Skip to content
AI Sec Watch

Digest archive

Past daily digests, newest first.

  • Anthropic Claude Code Leak Weaponized With Malware: Hackers are reposting Anthropic's accidentally leaked Claude Code source code on GitHub with embedded infostealer malware (software that steals personal information like passwords and credentials). Anthropic has issued copyright takedowns targeting thousands of repositories hosting the leaked code.
  • Critical Authorization Bypass in Directus CMS Enables File Overwrite: Directus contains a high-severity flaw in its TUS resumable upload endpoint (a feature for uploading files in chunks) that allows any authenticated user to overwrite arbitrary files by specifying their UUID, completely bypassing row-level permissions and enabling potential data destruction or malicious file injection (CVE-2026-35412).
  • Mobile-MCP Vulnerable to Malicious Intent Execution via Prompt Injection: The mobile_open_url tool in @mobilenext/mobile-mcp fails to validate URL schemes before passing them to Android, allowing attackers to use prompt injection (tricking an AI by hiding instructions in its input) to trigger dangerous actions like unauthorized phone calls, SMS messages, or access to private device data (CVE-2026-35394).
  • Directus Exposed Sensitive Credentials in Revision History: Directus failed to sanitize sensitive fields including authentication tokens, two-factor secrets, and API keys before storing them in revision history, allowing anyone with database access to read these credentials in plaintext and potentially compromise user accounts or third-party integrations.

  • Major AI Infrastructure Breach Exposes Training Data Secrets: Meta and other AI labs paused work with Mercor (a contractor hiring platform for AI training data) after hackers compromised a version of LiteLLM and stole hundreds of gigabytes of proprietary datasets that could reveal competitive secrets to rivals. The breach, likely by hacking group TeamPCP, affected thousands of organizations.
  • Critical Auth Bypass in LiteLLM via Cache Collision: LiteLLM's JWT authentication (a method to verify user identity using encoded tokens) could be bypassed because the system only used the first 20 characters of a token as a cache key, allowing attackers to create fake tokens matching legitimate users' cached tokens and gain their permissions. The flaw only affects deployments with JWT/OIDC authentication explicitly enabled. (CVE-2026-35030, Critical)
  • MLflow Job Endpoints Skip Authentication Entirely: MLflow has a vulnerability where API endpoints under `/ajax-api/3.0/jobs/*` skip authentication checks even when basic-auth protection is enabled, allowing attackers to submit and run jobs without logging in and potentially achieve RCE (remote code execution, where an attacker can run commands on a system they don't own). (CVE-2026-0545, Critical)
  • Claude Code Security Bypass After 50 Subcommands: Claude Code skips its security checks for commands with more than 50 subcommands, asking users to approve them without proper safety analysis after the 50th. Attackers could hide malicious commands in legitimate-looking code repositories to steal credentials and compromise software projects.
  • Mass Credential Theft via Unpatched Next.js Vulnerability: Threat group UAT-10608 is actively exploiting React2Shell (CVE-2025-55182, a pre-authentication RCE flaw in Next.js) to steal credentials at scale, with researchers discovering the attackers' exposed dashboard showing 766 compromised hosts in 24 hours and stolen credentials from AWS, Azure, OpenAI, and GitHub.

  • Axios npm Package Compromised in Supply Chain Attack: A three-hour supply chain attack injected a RAT (remote access trojan, malware giving attackers shell access and command execution) into axios versions 1.14.1 and 0.30.4 on npm. The @lightdash/cli package could resolve to these compromised versions during installation if users installed versions 0.1800.0 through 0.2695.0 without a lockfile (a file that pins exact dependency versions).
  • Multiple Critical Vulnerabilities Found in SillyTavern AI Interface: SillyTavern, a locally installed interface for interacting with AI text generation models, had several high-severity path traversal vulnerabilities (flaws that let attackers access files outside intended directories) in versions before 1.17.0. Authenticated attackers could write malicious files, read and delete sensitive files like secrets.json, and unauthenticated users could probe for file existence anywhere on the server (CVE-2026-34522, CVE-2026-34524, CVE-2026-34523).
  • Leaked Claude Code Source Exploited to Distribute Malware: After Anthropic's Claude Code (a terminal-based AI agent) was accidentally leaked on March 31, attackers created fake GitHub repositories that deliver Vidar infostealer malware to users searching for the leaked code. The malicious repositories use search engine optimization to appear in Google results and trick users into downloading malware disguised as the leaked source code.
  • Google Releases Gemma 4 Open-Source AI Models: Google DeepMind released Gemma 4, a family of open-source AI models in four sizes (2B to 31B parameters, where parameters are the trainable weights in a neural network) designed for complex reasoning and agentic workflows (AI systems that can autonomously plan and use tools). The models support multimodal processing (handling text, images, video, and audio), function-calling for tool integration, and context windows up to 256K tokens.

