Critical RCE Cascade in IBM Langflow OSS: IBM Langflow OSS versions 1.0.0 through 1.10.0 contain at least nine critical vulnerabilities that allow remote code execution (where attackers can run commands on a system they don't own), including unauthenticated attacks via webhook bypass (CVE-2026-8505), auto-login endpoint exploitation (CVE-2026-9103, CVE-2026-9198), unsafe deserialization in caching (CVE-2026-8476), and privilege escalation through database manipulation (CVE-2026-8635). The most severe chain allows unauthenticated attackers to mint superuser tokens and execute arbitrary Python code, achieving full system compromise.
Trump Administration Seizes Control of Frontier AI Model Access: The White House has established a new program called 'Gold Eagle' to review and approve which companies and organizations can access frontier AI models (the most advanced AI systems available), shifting power from tech companies like OpenAI and Anthropic to federal authorities. The administration has already blocked some AI model releases citing national security concerns, though it maintains these decisions remain voluntary for companies.
Command Injection in AI Agent Platforms: Multiple AI orchestration platforms contain high-severity command injection vulnerabilities, including Agentic-Flow (CVE-2026-58195), where user input is directly inserted into shell commands without validation, and AWS HealthOmics MCP Server (CVE-2026-15415), which has a path traversal flaw (using sequences like '../' to escape intended directories) in workflow linting tools. The AI Copilot WordPress plugin (CVE-2026-9810) also fails to bind OAuth tokens to specific users, allowing privilege escalation to administrator accounts.
NadMesh Botnet Targets AI Infrastructure for Credentials: A Go-based botnet called NadMesh is actively scanning for exposed AI services including ComfyUI, Ollama, and MCP (Model Context Protocol, a framework for AI tools) implementations to steal cloud credentials, Kubernetes tokens (authentication keys for container orchestration systems), and AI model access, with Docker API vulnerabilities representing the largest share of exploitation attempts.
EU Orders Android Open Access for Rival AI Assistants: The European Commission mandated that Google grant competing AI assistants the same access to Android device features as its Gemini assistant, including camera, microphone, screen contents, and background app control, with implementation required by August 2027. Security experts warn this could undermine traditional security models where the operating system controls application permissions, as multiple AI agents with deep system access may break existing containment mechanisms.
Anthropic Claude Extension Vulnerable to Workflow Hijacking: A flaw in Anthropic's Claude Chrome extension allows malicious browser extensions to trigger Claude's predefined AI workflows (automated tasks that connect to Gmail, Google Docs, Calendar, and Salesforce) by simulating user clicks. The extension fails to verify that click events are genuine by checking the Event.isTrusted property (a browser flag distinguishing real user actions from programmatically generated ones), enabling attackers to abuse Claude's integrations without user knowledge once a malicious extension is installed.
OpenAI Deploys GPT-Red to Automate Prompt Injection Defense: OpenAI developed GPT-Red, an automated red-teaming model (a tool that simulates attacks to find vulnerabilities) that searches for prompt injection vulnerabilities (tricks where hidden instructions in user input make an AI behave unexpectedly) before deployment. Using GPT-Red to test and harden GPT-5.6 Sol during training resulted in a model 6 times more resistant to prompt injection attacks compared to its predecessor.
Anthropic Prepares Major IPO as Bankers Schedule Investor Meetings: Anthropic, the company behind Claude AI models, has confidentially filed for an initial public offering (when a private company begins selling shares to the public) with the SEC and could go public as early as October 2025, making it one of the first major AI startups to enter public markets.
US States Lead Coordinated AI Safety Standards Through Reverse Federalism: California, New York, and Illinois are implementing a common framework for governing powerful AI systems through state legislation, establishing de facto national standards that require documented safety frameworks with risk assessments, incident reporting, and independent audits without waiting for federal action.
Microsoft and GitHub Copilot Hit with Multiple Command Injection Flaws: Microsoft 365 Copilot, Outlook Copilot, and GitHub Copilot are affected by several critical and high-severity vulnerabilities including command injection (CVE-2026-48561, CVE-2026-55145) and improper file restrictions allowing local code execution (CVE-2026-50510). A separate flaw in Microsoft 365 Copilot for iOS (CVE-2026-58617) permits privilege escalation over a network.
