No new AI/LLM security issues were identified today.
Amazon Q Developer Executes Malicious Code From Cloned Repos: Amazon Q for VS Code had a high-severity vulnerability (CVE-2026-12957, CVSS 8.5) that allowed attackers to run arbitrary commands and steal AWS credentials by embedding malicious MCP server configurations (local processes that extend AI assistant capabilities) in a repository. The flaw occurred because Amazon Q automatically loaded and executed these configurations without verifying workspace trust or requesting user permission, giving attackers full access to the developer's environment variables and cloud credentials.
US Government Restricts GPT-5.6 and Mythos Releases: The Trump administration requested that OpenAI limit its GPT-5.6 rollout to government-vetted partners before a wider launch, marking the first time a US AI firm has been told to restrict model access pre-release. Anthropic's Mythos models were pulled from service for two weeks under similar restrictions before being released to approximately 100 approved companies and federal agencies, signaling a new era of government oversight for advanced AI deployments.
Attackers Exploit OpenAI's Organization Invites to Impersonate Companies: Cybersecurity firms are being targeted by fraudulent OpenAI organization invitations that appear to come from legitimate companies, using OpenAI's real email infrastructure with attached payment methods to trick employees into sharing source code and internal documents. The invitations are difficult to detect despite OpenAI's domain mismatch warnings, as they leverage the platform's authentic communication channels.
Malware Designed to Evade LLM-Based Security Tools: Security researchers identified malware such as macOS.Gaslight (linked to North Korean threat actors) that specifically subverts AI-powered security analysis tools by causing LLM-assisted detection systems (security products that use large language models to analyze threats) to halt analysis or refuse to operate. This represents an emerging adversarial technique where malware authors are actively engineering code to bypass AI-based defenses.
Anthropic Expands AI Infrastructure in Asia-Pacific: Anthropic is rapidly building data center operations in Australia and Japan, hiring 13 people to manage infrastructure driven by advantages like renewable energy and political stability, though Australia's copyright laws may complicate expansion plans.
Critical RCE in ToolJet Marketplace Plugins: ToolJet versions before 3.20.178-lts contain a vulnerability (CVE-2026-55413) where authenticated builder-role users can inject malicious JavaScript into shared marketplace plugins, achieving RCE (remote code execution, where an attacker can run commands on a system they don't own) with full Node.js access that executes whenever anyone uses the compromised plugin.
Anthropic Accuses Alibaba of Massive Model Distillation Attack: Anthropic alleged that Alibaba conducted an illegal distillation campaign (training a weaker AI model using outputs from a stronger one without permission) involving 28.8 million exchanges through fraudulent accounts between April and June 2024. Anthropic is calling for coordinated government and industry action to combat such illicit capability extraction.
OpenAI and Broadcom Unveil Jalapeño Inference Chip: OpenAI's first custom AI accelerator, designed specifically for LLM inference (running trained models to generate outputs), delivers significantly better performance per watt than current alternatives and will deploy in data centers starting 2026. The ASIC (application-specific integrated circuit, a processor built for one particular task) was co-designed with Broadcom in nine months using OpenAI's own AI models.
OpenAI Launches Patch the Planet to Accelerate Open-Source Fixes: OpenAI deployed a new program combining AI-assisted vulnerability discovery with security experts from Trail of Bits to identify, fix, and deploy patches for flaws in critical open-source projects like Python, Go, and cURL. The company argues that AI has made vulnerability discovery so fast that security teams are overwhelmed, shifting its Daybreak initiative to prioritize rapid patching over pure research.
Fake AI Agent Skill Bypassed Security Scanners and Reached 26,000 Agents: Security researchers created a malicious AI agent skill (a bundle of instructions that agents load and execute) that evaded all scanning tools by exploiting a structural flaw where reviewers only check the initial package but attackers can later swap the external webpage it references. The attack leveraged inherited GitHub credibility and targeted advertising, demonstrating that current trust mechanisms and automated scans fail against sophisticated supply-chain attacks.
OpenAI Launches Multi-Billion Dollar Open Source Security Initiative: OpenAI expanded its Daybreak program to systematically find and fix vulnerabilities in critical open-source projects, partnering with Trail of Bits, HackerOne, and Calif to provide free security consulting and AI-powered bug hunting using GPT-5.5-Cyber (a specialized model trained on security tasks). In the first week, engineers discovered hundreds of bugs across 19 major projects including Python, Go, and RustCrypto, with 37 patches already merged.
US Export Controls Block Anthropic's Fable Model Over Code-Writing Capabilities: The US government placed export controls on Anthropic's Fable AI model, claiming its advanced code-writing capabilities posed a national security threat, while intelligence agencies from the Five Eyes alliance (US, UK, Canada, Australia, New Zealand) warned that AI models capable of severely damaging governments and businesses could arrive within months.
