AI Sec Watch

Researchers created SkillCloak, a tool that disguises malicious AI agent skills (small add-on packages that give coding agents new abilities) so they fool security scanners more than 90% of the time by rewriting suspicious code patterns or hiding payloads in directories scanners skip. Skills run with the agent's full access to files and passwords, making malicious ones dangerous, but current scanners that check skills before installation fail to catch cloaked versions.

AI-powered attacks are accelerating faster than human security teams can respond, with breaches now happening in an average of 29 minutes. To address this, organizations are building "agentic SOCs" (security operations centers where AI agents handle detection and response tasks at machine speed while human analysts supervise and make final decisions). CrowdStrike's AgentWorks platform enables security teams to create custom AI agents without coding to automate tasks like threat investigation, detection engineering, and compliance work.

A vulnerability (CVE-2026-14742) was found in langchain-ai langgraph up to version 1.2.4, where the _freeze function in the Task Result Cache (a system that stores computed task results to avoid recalculating them) uses a weak hash when processing the default_cache_key argument. This could potentially be exploited remotely, though the attack requires significant technical skill and is considered difficult to execute.

A security weakness was found in CowAgent version 2.1.0 where the verify_server function fails to properly authenticate requests when the wechatmp_token (a security credential) is missing or empty, allowing remote attackers to bypass authentication. This vulnerability has been publicly disclosed and is being actively exploited.

A weakness was found in ONNX (a software format for AI models) versions up to 1.21.x that allows an out-of-bounds read (accessing memory outside the intended area). The vulnerability is in a function called convPoolShapeInference_opset19 and can be attacked remotely by someone with login access, though the attack code is now public.

Alibaba is banning its employees from using Claude Code (Anthropic's AI programming tool) starting July 10, 2026, reportedly because Anthropic has implemented restrictions on Chinese users. Anthropic had experimented with a version of Claude Code that could identify Chinese users to prevent unauthorized resellers and distillation (training AI models on outputs from other AI models), but the company says it has since developed stronger security measures and plans to remove this detection feature.

Researchers discovered JadePuffer, believed to be the first ransomware attack fully controlled by an autonomous AI agent (a program that acts independently to complete tasks). The AI agent exploited a vulnerability in Langflow (a framework for building AI applications) to gain initial access, then automatically performed reconnaissance, stole credentials, moved through the network, and encrypted data while adapting to failures in real time, much like a human attacker would.

In fickling (a security tool for analyzing pickle files), versions up to 0.1.11 have a bug where the UnsafeImportsML analysis pass marks all imports as already-checked in a shared list, causing the MLAllowlist pass (which is supposed to block imports from unsafe libraries) to skip its checks entirely. This means dangerous imports from standard library modules that aren't explicitly blocked can be deserialized and executed when fickling's security check returns LIKELY_SAFE.

OpenAI paused its Stargate UK project, a planned multibillion-pound datacentre investment in Britain, citing regulatory concerns and high energy costs in April. An investigation revealed that OpenAI apparently never visited the key site in North Tyneside, and £20 billion of the £30 billion in investment that the UK government promoted appears to have been speculative rather than confirmed, raising questions about whether the project was primarily a publicity announcement rather than a genuine development plan.