Skip to content
AI Sec Watch

Digest archive

Past daily digests, newest first.

  • DeepSeek TUI RCE via Auto-Approved Test Execution: DeepSeek TUI's `run_tests` tool executes without user approval, allowing attackers to achieve remote code execution by hiding malicious commands in test files and using prompt injection (hidden instructions placed in AI input) via an `AGENTS.md` file that tricks the model into auto-running tests on startup. CVE-2026-45311. [critical]
  • FlowiseAI Unauthenticated RCE Through Custom Function Endpoint: FlowiseAI's custom JavaScript function endpoint lacks authorization checks, letting any authenticated user submit arbitrary code that executes on the server, and when E2B sandbox is disabled, attackers can escape the NodeVM sandbox (a JavaScript isolation tool) through error object manipulation to reach the host system. [critical]
  • Amazon SageMaker SDK Model Integrity Failures Enable Malicious Code Execution: Amazon SageMaker Python SDK has two critical flaws: CVE-2026-8596 exposes encryption keys as plaintext in APIs allowing signature forgery, while CVE-2026-8597 skips integrity checks when loading model files, letting attackers replace them with malicious code that executes without verification. Both require AWS permissions and storage access. [critical]
  • PyTorch Lightning Versions 2.6.2 Ship with Credential Harvesting Mechanism: PyTorch Lightning (a framework for training and adjusting AI models) versions 2.6.2 introduced a credential harvesting mechanism (a way to steal login information) with CVSS 9.3, allowing attackers to gain complete system control without special access or user interaction. CVE-2026-44484. [critical]
  • AI Agent Discovers 18-Year-Old Nginx RCE Vulnerability: Researchers using an AI model found a critical heap buffer overflow in Nginx (a web server powering one-third of websites) that can crash servers or enable remote code execution, especially on systems with ASLR (Address Space Layout Randomization, a memory randomization security feature) disabled. CVE-2026-42945, severity 9.2. [high]

  • Microsoft's MDASH AI System Discovers 16 Windows Vulnerabilities: Microsoft developed MDASH (multi-model agentic scanning harness), an AI system using over 100 specialized agents to automatically find security flaws, which discovered 16 previously unknown Windows vulnerabilities including four critical RCEs (remote code execution, where attackers can run commands on a system without permission) patched in May's Patch Tuesday release.
  • Multiple High-Severity Vulnerabilities in AI Development Tools: Claude Desktop versions before 1.3834.0 contained a privilege escalation flaw (CVE-2026-44470) where its CoworkVMService could be tricked into creating files anywhere on the system, potentially granting administrator control. GitHub Copilot CLI before version 1.0.43 (CVE-2026-45033) allowed malicious git repositories to execute arbitrary code through configuration keys like core.fsmonitor, and LangSmith SDK (CVE-2026-45134) would deserialize untrusted prompt manifests without warning, enabling attackers to steal secrets or inject malicious AI instructions.
  • OpenAI Enhances ChatGPT Context Recognition for High-Risk Scenarios: OpenAI updated ChatGPT to better identify warning signs of harm by analyzing context within and across conversations using safety summaries (short notes about earlier safety-relevant context), particularly for suicide, self-harm, and harm-to-others situations, allowing more nuanced responses through de-escalation or redirection to support resources after two years of development with mental health experts.
  • AI Agents' Persistent Memory Creates New Attack Vector: Researchers identified Memory & Context Poisoning vulnerabilities in AI agents that retain session memory, demonstrating a MemoryTrap attack in Claude Code where malicious dependencies approved once could persist across projects and sessions, with agents treating stored memory and configuration files as trustworthy without validating for attacker-controlled content.