Samsung Deploys ChatGPT Enterprise to All Employees Globally: Samsung Electronics is rolling out ChatGPT Enterprise and Codex (an AI coding assistant) across its Korea and Device eXperience divisions worldwide, marking one of OpenAI's largest enterprise deployments to date. The deployment includes security controls like data protection and access management to enable AI use within corporate policies.
Cloudflare Enables Anonymous AI Agent Deployments: Cloudflare now allows users to deploy applications on its Workers serverless platform without account creation through temporary 60-minute projects. This reduces friction for testing and prototyping but introduces potential abuse vectors for malicious actors seeking ephemeral infrastructure.
Microsoft Attributes Major npm Supply Chain Attack to North Korean Hackers: The Sapphire Sleet group compromised an npm maintainer account and poisoned over 140 JavaScript packages with a malicious dependency that exfiltrated credentials, API keys, and cryptocurrency wallets from developer machines. The malware used post-install hooks (code that executes automatically during package installation) and deployed platform-specific persistence mechanisms across Windows, Linux, and macOS.
Lloyds Banking Group Expands AI Agent Workforce by 300: The bank is hiring 300 technologists by September to build agentic AI systems (autonomous models that plan and execute tasks with minimal human oversight), even as broader AI adoption may eventually reduce headcount elsewhere in the organization.
Widespread Critical Vulnerabilities in AI Agent Frameworks: Multiple critical command injection and authentication bypass vulnerabilities were disclosed in popular AI agent tools, including Network-AI (CVE-2026-48814, CVE-2026-54051), Langflow (CVE-2026-55255, CVE-2026-55447), and agentic-flow. These flaws allow unauthenticated attackers to execute arbitrary commands, read sensitive files, or hijack other users' workflows, exposing organizations running AI agents to immediate risk of system compromise and data theft.
Microsoft Identifies AutoJack Attack Chain Targeting AI Browsing Agents: Microsoft disclosed AutoJack, an exploitation technique that weaponizes malicious webpages to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) on computers running AI agents with web browsing capabilities. The attack chains together weaknesses in AutoGen Studio's Model Context Protocol implementation, allowing hostile pages visited by the agent to execute arbitrary code without credentials or user interaction.
PraisonAI File Access Vulnerabilities Expose Systems to Total Compromise: Two critical and high-severity flaws in PraisonAI allow attackers to read or write arbitrary files and trigger SSRF (server-side request forgery, tricking a server into making requests to unintended locations) attacks by manipulating AI agent tool parameters. The `multiedit` tool passes filepaths directly to `open()` without validation, enabling credential theft and system takeover, while search tools accept attacker-controlled `searxng_url` parameters that can reach internal services and cloud metadata endpoints to steal credentials.
Unauthenticated Email Triggers Privileged AI Code Execution in AgenticMail: A high-severity flaw in AgenticMail allows any external sender to trigger a Claude Code session running in `bypassPermissions` mode (removing safety restrictions) by sending an email whose contents are embedded directly into the AI prompt without sender verification. This enables prompt injection (tricking the AI by hiding instructions in its input) leading to arbitrary code execution and file access under the operator's identity.
Cursor AI Editor Sandbox Escapes Allow Full System Access: Cursor versions before 3.0 contain two critical sandbox bypass vulnerabilities (CVE-2026-50549 and CVE-2026-50548) where AI agents can create symlinks (shortcuts that point to different file locations) to write files outside the workspace without user approval, potentially achieving full system access.
North Korean Gaslight Malware Weaponizes Prompt Injection Against AI Analysis Tools: A new macOS malware attributed to North Korean threat actors embeds 38 fabricated error messages and crash reports to confuse LLM-powered security analysis tools through prompt injection (tricking AI by hiding malicious instructions in input), while simultaneously exfiltrating browser histories and credentials via Telegram-based command-and-control infrastructure.
Academic Survey Maps Hallucination Landscape in Vision-Language Models: A comprehensive 36-page survey in ACM Computing Surveys examines hallucinations (instances where AI systems generate plausible-looking but false or nonsensical information) across both language-only and multimodal AI systems that process text and images.
Firebase Studio Vulnerability Exposed User Projects: GCP-2026-043 allowed authenticated users to access and download source code and list storage buckets belonging to other users' Firebase projects (Google's backend service for building apps). The high-severity vulnerability has been fixed and deployed.
Malicious AI Agent Skill Evaded Security Checks and Reached 26,000 Users: A malicious AI agent skill (a reusable tool extending agent capabilities) bypassed marketplace security by hiding instructions behind a fake domain that redirected to a legitimate site during review, then changed content post-approval to collect user data. This incident demonstrates that one-time security scans cannot detect components that behave differently after gaining trust.
