SANS Internet Storm Center Stormcast: AI Agent Forensics, Claude AI in Attacks, IDN Typosquatting, and Cisco Finesse Vulnerability

This SANS Internet Storm Center Stormcast from Friday, October 9th, 2026 covers several cybersecurity developments. Jim Clausing created two scripts that reconstruct AI agent activity from logs into JSON format, specifically for Open Code and Hermes agents, which can be useful for forensic investigations of both attacker and victim AI agent activities. CrowdStrike discovered a Claude MD file on a compromised system during an investigation of attacks on South Korean financial institutions, revealing the attacker's chat history with Claude AI and demonstrating what they term prompt kitties rather than script kiddies. International domain name typosquatting continues to evolve, with attackers now using letters that are visually similar but not officially classified as confusables to bypass Google Chrome's detection mechanisms, though the specific test domain impersonating Apple does not display in Safari but works in Chrome. Cisco published a high-severity advisory for Cisco Finesse regarding a server-side request forgery vulnerability that allows limited access to sensitive information, with no patch currently available until early next year and no workarounds offered, though details have already been made public.