code style and comments may support an assessment but cannot prove authorship. Maya’s point is operationally decisive: whether a person or an LLM produced the malware does not change the significance of install-time execution, credential discovery, and exfiltration.

The immediate hunt should enumerate npm manifests, lockfiles, caches, and installation logs for implicated packages and undeclared HTTP dependencies. Teams should then correlate npm process telemetry showing preinstall spawning node index.js with associated outbound activity, while treating exposed developer, package-registry, source-control, and CI/CD credentials as the central risk. As we move into synthesis, this case reinforces a broader theme from the room: prioritize verified execution paths and credential exposure, preserve attribution caveats, and do not let uncertain provenance claims distract from containment.