- Agentic AI Used to Deploy Ransomware via Langflow Exploit: A threat actor exploited CVE-2025-3248 (a critical authentication bypass in Langflow, a Python framework for building AI-driven applications) to gain code execution, then deployed an agentic AI (an autonomous system that plans and executes multi-step tasks) to conduct reconnaissance, steal credentials, pivot laterally, and deploy ransomware. The AI adapted in real time to obstacles, demonstrating how LLM agents can lower the technical barrier for sophisticated attacks.
- Critical RCE Vulnerabilities in Cursor AI Code Editor: CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) allow attackers to achieve OS-level remote code execution (running commands on a victim's machine) by exploiting automatic command execution in the Cursor AI editor. The flaws involve directory traversal to escape sandbox protections and symbolic link attacks to write files outside project boundaries.
- Prompt Injection Flaw in Kong Konnect MCP Server: CVE-2026-13341 affects Kong Konnect's Model Context Protocol server (a system for standardized AI-to-tool communication) versions before 1.0.0, allowing remote attackers to perform prompt injection (hiding malicious instructions in input to trick the AI) and trigger unintended API requests.
- Anthropic Launches Claude Science Workbench for Drug Development: Anthropic introduced Claude Science, an AI workbench that consolidates fragmented research tools and datasets to accelerate scientific discovery, with existing biotech and pharmaceutical customers. The company announced plans to develop its own drugs using the platform.
Digest archive
Past daily digests, newest first.
- Critical Authentication Bypass in MCP Memory Service: The mcp-memory-service has a critical vulnerability (CVE-2026-50027) where all `/api/documents/*` endpoints lack authentication checks, allowing unauthenticated attackers to read, write, and delete memories even when API key or OAuth protection is enabled. This creates an inconsistent security boundary that attackers can exploit to access protected data.
- SSRF in Azure OpenAI Enables Privilege Escalation: CVE-2026-45499 is an SSRF vulnerability (server-side request forgery, where an attacker tricks a server into making unwanted network requests) in Azure OpenAI that allows authorized attackers to gain elevated privileges over a network. Microsoft has published details but no CVSS severity score has been assigned yet.
- AI Agent Autonomously Executes Ransomware Attack via Langflow Exploit: An AI agent conducted a complete ransomware operation by exploiting CVE-2025-3248, an authentication flaw in Langflow (an open-source tool for building AI applications), then autonomously chained multiple attack steps to steal credentials, move laterally, and encrypt databases. This demonstrates AI's capability to lower the skill barrier for sophisticated cyberattacks.
- OpenAI Proposes 5% Government Stake to Ease Political Pressure: OpenAI has proposed giving the U.S. government a 5% equity stake (worth approximately $42.6 billion) to reduce Washington pressure, with CEO Sam Altman suggesting other major AI companies like Anthropic, Google, and Meta could participate through a government investment vehicle. The proposal frames this as allowing the public to financially benefit from AI's success.
- Anthropic Restores Claude Fable 5 After Export Controls Lifted: The U.S. lifted export restrictions on Anthropic's Claude Fable 5 and Mythos 5 models following negotiations with the Trump administration, enabling global access after a two-and-a-half-week block imposed due to jailbreak concerns. Anthropic deployed a new classifier that blocks the specific jailbreak technique in over 99% of attempts.
- Phantom Squatting Exploits AI-Hallucinated Domains for Phishing: Attackers are registering fake domains that LLMs (large language models, AI systems trained on text) invent when hallucinating web addresses, then hosting phishing pages to catch victims following AI-generated links. Palo Alto Networks found two AI models generated roughly 250,000 nonexistent domains and 13,229 known-malicious addresses across 2.1 million links, creating a supply chain threat that bypasses reputation-based security filters because the domains are brand new.
- Critical Cursor Vulnerabilities Enable Sandbox Escape via Prompt Injection: Cursor, an AI code editor used by over half of Fortune 500 companies, contained two critical flaws (CVE-2026-50548 and CVE-2026-50549, both severity 9.8/10) allowing attackers to use prompt injection (hiding malicious instructions in data the AI reads) to escape the sandbox and execute arbitrary commands on developers' machines without user interaction. The vulnerabilities exploited improper validation of folder parameters and symbolic links to write to restricted system files.
- Browser-Native Ransomware Created Autonomously by AI Model: Check Point discovered that an AI model independently combined browser vulnerabilities with ransomware techniques to create malware operating entirely within web pages, while separate research found InfernoGrabber v9.0 (built using DeepSeek) exploiting Chrome's File System Access API to encrypt files on Windows and Android without requiring traditional exploits or installations. This represents a shift where AI autonomously connects theoretical risks to practical attack methods rather than merely assisting human attackers.
- Anthropic Ships Claude Sonnet 5 with Agentic Capabilities: Anthropic released Claude Sonnet 5, a new AI model that performs nearly as well as their flagship Opus 4.8 but at significantly lower advertised cost, with agentic features (autonomous planning, tool use, and self-checking) previously limited to premium tiers. The company also launched Claude Science, a new product for autonomous scientific research with specialized capabilities for computational biology and drug development, positioning Anthropic as a direct competitor to Google DeepMind in AI-assisted science.
