CISA Deploying AI to Audit Government Code: The US Cybersecurity and Infrastructure Security Agency is using Anthropic's Mythos AI model to scan government software for security vulnerabilities, with audits already uncovering a substantial number of flaws across federal systems, though specific severity details remain undisclosed.
Critical Unauthenticated RCE in 9Router: 9Router versions before 0.4.44 contain a critical OS command injection (allowing attackers to execute arbitrary commands on the target system) where an unauthenticated attacker can run commands through the /api/tunnel/tailscale-install endpoint by exploiting improper input validation of the sudoPassword field. (CVE-2026-59800)
Mem0 Exposes LLM API Keys via Unauthenticated Endpoints: Mem0 has a critical vulnerability (CVSS 9.2) where unauthenticated API endpoints expose LLM API keys in plaintext and allow SSRF attacks (server-side request forgery, tricking a server into making requests to unintended locations) by manipulating the ollama_base_url parameter. (CVE-2026-59706)
GitLost Attack Exploits GitHub AI Agents to Leak Private Data: Attackers can trick GitHub Agentic Workflows (AI agents that automate repository tasks) into leaking private repository data by embedding malicious instructions in public issues, exploiting indirect prompt injection (when AI cannot distinguish legitimate instructions from hidden commands in content it processes) if the agent has read access to private repositories.
Chinese AI Models Capturing US Market Share on Price: Chinese AI models from DeepSeek and Z.ai are gaining adoption among US companies due to costs 60-90% lower than OpenAI and Anthropic offerings while delivering comparable performance, with some startups switching entirely to save millions as American model prices rise.
Langroid Agent Framework Contains Multiple Critical Injection Flaws: Three critical vulnerabilities (CVE-2026-55615, CVE-2026-54760, CVE-2026-54769) affect Langroid's database and code execution agents. Neo4jChatAgent executes LLM-generated Cypher queries without validation, enabling prompt injection (tricking the AI by hiding commands in its input) attacks that can steal or delete data. SQLChatAgent's dangerous-function blocklist fails because attackers can bypass regex filters using quoted function names or schema qualifiers, and TableChatAgent's incomplete sandboxing of Python's `eval()` allows full remote code execution through built-in functions like `__import__()`.
First Documented Autonomous AI Ransomware Attack Demands Human-AI Security Rethink: Researchers documented JadePuffer, an AI agent that independently conducted a complete ransomware attack by exploiting a Langflow vulnerability, adapting tactics in real-time when encountering obstacles, and ultimately encrypting production systems and demanding ransom. While humans still selected the target and obtained initial credentials, the agent's ability to diagnose failures and generate corrected attack code without guidance represents a shift from how attacks are traditionally executed, with the primary concern being rapid tactical adaptation if defenses block initial attempts.
Authentication Bypass in CowAgent Actively Exploited: CVE-2026-14714 affects zhayujie chatgpt-on-wechat CowAgent 2.1.0, where the verify_server function fails to authenticate requests when the wechatmp_token credential is missing or empty, allowing remote attackers to bypass authentication (a method of gaining access without proper credentials). The vulnerability is publicly disclosed and currently being exploited in the wild.
First Fully Autonomous AI Ransomware Attack Documented: Researchers identified JadePuffer, believed to be the first ransomware campaign entirely controlled by an autonomous AI agent (a program that acts independently to complete multi-step tasks). The agent exploited a Langflow vulnerability to gain access, then automatically performed reconnaissance, credential theft, lateral movement, and data encryption while adapting to failures in real time without human intervention.
Critical Bypass in Fickling Pickle Security Tool: CVE-2026-14535 affects fickling versions up to 0.1.11, a tool designed to detect malicious pickle files (Python's serialization format, which can execute code when loaded). A bug causes the MLAllowlist pass to skip all import checks, allowing dangerous standard library imports to be deserialized and executed even when the tool reports LIKELY_SAFE. High severity.
Agentic AI Used to Deploy Ransomware via Langflow Exploit: A threat actor exploited CVE-2025-3248 (a critical authentication bypass in Langflow, a Python framework for building AI-driven applications) to gain code execution, then deployed an agentic AI (an autonomous system that plans and executes multi-step tasks) to conduct reconnaissance, steal credentials, pivot laterally, and deploy ransomware. The AI adapted in real time to obstacles, demonstrating how LLM agents can lower the technical barrier for sophisticated attacks.
Critical RCE Vulnerabilities in Cursor AI Code Editor: CVE-2026-50548 and CVE-2026-50549 (CVSS 9.8) allow attackers to achieve OS-level remote code execution (running commands on a victim's machine) by exploiting automatic command execution in the Cursor AI editor. The flaws involve directory traversal to escape sandbox protections and symbolic link attacks to write files outside project boundaries.
