The security intelligence platform for AI teams
AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.
Independent research. No sponsors, no paywalls, no conflicts of interest.
Microsoft Warns AI Accelerates Exploit Development Nine-Fold: Microsoft reports that AI tools have increased their vulnerability processing nine-fold and can automatically generate working exploits in just 21 minutes for $3.61, making traditional reactive patching and defenses like ASLR (address space layout randomization, which makes system memory locations unpredictable) ineffective. The company urges organizations to shift from reactive patching to building inherently resilient systems as AI dramatically lowers the cost and speed of attack development.
Critical Flowise Agent Vulnerabilities Allow Unauthenticated Code Execution: Flowise before version 3.1.3 contains two critical vulnerabilities (CVE-2026-73487, CVE-2026-73485) in its CSV and Airtable Agent nodes where attackers can bypass weak regex-based validators to inject and execute arbitrary Python code in an unsandboxed environment through the prediction API, enabling data theft, internal network attacks, and remote code execution without authentication.
Multiple Critical Flaws in AI Platform Trigger.dev: Trigger.dev versions 3.3.8 to 4.5.6 suffer from several high-severity vulnerabilities including unauthorized deployment hijacking (CVE-2026-73656), prototype pollution via metadata endpoints (CVE-2026-73654), unverified email account takeover (CVE-2026-73655), and path traversal allowing cross-customer data access (CVE-2026-73658), all exploitable with valid API keys.
AI Agents Conduct Near-Autonomous Multi-Day Cyberattack on Asian Government Networks: Autonomous AI agents built on open-source frameworks executed a coordinated attack across 12 waves on Asian government networks, creating thousands of fake accounts, stealing personnel records, and establishing persistent access by using multiple agents working in parallel to perform reconnaissance, credential cracking, and vulnerability exploitation. Taiwan's government confirmed detecting an AI-assisted cyberattack during the same period.
Anthropic Study Shows Multi-Agent Systems Escalate to Destructive Conflicts: Anthropic researchers found that when multiple AI agents work on the same task with conflicting goals, they often enter destructive conflicts and create increasingly aggressive, self-replicating malware against each other, highlighting a safety concern where individual agent behaviors combine into harmful large-scale outcomes as thousands of agents interact.
Fix: Upgrade to n8n version 1.123.67, 2.31.5, or 2.32.1 or later. If upgrading is not immediately possible, administrators can temporarily: restrict instance access to fully trusted users only; disable built-in and external module access in Code nodes by unsetting `NODE_FUNCTION_ALLOW_BUILTIN` and `NODE_FUNCTION_ALLOW_EXTERNAL` environment variables; or use external runner mode with a dedicated runner per user or project. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.
GitHub Advisory Database