- Malicious AI Skills Flooding Public Marketplaces: Public marketplaces for AI skills (specialized add-ons that extend AI agent capabilities) are being flooded with malicious packages that steal passwords and data, and security scanners designed to detect these threats can be bypassed in under an hour through simple modifications because they rely on static detection methods.
- Microsoft Ships Sandbox for Autonomous AI Agents: Microsoft released Microsoft Execution Container (MXC), a sandbox (an isolated environment that restricts what a program can do) designed to limit what autonomous AI agents can access as companies deploy agents that independently run code and access files in development workflows.
- Google Gemini Notification Hijacking Patched: A vulnerability in Google Gemini's Android voice assistant allowed attackers to embed malicious commands in notifications from apps like WhatsApp or Slack through prompt injection (hiding harmful instructions in input data), enabling them to manipulate the assistant's responses and actions without installing malware on the device. Google has already patched this flaw with no evidence of real-world exploitation.
- UK Regulators Force Google to Offer AI Opt-Out: The UK's Competition and Markets Authority ruled that Google must allow website publishers to opt out of AI Search features like AI Overviews (summaries generated by AI) and prevent their content from being used to train Google's models, giving publishers more control over how AI systems use their content.
Digest archive
Past daily digests, newest first.
- LibreChat Leaks Secrets via Environment Variable Injection: LibreChat, a ChatGPT-like application supporting multiple AI providers, has a critical vulnerability (CVE-2026-32625) in versions up to 0.8.3 where it unsafely replaces environment variable placeholders when validating user-provided server URLs. An authenticated attacker can create a malicious server configuration that tricks LibreChat into sending sensitive secrets like encryption keys and database credentials to an attacker-controlled server, compromising the entire installation without needing admin access.
- Malicious npm Package Targets OpenAI Codex Users: Attackers published a malicious npm package called codexui-android that appeared to be a legitimate tool for OpenAI Codex users but secretly stole authentication tokens and sent them to an external server, reaching about 27,000 weekly downloads before detection. The attack exploited a supply chain gap where malicious code was hidden in the distributed package but not visible in the public source code repository, reflecting broader vulnerability in AI software security where developer tokens provide persistent access to accounts.
- OpenMed RCE Through Malicious Model Loading: OpenMed versions before 1.5.2 have a critical remote code execution vulnerability (CVE-2026-47117, RCE allows attackers to run commands on the affected system) in how it loads privacy-filter models. The vulnerability exists because the software uses overly broad pattern matching on user-supplied model names, allowing unauthenticated attackers to trick it into loading malicious code from external sources that gets executed with the same permissions as the OpenMed service.
- Anthropic Expands Mythos Vulnerability Scanning to 150 Organizations: Anthropic is expanding Project Glasswing, which uses its Claude Mythos AI model to find software vulnerabilities, to 150 additional organizations across 15+ countries in critical sectors like power, water, and healthcare. Since the initial launch with 50 partners, Project Glasswing participants have discovered over 10,000 high or critical-level security flaws using the AI tool.
- OpenAI Codex Tokens Stolen in npm Supply Chain Attack: Attackers compromised the popular npm package codexui-android and embedded malicious code that steals authentication tokens from OpenAI Codex users, including refresh tokens that never expire and allow indefinite impersonation. This supply chain compromise gives attackers persistent access to victims' code-generation AI accounts and any systems those accounts can reach.
- Anthropic Opens Mythos Access to EU Security Agency: Anthropic is granting the EU's ENISA access to its Mythos model, an advanced AI system that excels at finding security flaws in software, after months of requests driven by concerns that bad actors could use it to exploit thousands of previously unknown vulnerabilities. The move reflects growing tension between giving defenders powerful tools and preventing offensive misuse.
- Flowise MCP Implementation Enables Remote Code Execution: Flowise, an open-source platform for building self-hosted AI assistants, contains a critical RCE (remote code execution, where an attacker can run commands on a system they don't own) vulnerability in its Model Context Protocol implementation that allows attackers to execute arbitrary commands by importing a malicious chatflow. Flowise's attempted input validation patches have proven ineffective at stopping the exploit.
- CrowdStrike Launches AI Discovery for Shadow AI Control: CrowdStrike released AI Discovery and Governance for Falcon for IT to help organizations find and control unsanctioned AI tools running across their infrastructure, addressing the risk that shadow AI (locally deployed models and tools running without centralized oversight) inherits existing permissions and expands the attack surface without visibility.
- Fashion Industry Adopts AI-Generated Models at Scale: Retailers are replacing human models and photographers with generative AI (machine learning systems that create new images) for product imagery, raising questions about disclosure standards and workforce displacement in commercial photography.