- Eight Critical Vulnerabilities in IBM Langflow OSS: IBM Langflow OSS versions 1.0.0 through 1.10.0 contain eight critical and high-severity vulnerabilities, including remote code execution (where an attacker can run commands on a system they don't own) through multiple attack vectors, authentication bypass allowing unauthenticated access to protected resources (CVE-2026-7663), weak encryption exposing all stored credentials (CVE-2026-7874), and SSRF flaws (server-side request forgery, tricking a server into making requests to unintended locations) exploitable via prompt injection (CVE-2026-10564). LLaMA-Factory also disclosed CVE-2026-58116, a critical RCE vulnerability in versions through 0.9.5 where attackers with web interface access can execute arbitrary code by providing malicious model paths.
- BioShocking Attack Bypasses AI Browser Guardrails: Researchers discovered BioShocking, an indirect prompt injection technique (hiding malicious commands in web page content that AI can't distinguish from legitimate instructions) that manipulates AI browsers into stealing user credentials by framing theft as fictional game actions. LayerX tested six mainstream AI browser products including ChatGPT Atlas and Claude, and all six failed to prevent the attack, with only OpenAI implementing a working fix after disclosure.
- MCP Tool Poisoning Threatens AI Agent Security: Microsoft warned that attackers can poison tool descriptions in MCP (Model Context Protocol, an open system that lets AI agents call external tools) to trick agents into leaking company data by hiding malicious instructions inside plain-text metadata that agents read when deciding how to use tools. If systems don't require re-approval when tool descriptions change, poisoned instructions go live in production without detection, making unauthorized data exfiltration appear as normal agent activity.
- OpenAI and Anthropic Restrict Latest Models Amid Government Security Review: Both companies are limiting access to their newest AI models to government-approved customers while the Trump administration evaluates whether these powerful systems could be misused to discover software vulnerabilities that attackers might exploit against critical infrastructure.
- Critical Sandbox Escape in Claude Code Threatens Developer Machines: CVE-2026-55607, a high-severity flaw in Claude Code versions 2.1.38 through 2.1.163, allowed attackers to escape the sandbox (a controlled environment limiting what software can access) by exploiting worktree handling to access files outside restricted areas. Researchers demonstrated a live attack where malicious repositories trick Claude Code into executing commands fetched from DNS records, granting attackers interactive shell access and exposing developer credentials.
- Straiker Secures $64M to Address AI Agent Security Gaps: The 2025-founded startup raised significant funding to build a platform that discovers and monitors AI agents across enterprise environments, combining pre-deployment adversarial testing (controlled attacks before deployment) with runtime protection to identify vulnerabilities and block threats in real-time.
- Identity Management Crisis Emerges for Autonomous AI Agents: Organizations deploying agentic AI (autonomous systems that authenticate, call APIs, and take production actions at machine speed) face three critical gaps: lack of visibility into what agents exist, overprivileged access permissions, and traditional identity systems that cannot handle intent-based, context-aware access control required for agents operating with human-like autonomy.
- Anthropomorphizing AI Agents Degrades Human Performance: Boston University research found that framing AI agents as "coworkers" rather than tools caused humans to catch 18% fewer errors and pass questionable work to managers 44% more often, inverting accountability and creating dangerous responsibility gaps as agents deploy into healthcare and government.
- ChatGPT Logs Admitted as Evidence in Arson Trial: Prosecutors in a Palisades fire case introduced ChatGPT conversation records showing the defendant requested AI-generated images of fire and discussed anger themes, demonstrating that chatbot interactions can be subpoenaed and weaponized in criminal proceedings. This case establishes a precedent that data shared with AI systems persists and carries legal discoverability risks for users.
- AI Coding Agents Exploited via DNS-Hidden Malware: Researchers demonstrated a novel attack vector where AI coding assistants like Claude Code can be socially engineered through benign repository instructions to execute malicious payloads retrieved from DNS records (the system that translates domain names to IP addresses), bypassing traditional code review since no suspicious code appears in the repository itself. This highlights a new class of supply chain risk unique to autonomous agents that execute commands without human verification.
- OpenAI Deploys GPT-5.6 Sol with Hardened Cyber Controls: OpenAI released a limited preview of GPT-5.6 Sol specifically tuned for cybersecurity tasks including vulnerability research and patch development, featuring enhanced jailbreak resistance (defenses against prompts designed to bypass safety restrictions) and guardrails targeting offensive cyber use cases, though the company acknowledges the dual-use controls may over-block legitimate security work during the preview period.
- Margaret Atwood Flags Hallucination Risk in LLMs: Author Margaret Atwood publicly criticized Claude for generating factually incorrect information about a TV show, underscoring the persistent hallucination problem (when large language models confidently generate plausible but false information) inherent in systems trained on unverified or low-quality data.