Grok Build Exfiltrated Entire Codebases Including Credentials: xAI's Grok Build coding assistant was uploading users' complete Git repositories to cloud storage, not just files it needed to process, including unredacted API keys and credentials even in files the AI was instructed to ignore. The company disabled this feature after researchers discovered a 12 GB repository generated 5.10 GB of storage traffic.
Anthropic Discovers Hidden Reasoning Layer in Claude: Anthropic researchers identified "J-space," a previously hidden internal layer where large language models (AI systems trained on text to predict and generate language) store words that influence reasoning without ever appearing in output. The discovery shows that LLMs internally track progress and comment on their own decisions in ways that affect behavior, though experts caution against overstating the finding's implications.
MemGhost Attack Poisons AI Agent Memory Through Single Email: Researchers demonstrated an attack that plants persistent false information in AI agents (assistants that remember information across sessions) through one crafted email, with the false memory then influencing future responses while hiding its file-editing steps from users. The attack succeeded in 87.5% of background-mode tests, exposing a fundamental vulnerability in agents that automatically process incoming messages.
Apple Sues OpenAI Over Trade Secret Theft: Apple has filed a lawsuit against OpenAI alleging trade secret theft, triggering a public exchange between Elon Musk and Sam Altman on social media. The dispute reflects ongoing tension over OpenAI's shift from nonprofit to for-profit structure, which Musk previously challenged unsuccessfully in court earlier this year.
Anthropic Extends Free Access to Claude Fable 5: Anthropic has postponed the end of free Claude Fable 5 access for paid subscribers to July 19, marking the third deadline extension. Users can access the model at no additional cost for up to 50% of their weekly usage limits before needing to purchase credits or switch to alternative Claude models.
PraisonAI Critical RCE Allows Code Execution via Prompt Injection: PraisonAI before version 1.6.78 contains a critical remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in its CodeAgent that executes AI-generated Python code without AST validation (checking code structure before running) or sandboxing (isolating code from the full system), allowing attackers to use prompt injection (tricking the AI by hiding malicious instructions in input) to steal credentials or run arbitrary commands. (CVE-2026-61447)
Ghostcommit Attack Embeds Prompt Injection in Repository Images: Researchers discovered an attack technique that hides prompt injection instructions inside PNG images in code repositories, which triggers later when AI coding agents scan the approved code and extract commands to steal secrets from configuration files, encoding them as numbers that evade security scanners.
Apple Sues OpenAI for Trade Secret Theft: Apple filed a federal lawsuit alleging that OpenAI orchestrated a scheme to steal confidential hardware designs and manufacturing techniques through former Apple employees, including OpenAI's current chief hardware officer. The suit marks a dramatic collapse of the companies' 2024 partnership that integrated ChatGPT into iPhones, deteriorating after OpenAI moved to enter the hardware market by acquiring designer Jony Ive's startup.
HalluSquatting Exploits AI Hallucinations for Malware Distribution: Attackers are pre-registering fake repository and package names that AI coding assistants commonly hallucinate (generate false information about things that don't exist), then planting malicious code so that when developers ask AI tools to clone or install resources, the AI pulls down and executes the attacker's code instead.
OpenAI Releases GPT-5.6 After White House Security Review: OpenAI launched the GPT-5.6 family (Luna, Terra, and Sol) with a one-million token context window and new capabilities for multi-agent coordination, following an initial delay for government security testing by the White House's Center for AI Standards and Innovation. The flagship Sol model delivers 54% better token efficiency on agentic coding tasks and introduces programmatic tool calling and prompt cache breakpoints to support long-running autonomous workflows.
Critical Authentication Bypass in Ruflo Agent Harness: Ruflo, a meta-harness for managing AI coding agents like Claude Code, exposed two unauthenticated endpoints in its default Docker Compose deployment (versions before 3.16.3) that allowed arbitrary terminal command execution, API key exfiltration, and corruption of stored learning patterns to any network attacker. (CVE-2026-59726, critical severity)
CISA Orders Emergency Patching of Actively Exploited Langflow Flaw: The U.S. Cybersecurity and Infrastructure Security Agency ordered federal agencies to immediately patch CVE-2026-55255, an IDOR (insecure direct object reference, where attackers manipulate request parameters to access unauthorized data) in Langflow, a popular drag-and-drop AI agent builder. Attackers are already exploiting this vulnerability in the wild to achieve code execution, deploy malware, and steal credentials from compromised servers.
