Perimeter Weaponization and the AI Zero Trust Pivot: F5, Cisco, and Tencent AI-Infra-Guard

Threat actors are currently deploying specialized Linux rootkits on F5 BIG-IP APM devices and exploiting vulnerabilities in Cisco Firepower Management Center (FMC) to establish persistence and enable undetected network interception. Simultaneously, the proliferation of autonomous AI agents is bypassing traditional point-in-time Zero Trust verification, necessitating a transition toward high-velocity continuous authentication. CISA has added five newly exploited CVEs to its Known Exploited Vulnerabilities (KEV) catalog, mandating immediate patching for federal and regulated entities. To mitigate AI-specific infrastructure risks, Tencent has released AI-Infra-Guard, an open-source scanning engine designed to detect systemic vulnerabilities within AI-driven environments.

• Infrastructure Exploitation: F5 and Cisco Vulnerabilities

  • Linux-based rootkits are being deployed on F5 BIG-IP APM devices, providing attackers with deep persistence and the ability to intercept traffic.
  • Critical bugs in Cisco FMC are being exploited to compromise management planes and facilitate lateral movement.
  • These attacks target the perimeter security layer, effectively turning defensive hardware into attack vectors for network-wide interception.

• Compliance Mandates: CISA KEV Updates

  • CISA has updated the Known Exploited Vulnerabilities (KEV) catalog with five new entries, signaling active weaponization.
  • Federal agencies and regulated sectors are now under strict deadlines for patching these specific CVEs to avoid systemic compromise.
  • The shift emphasizes the necessity of vulnerability management prioritized by active exploitation rather than theoretical CVSS scores.

• Identity Evolution: The AI Zero Trust Paradox

  • Traditional "least privilege" models are failing as autonomous AI agents operate at speeds and scales that exceed human-centric verification.
  • Point-in-time authentication is obsolete for AI agents, which require continuous, high-velocity verification to prevent unauthorized API orchestration.
  • Industry leaders, including Teleport, are advocating for a transition to dynamic identity frameworks designed specifically for non-human autonomous entities.

• Defensive Tooling: Tencent AI-Infra-Guard

  • Tencent's AI-Infra-Guard introduces an open-source scanning engine and detection logic to identify flaws in AI infrastructure.
  • The tool addresses a critical gap in standard security tooling, which often overlooks the unique integrity requirements of AI workloads.
  • Integration of Zero Trust policy configuration templates allows organizations to harden AI agent authentication flows.

• Strategic Outlook for CISOs

  • The convergence of hardware-level rootkits and AI identity risks creates a significant visibility gap in the modern security stack.
  • Organizations must prioritize the integrity of perimeter hardware while simultaneously updating identity providers to support autonomous agents.
  • Immediate action items include auditing F5/Cisco firmware and deploying specialized scanners for AI-driven infrastructure.