ThreatLocker Highlights Key Cyber Threat Activity and Research from August 2026

Recap includes AI agent security, ClickFix attacks, exposed infrastructure, zero-day research, and company momentum

ORLANDO, Fla., Sept. 3, 2026 /PRNewswire/ -- ThreatLocker today released highlights of the company's cybersecurity research and company news from August.

"Everyone was talking about AI in August, but the incidents we analyzed reinforced that most security problems still follow familiar paths," said Danny Jenkins, CEO & Co-founder of ThreatLocker. "The attacks we looked at were caused by trusted access, regardless of whether AI was involved."

Basic Controls Are Still Most Important

The month's incidents showed why basic cybersecurity controls cannot be treated as a secondary problem to AI. Attacks targeting water systems showed how exposed infrastructure default credentials still create serious risk.

ThreatLocker also examined why ClickFix is so effective against security-aware users. ClickFix does not just rely on a user trusting the wrong prompt. It also depends on trusted system tools, including PowerShell and Command Prompt, being allowed to execute commands or reach the internet without enough restriction.

ThreatLocker MDR intercepted ACR Stealer delivered by ClickFix, showing how the social engineering technique can be used to deliver credential-stealing malware. The incident highlighted the need to limit what can execute and what it can reach if a user is tricked.

The company also published guidance on why cybersecurity strategy is shifting from threat detection to threat containment, as well as how to build cyber resilience that survives a compromise.

AI Security Still Requires Trust Boundaries

AI was still an important part of the August cybersecurity story, but not because it replaced traditional security concerns. The issue was how much access AI tools and agents receive once they are added to business environments, and what they are allowed to do with that access.

ThreatLocker's research examined the security problems created by AI tools and agents, including how the Cursor AI hack highlights AI shortcomings, what happens when an AI agent can access secrets, and how indirect prompt injection can manipulate AI agents through untrusted data.

The company also explored what permissions autonomous AI agents should have, and the difference between excessive agency and least agency. The common question across those pieces was not whether organizations should use AI, but how to put boundaries around what AI tools can access, execute, and change.

AI security was a major focus at Black Hat and DEF CON in Las Vegas, where ThreatLocker participated in discussions about AI-driven cyber risk, workplace AI tools, and the changing role of defenders. At Black Hat, Jenkins delivered a mainstage session, "Defending against hidden risks of AI tools in the workplace," focused on how AI tools can bypass controls and introduce new attack surfaces. Jenkins also joined Lead Cybersecurity Engineer Kieran Human for the breakout session, "Red teamer or AI-powered attacker? Generating, evading, and delivering malware with AI," which demonstrated AI malware creation and exploit detection.

Exploits and Exposed Systems

ThreatLocker tracked new exploit activity and risks involving trusted tools throughout August.

The company analyzed ShieldBreak, a proof-of-concept exploit from NightmareEclipse that targets the same weakness as RoguePlanet. The company's threat intelligence team also examined the N-able N-central vulnerability, which showed how vulnerable remote monitoring can give attackers access if left exposed.

ThreatLocker further published research on WiFi Pineapple hacking, and supply chain security lessons and best practices.

Industry Engagement and Company Momentum

ThreatLocker leaders participated in industry conversations throughout August on AI agents, phishing, session hijacking, and why foundational controls still matter most as attack techniques become more convincing.

ThreatLocker also announced a $190 million Series F funding round to support product innovation and global expansion. As part of that growth, the company announced plans to open a new office in Reading, U.K.

About ThreatLocker

ThreatLocker is a global cybersecurity leader that stops cyberattacks before they happen. The company's Zero Trust Platform prevents breaches from both known and unknown threats by allowing only explicitly trusted software and activity across endpoints, networks, and cloud systems. Built to deploy quickly and scale across complex environments, the platform reduces operational overhead while keeping business running uninterrupted. Headquartered in Orlando, Florida, with offices in Dublin, Dubai, and Brisbane, ThreatLocker protects over 70,000 organizations worldwide.

Contact: [email protected], 321-515-3813

SOURCE ThreatLocker, Inc.