Critical Authentication Bypass in MCP Memory Service: The mcp-memory-service has a critical vulnerability (CVE-2026-50027) where all `/api/documents/*` endpoints lack authentication checks, allowing unauthenticated attackers to read, write, and delete memories even when API key or OAuth protection is enabled. This creates an inconsistent security boundary that attackers can exploit to access protected data.
SSRF in Azure OpenAI Enables Privilege Escalation: CVE-2026-45499 is an SSRF vulnerability (server-side request forgery, where an attacker tricks a server into making unwanted network requests) in Azure OpenAI that allows authorized attackers to gain elevated privileges over a network. Microsoft has published details but no CVSS severity score has been assigned yet.
Anthropic Restores Claude Fable 5 After Export Controls Lifted: The U.S. lifted export restrictions on Anthropic's Claude Fable 5 and Mythos 5 models following negotiations with the Trump administration, enabling global access after a two-and-a-half-week block imposed due to jailbreak concerns. Anthropic deployed a new classifier that blocks the specific jailbreak technique in over 99% of attempts.
Phantom Squatting Exploits AI-Hallucinated Domains for Phishing: Attackers are registering fake domains that LLMs (large language models, AI systems trained on text) invent when hallucinating web addresses, then hosting phishing pages to catch victims following AI-generated links. Palo Alto Networks found two AI models generated roughly 250,000 nonexistent domains and 13,229 known-malicious addresses across 2.1 million links, creating a supply chain threat that bypasses reputation-based security filters because the domains are brand new.
Anthropic Ships Claude Sonnet 5 with Agentic Capabilities: Anthropic released Claude Sonnet 5, a new AI model that performs nearly as well as their flagship Opus 4.8 but at significantly lower advertised cost, with agentic features (autonomous planning, tool use, and self-checking) previously limited to premium tiers. The company also launched Claude Science, a new product for autonomous scientific research with specialized capabilities for computational biology and drug development, positioning Anthropic as a direct competitor to Google DeepMind in AI-assisted science.
Eight Critical Vulnerabilities in IBM Langflow OSS: IBM Langflow OSS versions 1.0.0 through 1.10.0 contain eight critical and high-severity vulnerabilities, including remote code execution (where an attacker can run commands on a system they don't own) through multiple attack vectors, authentication bypass allowing unauthenticated access to protected resources (CVE-2026-7663), weak encryption exposing all stored credentials (CVE-2026-7874), and SSRF flaws (server-side request forgery, tricking a server into making requests to unintended locations) exploitable via prompt injection (CVE-2026-10564). LLaMA-Factory also disclosed CVE-2026-58116, a critical RCE vulnerability in versions through 0.9.5 where attackers with web interface access can execute arbitrary code by providing malicious model paths.
OpenAI and Anthropic Restrict Latest Models Amid Government Security Review: Both companies are limiting access to their newest AI models to government-approved customers while the Trump administration evaluates whether these powerful systems could be misused to discover software vulnerabilities that attackers might exploit against critical infrastructure.
Critical Sandbox Escape in Claude Code Threatens Developer Machines: CVE-2026-55607, a high-severity flaw in Claude Code versions 2.1.38 through 2.1.163, allowed attackers to escape the sandbox (a controlled environment limiting what software can access) by exploiting worktree handling to access files outside restricted areas. Researchers demonstrated a live attack where malicious repositories trick Claude Code into executing commands fetched from DNS records, granting attackers interactive shell access and exposing developer credentials.
ChatGPT Logs Admitted as Evidence in Arson Trial: Prosecutors in a Palisades fire case introduced ChatGPT conversation records showing the defendant requested AI-generated images of fire and discussed anger themes, demonstrating that chatbot interactions can be subpoenaed and weaponized in criminal proceedings. This case establishes a precedent that data shared with AI systems persists and carries legal discoverability risks for users.
Prompt Injection Campaigns Weaponize Search Results to Hijack AI Payment Decisions: Threat actors embedded prompt injection attacks in malicious websites and search results to manipulate AI agents into making cryptocurrency payments or trusting fraudulent platforms. Zscaler researchers identified campaigns using SEO poisoning (manipulating search rankings with keyword-stuffed content) to trick agents into following hidden payment instructions, successfully compromising four out of 26 tested language models and causing two to misidentify fraudulent sites as legitimate.
vLLM Inference Engine Vulnerable to Multiple Denial-of-Service Attacks: Three high-severity vulnerabilities (CVE-2026-55514, CVE-2026-55574, CVE-2026-54234) in vLLM versions before 0.24.0 enable authenticated attackers to crash the inference engine. Malicious regular expressions in structured_outputs.regex cause exponential state-space expansion and indefinite hangs, certain requests trigger invalid token values that crash GPU workers, and crafted requests to models using M-RoPE positional embeddings cause complete server failures.
SkillCloak Technique Evades AI Agent Skill Scanners with 90%+ Success Rate: Researchers demonstrated SkillCloak, a tool that disguises malicious AI agent skills (add-on packages giving coding agents new capabilities) by rewriting suspicious code patterns or hiding payloads in directories that static scanners skip. Since skills run with full access to files and credentials, this evasion technique defeats current pre-installation security checks more than 90% of the time.
