Alex: Good Monday morning. Welcome to Cleartext for July 20th, 2026. I'm Alex Chen, alongside Jordan Reeves. We've got a dense board today. An autonomous AI agent used as an actual attack tool in the wild. Russian intelligence turning IP cameras into a continent-wide surveillance network. Romania's land registry wiped clean. Two critical zero-days under active exploitation — SonicWall and ServiceNow. A healthcare vendor breach hitting two thousand US hospitals. And European regulators fining a telco not for a technical failure, but for getting social-engineered. Plus, UK police are pushing for a new kind of preemptive legal power that could change how we think about regulatory exposure. Let's get into it.

Jordan: Let's start with the Hugging Face breach, because this one is genuinely novel. BleepingComputer confirmed over the weekend that attackers breached Hugging Face's production infrastructure using an autonomous AI agent. Not a human operator using AI-assisted tooling — an autonomous agent system that navigated the environment, found the path, and executed the breach. The entry point was a malicious dataset that abused the platform's pipeline execution environment to pivot into internal systems. Credentials and internal datasets were accessed. Hugging Face is telling all users to rotate tokens immediately.

Alex: This is the story I want every CISO reading their weekend briefing to sit with. We've been talking about AI-augmented attacks for two years now. Faster phishing, better reconnaissance, more convincing social engineering. This is categorically different. This is an autonomous system executing a multi-step intrusion chain without continuous human direction. It found the seam in the pipeline execution environment and exploited it on its own.

Jordan: And the seam it found isn't exotic. Hugging Face runs a massive model-hosting and dataset-sharing platform. Pipelines execute code. If you can inject into a pipeline — through a poisoned dataset, in this case — you're running code in a trusted context. The agent figured that out.

Alex: The immediate action for anyone using Hugging Face is obvious — rotate every token, audit your account activity, review what models and datasets you've pulled recently. But the strategic question is bigger. How many of your environments have execution contexts that an autonomous agent could discover and exploit? CI/CD pipelines, data ingestion workflows, model training jobs. If you're running AI workloads, you have attack surface you probably haven't threat-modeled for agentic exploitation.

Jordan: And I'd add — this isn't just about defending against AI agents. It's about the AI agents you're deploying internally. If you're giving autonomous systems access to your infrastructure, production credentials, internal APIs, you need to treat them like you'd treat a contractor with admin rights. Least privilege, monitoring, kill switches.

Alex: Exactly. The blast radius question works in both directions. Alright, let's pivot to the geopolitical cluster, because Moscow had a very busy week.

Jordan: Three stories, one throughline. The Dutch intelligence services — AIVD and MIVD — published a joint advisory on July 10th confirming that Russian intelligence is systematically hijacking IP cameras across multiple NATO member states and Ukraine. The targets are military transport routes, weapons shipment corridors, troop movement areas. This is physical surveillance at continental scale using commodity IoT devices.

Alex: And this is the part that should matter to the private sector. These aren't cameras on military bases. They're cameras at logistics hubs, shipping yards, rail corridors, highway interchanges. The cameras belong to private companies — freight operators, port authorities, transport providers. If you're in logistics, transportation, or anywhere in the defense supply chain, your externally accessible camera systems are now confirmed intelligence targets for a nation-state.

Jordan: The tradecraft is straightforward. Default credentials, unpatched firmware, cameras exposed directly to the internet. It's not sophisticated. It doesn't need to be. The sophistication is in the targeting and the aggregation — correlating feeds from hundreds of cameras across multiple countries to build a real-time picture of military logistics. That's an intelligence operation, not a hack.

Alex: The action here is unglamorous but essential. Audit every externally accessible camera. Change default credentials. Segment these devices off your production network. Review vendor remote access. And if you're a defense contractor or logistics provider with government contracts, expect this to show up in compliance requirements soon.

Jordan: Second in the Russia cluster — UAC-0145, which CERT-UA has formally attributed as a Sandworm sub-cluster, is using ClickFix-style fake CAPTCHA pages to trick Ukrainian targets into self-installing data-stealing malware. ClickFix is the social engineering technique where a fake CAPTCHA asks the user to paste a command into their terminal. It sounds absurd, but it works at scale.

Alex: And the critical detail is that ClickFix has already migrated beyond Ukraine. We've seen it targeting Western European organizations. GRU develops techniques in the conflict zone and then exports them. If your security awareness program doesn't specifically address ClickFix-style lures, you're behind.

Jordan: Third in this cluster, and arguably the most alarming single incident of the week — a hacker wiped Romania's entire national land registry database. The authoritative record of who owns what property in the country. Destroyed.

Alex: Let that sink in. This isn't ransomware. This isn't data exfiltration for sale. This is the destruction of an authoritative state record. Property ownership. The foundation of economic activity. If the backups aren't immutable and tested, Romania has a genuine crisis of title.

Jordan: We don't have full attribution yet, but the geopolitical context is obvious. Romania is a NATO frontline state. It's been a key transit corridor for Ukrainian military support. Whether this was Russian state action, a hacktivist proxy, or something else, the message is clear — authoritative databases are targets for destruction, not just theft.

