Browse All

Mistral Vibe before version 2.25.5 has a remote code execution vulnerability (RCE, where an attacker can run commands on a system they don't own) in its worktree creation process. The vulnerability occurs because git hooks (scripts that run automatically during git operations) are executed before the system checks whether the repository is trusted, allowing attackers to run malicious commands with the same user privileges as Vibe.

A security researcher demonstrated BragJack, an attack that hijacks AI assistants built into popular browsers by exploiting a single malicious browser extension. The attack abuses browser extensions' ability to manipulate network traffic using declarativeNetRequest (DNR, a feature that lets extensions change how network requests are handled) to intercept communications between AI models and their privileged browser components, potentially allowing attackers to read files, take screenshots, access browsing history, or control the AI agent to perform actions on websites.

Researchers at Hacktron used Anthropic's Claude Opus 5 to chain two security flaws and gain access to OpenAI employees' accounts and an internal code repository: a memory corruption bug in the libheif image library (CVE-2026-32882, which scores 8.8 out of 10 for severity) that allowed remote code execution on OpenAI's public help forum, combined with a weakness in OpenAI's single sign-on (SSO, a shared login system) that let them take over staff accounts. The researchers responsibly reported their findings without reading source code or accessing customer data, and OpenAI confirmed a fix within 14 hours and paid a $6,500 bounty.

ToolHive's containerized MCP servers (which are Docker containers running AI tools) can reach host services through `host.docker.internal` (a special hostname that points to the host machine from inside a container) when using the default insecure network settings, allowing a compromised server to attack other services on the host without breaking out of the container. This is especially dangerous because ToolHive's MCP endpoints and other MCP servers are unauthenticated (don't require login), so an attacker can call their tools directly.

LMDeploy (a tool for deploying large language models) has a critical vulnerability in how it loads model configurations from HuggingFace. When loading a model, the software uses eval() (a Python function that executes code from text) on an untrusted value called quant_dtype without checking if it's safe. An attacker can publish a malicious model on HuggingFace with crafted code hidden in the quant_dtype field, allowing them to run arbitrary commands on any computer that loads the model using LMDeploy.

Popular AI coding agents like Claude Code, Codex, GitHub Copilot, and Gemini CLI were vulnerable to Plugin4Shell, a zero-click RCE (remote code execution, where attackers can run malicious code on a system without user interaction) attack that let attackers swap legitimate plugins with malicious ones. The flaw exploited a verification gap: these agents checked out plugin code using a SHA (secure hash algorithm, a unique cryptographic identifier), but didn't verify that the correct version was actually retrieved, allowing attackers who controlled a plugin's repository to inject malicious code. Most vendors have now released patches for this vulnerability.

Security researchers used Anthropic's Claude AI model to compromise OpenAI employee accounts and gain access to OpenAI's GitHub repository (a system for storing and managing code) within 72 hours. They demonstrated their unauthorized access by submitting a pull request (a request to add code changes) from a stolen employee account, though they did not access the internal code itself.

vLLM (a tool for running large language models) versions before 0.28.0 have a vulnerability where two endpoints (/v1/embeddings and /pooling) don't properly check if token IDs (numeric identifiers representing words) are valid. An attacker can send a request with a negative token ID to crash the system, and because this triggers a CUDA assertion (an error check on the GPU, the specialized processor used for AI), it corrupts the GPU's state and breaks all future requests until the service restarts.

Security researchers at Hacktron AI used Anthropic's Claude AI model to find and exploit vulnerabilities in OpenAI's systems, gaining access to employee accounts as part of a bug-bounty program. The attack chained together two critical flaws: a memory bug in libheif (a library that converts iPhone image formats) that was already patched but not formally tracked, and another vulnerability in the Discourse forum software that allowed account takeover. OpenAI resolved the issues and awarded the researchers $6,500, highlighting how accessible AI tools are making it easier to find security weaknesses even in well-resourced companies.

Researchers used Claude (an AI assistant) to build a working exploit for an unpatched bug in a third-party image library, then chained it with a flaw in OpenAI's sign-in system to gain remote code execution (the ability to run commands on someone else's computer) on OpenAI's community forum and take over employee accounts. The vulnerability stemmed from the forum accepting image uploads that were processed by ImageMagick with an outdated library, combined with sign-in tokens that granted excessive permissions to linked ChatGPT and GitHub accounts.

A security flaw in four AI coding agents (Claude Code, Codex, GitHub Copilot, and Gemini CLI) allows someone controlling a plugin's code repository to swap in malicious code even when the agent is locked to a specific reviewed version. The vulnerability works by creating a branch with a name that looks like a commit hash (a long string identifying exact code), tricking the agent into installing different code while reporting it installed the locked version, giving the malicious code access to the user's files and credentials.

Researchers found that AWS AgentCore Harness, a managed runtime for AI agents (software that can reason and take actions), has a security flaw where attackers can use prompt injection (tricking an AI by hiding instructions in its input) to steal plaintext credentials from the identity vault (secure storage for passwords and keys). The problem occurs because the harness's built-in shell tool, which is enabled by default and runs with root access (highest-level permissions), can access the same memory where credentials are temporarily exposed when retrieved from the vault.

A threat actor likely used an LLM (large language model, an AI system that generates text) to build PhantomRaven, a malware stealer distributed through npm (a package registry where developers share code libraries). The malware uses typosquatting (creating packages with names similar to legitimate ones) and a remote dynamic dependency (RDD, code downloaded from an external server rather than included directly) to steal developer credentials and secrets from machines, with the attacker claiming to be a bug bounty hunter who reports vulnerabilities to collect rewards.

A flaw in Microsoft 365 Copilot's permission settings allows someone with authorized access to improperly view sensitive information across a network. The issue stems from incorrect assignment of permissions (access rules) to a critical resource (important data or system component), meaning the AI tool isn't properly restricting who can see what.

vLLM (a software framework for running large language models) versions up to 0.29.0 has a memory cleanup bug in its decode workers (specialized processors that handle the generation phase of AI inference). Attackers can exploit this by sending requests with max_tokens=0 (asking for zero output tokens), which prevents the system from properly clearing temporary data, eventually consuming all available memory until the worker crashes and restarts.

Microsoft 365 Copilot's Business Chat has a vulnerability where special characters are not properly filtered before being used in commands, allowing attackers to inject malicious commands (command injection, where an attacker sneaks unauthorized instructions into a system by exploiting how it processes input). This could let unauthorized people access and steal sensitive information across the network.

Azure Machine Learning contains a vulnerability where authorization checks (the system that verifies whether a user is allowed to perform an action) are not working correctly, allowing an attacker without permission to access and steal sensitive information over the internet.