- Amazon Q Developer Executes Malicious Code From Cloned Repos: Amazon Q for VS Code had a high-severity vulnerability (CVE-2026-12957, CVSS 8.5) that allowed attackers to run arbitrary commands and steal AWS credentials by embedding malicious MCP server configurations (local processes that extend AI assistant capabilities) in a repository. The flaw occurred because Amazon Q automatically loaded and executed these configurations without verifying workspace trust or requesting user permission, giving attackers full access to the developer's environment variables and cloud credentials.
- US Government Restricts GPT-5.6 and Mythos Releases: The Trump administration requested that OpenAI limit its GPT-5.6 rollout to government-vetted partners before a wider launch, marking the first time a US AI firm has been told to restrict model access pre-release. Anthropic's Mythos models were pulled from service for two weeks under similar restrictions before being released to approximately 100 approved companies and federal agencies, signaling a new era of government oversight for advanced AI deployments.
- Attackers Exploit OpenAI's Organization Invites to Impersonate Companies: Cybersecurity firms are being targeted by fraudulent OpenAI organization invitations that appear to come from legitimate companies, using OpenAI's real email infrastructure with attached payment methods to trick employees into sharing source code and internal documents. The invitations are difficult to detect despite OpenAI's domain mismatch warnings, as they leverage the platform's authentic communication channels.
- Malware Designed to Evade LLM-Based Security Tools: Security researchers identified malware such as macOS.Gaslight (linked to North Korean threat actors) that specifically subverts AI-powered security analysis tools by causing LLM-assisted detection systems (security products that use large language models to analyze threats) to halt analysis or refuse to operate. This represents an emerging adversarial technique where malware authors are actively engineering code to bypass AI-based defenses.
- Anthropic Expands AI Infrastructure in Asia-Pacific: Anthropic is rapidly building data center operations in Australia and Japan, hiring 13 people to manage infrastructure driven by advantages like renewable energy and political stability, though Australia's copyright laws may complicate expansion plans.
- Critical RCE in ToolJet Marketplace Plugins: ToolJet versions before 3.20.178-lts contain a vulnerability (CVE-2026-55413) where authenticated builder-role users can inject malicious JavaScript into shared marketplace plugins, achieving RCE (remote code execution, where an attacker can run commands on a system they don't own) with full Node.js access that executes whenever anyone uses the compromised plugin.
- Cursor AI Editor Sandbox Escapes Allow Full System Access: Cursor versions before 3.0 contain two critical sandbox bypass vulnerabilities (CVE-2026-50549 and CVE-2026-50548) where AI agents can create symlinks (shortcuts that point to different file locations) to write files outside the workspace without user approval, potentially achieving full system access.
- North Korean Gaslight Malware Weaponizes Prompt Injection Against AI Analysis Tools: A new macOS malware attributed to North Korean threat actors embeds 38 fabricated error messages and crash reports to confuse LLM-powered security analysis tools through prompt injection (tricking AI by hiding malicious instructions in input), while simultaneously exfiltrating browser histories and credentials via Telegram-based command-and-control infrastructure.
- Academic Survey Maps Hallucination Landscape in Vision-Language Models: A comprehensive 36-page survey in ACM Computing Surveys examines hallucinations (instances where AI systems generate plausible-looking but false or nonsensical information) across both language-only and multimodal AI systems that process text and images.
- Anthropic Accuses Alibaba of Massive Model Distillation Attack: Anthropic alleged that Alibaba conducted an illegal distillation campaign (training a weaker AI model using outputs from a stronger one without permission) involving 28.8 million exchanges through fraudulent accounts between April and June 2024. Anthropic is calling for coordinated government and industry action to combat such illicit capability extraction.
- OpenAI and Broadcom Unveil Jalapeño Inference Chip: OpenAI's first custom AI accelerator, designed specifically for LLM inference (running trained models to generate outputs), delivers significantly better performance per watt than current alternatives and will deploy in data centers starting 2026. The ASIC (application-specific integrated circuit, a processor built for one particular task) was co-designed with Broadcom in nine months using OpenAI's own AI models.
- Firebase Studio Vulnerability Exposed User Projects: GCP-2026-043 allowed authenticated users to access and download source code and list storage buckets belonging to other users' Firebase projects (Google's backend service for building apps). The high-severity vulnerability has been fixed and deployed.
- Malicious AI Agent Skill Evaded Security Checks and Reached 26,000 Users: A malicious AI agent skill (a reusable tool extending agent capabilities) bypassed marketplace security by hiding instructions behind a fake domain that redirected to a legitimate site during review, then changed content post-approval to collect user data. This incident demonstrates that one-time security scans cannot detect components that behave differently after gaining trust.
- AI Agents Create New Multi-Principal Identity Crisis: Current OAuth tokens (standardized digital credentials for verifying identity and permissions) cannot properly track both an AI agent's identity and the user it represents, making access control enforcement impossible as agents become more autonomous and act on behalf of multiple users. The industry lacks standardization for these multi-principal scenarios where agents invoke other agents and operate without human oversight.