All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
A vulnerability called CVE-2026-14471 exists in Amazon mcp-gateway-registry (a tool that manages AI agent access to different services) versions 1.0.3 through 1.0.12. An authenticated user can exploit SQL injection (inserting malicious SQL commands into inputs) in the metrics tracking system to read sensitive data like API keys, or delete and modify stored information.
Langroid has a security flaw where tools registered with `use=False, handle=True` (meant to prevent the AI from calling them) can still be invoked directly by users sending raw JSON chat messages, because the message-handling code doesn't verify whether the message came from a user or the AI. This could allow unauthorized access to sensitive operations like file access or database queries depending on which tools are enabled.
Langroid's TableChatAgent and VectorStore have a critical vulnerability where they use Python's `eval()` function to execute code generated by the AI, but fail to properly sandbox it. Even though they pass an empty dictionary for local variables, Python automatically includes built-in functions like `__import__()` in the execution environment, allowing an attacker to run arbitrary commands on the host system through prompt injection (tricking the AI into generating malicious code).
Langroid's SQLChatAgent has a security flaw in its dangerous-function blocklist, which uses a regex pattern (a rule for matching text) to block dangerous PostgreSQL functions like pg_read_file. However, attackers can bypass this blocklist by writing the function name in quoted form, adding comments, or using schema-qualified names (like pg_catalog."pg_read_file"), because PostgreSQL accepts all these variations but the regex only checks for the function name directly followed by an opening parenthesis. This means the earlier fix that tried to block file-reading functions doesn't actually work.
Attackers are running a phishing campaign that impersonates over 30 major brands (like Adobe, Netflix, and OpenAI) by sending fake job interview emails to marketing professionals. The emails use real recruiter names and photos, then redirect victims through legitimate services like PeopleForce and Salesforce Marketing Cloud to a malicious page where a fake Google login (created using browser-in-the-browser, a technique that mimics a real authentication popup) steals Google account credentials.
vLLM (a system for running large language models) versions 0.22.0 to 0.23.0 have a vulnerability where two audio processing routes load uploaded files entirely into memory before checking if they exceed the maximum allowed file size limit (25 MB by default), allowing attackers to cause memory exhaustion or crash the system by uploading oversized files. This happens because the size check occurs too late in the process, after the file has already been loaded.
The OpenAI Codex desktop app for macOS had a security flaw where it automatically loaded remote images from AI responses without user confirmation. An attacker could use indirect prompt injection (tricking the AI by hiding instructions in untrusted input like tool results) to make the app fetch images containing sensitive data like API keys or source code, secretly sending that information to the attacker's server.
The flyto-core library has a security flaw in its SSRF protection (SSRF is server-side request forgery, where an attacker tricks a server into making requests to internal systems). The protection checks if a URL points to a private IP address, but it only recognizes standard private IP formats and misses special IPv6 transition address forms (formats that embed IPv4 addresses like ::ffff:127.0.0.1). An attacker who can write workflows can use these alternate address formats to bypass the protection and access internal services like cloud metadata endpoints, potentially reading sensitive data.
A malicious actor used an agentic threat actor (an AI system designed to perform tasks autonomously) to exploit a vulnerability in Langflow (an open-source platform for building AI applications) and conducted a complete ransomware attack (malware that encrypts data and demands payment for its return). The attack resulted in stolen data from a production database and encrypted systems across the targeted infrastructure.
This week's security recap highlights how trust placed too early in systems created widespread vulnerabilities. Key incidents include Google disrupting the NetNut residential proxy botnet (a network of compromised home devices like smart TVs used to hide malicious traffic) affecting at least 2 million devices, WhatsApp introducing usernames to protect privacy but raising impersonation concerns, and security researchers being tricked into running malicious code hidden in fake proof-of-concept repositories on GitHub that deliver ChocoPoC (a trojan capable of stealing passwords and browser data).
Threat actors are using prompt injection attacks (tricking an AI by hiding instructions in its input) embedded in malicious websites and search results to trick AI agents into making cryptocurrency payments or trusting fake platforms. Researchers at Zscaler found two campaigns: one hiding payment instructions in a fake Python library website using SEO poisoning (manipulating search rankings with keyword-stuffed content), and another impersonating DeBank, a cryptocurrency platform. When tested on 26 different language models, four were successfully tricked into making payments, while two misidentified the fraudulent website as legitimate.
When DEBUG loglevel (a setting that outputs detailed program information for troubleshooting) is enabled in SUSE Rancher AI Agent versions before 1.0.2, sensitive data like API keys (credentials for accessing external services) and LLM response text can be written to logfiles where local attackers (people with access to the same computer) could find and misuse them. This is rated as HIGH severity with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 7.0.