AI Agents Create New Multi-Principal Identity Crisis: Current OAuth tokens (standardized digital credentials for verifying identity and permissions) cannot properly track both an AI agent's identity and the user it represents, making access control enforcement impossible as agents become more autonomous and act on behalf of multiple users. The industry lacks standardization for these multi-principal scenarios where agents invoke other agents and operate without human oversight.
Anthropic's Fable 5 Jailbroken Days After Launch: Anthropic's newly released Fable 5 model was successfully jailbroken (tricked into bypassing safety restrictions) shortly after deployment, despite claims of thorough security testing. The incident underscores that even rigorous pre-release evaluation cannot guarantee vulnerabilities will remain undiscovered in production.
$20 Million AI Regulation Battle Unfolds in New York Primary: Competing super PACs funded by AI companies are flooding a New York congressional race with over $20 million, with OpenAI and Andreessen Horowitz backing lighter regulation while Anthropic supports stricter safety requirements built into models from development. The race has become a proxy war over whether the U.S. government should impose heavy regulatory oversight on the AI industry.
DNS Rebinding Bypasses SSRF Protection in Budibase: Budibase backend-core contains a time-of-check to time-of-use vulnerability (CVE-2026-54353) where SSRF protections (server-side request forgery defenses that prevent servers from making unintended requests) can be bypassed through DNS rebinding, allowing attackers to return safe IPs during validation checks but malicious internal IPs during actual connections to access localhost or cloud metadata endpoints.
Multiple Cross-Tenant Data Exposure Flaws in Dify AI Platform: Researchers disclosed four vulnerabilities in Dify (an open-source AI workflow platform) that enabled unauthorized access to private AI conversations and files across different customer accounts due to missing permission checks, allowing attackers to read sensitive chat data without authentication.
Legacy Infrastructure Gaps Undermine AI Agent Security: Organizations deploying AI agents are exposing themselves to attacks that bypass AI-specific security measures by exploiting unpatched servers, misconfigured Active Directory permissions, and cached credentials in underlying infrastructure, creating a dangerous gap where attackers can access the data and resources AI agents depend on.
Researchers Expose Music Training Data Behind Major AI Models: Four public datasets containing between 100,000 and 12 million songs have been downloaded thousands of times and used by companies including Google and Stability to train AI models, surfacing unresolved questions about artist attribution and compensation in model development.
M365 Copilot SearchLeak Exposes Prompt Injection Attack Surface: Security researchers disclosed SearchLeak, a prompt injection attack (tricking an AI by hiding malicious instructions in its input) targeting Microsoft's M365 Copilot Enterprise Search that exploits URL parameters to exfiltrate sensitive corporate data including emails, documents, and meeting transcripts. While Microsoft patched the specific vulnerability, the disclosure reveals a broader systemic risk called parameter-to-prompt injection that threatens any AI-powered web service with broad access to enterprise assets.
U.S. Restricts Anthropic AI Models as Munitions Under Export Controls: The White House classified Anthropic's Fable model as a dangerous munition and blocked foreign access after the company released an AI system described as "relentlessly proactive" at achieving difficult goals with minimal guidance, raising concerns about misuse. This marks the first major application of AI export controls, though experts note the open-source community has already demonstrated ability to replicate similar capabilities using cheaper models and improved interface code.
Enterprise AI Agents Emerge as Unmanaged Identity Crisis: A 2026 survey found 82% of organizations discovered AI agents created without security oversight, and 65% experienced security incidents involving these agents, typically resulting in data exposure. AI agents now function as autonomous identities with privileged access to critical business systems like Salesforce and GitHub, yet most organizations lack visibility or access controls for these non-human actors, creating significant security blind spots.
Adobe Expands AI Assistant Access Across Creative Cloud Suite: Adobe is deploying conversational AI assistants to Photoshop, Premiere, Illustrator, InDesign, and Frame.io, each customized for its specific application to help organize workflows and automate editing and design tasks. The rollout represents a significant expansion of AI agent capabilities into professional creative tools used widely across enterprises.
Attackers Weaponize Trusted Platforms for AI Tool Impersonation Campaign: A seven-week campaign abused Google Ads, GitLab, and Claude to deliver malware to over 2,000 victims by impersonating popular AI developer tools and using ClickFix social engineering (tricking users into manually running malicious commands). The attacks succeeded because victims trusted these legitimate platforms and assumed instructions from AI tools were reliable, making detection harder than traditional malware distribution.
AI-Assisted Reanalysis Solves Previously Unsolvable Rare Disease Cases: Researchers using OpenAI o3 Deep Research re-examined 376 unsolved rare genetic disease cases, establishing 18 new diagnoses (4.8% additional yield) by connecting clinical data, genetic variants, and scientific literature into evidence-based hypotheses for specialist review.