  • Claude Code Source Leaked via npm Packaging Error: Anthropic confirmed that Claude Code's source code was accidentally leaked through an npm package containing a source map file, exposing nearly 2,000 TypeScript files and over 512,000 lines of code. Users who downloaded the affected version on March 31, 2026 may have received a trojanized HTTP client (compromised software) containing malware.
  • AI Tool Discovers Zero-Days in Vim and GNU Emacs Within Minutes: Researcher Hung Nguyen used Anthropic's Claude Code to quickly discover zero-day exploits (previously unknown security flaws) in Vim and GNU Emacs that would allow attackers to execute arbitrary code by tricking users into opening malicious files. Claude Code generated proof-of-concept exploits (working examples of attacks) within minutes, demonstrating how AI can accelerate vulnerability discovery.
  • Critical Python Sandbox Escape in PraisonAI: PraisonAI's `execute_code()` function can be bypassed by creating a custom string subclass with an overridden `startswith()` method, allowing attackers to run arbitrary OS commands on the host system (CVE-2026-34938). This is especially dangerous because many deployments auto-approve code execution, so attackers could trigger it silently through indirect prompt injection (sneaking malicious instructions into the AI's input).
  • Multiple High-Severity Vulnerabilities in ONNX Format: ONNX (Open Neural Network Exchange, a standard format for sharing machine learning models) versions before 1.21.0 contain several high-severity vulnerabilities including path traversal via symlink (CVE-2026-27489, CVSS 8.7) and improper validation allowing attackers to craft malicious models that overwrite internal object properties (CVE-2026-34445). These flaws allow attackers to read arbitrary files outside intended directories or manipulate model behavior.

  • OpenAI Closes Record $122 Billion Funding Round: OpenAI raised $122 billion at an $852 billion valuation with backing from SoftBank, Amazon, and Nvidia, now serving 900 million weekly users and generating $2 billion monthly revenue as it prepares for a potential IPO despite not yet being profitable.
  • Multiple Critical FastGPT Vulnerabilities Disclosed: FastGPT versions before 4.14.9.5 contain three high-severity flaws including CVE-2026-34162 (unauthenticated proxy endpoint allowing unauthorized server-side requests), CVE-2026-34163 (SSRF vulnerability letting attackers scan internal networks and access cloud metadata), and issues with MCP tools endpoints that accept user URLs without validation.
  • Claude SDK Filesystem Sandbox Escapes: Both TypeScript (CVE-2026-34451) and Python (CVE-2026-34452) versions of Claude SDK had vulnerabilities in their filesystem memory tools where attackers could use prompt injection or symlinks to access files outside intended sandbox directories, potentially reading or modifying sensitive data they shouldn't access.
  • Axios npm Supply Chain Attack Impacts Millions: Attackers compromised the npm account of Axios' lead maintainer and published malicious versions containing a remote access trojan (malware that gives attackers control over infected systems), affecting a library downloaded 100 million times per week and used in 80% of cloud environments before being detected and removed within hours.
  • Claude AI Discovers RCE Bugs in Vim and Emacs: Claude AI helped identify remote code execution vulnerabilities (where attackers can run commands on systems they don't own) in Vim and GNU Emacs text editors that trigger simply by opening a malicious file, exploiting modeline handling in Vim and automatic Git operations in Emacs.

  • Anthropic's Unreleased Cybersecurity Model Accidentally Exposed: A configuration error leaked details of Anthropic's powerful new AI model called Mythos, designed for cybersecurity use cases with advanced reasoning and coding abilities including recursive self-fixing (autonomously finding and patching its own bugs). The leak raises concerns because the model's improved vulnerability detection could enable more sophisticated cyberattacks, prompting Anthropic to plan a phased rollout to enterprise security teams first.
  • Critical Command Injection in MLflow Model Deployment: MLflow has a command injection vulnerability (where attackers insert malicious commands into input that gets executed) in its model serving code when using `env_manager=LOCAL`, allowing attackers to execute arbitrary commands by manipulating dependency information in the `python_env.yaml` file without any safety checks. (CVE-2025-15379, Critical)
  • Multiple High-Severity Flaws in AI Agent Frameworks: CrewAI has several vulnerabilities including Docker fallback issues that enable RCE (remote code execution, where attackers run commands on systems they don't control) when containerization fails (CVE-2026-2287, CVE-2026-2275), while OpenClaw suffers from malicious plugin code execution during installation and sandbox bypass flaws that let agents access other agents' workspaces. SakaDev and HAI Build Code Generator can both be tricked through prompt injection (hiding malicious instructions in normal-looking input) to misclassify dangerous terminal commands as safe and execute them automatically (CVE-2026-30306, CVE-2026-30308).
  • ChatGPT Data Leakage Vulnerability Patched: OpenAI fixed a vulnerability that allowed attackers to secretly extract sensitive user data including conversation messages and uploaded files by exploiting a hidden DNS-based communication channel (covert data transmission using the Domain Name System) in ChatGPT's Linux runtime, bypassing all safety guardrails designed to prevent unauthorized data sharing.