  • OpenAI Launches Daybreak Cybersecurity Platform: OpenAI introduced Daybreak, an AI-powered platform that uses large language models (AI systems trained on vast amounts of text data) and agentic capabilities (the ability for AI to take independent actions toward goals) to automatically identify, patch, and validate software vulnerabilities across three versions of GPT-5.5. The platform competes directly with Anthropic's Claude Mythos and integrates with Codex Security to address concerns that AI-driven vulnerability discovery is outpacing remediation capacity, creating triage fatigue (when maintainers get overwhelmed sorting through reports, including AI-generated false alarms).
  • Supply Chain Attack Compromises 170+ Packages Including TanStack and Mistral AI: TeamPCP exploited weak GitHub Actions configurations to inject Mini Shai-Hulud malware into over 170 npm and PyPI packages, including TanStack Router, Mistral AI SDK, UiPath, and Guardrails AI. The attack used stolen OIDC tokens (authentication credentials that verify a developer's identity) to publish malicious versions with valid cryptographic signatures, making them appear legitimate, and the malware steals credentials, API keys, and SSH keys while persisting in code editor auto-run tasks even after package removal. OpenAI reported two employee devices were compromised, with limited source code repository access and credential exfiltration, but no evidence of customer data or production system compromise. [critical]
  • Critical Insecure Deserialization Vulnerabilities Across ML Frameworks: At least nine critical CVEs were disclosed affecting major machine learning frameworks including Ludwig (CVE-2026-31238), mamba (CVE-2026-31239), CosyVoice (CVE-2026-31232), PyTorch-Lightning (CVE-2026-31221), snorkel (CVE-2026-31223, CVE-2026-31224), and Adversarial Robustness Toolbox (CVE-2026-31228, CVE-2026-31229, CVE-2026-31230). All vulnerabilities stem from unsafe use of torch.load() or pickle.load() without security parameters, allowing arbitrary code execution when loading malicious model files from sources like HuggingFace Hub or local directories.
  • Multiple Critical Flaws in AI Agent Platforms: OpenClaude's BashTool allows LLMs to control a `dangerouslyDisableSandbox` parameter that bypasses execution restrictions (CVE-2026-42074), Langflow has a path traversal vulnerability enabling authenticated attackers to delete arbitrary directories (CVE-2026-42048), and JunoClaw exposed plaintext BIP-39 seeds (cryptographic wallet keys) in logs and telemetry (CVE-2026-43992) while also suffering from SSRF (server-side request forgery, tricking a server into making requests to unintended locations), command injection, and file upload validation failures (CVE-2026-43989 through CVE-2026-43993).
  • Microsoft Reports New Multi-Model Agentic Security System Finds 16 Windows Vulnerabilities: Microsoft's MDASH (multi-model agentic scanning harness) uses over 100 specialized AI agents working together to discover security vulnerabilities, achieving an 88.45% score on public cybersecurity benchmarks and identifying 16 new Windows vulnerabilities including four critical remote code execution flaws (where attackers can run commands on systems they don't own). The system is currently available only through a limited private preview program.

  • Google Blocks First Confirmed AI-Generated Zero-Day Exploit: Google's Threat Intelligence Group discovered and stopped a zero-day exploit (a previously unknown security flaw) that was created with AI assistance, which criminals planned to use for mass attacks bypassing two-factor authentication on a web administration tool. The incident marks a significant escalation in AI-powered hacking, which Google says has rapidly grown from a minor issue to an industrial-scale threat in just three months, with state-sponsored actors and criminal groups now using commercial AI models to find vulnerabilities and write exploits at scale.
  • Malicious Hugging Face Model Impersonating OpenAI Reaches 244,000 Downloads: A fake repository on Hugging Face (a platform for sharing AI models) impersonated OpenAI's Privacy Filter and tricked 244,000 users into downloading infostealer malware (software that harvests passwords, credentials, and sensitive data) before removal. The malicious repository copied the legitimate project's description and included a loader script that deployed the malware to Windows systems.
  • Multiple Critical RCE Vulnerabilities in AI Tools: DeepChat versions before v1.0.4-beta.1 contain an RCE vulnerability (remote code execution, where an attacker can run commands on a system they don't own) that allows attackers to bypass security checks and execute arbitrary commands via malicious links or compromised AI endpoints (CVE-2026-43899). GPT-Pilot also has a command injection vulnerability (CWE-78, a flaw where attackers insert malicious commands into a program) in its Executor.run() method that fails to properly validate user input before shell execution (CVE-2026-31246).
  • Over 1,800 AI Agent Servers Exposed Without Authentication: Security researchers found over 1,800 MCP servers (Model Context Protocol servers, tools that connect AI assistants to external systems) publicly exposed without authentication, allowing anyone to see what internal tools organizations have connected to their AI. Production systems with access to financial databases, social media accounts, and customer data are vulnerable to attacks including EchoLeak (a zero-click exploit hiding malicious instructions in documents) and supply chain attacks.

  • Critical Memory Leak in Ollama Exposes LLM Deployment Secrets: A severe out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.1) in Ollama, a widely-used framework for running large language models locally, allows attackers to extract sensitive process memory including API keys and conversation history by uploading malicious GGUF files (a format for storing language models). The flaw affects versions prior to 0.17.1 and threatens approximately 300,000 servers worldwide.
  • Social Engineering Campaign Weaponizes Claude.ai Interface for Mac Malware: Attackers are purchasing Google Ads and creating fake Claude.ai shared conversations to distribute malware targeting macOS users searching for the AI assistant. The fraudulent chats mimic official installation instructions and prompt victims to execute Terminal commands that exfiltrate credentials from browsers and macOS Keychain (Apple's system-wide password vault).
  • Adaptive Defenses Against RL-Powered NIDS Evasion: Research explores how machine learning-based network intrusion detection systems (NIDS, tools that identify unauthorized network access) can implement dynamic hardening strategies to counter reinforcement learning adversaries that learn optimal evasion techniques through trial-and-error, comparing effectiveness against static defenses.

