BreachX's Typhon AI v2 Reveals 3 Zero-Days in Red Hat's SSSD—AI Goes Offensive

The conventional image of AI as a conversational agent is being shattered. BreachX didn't just ask a model for a summary—they deployed Typhon AI Mil v2 to autonomously probe authentication logic and uncover three zero-days buried deep in Red Hat's SSSD. This marks a pivotal moment where AI transitions from productivity tool to a core asset in vulnerability discovery, with implications for both defenders and adversaries.

In a notable demonstration of how artificial intelligence is expanding beyond traditional language tasks into specialized cybersecurity domains, Bengaluru-based BreachX has disclosed three previously unknown vulnerabilities in the System Security Services Daemon (SSSD), a core identity management component deployed across millions of enterprise Linux systems worldwide. The flaws—identified as CVE-2026-68742, CVE-2026-68743, and CVE-2026-68744—were unearthed using Typhon AI Mil v2, an internally developed model purpose-built for offensive security research, and were responsibly disclosed to Red Hat under a coordinated vulnerability disclosure process. Red Hat has formally acknowledged BreachX Zero Day Research Labs for the discoveries.

“

BreachX didn't just ask a model for a summary—they deployed Typhon AI Mil v2 to autonomously probe authentication logic and uncover three zero-days buried deep in Red Hat's SSSD.

SSSD serves as the authentication and access management backbone for enterprise Linux distributions, interfacing with Microsoft Active Directory, LDAP, and FreeIPA. Its ubiquitous deployment means the impact of any vulnerability, even those of low to moderate severity, can cascade across corporate and government environments. The affected products include Red Hat Enterprise Linux versions 7 through 10 and OpenShift Container Platform 4. The vulnerabilities are not remotely exploitable; they require local access to the system. An attacker with such access could potentially crash parts of the authentication service or leak limited portions of process memory—actions that, while not catastrophic in isolation, could be leveraged as stepping stones in a broader attack chain. The fact that SSSD handles user and group information, credentials, and session data makes any memory disclosure a sensitive matter.

The discovery highlights a significant evolution in offensive security tooling. Typhon AI Mil v2 is not a general-purpose large language model but an application-specific AI trained to reason about code paths, authentication logic, and potential breakpoints. BreachX's approach signals a shift from manual fuzzing and static analysis to AI-driven reasoning capable of identifying subtle flaws buried in complex authentication workflows. This positions AI as a force multiplier for vulnerability research teams, accelerating the discovery of issues that might otherwise remain hidden in widely tested open-source components. For defenders, it underscores the escalating race between automated offense and defense, where machine-speed analysis can be used to fortify code before malicious actors develop exploits.

From an enterprise risk perspective, the immediate threat is limited. Red Hat has been notified and will presumably issue patches. However, the vulnerabilities serve as a reminder that identity infrastructure, often treated as a settled component, remains a critical attack surface. Organizations running RHEL or OpenShift should prioritize patch management for SSSD when fixes are released and review their local access controls, particularly in multi-tenant or shared environments where a local user could exploit these flaws.