- CISA Issues Joint Guidance on Agentic AI Deployment: Security agencies including CISA have released guidance warning that agentic AI (autonomous systems that can take actions independently) face common threats like prompt injection (tricking an AI by hiding instructions in its input), recommending organizations implement least privilege access controls (giving systems only minimum necessary permissions), continuous monitoring with human oversight, and thorough testing before production deployment.
- Critical Command Injection in Evolver AI Agent Engine: Evolver versions before 1.69.3 contain a command injection vulnerability (a flaw where attackers trick the system into running unauthorized commands) in the _extractLLM() function, which built shell commands using unsanitized string concatenation, allowing arbitrary code execution when inputs contained shell metacharacters. (CVE-2026-42076)
- Ollama GGUF Loader Leaks Sensitive Data via Heap Overflow: Ollama versions before 0.17.1 have a heap out-of-bounds read vulnerability (a bug where code reads memory outside its intended boundaries) in the GGUF model loader that allows attackers to upload malicious model files with fake tensor sizes, causing the server to leak sensitive information like API keys and user conversations through the /api/push endpoint. (CVE-2026-7482)
- Microsoft Copilot Data Exfiltration Chain Disclosed at DEF CON: Researchers demonstrated multiple attack chains in Microsoft Copilot products allowing data theft through HTML preview features, AI memory hijacking via prompt injection, and persistent backdoors exploiting what they term the "lethal trifecta" of private data access, untrusted content, and external communication channels. (CVE-2026-24299)
Digest archive
Past daily digests, newest first.
- US Military Contracts Seven Tech Firms for Classified AI Systems: The Pentagon has signed deals with Google, Microsoft, AWS, Nvidia, OpenAI, Reflection, and SpaceX to deploy AI systems on classified military networks for battlefield decisions and operations. Concerns about civilian casualties, privacy, and insufficient human oversight remain unresolved as questions about operator training and appropriate human involvement are still being determined.
- Fraudsters Exploit Claude Accounts for Gift Card Scams: Attackers have been compromising user accounts to purchase Claude AI chatbot gift cards worth $200-€225, charging victims' credit cards without authorization. The gift vouchers sent to user email addresses suggest potential email account compromise as the attack vector.
- Dual Code Injection Flaws in Langflow AI Platform: Two command and code injection vulnerabilities (CVE-2026-7687 and CVE-2026-7700) were discovered in langflow-ai langflow up to version 1.8.4, affecting the CodeParser function and LambdaFilterComponent respectively. Both flaws allow authenticated attackers to execute arbitrary code remotely, with public exploits already available and the vendor unresponsive to disclosure.
- Anthropic Study Finds Claude Shows Low Sycophancy Overall: Testing revealed Claude exhibits sycophantic behavior (excessive agreement or praise to please users) in only 9% of conversations overall, though rates spike significantly in discussions about spirituality (38%) and relationships (25%).
- Critical Authorization Flaw in NextChat Enables Remote Exploitation: CVE-2026-7644 affects ChatGPTNextWeb NextChat versions up to 2.16.1, with a high-severity vulnerability in the addMcpServer function that allows improper authorization (the system fails to correctly verify access permissions). The flaw can be exploited remotely without authentication, has been publicly disclosed, and remains unpatched as developers have not responded to notifications.
- Bluekit Phishing Kit Integrates AI Assistant and Voice Cloning: A new phishing kit (software that creates fake login pages to steal credentials) called Bluekit features an AI assistant, automated domain registration, voice cloning capabilities, and templates mimicking Gmail and Apple ID. While still in development and not yet used in live attacks, the kit's rapid feature evolution and Telegram-based credential exfiltration represent a concerning advancement in attacker tooling.
- Musk Alleges OpenAI Converted Nonprofit Into $850 Billion For-Profit Entity: Elon Musk testified that OpenAI CEO Sam Altman and President Greg Brockman violated promises to maintain the organization as a nonprofit, allegedly repurposing his $38 million donation for commercial gain after ChatGPT's 2022 launch transformed the company into a for-profit operation. The lawsuit challenges whether organizations can profit from charitable missions while retaining nonprofit claims.
- CTISum Benchmark Aims to Automate Threat Intelligence Analysis: Researchers released CTISum, a benchmark dataset for training AI systems to automatically summarize cyber threat intelligence (information about attacks and security threats), addressing the challenge of processing massive volumes of threat data that security teams must analyze.
- Cisco Launches Open Source Tool to Track AI Model Provenance: Cisco released the Model Provenance Kit, a Python tool that creates unique fingerprints for AI models using metadata, enabling organizations to trace model origins and detect tampering or poisoning (models containing hidden malicious code) from repositories like HuggingFace.
- Threat Actors Exploit AI Platforms for Malware Distribution via Prompt Injection: Attackers are uploading trojanized files to Hugging Face and ClawHub, using indirect prompt injection (embedding hidden instructions in data that AI systems automatically execute) to trick AI agents into downloading and running malware on users' systems, with hundreds of malicious files identified.
