All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Researchers discovered a new attack called agent data injection (ADI), where attackers plant fake information in data that AI agents trust, like email sender names or button IDs, causing the agents to misclick or run unintended commands while still completing their original task. Unlike prompt injection (hiding commands in text input), ADI works by corrupting small facts the agent relies on, using fake punctuation characters that language models often misread as real delimiters even though a strict parser would ignore them. The attack successfully compromised real tools including web agents (Claude, Google's Antigravity, Nanobrowser) and coding assistants (Claude Code, OpenAI's Codex, Google's Gemini CLI).
Nvidia announced Cosmos 3 Edge, a world model (a system that learns from various inputs to help robots and AI agents understand and move through physical environments in real time), as part of its expansion into Japan's AI market. The company is forming partnerships with major Japanese firms like Fujitsu, Hitachi, and Kawasaki Heavy Industries, and is also investing in healthcare and drug discovery through initiatives like the Tokyo-1 AI drug discovery consortium.
The WPBot plugin for WordPress (a platform for building websites) has a security flaw where it doesn't properly check if users have permission to perform certain actions, allowing subscribers and higher-level users to re-embed stored RAG documents (external documents that an AI uses to answer questions). This vulnerability lets attackers waste the site owner's paid API credits (money spent on third-party AI services like OpenAI or Gemini) by triggering unnecessary document processing.
The BetterDocs WordPress plugin before version 4.5.5 has a security flaw where it doesn't clean up AI-generated documentation summaries before storing and displaying them. Because this feature is available to users who aren't logged in, attackers can use prompt injection (tricking the AI by hiding malicious instructions in their input) to store harmful code that runs in visitors' browsers, including admin accounts.
A developer discovered a tool called grok-mermaid in Grok's open-source codebase that converts Mermaid diagrams (visual flowcharts and charts created with code) into Unicode box art for display in terminals. They adapted this Rust-based tool to work in web browsers using WebAssembly (a technology that lets compiled code run in browsers).
Cars24, a major automotive marketplace in India, uses OpenAI's technology to build AI agents that handle conversations across the entire customer journey, from car discovery to post-purchase support, allowing the company to scale without constantly hiring more staff. The company also deployed Codex (a code-writing AI) across its software development process to help engineers and product managers move work from task creation through implementation and bug fixes more efficiently.
Pomerium's authentication callback endpoint allows unauthenticated attackers to send specially crafted encrypted messages that trigger unbounded decompression of zstd-compressed data (a compression algorithm), causing the proxy to allocate unlimited memory and crash. The vulnerability exists because the code decompresses attacker-controlled data before validating who sent it, and unlike other parts of Pomerium's code, it doesn't limit how much memory the decompression can use.
django-haystack's Elasticsearch backend contains a remote code execution vulnerability where it calls `eval()` (a function that executes Python code from strings) on field values without proper validation. This happens when a SearchField uses an `index_fieldname` alias different from its logical name; the lookup fails and the raw value is passed to `eval()`. An attacker who can control indexed content and trigger a search can execute arbitrary code on the Django application.
LiteLLM version 1.18.10 has a remote code execution vulnerability in its MCP server creation feature, where the application accepts JSON configuration files with arbitrary command and args values and executes them without checking if they're safe, allowing attackers to run unauthorized operating system commands with the privileges of the LiteLLM process.
Google DeepMind and Isomorphic Labs are developing AI tools to improve society's ability to prevent, detect, and respond to disease outbreaks and biosecurity threats. Their approach includes using AI models like AlphaFold (which maps protein structures) and drug design systems to help researchers create vaccines and treatments, while also implementing safeguards to prevent misuse of their AI systems by bad actors.
Fix: The source describes several mitigation approaches already being implemented: (1) a four-step safety process for their models involving threat modeling, evaluations, mitigations and monitoring; (2) adapting SynthID watermarking technology to biology to help DNA synthesis providers screen for potentially risky AI-generated sequences; (3) making AI systems available to trusted partners for prevention, detection, and response efforts; and (4) establishing a focused unit at Isomorphic Labs to rapidly deploy drug design capabilities during novel outbreaks.
DeepMind Safety ResearchResearchers discovered a vulnerability where LLMs (large language models) could be tricked through prompt injection (hiding malicious instructions in data) to emit ANSI escape codes (special terminal control sequences), which macOS Terminal would interpret as commands to make DNS requests (requests that translate domain names to IP addresses) containing stolen data. Apple fixed this behavior in macOS Tahoe 26.1, released November 3, 2025, so the vulnerable escape sequences no longer trigger DNS requests.
Fix: Apple addressed the issue in macOS Tahoe 26.1, released on November 3, 2025. After installing the update, the same escape sequence no longer triggers a DNS request in the Terminal app.
