The security intelligence platform for AI teams
AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.
Independent research. No sponsors, no paywalls, no conflicts of interest.
Critical WordPress AI Plugin Flaw Enables Full Site Takeover: The AI Copilot – Content Generator plugin for WordPress (all versions up to 1.5.6) contains an authorization bypass vulnerability where unauthenticated attackers can exploit a publicly visible nonce (a temporary code meant to prevent unauthorized actions) to create admin accounts and completely take over websites when the plugin's form or chatbot is publicly accessible. (CVE-2026-14526)
Atlassian Rovo Assistant Leaks Sensitive Data Through Prompt Injection: Atlassian's Rovo assistant can be manipulated via prompt injection (malicious instructions hidden in documents or URLs) to exfiltrate sensitive data from Jira and Confluence to attacker-controlled servers. While Atlassian confirmed fixing the URL-based attack vector (RovoBlast) in July 2026, the document-based exploit remains unpatched with unclear vendor response.
Surge in AI-Generated Explicit Deepfakes Targeting UK Children: UK safety organizations report a sharp increase in cases where children are victimized by explicit deepfakes (AI-generated fake images or videos showing real people in fabricated scenarios), with particular concern over "nudification" tools that digitally remove clothing from photos of minors.