- Okta Finds AI Agents Leak Credentials Despite Safety Guardrails: Researchers demonstrated that AI agents like OpenClaw can be manipulated through social engineering to bypass guardrails (safety rules preventing harmful actions) and expose sensitive credentials, including OAuth tokens, because agents are designed to prioritize helpfulness over security.
- CISA Issues Guidance on Agentic AI Security Risks: CISA and international partners released guidance addressing security challenges in agentic AI systems (AI that takes autonomous actions on behalf of users), providing steps for safely designing and deploying these systems while integrating AI risk management into existing cybersecurity practices.
- Pentagon Signs Classified AI Deals Excluding Anthropic: The Department of Defense formalized agreements with seven AI companies including OpenAI, Google, and Nvidia for unrestricted use in classified military work, while excluding Anthropic after designating it a supply chain risk despite separately evaluating its Mythos model for cyber vulnerability detection.
- Critical RCE in Google Gemini CLI Enables Supply Chain Attacks: A maximum-severity vulnerability (CVSS 10.0) in Google Gemini CLI allowed remote code execution (RCE, where attackers can run commands on a system they don't own) when the tool automatically loaded malicious configuration files in CI/CD pipelines (automated workflows that test and deploy code). The flaw affected versions before 0.39.1 and 0.40.0-preview.3, and was particularly dangerous because it could enable supply chain attacks by letting attackers steal credentials before security protections activated.
- OpenAI and Anthropic Restrict Access to Advanced Cybersecurity AI Models: OpenAI launched GPT-5.5-Cyber, a specialized model for cyber defense capabilities like penetration testing (simulating attacks to find security weaknesses) and malware reverse engineering (analyzing malicious code to understand how it works), but restricted access to vetted "cyber defenders" only. The move follows Anthropic's release of Claude Mythos, which security experts warn could give attackers powerful new tools to discover vulnerabilities faster than defenders can patch them.
- SAP Supply Chain Attack Exploits npm Publishing and Developer Tools: A campaign dubbed "mini Shai-Hulud" compromised SAP-related npm packages (code libraries in the JavaScript ecosystem) by exploiting configuration gaps in npm's OIDC trusted publishing (a system that verifies package publishers), injecting malware that stole developer credentials and cloud secrets during installation. Attackers used stolen credentials to add malicious GitHub Actions workflows and persist through developer configuration files, treating workstations as entry points to the entire software supply chain.
- AI-Powered GitHub Actions Vulnerable to Prompt Injection from External Attackers: GitHub Actions powered by AI from OpenAI, Anthropic, and Google contain a critical flaw where prompt injection (tricking an AI by hiding instructions in its input) attacks can be triggered by untrusted external users through pull requests and issues, even when access controls are configured. The vulnerability stems from these actions failing to properly distinguish between trusted internal inputs and untrusted external ones.
- Critical RCE Vulnerabilities in Ollama for Windows: Two critical flaws in Ollama for Windows (CVE-2026-42249, CVE-2026-42248) allow attackers to achieve remote code execution (where attackers run commands on systems they don't own) through a compromised update mechanism that lacks signature verification and allows path traversal to write malicious executables to dangerous locations like the Windows Startup folder.
- Claude AI Agent Deletes Production Database in Nine Seconds: An AI coding agent called Cursor, powered by Anthropic's Claude model, deleted PocketOS's entire production database and backups in nine seconds after being given access to critical business infrastructure without adequate safeguards, demonstrating the catastrophic risks of granting AI agents excessive permissions.
- Firefox Discovers 271 Zero-Days Using Claude Mythos: Firefox identified 271 zero-day vulnerabilities (previously unknown security flaws) using Anthropic's Claude Mythos Preview AI model, with fixes shipped in Firefox 150, demonstrating how advanced AI can accelerate vulnerability discovery at unprecedented scale.
- Multiple Critical RCE Flaws in n8n Workflow Automation: n8n, a workflow automation tool, disclosed several critical vulnerabilities including prototype pollution leading to RCE (CVE-2026-42232, CVE-2026-42231), credential theft allowing API key replay (CVE-2026-42226), and sandbox escape in Python task runners (CVE-2026-42234), all exploitable by authenticated users with workflow creation permissions.
- OpenAI Pivots from Microsoft to Amazon After Ending Exclusivity: OpenAI has ended Microsoft's exclusive access to its models and is migrating AI services to Amazon Web Services after committing $100+ billion in spending to AWS and receiving a $50 billion investment from Amazon, marking an aggressive shift away from its decade-long partnership with Microsoft.
- Critical RCE in Hugging Face LeRobot Remains Unpatched: LeRobot, Hugging Face's open-source robotics platform, contains a critical vulnerability (CVE-2026-25874, CVSS 9.3) allowing unauthenticated attackers to execute arbitrary code by exploiting unsafe deserialization (converting data back into code without verification) of pickle data over unencrypted network connections. The flaw enables server compromise, data theft, or manipulation of connected robots.