Embrace The RedAI tools can now quickly assemble comprehensive profiles of executives from publicly available information, creating a major security risk for social engineering attacks (tricks that manipulate people into revealing access credentials or sensitive data). What once took skilled analysts days to compile now takes minutes, making executives viable targets for less-skilled attackers and expanding the pool of potential threats significantly.
OpenAI has developed GPT-Red, an automated red-teaming model (a tool that simulates attacks to find vulnerabilities) that searches for prompt injection vulnerabilities (tricks where hidden instructions in user input make an AI behave unexpectedly) in its language models before deployment. By using GPT-Red to test and improve GPT-5.6 Sol during training, OpenAI achieved a model that is 6 times more resistant to prompt injection attacks compared to its previous version.
Fix: OpenAI directly integrated GPT-Red into the training process of GPT-5.6 Sol using self-play reinforcement learning, where the attacking model and defender models are trained simultaneously on red-teaming scenarios. The defender models are rewarded for resisting attacks, making them progressively more robust. OpenAI also keeps GPT-Red separate from other models so its malicious capabilities do not reach bad actors.
The Hacker NewsFix: Upgrade the BetterDocs WordPress plugin to version 4.5.5 or later.
NVD/CVE Database```json { "summary": "AI tools are making it easier for attackers to find and exploit vulnerabilities much faster than organizations can patch them, breaking traditional vulnerability management systems that rely on scheduled updates. Security experts recommend moving toward "just in time" patching (fixing vulnerabilities as soon as they are discovered and actively exploited, rather than waiting for scheduled maintenance windows) and using compensating controls (security measures that block at
This academic paper presents a method for prioritizing vulnerabilities (security weaknesses in software) based on context-aware probabilistic risk estimation (calculating the likelihood and impact of threats using situation-specific information). The approach helps organizations decide which security issues to fix first by estimating risks more intelligently rather than treating all vulnerabilities equally.
This academic article examines how organizations can protect sensitive information and comply with privacy regulations when managing supply chains (the networks of companies and processes involved in getting products from makers to customers). The paper discusses the difficulties companies face in securing data across multiple partners, identifies new opportunities to improve privacy practices, and describes emerging technological and organizational approaches to address these challenges.
Microsoft SharePoint has a deserialization of untrusted data vulnerability (a flaw where the software unsafely processes data from untrusted sources, allowing attackers to inject malicious code), which lets unauthorized attackers execute code over a network. This vulnerability is actively being exploited in real-world attacks. Organizations must apply vendor-provided mitigations by July 19, 2026, following CISA's BOD 26-04 guidance on prioritizing security updates, or stop using the product if no fix is available.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Consult Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 for specific patches or fixes.
CISA Known Exploited VulnerabilitiesFortinet FortiSandbox has a critical vulnerability that lets unauthenticated attackers run unauthorized commands (OS command injection, where an attacker can execute system commands on the affected system) by sending specially crafted HTTP requests. This vulnerability is actively being exploited by attackers. Organizations using FortiSandbox must apply vendor-provided patches or mitigations by July 19, 2026, or stop using the product if fixes are unavailable.
Fix: Apply mitigations in accordance with vendor instructions from Fortinet. Follow CISA's BOD 26-04 guidance for patching prioritization. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. See vendor security advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-141 for specific patch or mitigation details.
CISA Known Exploited VulnerabilitiesFortinet FortiSandbox has a vulnerability that allows attackers without authentication to run unauthorized commands on the system through specially crafted HTTP requests (OS command injection, where an attacker tricks the system into executing their commands). This vulnerability is actively being exploited by real attackers. Organizations must apply fixes according to vendor instructions and follow CISA's BOD 26-04 guidance on prioritizing security updates, with a deadline of July 19, 2026.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA Known Exploited VulnerabilitiesxAI's grok CLI tool (a command-line coding assistant) had a critical privacy flaw where running it in a directory would automatically upload that entire directory to xAI's cloud servers, exposing users' SSH keys, passwords, and personal files without clear consent. After public backlash, xAI disabled the upload feature, deleted all previously uploaded user data, changed the default to keep data local, and released the tool's entire source code (844,530 lines of Rust) under an open Apache 2.0 license to rebuild trust and let users run it privately on their own computers.
Fix: xAI took the following steps explicitly mentioned in the source: (1) disabled the data upload feature, (2) deleted all user data that was previously uploaded to their servers, (3) disabled data retention by default for all users starting July 12th, and (4) released the entire Grok Build codebase as open-source under Apache 2.0 license so users can run it 'fully open-sourced and local-first with your own inference' without uploading to their servers.
Simon Willison's WeblogFix: The source text does not explicitly describe a fix, patch, or version update. It documents the vulnerability and its root causes but does not state how to remediate it. N/A -- no mitigation discussed in source.
GitHub Advisory Database