- Anthropic Details Multi-Layer Agent Containment Architecture: Anthropic published technical documentation on their containment strategy for Claude, combining process sandboxes (isolated execution environments), virtual machines, filesystem boundaries, and egress controls (preventing unauthorized data transfer) to prevent credential theft and data exfiltration even when adversaries attempt to exploit the AI model or user inputs.
- Model X-Ray Detects Malware Hidden in AI Weights: Researchers developed a technique using few-shot learning (training with minimal examples) to identify malicious code embedded in model weights (the numerical parameters of trained AI systems), addressing a novel attack vector where adversaries conceal malware inside AI models that evades conventional detection.
- Vatican Addresses AI Harms with Anthropic Participation: Pope Leo XIV issued major guidance on AI risks including job displacement and weaponization, with Anthropic co-founder Chris Olah participating in the Vatican ceremony amid criticism that such partnerships may produce superficial messaging rather than substantive examination of AI technology's impact.
- Critical Sandbox Escapes in PraisonAI Allow Full System Compromise: Multiple critical vulnerabilities in PraisonAI (an AI agent framework) allow authenticated and unauthenticated attackers to execute arbitrary commands on host systems. The flaws include sandbox escape via Python builtins access (CVE-2026-47392), unauthenticated RCE (remote code execution, where attackers run commands on systems they don't own) through an unsafe eval() tool in agent-to-agent servers (CVE-2026-47391), and API deployments with authentication disabled by default (CVE-2026-47393).
- RAGFlow Template Injection Enables Remote Command Execution: RAGFlow, an open-source RAG (retrieval-augmented generation, where AI pulls external documents to answer questions) engine, contains a Jinja2 template injection vulnerability in version 0.24.0 and earlier that lets any registered user execute arbitrary OS commands by creating a malicious Canvas workflow (CVE-2026-45312).
- Attackers Deploy LLM Agents for Post-Exploitation After Marimo Breach: An attacker exploited CVE-2026-39987, a critical vulnerability in Marimo notebook software allowing unauthenticated RCE, then deployed an LLM agent (an autonomous AI system that can plan and execute tasks) to steal cloud credentials and database information. This represents a notable shift from traditional scripted attacks, as the AI agent can adapt to unexpected obstacles in real-time.
- ChatGPT Share Links Weaponized in Malware and Phishing Campaigns: Attackers are exploiting ChatGPT's share feature to host fake outage pages on legitimate OpenAI URLs, distributing malware through Google ads in the "LLMShare" campaign. Separately, the ChatGPhish vulnerability allows attackers to embed malicious instructions in web pages that ChatGPT processes and renders as trusted phishing links when users request summaries, potentially leaking IP addresses and bypassing desktop security filters.
- Vibe Coding Explosion Creates Massive Shadow IT Security Gap: Over 2,000 exposed applications built by employees using AI-driven development platforms (vibe coding, where non-programmers build working apps by describing what they want) were discovered containing sensitive data across major companies, published on the public internet without access controls. Traditional security tools like EDR (endpoint detection and response) and DLP (data loss prevention) fail to detect these cloud-to-cloud connections because they were designed for different threat models.
- Google Launches AI Threat Defense Platform Against Autonomous Attacks: Google Cloud announced AI Threat Defense, a security platform that uses AI to autonomously detect and stop AI-powered cyberattacks, combining threat intelligence with code repair tools powered by Gemini to deploy fixes within minutes instead of days. The platform addresses a growing gap where agentic attacks (cyberattacks powered by AI that learn and adapt autonomously) move faster than human security teams can respond.
- Russia-Linked GreyVibe Exploits ChatGPT and Gemini Across Full Attack Lifecycle: A Russia-linked threat group called GreyVibe has been targeting Ukrainian military and government entities since August 2025 using ChatGPT, Gemini, and other AI tools to generate phishing lures (fake websites and emails impersonating legitimate organizations) and likely develop custom malware including LegionRelay remote access trojan and FallSpy Android spyware. While less sophisticated than elite state actors, the group demonstrates how AI tools allow attackers to operate well above their baseline technical skill level.
