Digest archive

No new AI/LLM security issues were identified today.

No new AI/LLM security issues were identified today.

No new AI/LLM security issues were identified today.

No new AI/LLM security issues were identified today.

• Hades Malware Evades AI Security Tools via Prompt Injection: A sophisticated campaign targeting Python developer environments uses adversarial prompt injection (embedding malicious instructions in text to mislead AI systems) to bypass AI-powered security scanners, while also harvesting credentials, replicating across systems, and extracting sensitive data from memory. The malware infiltrates through compromised Python packages and leverages the Bun JavaScript runtime to execute payloads.
• Perplexity AI Targets 2028 IPO Amid Industry Uncertainty: The company's CEO confirmed plans for a 2028 initial public offering independent of outcomes for competitors Anthropic and OpenAI, signaling confidence despite upcoming tests of investor appetite for high-valuation AI firms.

• Code Injection Flaw in AWS AgentCore CLI for Bedrock Agents: CVE-2026-11393 affects AWS AgentCore CLI versions 0.4.0 through 0.14.1, allowing attackers with certain permissions to inject malicious Python code via improper escaping of triple-quote characters in agent configuration fields. No mitigation has been disclosed yet for this high-severity vulnerability in a tool used to manage AI agents on Amazon Bedrock.
• Two High-Severity Memory Exhaustion Flaws in Netty's Redis Components: CVE-2026-44250 allows attackers to crash servers by sending deeply nested Redis arrays that exhaust memory through unbounded state object creation, while CVE-2026-44890 enables DoS (denial of service, preventing legitimate users from accessing a system) by sending malformed Redis messages without proper line endings across multiple connections, exhausting the server's direct memory pool used for I/O operations.
• Microsoft Restructures AI Division to Pursue Superintelligence Independently: Following an October renegotiation with OpenAI, Microsoft's AI division now operates independently to develop frontier models (cutting-edge AI systems at the limits of current capabilities) and pursue superintelligence (AI systems surpassing human abilities across all domains), marking a strategic shift in the partnership between the two companies.

• Anti-AI Extremism Escalates to Physical Attacks: Recent incidents include attempted arson targeting OpenAI and other violent acts driven by anti-AI ideology, mirroring earlier techno-pessimist (those who believe technology will cause societal harm) militant movements and prompting heightened security concerns across the industry.
• AI Investment Surge Meets Profitability Concerns: Major AI companies including OpenAI, Anthropic, and SpaceX are pursuing substantial valuations and public offerings amid unprecedented datacenter spending, yet questions intensify around whether practical applications can justify the billions deployed on AI infrastructure.

• OpenAI Launches Lockdown Mode to Counter Prompt Injection: OpenAI introduced Lockdown Mode, a security feature that disables web browsing, image retrieval, deep research, and agent capabilities to mitigate prompt injection attacks (when malicious instructions hidden in webpages or uploaded content manipulate an AI's responses). The feature reduces but does not eliminate exfiltration risks, as attacks may still occur through cached content or uploaded files.
• AI Agent Discovers 21 Zero-Days in FFmpeg as Chrome Patches Record 429 Bugs: An AI security agent uncovered 21 previously unknown vulnerabilities (zero-days, or security flaws unknown to the public) in FFmpeg, a widely-used media library, while Google released Chrome 149 with 429 security patches in a single update. The development underscores how AI tools are accelerating vulnerability discovery, creating pressure on security teams to remediate flaws at unprecedented speed.
• Meta's AI Account Support Tool Exploited for Account Takeover: Meta's AI-powered account support tool, launched in March to automate password resets and other functions, has been discovered and exploited by attackers to take over user accounts. The vulnerability represents a concerning case of AI automation introducing new attack vectors in critical authentication systems.
• Persistent Backdoor Attack Targets Personalized Federated Learning: Researchers identified a stealthy backdoor attack (hidden malicious code inserted into AI systems) specifically designed to compromise personalized federated learning (a privacy-focused method where multiple computers train an AI model together without sharing raw data). The attack is engineered to evade detection and persist across training cycles.

• NSA Deploys Anthropic Engineers to Integrate Mythos for Cyber Operations: Anthropic has reportedly sent engineers to the NSA to help the intelligence agency deploy Mythos, a cybersecurity-focused AI model, marking a significant reversal after the Department of Defense previously banned NSA use of Anthropic's technology over supply-chain concerns related to mass surveillance and autonomous weapons restrictions.
• Critical Prompt Injection Flaws in Amazon Q and Claude Code Expose Developer Environments: Multiple high-severity vulnerabilities affect AI coding assistants, including Amazon Q and Kiro IDE suffering from prompt injection (tricking AI by hiding malicious instructions in files) that could execute unauthorized commands, while Claude Code's GitHub Action leaked credentials by processing untrusted content without proper sandboxing, and separately stores OAuth tokens in plaintext vulnerable to silent exfiltration via malicious npm packages.
• Cross-Workspace IDOR in PraisonAI Allows Unauthorized Agent Access: PraisonAI Platform contains an insecure direct object reference (IDOR, a flaw where users access resources by guessing IDs) vulnerability (CVE-2026-47419) that allows any authenticated user to read, modify, or delete AI agents across all workspaces because the system verifies workspace membership but never checks if the target agent belongs to that specific workspace.
• MCP Server Kubernetes Vulnerability Enables Bearer Token Theft via Flag Injection: The `kubectl_generic` tool in `mcp-server-kubernetes` accepts unvalidated kubectl flags, allowing attackers to inject `--server` and `--insecure-skip-tls-verify` parameters that redirect Kubernetes bearer tokens (authentication credentials) to attacker-controlled servers when privileged operators follow AI agent instructions embedded in logs, enabling full cluster compromise (CVE-2026-47250).

• Hugging Face Transformers RCE Bypasses Security Settings: A high-severity vulnerability in the widely used Hugging Face Transformers library allows attackers to execute malicious code even when developers enable trust_remote_code=false protections, which are meant to block remote code execution. The attack hides instructions in a fake configuration parameter that leaves no traces, affecting versions 4.56.0 through 5.2.x in a library downloaded millions of times weekly.
• Gemini Voice Assistant Hijacked via Messaging Notifications: Researchers discovered a critical vulnerability where attackers could inject malicious commands into Google's Gemini voice assistant through WhatsApp, Slack, or SMS notifications using a technique called Fake Context Alignment, allowing control of smart home devices and calls without user knowledge. Google patched the prompt injection (tricking an AI by hiding instructions in its input) vulnerability in November 2025 with improved content classifiers.
• Claude Code GitHub Action Enabled Repository Hijacking: A security flaw in Anthropic's Claude Code GitHub Action allowed attackers to compromise repositories by opening a single malicious GitHub issue that exploited broken permission checks and indirect prompt injection, potentially stealing credentials and poisoning the action for downstream projects.
• Microsoft Updates AI Agent Failure Taxonomy After Year of Red Teaming: Microsoft's AI Red Team released an updated taxonomy of failure modes in agentic AI systems (AI that can autonomously perform tasks) based on 12 months of real-world testing, adding seven new categories including agentic supply chain compromise, goal hijacking, and inter-agent trust escalation driven by widespread vulnerabilities in open-source frameworks and tool ecosystems.