February 2026 saw AI dominate the security landscape across multiple fronts: a Cline CLI supply chain compromise via a stolen token, an infostealer targeting AI agent configurations, malicious skills found in the ClawHub marketplace, and a large-scale AI-orchestrated attack compromising 600+ FortiGate devices. The BeyondTrust CVE-2026-1731 (critical RCE) was weaponized within hours of disclosure and later used in ransomware attacks. Microsoft coined 'AI Recommendation Poisoning' as a new threat category. Sysdig's own research showed an attacker can go from initial access to admin privileges in eight minutes using AI. The CISO commentary warns that Shadow AI is more dangerous than Shadow IT, as agent tools on employee laptops hold live API keys and production access. Core takeaways: patch fast, rotate credentials, secure AI identities, and maintain real-time detection because patch cycles alone are no longer sufficient.