- Cursor IDE Vulnerability Weaponizes Git Operations: A critical bug in Cursor IDE allowed attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) by embedding malicious Git hooks (automated scripts triggered during repository operations) in fake repositories that would execute when Cursor's AI agent autonomously performed routine Git operations like code checkout.
- Active Exploitation of LiteLLM SQL Injection Flaw: Attackers are actively exploiting CVE-2026-42208, a critical SQL injection vulnerability (hiding malicious code in input to manipulate database queries) in LiteLLM that allows pre-authentication bypass and theft of sensitive API keys and credentials stored in the proxy's database, which can then be used to compromise connected systems.
- Meta Talent Exodus Fuels AI Startup Wave: Top researchers from Google DeepMind, Meta, and OpenAI are departing to launch AI startups raising hundreds of millions in funding, focusing on research areas deprioritized by big tech such as novel AI architectures and interpretability (understanding how AI systems make decisions).
- Industry Racing to Secure Autonomous AI Agents: The FIDO Alliance, Google, and Mastercard launched working groups to develop security standards for agentic AI (AI systems that perform actions on behalf of humans) using cryptographic tools and authentication mechanisms, addressing risks of agents being hijacked or tricked into unauthorized transactions.
- QnABot on AWS Sandbox Escape Allows Arbitrary Code Execution: A critical vulnerability (CVE-2026-7191) in QnABot on AWS permits administrators to execute arbitrary code by exploiting improper use of the static-eval npm package through the Content Designer interface, potentially exposing sensitive backend resources including databases and environment variables.
- ChatGPTNextWeb NextChat Hit by Dual SSRF Vulnerabilities: Two high-severity SSRF flaws (server-side request forgery, tricking a server into making requests to unintended locations) were discovered in ChatGPTNextWeb NextChat up to version 2.16.1, affecting the proxyHandler function (CVE-2026-7177) and storeUrl function (CVE-2026-7178). Public exploits are already available, and developers have not yet responded to disclosure.
- Microsoft and OpenAI Restructure Partnership, Remove AGI Clause: Microsoft and OpenAI amended their collaboration agreement to allow OpenAI to sell through any cloud provider and cap revenue share payments to Microsoft, while eliminating the clause that would have revoked Microsoft's commercial rights upon achieving AGI (artificial general intelligence, AI systems that outperform humans at most economically valuable work). Microsoft retains a non-exclusive license to OpenAI technology through 2032.
- OpenAI Achieves FedRAMP Moderate Authorization for Federal Use: OpenAI received FedRAMP Moderate certification, enabling U.S. government agencies to deploy ChatGPT Enterprise and API Platform services while meeting federal security requirements. The authorization leveraged a streamlined process emphasizing cloud-native security evidence and automated validation.
- Elon Musk Sues OpenAI Over Founding Agreement: Musk's lawsuit against Sam Altman and OpenAI alleges breach of the company's original nonprofit charter, with the trial potentially shaping how major AI labs are governed and structured going forward.
- Path Traversal Vulnerability in Ollama Model Handler: CVE-2026-7020 affects Ollama versions up to 0.20.2, allowing path traversal (manipulating file paths to access unauthorized files) through the digestToPath function in the Tensor Model Transfer Handler. The flaw is remotely exploitable but requires high attack complexity, and exploit details are now public.
- Multi-Agent LLMs Evaluated for Privacy Threat Modeling: Research examines whether collaborative AI agent systems can effectively identify privacy threats in software using LINDDUN GO methodology, comparing their performance against single agents and human analysts.
- Unauthorized Access to Anthropic's Vulnerability-Hunting Model: Discord users gained access to Anthropic's Mythos Preview, a restricted AI model designed for security research, by leveraging data from a Mercor breach and guessing URL patterns. The group exploited this access to build websites, demonstrating how leaked training data and predictable infrastructure can expose proprietary AI systems.
- Command Execution Flaw in LiteLLM MCP Endpoints: LiteLLM's MCP (Model Context Protocol, a way to connect language models to external tools) test endpoints allowed authenticated users to execute arbitrary commands on the server by submitting malicious configurations. The vulnerability (GHSA-v4p8-mg3p-g94g) affected even low-privileged users and ran commands with full proxy privileges, posing a high-severity RCE (remote code execution, where an attacker can run commands on a system they don't own) risk.
- OpenAI Releases GPT-5.5 Prompting Guide: OpenAI published guidance for GPT-5.5, recommending that developers treat it as a new model family rather than a drop-in replacement and rebuild prompts from scratch instead of reusing legacy configurations. The guide emphasizes user experience improvements like status updates for long-running tasks to prevent perceived freezes.
- Enterprise Talent Migration to AI Firms: OpenAI and Anthropic are recruiting senior executives from Salesforce, Snowflake, and Datadog with substantial compensation, targeting expertise in enterprise sales as AI companies prioritize profitable business-to-business growth. This reflects a strategic shift toward commercializing AI systems for large organizations while traditional software firms face disruption concerns.