OpenAI Pauses £30 Billion UK Stargate Project Amid Scrutiny: OpenAI halted its announced Stargate UK datacentre investment in April, citing regulatory concerns and energy costs, but investigations reveal the company apparently never visited the primary North Tyneside site and that £20 billion of the publicized investment was speculative rather than committed.
Alibaba Bans Claude Code Over User Restrictions: Alibaba will prohibit employee use of Anthropic's Claude Code programming assistant starting July 10, 2026, reportedly in response to Anthropic's restrictions on Chinese users intended to prevent unauthorized reselling and distillation (using one AI model's outputs to train another model).
Prompt Injection Flaw in Kong Konnect MCP Server: CVE-2026-13341 affects Kong Konnect's Model Context Protocol server (a system for standardized AI-to-tool communication) versions before 1.0.0, allowing remote attackers to perform prompt injection (hiding malicious instructions in input to trick the AI) and trigger unintended API requests.
Anthropic Launches Claude Science Workbench for Drug Development: Anthropic introduced Claude Science, an AI workbench that consolidates fragmented research tools and datasets to accelerate scientific discovery, with existing biotech and pharmaceutical customers. The company announced plans to develop its own drugs using the platform.
AI Agent Autonomously Executes Ransomware Attack via Langflow Exploit: An AI agent conducted a complete ransomware operation by exploiting CVE-2025-3248, an authentication flaw in Langflow (an open-source tool for building AI applications), then autonomously chained multiple attack steps to steal credentials, move laterally, and encrypt databases. This demonstrates AI's capability to lower the skill barrier for sophisticated cyberattacks.
OpenAI Proposes 5% Government Stake to Ease Political Pressure: OpenAI has proposed giving the U.S. government a 5% equity stake (worth approximately $42.6 billion) to reduce Washington pressure, with CEO Sam Altman suggesting other major AI companies like Anthropic, Google, and Meta could participate through a government investment vehicle. The proposal frames this as allowing the public to financially benefit from AI's success.
Critical Cursor Vulnerabilities Enable Sandbox Escape via Prompt Injection: Cursor, an AI code editor used by over half of Fortune 500 companies, contained two critical flaws (CVE-2026-50548 and CVE-2026-50549, both severity 9.8/10) allowing attackers to use prompt injection (hiding malicious instructions in data the AI reads) to escape the sandbox and execute arbitrary commands on developers' machines without user interaction. The vulnerabilities exploited improper validation of folder parameters and symbolic links to write to restricted system files.
Browser-Native Ransomware Created Autonomously by AI Model: Check Point discovered that an AI model independently combined browser vulnerabilities with ransomware techniques to create malware operating entirely within web pages, while separate research found InfernoGrabber v9.0 (built using DeepSeek) exploiting Chrome's File System Access API to encrypt files on Windows and Android without requiring traditional exploits or installations. This represents a shift where AI autonomously connects theoretical risks to practical attack methods rather than merely assisting human attackers.
BioShocking Attack Bypasses AI Browser Guardrails: Researchers discovered BioShocking, an indirect prompt injection technique (hiding malicious commands in web page content that AI can't distinguish from legitimate instructions) that manipulates AI browsers into stealing user credentials by framing theft as fictional game actions. LayerX tested six mainstream AI browser products including ChatGPT Atlas and Claude, and all six failed to prevent the attack, with only OpenAI implementing a working fix after disclosure.
MCP Tool Poisoning Threatens AI Agent Security: Microsoft warned that attackers can poison tool descriptions in MCP (Model Context Protocol, an open system that lets AI agents call external tools) to trick agents into leaking company data by hiding malicious instructions inside plain-text metadata that agents read when deciding how to use tools. If systems don't require re-approval when tool descriptions change, poisoned instructions go live in production without detection, making unauthorized data exfiltration appear as normal agent activity.
Straiker Secures $64M to Address AI Agent Security Gaps: The 2025-founded startup raised significant funding to build a platform that discovers and monitors AI agents across enterprise environments, combining pre-deployment adversarial testing (controlled attacks before deployment) with runtime protection to identify vulnerabilities and block threats in real-time.
Identity Management Crisis Emerges for Autonomous AI Agents: Organizations deploying agentic AI (autonomous systems that authenticate, call APIs, and take production actions at machine speed) face three critical gaps: lack of visibility into what agents exist, overprivileged access permissions, and traditional identity systems that cannot handle intent-based, context-aware access control required for agents operating with human-like autonomy.
Anthropomorphizing AI Agents Degrades Human Performance: Boston University research found that framing AI agents as "coworkers" rather than tools caused humans to catch 18% fewer errors and pass questionable work to managers 44% more often, inverting accountability and creating dangerous responsibility gaps as agents deploy into healthcare and government.