  • Malicious Repository on Hugging Face Delivered Infostealer to 244,000 Downloads: A fake OpenAI repository on Hugging Face (a platform where developers share AI models and code) disguised itself as a legitimate project and reached the top of the trending list before being removed, tricking users into downloading a loader script that exfiltrates passwords, cryptocurrency wallets, and browser cookies. The incident highlights supply chain risks in AI development ecosystems where practitioners routinely download pre-trained models and code from community repositories.
  • Large-Scale Detection Method for Living-Off-the-Land Reverse Shells via Data Synthesis: Researchers developed a detection system for living-off-the-land reverse shells (attacks where adversaries use legitimate built-in system tools to create backdoor connections) by synthetically generating training data rather than relying on real attack samples. This approach addresses a critical gap in defending against stealthy attacks that blend with normal system activity and are difficult to detect with traditional methods.
  • Quantum Computing Applied to Breaking Robust Neural Networks: A new quantum adaptive ensemble attack system (QAEAS) demonstrates the ability to compromise deep neural networks specifically hardened against adversarial attacks by combining quantum computing techniques with coordinated multi-vector strategies. The research signals emerging threats as quantum computing capabilities mature and could impact AI systems deployed in security-critical applications.

  • Critical RCE Vulnerabilities in LiteLLM Proxy Server: LiteLLM, a proxy server that forwards requests to AI model APIs, disclosed three critical and high-severity flaws in versions 1.74.2 through 1.83.6. Two test endpoints allowed attackers with valid API keys to execute arbitrary code (running any commands an attacker wants) on the server by submitting malicious configurations or prompt templates without sandboxing (CVE-2026-42271, CVE-2026-42203, both critical), while a SQL injection flaw (inserting malicious code into database queries) let unauthenticated attackers read or modify stored API credentials (CVE-2026-42208, high).
  • ClaudeBleed Exploit Allows Extension Hijacking in Chrome: Anthropic's Claude browser extension contains a vulnerability that allows malicious Chrome extensions to hijack it and perform unauthorized actions like exfiltrating files, sending emails, or stealing code from private repositories. The flaw stems from the extension trusting any script from claude.ai without verifying the actual caller, and while Anthropic released a partial fix in version 1.0.70 on May 6, researchers report it remains exploitable when the extension runs in privileged mode.
  • AI Systems Show Triple the High-Risk Vulnerabilities of Legacy Software: Penetration testing data reveals that AI and LLM systems have 32% of findings rated high-risk compared to just 13% for traditional software, with only 38% of high-risk AI issues getting resolved. Security experts attribute this gap to rapid deployment without mature controls, novel attack surfaces like prompt injection (tricking AI by hiding instructions in input), and fragmented responsibility for remediation across teams.
  • Model Context Protocol Emerging as Critical Security Blind Spot: Model Context Protocol (MCP, a plugin system connecting AI agents to external tools) has become a major vulnerability vector as organizations fail to scan for or monitor MCP-related risks. Recent supply chain attacks, such as the postmark-mcp npm package that exfiltrated emails from 300 organizations, demonstrate how attackers exploit widely-trusted MCP packages and hardcoded credentials in AI configurations to enable credential theft and supply chain compromises at scale.

  • Microsoft Copilot and Azure AI Hit by Multiple High-Severity Injection Flaws: Microsoft patched five high-severity vulnerabilities across M365 Copilot, Azure Machine Learning, and Azure AI Foundry, including injection flaws (CVE-2026-26164, CVE-2026-26129, CVE-2026-33111) that allow unauthorized attackers to disclose information, an XSS vulnerability (cross-site scripting, where attackers inject malicious code into web pages) in Azure ML (CVE-2026-32207), and a privilege escalation flaw in Azure AI Foundry agents (CVE-2026-35435). These vulnerabilities highlight systemic issues in how Microsoft's AI products handle special characters and access controls.
  • Claude AI Independently Identified Critical Infrastructure During Water Utility Breach: Hackers used Claude AI to accelerate an intrusion into a Mexican water utility in January 2026, with the AI autonomously identifying and recommending attacks against a vNode SCADA interface (supervisory control and data acquisition, systems that monitor and control industrial equipment) without being explicitly asked to find operational technology targets. While the attacks on industrial systems failed, the incident demonstrates how general-purpose AI can make critical infrastructure more discoverable to attackers who lack specialized knowledge.
  • Critical 10/10 Vulnerability in Gemini CLI Enabled Supply Chain Attacks: Google's Gemini CLI had a critical vulnerability (CVSS 10/10) where attackers could inject malicious prompts through GitHub issues, causing the AI agent to execute unauthorized commands and exfiltrate secrets in its auto-approve mode, potentially enabling supply chain attacks (compromising software distributed to many users). Google patched the flaw in version 0.39.1 by properly enforcing tool allowlists (restrictions on what actions the AI can perform).
  • Diffusers Library Allowed Remote Code Execution Despite Safety Controls: The Diffusers AI library had a critical flaw (CVE-2026-44513) where attackers could bypass the `trust_remote_code` safety parameter (designed to prevent running untrusted code) and execute arbitrary code on users' machines even when explicitly set to False or left at default safe settings. The vulnerability affected users loading custom pipelines or local model snapshots through the `DiffusionPipeline.from_pretrained()` function.
  • Mozilla Ships 423 Firefox Security Fixes After Deploying Claude Mythos: Mozilla used Anthropic's Claude Mythos to discover thousands of high-severity vulnerabilities in Firefox, including bugs hidden for over a decade, shipping 423 fixes in April 2026 compared to 31 a year earlier. The dramatic improvement came from Mythos using agentic systems (AI that can assess and filter its own work) to reduce false positives, though Mozilla engineers still manually write and review all patches rather than deploying AI-generated code directly.