GitLost Attack Exploits GitHub AI Agents to Leak Private Repositories: A prompt injection attack (tricking an AI by hiding instructions in its input) called GitLost can manipulate GitHub's AI agents into leaking private repository contents by embedding malicious commands in public GitHub issues. The vulnerability stems from AI agents treating untrusted user input as legitimate instructions while having access to both public and private repositories, and GitHub's security protections have failed against simple variations like adding the keyword "additionally" to bypass safeguards.
Agent Data Injection Attack Bypasses AI Tool Guardrails: Researchers disclosed agent data injection (ADI), an attack where adversaries plant fake information in data sources AI agents trust, such as email sender names or button IDs, causing agents to misclick or execute unintended commands while appearing to complete legitimate tasks. Unlike prompt injection, ADI corrupts small factual elements using fake punctuation characters that language models misread as valid delimiters, successfully compromising Claude, Google's Antigravity, Nanobrowser, and multiple coding assistants.
Over One Million Emails Evade AI Filters with Text Salting: More than one million phishing emails have used text salting (embedding hidden characters or text invisible to humans but detectable to AI) to bypass AI-based email security filters. The research demonstrates that large language models are surprisingly vulnerable to this evasion technique, allowing malicious messages to reach inboxes undetected.
Critical RCE in Cursor Cloud Agent Exposed Developers to Code Execution and Credential Theft: CVE-2026-61613 allowed attackers to use malicious web content to connect to an unprotected local endpoint in Cursor's Cloud Agent before the March 31, 2026 fix, enabling arbitrary code execution, file theft, and extraction of GitHub access tokens from developers' machines.
Multiple High-Severity Vulnerabilities Threaten AI Agent Frameworks: django-haystack's Elasticsearch backend executes arbitrary code via unsafe `eval()` calls on field values (GHSA-r3hx-x5rh-p9vv), LangBot allows authenticated RCE (remote code execution, where attackers run commands on systems they don't own) through malicious MCP plugin configuration (CVE-2026-54449), and Strands Agents' elasticsearch_memory tool leaked operator credentials when LLMs controlled connection settings (CVE-2026-15746).
Researchers Build Automated Zero-Day Discovery System Using LLM Pipeline: Security researchers at Intruder developed an automated vulnerability discovery system that uses program slicing (extracting only relevant code segments) to focus LLMs on specific code paths, successfully identifying a SQL injection zero-day in a WordPress plugin with over 300,000 users by filtering findings through multiple AI models before attempting exploitation.
Claude for Chrome Exploited by Malicious Extensions: Two unpatched vulnerabilities in Anthropic's Claude for Chrome extension allow any rogue browser extension to fake user clicks and silently access Gmail, Google Docs, and Calendar data, bypassing the extension's safety controls. The flaws remain exploitable in version 1.0.80 despite a simple one-line fix being available.
NVIDIA Triton Inference Server Patches Authentication Bypass and Resource Exhaustion Bugs: NVIDIA addressed multiple high-severity vulnerabilities in Triton Inference Server including authentication bypass via alternative path (CVE-2026-47481), uncontrolled resource consumption (CVE-2026-47479, CVE-2026-47476), stack-based buffer overflow (CVE-2026-47477), and memory leaks. A related medium-severity flaw in TensorRT-LLM (CVE-2026-24271) allowed unlimited GPU resource allocation leading to denial of service.
AI Agents Automate Full Attack Chains, Outpacing Traditional Defenses: Security experts warn that attackers now deploy AI agents (autonomous systems executing multi-step tasks) to automate entire attack lifecycles from initial compromise to data exfiltration and persistence, dramatically accelerating timelines compared to manual operations while most organizations rely on incident response playbooks designed for human adversaries.