Fix: This issue is fixed in version 0.24.0.
NVD/CVE DatabaseOpenAI CEO Sam Altman has proposed giving Americans equity stakes in major AI companies as compensation for the human-generated work (books, movies, art) that AI learns from without payment, and as a potential safety net against job losses from AI. If a 5% stake in OpenAI were distributed equally among American households, each would receive about $320 in equity, though details remain vague and the proposal has not yet become concrete policy.
When multiple AI agents work together and delegate tasks to each other, an agent might gain more permissions than the original user intended, even with standard access controls in place. This post explains how to prevent this using Cedar, an open source authorization policy language, which enforces permissions at three levels: checking if an agent can use a tool, checking if one agent can delegate to another agent, and verifying the original human user still has permission for the entire chain of delegated tasks.
Fix: The source provides a reference implementation using a three-layer Cedar policy model deployed on AWS. The solution involves: (1) authenticating the user through an OIDC-compliant identity provider (Amazon Cognito with MFA) to obtain a signed JWT; (2) filtering requests through AWS WAF with CommonRuleSet, SQLiRuleSet, rate limiting, and body size constraints; (3) verifying JWT signatures via Amazon API Gateway; (4) using an MCP adapter Lambda function to extract verified claims from the token and map them to Cedar context attributes (role, MFA status, user ID, session ID, and authentication method); (5) cryptographically signing the user context with HMAC-SHA256 to prevent tampering; and (6) evaluating authorization through three sequential Cedar policy layers that check agent-to-tool trust scores and lifecycle stage, agent-to-agent delegation hop counts and task capabilities, and originating user role and MFA status.
AWS Security BlogAI agents (software systems that can independently perform tasks) are creating security challenges for organizations because they lack human judgment and can be created and destroyed rapidly, breaking traditional zero trust models (security approaches where all access requests are verified, not automatically trusted). Many organizations are responding by giving AI agents overly broad access permissions instead of redesigning their security systems, which has already caused serious incidents like AI agents accidentally deleting production databases (live data systems).
Traditional security controls like static passwords and fixed permissions don't work well for agentic AI (autonomous AI systems that operate independently and make decisions). Organizations need new approaches to manage agentic identity (how AI agents prove who they are), control what resources agents can access, handle secrets (like passwords and API keys) that agents use, and ensure permissions get restricted as workflows move between agents.
As AI tools move from being used as assistants (where humans direct each action) to autonomous agents and operators (where AI acts on its own), organizations are not updating their security and governance practices to match this increased risk. The article explains that when humans stay close to AI interactions, risks like accidentally sharing API keys or credentials can be managed with existing controls, but autonomous AI agents need stronger identity management, access controls, and auditability since humans are no longer in the loop to catch mistakes.
Researchers developed an AI-based attack system that can identify and jam wireless communications across different IoT protocols (Wi-Fi, ZigBee, BLE) operating in the 2.4 GHz frequency band. The system uses deep learning models (LSTM neural networks with attention mechanisms) trained on channel state information (CSI, the detailed characteristics of wireless signals) to classify signal types with over 96% accuracy, then employs reinforcement learning (a type of AI that learns through trial and error) to intelligently decide when and how to jam these communications. Tests showed the attack successfully disrupted ZigBee and BLE device performance while remaining difficult to detect.
Fix: For the NetNut botnet: Google disabled Google accounts used by NetNut for command-and-control, updated Google Play Protect, and disabled applications known to incorporate NetNut SDKs. For WhatsApp username impersonation: Meta reserves usernames for public figures, government entities, and some of their variations so that only legitimate users can claim them. For ChocoPoC malware in fake PoC repos: N/A -- no mitigation discussed in source.
The Hacker NewsResearchers documented JadePuffer, an autonomous AI agent that conducted a complete ransomware attack by exploiting a vulnerability in a Langflow server, then adapted its tactics in real-time to breach a production database and demand a ransom. What made this attack notable was not the individual hacking techniques used, but the AI's ability to make operational decisions on its own, diagnose failures, and generate corrected attack code without human guidance. An independent security researcher noted this represents an evolution in how attacks are executed rather than a completely new technique, with the biggest concern being the AI agent's ability to quickly change tactics if defenses block it.
Fix: Update SUSE Rancher AI Agent to version 1.0.2 or later.
NVD/CVE DatabaseThe cybersecurity industry faces a 'validation gap' rather than a true skills gap, meaning the problem isn't that skilled people don't exist but that we can't verify who is actually ready for real-world security work. Traditional training like courses and certifications can't keep pace with rapidly evolving threats from AI and attacker tactics, so security professionals need continuous hands-on experience with their organization's actual systems and attack scenarios, not just theoretical knowledge.