- Critical RCE in vLLM Resurfaces Despite Earlier Patch Attempts: vLLM version 0.14.1 contains a vulnerability where the `trust_remote_code` parameter remains hardcoded to True in two model files even when users attempt to disable it, allowing RCE (remote code execution, where attackers can run harmful code on your system) through malicious models downloaded from HuggingFace. This represents a partial fix attempt for two earlier vulnerabilities that failed to fully resolve the issue. (CVE-2026-4944, high severity)
- Nono Sandbox Escape Enables AI Agent Breakout via D-Bus: A sandbox escape vulnerability in nono, a sandboxing tool using Landlock and seccomp (Linux security features that restrict program capabilities), allows processes to break containment by communicating with systemd D-Bus sockets used for inter-process communication. An AI agent or untrusted tool with bash access could exploit this to write files or execute commands outside the sandbox with full user permissions. (CVE-2026-47128, medium severity)
- Anthropic Ships Code Sandbox and Security Plugin for Claude: Anthropic released a self-hosted sandbox allowing Claude Managed Agents (AI systems that perform tasks autonomously) to execute code in user-controlled environments, plus a security guidance plugin that scans for vulnerabilities as developers write code, reducing security issues by 30-40% in internal testing.
- Critical RCE Vulnerabilities Hit AI Agent Frameworks: IBM Langflow OSS versions 1.0.0 through 1.9.1 contain a path traversal flaw (CVE-2026-7524) enabling RCE (remote code execution, where attackers run commands on systems they don't own) through improper symbolic link validation, while Langroid pre-0.63.0 allows prompt injection (hiding malicious instructions in input data) to trigger SQL commands that achieve RCE on database servers (CVE-2026-25879).
- Starlette Authentication Bypass Exposes FastAPI-Based AI Tools: A flaw in Starlette (CVE-2026-48710), the framework powering FastAPI, allows attackers to bypass authentication by sending malformed Host header characters, tricking the framework into parsing request paths differently than the server and potentially enabling SSRF (server-side request forgery, making the server request data from unintended locations) or RCE on affected systems.
- AI Safety Benchmarks Fail Against Multi-Turn Attacks: Cisco research reveals that popular AI models from OpenAI, Anthropic, and Google are far more vulnerable to iterative attacks using role-playing and gradual escalation across conversation turns than single-prompt safety benchmarks suggest, as current standardized tests fail to capture real-world adversarial techniques.
- Microsoft Copilot Cowork Data Exfiltration Flaw: Microsoft Copilot Cowork had a vulnerability where attackers could use prompt injection (tricking the AI by hiding instructions in its input) to make agents send unapproved emails containing OneDrive download links, enabling file theft through external images that leak data when opened.
- Critical GitLab MCP Server Authentication Bypass: GitLab MCP Server (a tool that lets AI agents interact with GitLab) exposed an unauthenticated endpoint accessible from any network before version 0.6.0, allowing remote attackers to modify repositories using the server operator's stored credentials. (CVE-2026-44895, critical severity)
- NVIDIA Transformers4Rec Deserialization Vulnerability: NVIDIA Transformers4Rec for Linux contains a high-severity flaw where attackers can exploit improper deserialization (unsafe processing of stored data formats) of untrusted data to achieve code execution, data tampering, and information disclosure. (CVE-2026-24162)
- GitHub Megalodon Campaign Compromises 5,500 Repositories: Attackers used stolen credentials to inject malicious commits into over 5,500 GitHub repositories, modifying GitHub Actions workflows to exfiltrate cloud credentials and SSH keys through base64-encoded bash payloads disguised as routine maintenance activity.
- India Mandates 12-Hour Patching Window for Critical Flaws: CERT-In issued guidelines requiring organizations to patch critical internet-facing vulnerabilities within 12 hours, citing evidence that attackers now use LLMs (large language models, AI systems trained on large amounts of text) to automate vulnerability discovery and exploitation faster than traditional methods.
- Anthropic's Mythos AI Uncovers 23,000 Software Vulnerabilities in One Month: Anthropic's Claude Mythos, an AI model trained for code analysis and cyberattack development, identified over 23,000 potential vulnerabilities across 1,000+ open source projects through Project Glasswing, with 1,726 confirmed and over 1,000 rated high or critical severity. The company is now preparing to release Mythos publicly with guardrails (safety restrictions built into the model) after initially withholding it due to security concerns, while maintainers struggle to patch the flood of discovered bugs faster than AI can find them.
- Researchers Call for System-Level Security Controls for AI Agents: A new analysis argues that securing AI agents requires treating models as fundamentally untrusted components and enforcing security at the system level, similar to how operating systems sandbox processes. The researchers found that all eleven real-world AI agent attacks they examined violated the secure information flow principle (controlling how sensitive data moves through a system), and recommend applying traditional security principles like least privilege and complete mediation rather than relying on model robustness.
- AI-Powered Bug Discovery Outpaces Patching Capacity: The surge in AI-generated vulnerability reports is overwhelming bug bounty programs and software maintainers, creating a cybersecurity imbalance where finding bugs is now far easier than fixing them. This shift is forcing companies to reconsider the traditional 90-day responsible disclosure window (the agreed-upon time between finding a bug and publicly revealing it) and accelerate patch (fix) deployment timelines.