  • Bluesky Launches AI-Powered Feed Customization Tool: Bluesky released Attie, an AI assistant that lets users create custom content feeds by describing what they want in plain language rather than adjusting technical settings. The tool runs on Claude (Anthropic's language model) and will integrate into apps built on Bluesky's AT Protocol.

  • OpenAI Shuts Down Sora Video App Over Profitability Concerns: OpenAI discontinued its Sora video-generation app and canceled a $1 billion Disney partnership because the service consumed too many computational resources without generating enough revenue to justify costs as the company prioritizes profitability.
  • Critical Injection Vulnerability in localGPT LLM Tool: CVE-2026-5002 allows remote injection attacks (inserting malicious code into input) through the LLM Prompt Handler in PromtEngineer localGPT's backend. The exploit code is publicly available, and the vendor has not responded to disclosure attempts.
  • Political Deepfakes Gain Influence Despite Public Awareness: AI researchers found that creators use generative AI (technology that creates images or videos from text descriptions) to produce fake media of political figures for propaganda and profit, and these deepfakes shape public perception even when viewers know the content is fake.
  • TikTok's AI Ad Labels Failing in Practice: Major companies like Samsung are posting AI-generated ads on TikTok without the required disclosure labels, preventing users from identifying whether advertisements were created by AI or humans despite platform policies requiring transparency.

  • Critical Langflow RCE Exploited Within Hours of Disclosure: Attackers exploited a critical vulnerability (CVE-2026-33017) in Langflow, an open-source AI pipeline builder, within hours of public disclosure, allowing them to run arbitrary code on unprotected systems through an exposed API endpoint that executes malicious Python without authentication. CISA added it to its Known Exploited Vulnerabilities catalog and set an April 8, 2026 patch deadline for federal agencies.
  • LangChain and LangGraph Vulnerabilities Expose Secrets in Widely Used AI Frameworks: Three high-severity vulnerabilities were discovered in LangChain and LangGraph, affecting millions of weekly downloads, that could expose sensitive files through path traversal (manipulating file paths to access restricted files), leak API keys through deserialization flaws, and allow database manipulation via SQL injection (inserting malicious database commands).
  • Prompt Injection Bypasses Safety Checks in AI Code Terminal Execution: AI Code's automatic terminal command execution feature can be tricked through prompt injection (hiding malicious instructions in AI input) to run dangerous commands without user approval, even when set to only execute "safe" commands (CVE-2026-30304).
  • RAG Poisoning Vulnerability in Open WebUI File Processing: Open WebUI's file batch processing endpoint lacks ownership verification, allowing any authenticated user to overwrite files in shared knowledge bases and poison the RAG system (retrieval-augmented generation, where AI pulls external documents to answer questions), causing the AI to serve attacker-controlled content to other users (CVE-2026-28788).
  • OpenAI Launches Bug Bounty Program for AI Safety Issues: OpenAI has started a bug bounty program (a system rewarding security researchers for finding problems) focused specifically on design or implementation flaws that could enable serious harm through AI misuse or safety failures.

  • CISA Warns of Active Langflow Exploitation: CISA reports that hackers are actively exploiting CVE-2026-33017, a critical vulnerability (rated 9.3 out of 10) in Langflow, an open-source framework for building AI workflows. This code injection flaw allows attackers to execute arbitrary Python code and gain RCE (remote code execution, where an attacker can run commands on a system they don't own) on unpatched systems running version 1.8.1 or earlier, with exploitation beginning just 20 hours after the vulnerability details were made public.
  • Critical RCE in n8n Workflow Automation: A prototype pollution vulnerability (a type of attack that modifies how objects are created in JavaScript) in n8n's GSuiteAdmin node allows authenticated users to execute arbitrary code on the n8n server by crafting malicious workflow parameters (CVE-2026-33696). An attacker with permission to create or modify workflows could exploit this to gain control over the entire n8n instance.
  • Claude Chrome Extension Allowed Zero-Click Prompt Injection: A vulnerability called ShadowPrompt in Anthropic's Claude Chrome extension allowed attackers to inject malicious prompts (hidden instructions) into the AI without user interaction by exploiting an overly permissive allowlist and an XSS vulnerability (a security flaw allowing attackers to run malicious code) in a CAPTCHA component. This zero-click attack could let attackers steal sensitive data, read conversation history, or perform actions like sending emails on behalf of the victim.
  • Federal Judge Blocks Trump Administration's Anthropic Ban: A federal judge granted Anthropic a preliminary injunction blocking the Trump administration's ban on federal agencies using Claude AI models and its Pentagon blacklisting as a supply chain risk (a designation claiming use of a company's technology threatens national security). The judge ruled the administration's actions constituted First Amendment retaliation for Anthropic publicly disagreeing with the government's contracting decisions.