Authorization Bypass in OpenClaw AI Model Gateway: OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability where attackers with lower trust levels can exploit misconfigured input paths to circumvent admin authorization checks (security rules verifying user permissions) and execute restricted operations through OpenAI-compatible HTTP model overrides. (CVE-2026-62186, high severity)
CrewAI SSRF Vulnerability Exposes Internal Services: CrewAI versions before 1.15.1 have an SSRF flaw (server-side request forgery, where an attacker tricks a server into making unwanted network requests) in the validate_url function that allows attackers to bypass security checks using URL redirects or DNS rebinding techniques to access internal services and cloud metadata. (CVE-2026-62240, high severity)
vllm-orchestrator-gateway Logs Credentials in Plaintext: A vulnerability in the vllm-orchestrator-gateway component logs authorization headers, bearer tokens (temporary access passwords), and complete chat conversations to persistent disk files, allowing anyone with logging system access to steal credentials and read private conversation content including personally identifiable information. (CVE-2026-15574, high severity)
PraisonAI Defense Misconfiguration Allows High-Severity Prompt Injection Bypass: PraisonAI versions before 4.6.78 have a misconfigured prompt injection defense (security feature that blocks attempts to trick an AI into ignoring its instructions) that only blocks CRITICAL-severity attacks, allowing HIGH-severity attacks to bypass protection and extract hidden system prompts or trigger unauthorized tool use. (CVE-2026-61439)
Critical Arbitrary File Read in MCP-Atlassian Tool: The mcp-atlassian tool's `confluence_upload_attachment` function lacks path validation, allowing authenticated users or AI agents manipulated via prompt injection (hidden malicious instructions in input) to read and exfiltrate sensitive files like SSH keys and API credentials by uploading them to Confluence (CVE not assigned, high severity).
BabelDOC PDF Parser Vulnerable to Pickle Deserialization Attack: BabelDOC's PDF parser deserializes untrusted pickle data from CMap files without validating file paths, allowing attackers to craft malicious PDFs with specially encoded filenames that trigger arbitrary code execution (running attacker code with the program's permissions) when processed (CVE-2026-54071, high severity).
Machine Identity Crisis as AI Agents Outnumber Humans 50 to 1: AI agents and other machine identities now outnumber human users by up to 50 to one in many organizations, but traditional identity security designed around human behavior patterns cannot track what these agents are, who owns them, or what systems they access, creating a significant attack surface.
GhostApproval Symlink Attack Bypasses Human Oversight in Six AI Coding Tools: Six major AI coding assistants (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf/Devin Desktop) are vulnerable to GhostApproval, an attack that exploits symbolic links (shortcuts pointing to other files) combined with misleading UI confirmation prompts to trick developers into approving file modifications to sensitive system files like SSH keys while displaying harmless file names. The flaw represents a fundamental design problem rather than a simple bug, as the AI models cannot reliably distinguish between code they analyze and instructions they should follow.
Credential Leakage in n8n Workflow Platform's AI Agents: The n8n workflow automation platform failed to enforce domain restrictions on credentials in its AI Agents feature (versions before 2.27.4 and 2.28.1), allowing member-level users with limited privileges to exfiltrate secret credentials to external attacker-controlled servers. (CVE-2026-59207, high severity)
UK Deploys Cyber Shield Autonomous Defense Initiative: The UK's National Cyber Security Centre announced Cyber Shield, a program to deploy paired red and blue AI agents that autonomously discover vulnerabilities and defend national networks in real time, responding to the compression of attacker reconnaissance timelines from weeks to minutes due to AI-powered exploitation tools.
Multiple Critical Vulnerabilities in LiteLLM AI Gateway: LiteLLM, a proxy server that forwards requests to different AI language model APIs, disclosed five vulnerabilities including authentication bypass (CVE-2026-59822), path traversal in skill file uploads (CVE-2026-59820), and file disclosure through health check endpoints (CVE-2026-59819). The authentication bypass allowed attackers to access protected AI tools without valid credentials by spoofing Authorization headers, while other flaws enabled arbitrary file writes and credential exposure through unsandboxed Python code execution in guardrails (safety filters).
Gradio SSRF Vulnerability Enables Cloud Credential Theft: Gradio before version 6.20.0 contains CVE-2026-59806, a vulnerability where the /gradio_api/file= endpoint accepts unvalidated URLs, allowing attackers to perform SSRF (server-side request forgery, where the server makes unintended requests to internal systems). Attackers can exploit this to target cloud metadata services and steal sensitive credentials like EC2 IAM role authentication tokens used by cloud services.
Five Eyes Agencies Warn AI Models Now Autonomously Hack Systems: National security agencies from the Five Eyes alliance warned that AI models can now autonomously penetrate systems and networks, decoupling skill from ability by enabling anyone with minimal expertise to conduct sophisticated attacks like data theft and ransomware deployment. The warning highlights that open-source models (AI code anyone can download and run locally) lack safety guardrails and will spread like earlier hacker tools, fundamentally changing the threat landscape.