What happened
Elastic's quarterly threat report confirms attackers in the wild are abusing approved AI coding agents and desktop AI apps as command-execution and credential-exfiltration shells, and reconstructs the Hugging Face malicious-dataset chain (HDF5 external storage page exposing env secrets, plus Jinja2 template injection) that enabled lateral movement after credential theft. The report frames agentic intrusions as still huntable via the processes, credentials and network paths agents touch.
Why it matters
This is the in-the-wild validation that vendor-signed AI agents are a real, current intrusion surface: because an agent holds credentials and can reach the internet, attacker activity behind it looks like the approved employee's own use, making it hard to distinguish and easy to miss. It also ties official AI-platform tooling (datasets) to a code-execution supply-chain vector.
Attack vector
Elastic's first 'threats,etc' report (published 2026-11-05) documents confirmed intrusions where attackers drive vendor-signed AI agents as 'explicitly trusted parent processes': running Claude Code through its VS Code extension over RDP, and using the ChatGPT desktop app as a shell command proxy to read internal docs and dump the login keychain. Agent sessions started with permission-bypass flags (e.g. --allow-dangerously-skip-permissions), stood up Cloudflare quick tunnels and installed persistent LaunchAgents. It also reconstructs the Hugging Face incident chain where a malicious dataset abused the dataset-processing pipeline via an HDF5 external storage page exposing environment secrets and worker source, plus Jinja2 template injection.
Affected systems
AI coding agents (Claude Code via VS Code extension, ChatGPT desktop app) and Hugging Face dataset-processing pipeline (HDF5 external storage / Jinja2 template injection)
Mitigation
Treat approved AI agents as a monitored attack surface, not a trusted sink: watch child processes spawned by the agent, restrict/scope agent permissions instead of wide bypass flags, constrain outbound reach, and validate any dataset loaded with remote-code/Jinja2 features before it runs.