Alex: For CISOs, the takeaway is about your own backup and recovery assumptions. If a threat actor got root on your most critical authoritative database — your ERP, your customer master, your financial ledger — and ran a destructive wipe, would you recover? Have you tested it? Are your backups truly immutable, or are they just offsite?

Jordan: Most organizations I've worked with have never tested a full destructive recovery scenario against their most critical system of record. They test backup restores, sure, but not against an adversary who had admin access and specifically targeted backup integrity. Romania just demonstrated what that failure mode looks like at national scale.

Alex: Let's move to the vulnerability block. Two critical items, both under active exploitation.

Jordan: SonicWall SMA 1000 series. Volexity discovered during an incident response engagement that a threat actor they're tracking as UTA0533 has been exploiting zero-days in these VPN appliances since at least June 22nd — almost a month before public disclosure. Exploitation grants root access. Root on your perimeter VPN appliance.

Alex: If you run SMA 1000 series, you should assume compromise until proven otherwise. Don't just patch. Hunt. Check for indicators of compromise. Assess what's downstream of that appliance. If an attacker had root on your VPN concentrator for potentially four weeks, your internal network segmentation is the only thing between you and a full domain compromise.

Jordan: Second — CVE-2026-6875 in the ServiceNow AI Platform. Critical remote code execution, now confirmed under active exploitation by the threat intelligence firm Defused. ServiceNow is in virtually every Fortune 500 company. It touches IT service management, security operations, HR workflows, procurement. The blast radius of a compromised ServiceNow instance is enormous.

Alex: This is an emergency patch. Full stop. But before you patch, verify no exploitation has already occurred. Check your ServiceNow audit logs. Look for anomalous API calls, unexpected admin actions, new integrations you didn't authorize. Patch without hunting first and you may be sealing an attacker inside.

Jordan: Two perimeter-class vulnerabilities under active exploitation simultaneously. That's a rough Monday for any SOC.

Alex: Moving to the breach space — Craneware, a healthcare software provider headquartered in Edinburgh, disclosed unauthorized access to a subset of its data environment. Employee and customer data confirmed stolen. Craneware serves more than two thousand US hospitals.

Jordan: This is a third-party risk event at scale. Two thousand hospitals. Craneware handles revenue cycle management — billing, pricing, compliance. The data they hold is sensitive. And because they're UK-listed, this is a cross-jurisdictional incident with GDPR, potential HIPAA implications, and UK regulatory exposure.

Alex: If you're a healthcare CISO, check your vendor inventory today. If Craneware is in your supply chain, invoke your breach notification clauses. Get forensic scope details. Understand what data of yours was in their environment. Don't wait for them to tell you — pull the thread yourself.

Jordan: And this is the third major healthcare vendor breach this year. The concentration risk in healthcare IT is systemic. A handful of vendors serve thousands of organizations, and when one falls, the blast radius is sector-wide.

Alex: Two governance stories to close out. Italy's Garante fined WINDTRE, one of Italy's major telecoms, 1.7 million euros for two breaches that exposed data on over 365,000 customers. The kicker — no technical vulnerabilities were exploited. Attackers posed as support technicians and social-engineered their way in. The regulator's finding was procedural failure. Help desk authentication. Access controls. Documentation.

Jordan: This is the regulatory direction across Europe. You can have perfect patch management and a state-of-the-art SOC, and still get fined because your help desk gave away the keys to someone who said the right words on the phone. Procedural controls are now a regulatory surface.

Alex: And in the UK, two senior police agency chiefs are citing the Transport for London prosecution to push for Cybercrime Risk Orders — a new legal mechanism that would give courts the power to impose proactive cybersecurity requirements on organizations assessed as high-risk. Not after a breach. Before one.

Jordan: That's a fundamental shift. Today, regulators respond after incidents. Cybercrime Risk Orders would let courts mandate specific security measures preemptively if an organization is deemed to be at elevated risk. Think of it as a restraining order for bad security hygiene.

Alex: If you have UK operations, put this on your legal team's radar now. It's early-stage, but the direction of travel is clear. Regulators and law enforcement want the authority to intervene before the breach, not just fine after it.

Jordan: Looking at the week ahead, Alex, the theme I keep coming back to is the expansion of what counts as an attack surface. IP cameras as intelligence collection platforms. AI pipeline execution environments as intrusion vectors. Autonomous agents as attack tools. Social engineering as a regulatory liability. The perimeter isn't a firewall anymore — it's everything.

Alex: Agreed. And the Romania incident adds another dimension. We've spent years focused on confidentiality — data theft, exfiltration, ransomware. Destructive attacks against authoritative records force us to think about integrity and availability in a way most organizations haven't operationalized. If your recovery strategy hasn't been tested against a determined adversary with admin access, this is the week to start that conversation.

Jordan: And for the AI agent story — I think we'll look back at the Hugging Face breach as an inflection point. The first confirmed autonomous agent intrusion. It won't be the last.

Alex: That's our show for Monday, July 20th. Show notes and links to every story we covered are at cleartext.fm. I'm Alex Chen.

Jordan: I'm Jordan Reeves. Patch ServiceNow. Hunt on your SonicWall boxes. Rotate your Hugging Face tokens. Have a good week.