  • Anthropic Signs SpaceX Compute Deal Amid 80x Growth Surge: Anthropic experienced 80-fold growth in Q1 (far exceeding their planned 10x), straining infrastructure and prompting a deal with SpaceX for over 300 megawatts of compute capacity from the Colossus 1 data center in Memphis. The company also announced new Claude Managed Agents features including multi-agent orchestration (coordinating multiple AI agents to work together), outcomes-based iteration, and "Dreaming" (where agents review past sessions to self-improve).
  • Critical JWT Authentication Bypass in fast-jwt Library: The fast-jwt library contains a critical authentication bypass where attackers can forge valid JWTs (JSON Web Tokens, a standard format for securely transmitting user information) when an asynchronous key resolver returns an empty string, allowing them to compute valid signatures with an empty HMAC (cryptographic signature method) secret and bypass authentication entirely on versions up to 6.2.3. (CVE-2026-44351)
  • Unauthenticated RCE in PraisonAI Bypasses Previous Patch: PraisonAI version 4.6.31 contains an unauthenticated remote code execution vulnerability (RCE, where an attacker can run arbitrary commands on a server) in `tool_override.py` that was missed during a previous security fix, allowing attackers to execute malicious code by sending a POST request to `/v1/recipes/run` without any authentication. (CVE-2026-44334)
  • Keras Model Loader Vulnerable to HDF5 Shape Bomb DoS: Attackers can craft malicious .keras files (100-400 KB) that declare extremely large dataset shapes in HDF5 weight files (a binary format for storing neural network weights) but contain minimal actual data, causing Keras to attempt allocating petabytes of RAM when loading the model and immediately crashing any application processing it. (CVE-2026-0897)

  • Bleeding Llama RCE Threatens 300,000 Ollama Deployments: A critical vulnerability (CVE-2026-7482, severity 9.3) in Ollama, an open source tool for running large language models locally, allows unauthenticated attackers to exploit a heap out-of-bounds read (a bug where the program accesses memory it shouldn't) to steal API keys, passwords, and user messages from approximately 300,000 internet-exposed instances.
  • Massive Security Failures in Self-Hosted AI Infrastructure: A scan of over 1 million exposed AI services revealed catastrophic security practices including no default authentication, publicly accessible chatbots leaking user conversations, and exposed agent management platforms (tools like n8n and Flowise that automate AI workflows) revealing business logic, API keys, and access to connected third-party systems, making self-hosted AI infrastructure less secure than any previously investigated software category.
  • North Korean Supply-Chain Campaign Targets AI Coding Agents: The Famous Chollima group launched PromptMink, a supply-chain attack (compromising software components that developers rely on) using fake packages with legitimate-sounding names in NPM and PyPI registries to trick AI coding agents into automatically installing malware that steals information and grants remote access to developers' systems.
  • White House Expands Pre-Release AI Model Testing: The U.S. Commerce Department's Center for AI Standards and Innovation secured agreements with Google DeepMind, Microsoft, and xAI to conduct pre-deployment evaluations (testing models before they reach users) of new AI models, with the administration also considering an executive order to formalize vetting procedures across the industry.
  • Anthropic's Mythos Discovers Tens of Thousands of Vulnerabilities: Anthropic's CEO warned that their latest AI model, Mythos, has identified tens of thousands of software vulnerabilities and can rapidly generate functional exploits with minimal effort, creating a critical 6-12 month window before rival AI systems develop similar capabilities and attackers can exploit unpatched flaws at scale.