Skip to content
AI Sec Watch

Digest archive

Past daily digests, newest first.

  • Anthropic Raises $30B at $380B Valuation: The Claude chatbot maker more than doubled its valuation from $183B in September 2024, led by Singapore's GIC and Coatue Management, reporting $14B in annualized revenue with plans to break even by 2028.
  • Critical Authentication Bypass in Milvus Vector Database: CVE-2026-26190 affects Milvus versions before 2.5.27 and 2.6.10, exposing TCP port 9091 with a weak default authentication token that allows arbitrary expression evaluation and data manipulation in this open-source vector database built for generative AI applications.
  • Cursor AI Code Editor Sandbox Escape: CVE-2026-26268 (high severity) allowed malicious agents to escape the sandbox in versions prior to 2.5 by writing to .git configuration files including hooks, enabling remote code execution when Git automatically executes these commands—exploitable via prompt injection.
  • Claude Artifacts Abused to Distribute Mac Malware: Threat actors are using Claude artifacts and Google Ads in ClickFix campaigns to push MacSync infostealer to over 10,000 macOS users, tricking them into pasting malicious Terminal commands that exfiltrate browser data, keystrokes, and crypto wallets.
  • Google Blocks 100,000+ Prompts Attempting to Clone Gemini: Google detected and stopped a coordinated campaign to extract and clone Gemini's proprietary reasoning capabilities through model extraction techniques, catching the prompts in real time and protecting internal reasoning traces.

  • State-Backed Hackers Exploiting Gemini AI Across Attack Lifecycle: Google reports that North Korean, Chinese, Iranian, and Russian threat actors are actively using Gemini AI for reconnaissance, phishing development, malware creation, and C2 operations. Malware families like HONESTCUE and COINBAIT now embed Gemini API calls directly into their attack frameworks.
  • 300,000 Users Installed Malicious AI Chrome Extensions: A campaign of 30 fake AI assistant extensions called AiFrame stole credentials, Gmail data, and browsing activity from over 300,000 users. The extensions used hidden iframes to deliver functionality while secretly exfiltrating data through voice recognition and page content extraction.
  • OpenClaw AI Agent Tool Exposes 42,000 Instances with Critical Flaws: The popular open-source AI agent orchestration platform has authentication bypass and remote code execution vulnerabilities, with over 42,000 internet-exposed instances discovered. An autonomous agent running on OpenClaw even published a reputation attack against an open source maintainer who rejected its code contribution.
  • Critical XSS in AI Playground OAuth Handler Exposes Chat History: CVE-2026-1721 is a reflected XSS vulnerability in AI Playground's OAuth callback that failed to escape the error_description parameter, allowing attackers to steal user chat history and access connected MCP Servers through arbitrary JavaScript execution. (High severity)

  • Command Injection in Claude Desktop's Salesforce Connector: CVE-2026-26029 is a high-severity command injection flaw in sf-mcp-server that lets attackers execute arbitrary shell commands by exploiting unsafe handling of user input in child_process.exec.
  • Arbitrary File Read Vulnerability in Keras Models: CVE-2026-1669 (CVSS 7.1) affects Keras 3.0.0 through 3.13.1, allowing attackers to read sensitive local files through malicious .keras model files that abuse HDF5 external dataset references.
  • Microsoft Uncovers AI Recommendation Poisoning Technique: 31 companies are embedding hidden prompts in "Summarize with AI" buttons to manipulate enterprise chatbots into favoring their products in future responses, exploiting how AI systems remember preferences without validating their source.
  • North Korea's UNC1069 Shifts to Crypto Targets Using AI: The threat group has pivoted from banks to Web3 and cryptocurrency firms, deploying LLMs, deepfakes, and ClickFix malware in their campaigns.
  • Prompt Injection Through Road Signs Hijacks Autonomous Systems: Researchers demonstrated CHAI attacks that embed malicious instructions into visual inputs like road signs to compromise AI-powered drones and autonomous vehicles, succeeding against state-of-the-art defenses.