All items

Check Point Research disclosed a jailbreak bundle named Haiou, which modifies OpenAI Codex configuration files to insert advertisements for a third-party OpenAI-compatible LLM gateway into agent responses. The bundle is distributed via a GitHub repository called haiou-codex and bundled within the open-source tool Codex-X, and Check Point codenamed the behavior prompt adware. Researchers warn that similar third-party skills or configurations could be used for supply chain attacks.

langchain4j-aideepin before 3.31.0 contains an insecure direct object reference flaw that lets any authenticated user read other users' character-chat conversations. An attacker sends GET /character/{uuid} with a victim's character uuid, and CharacterService.detail resolves it without an ownership check, exposing questions, AI answers, and attachment and audio URLs.

easyVoice before 0.0.23 contains a server-side request forgery flaw that lets unauthenticated attackers make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can reach loopback and internal services through /api/v1/tts endpoints, using error messages reflected in the x-generate-tts-warning header to probe internal hosts and ports.

CVE-2026-118628 is a Server-Side Request Forgery information disclosure flaw in the get-artifacts function of MLflow. The server does not properly validate a URI before accessing resources, letting a remote attacker disclose information in the server's context without authentication.

CVE-2026-118624 is a missing authorization flaw in the MLflow Tracking Server Jobs component. The flaw sits in the _find_validator function, which allows access to functionality without an authorization check. A remote attacker with authentication can exploit it to disclose information in the context of the service account.

IBM patched four Langflow OSS flaws, two rated critical at CVSS 9.8, that enable authentication bypass, API credential leakage and code execution. CVE-2026-93680 is an incomplete fix of an earlier auto-login issue, CVE-2026-110186 allows unauthenticated code execution through MCP tool enumeration, and CVE-2026-110193 needs at least a low-privileged account. The flaws affect versions 1.0.0 to 1.12.8 and are fixed in 1.13.0.

Endor Labs researchers found a vulnerability (CVE-2026-103916) in Docker Sandboxes, the isolation tool for AI coding agents. The sbx cp copy command does not enforce the sandbox's approved folder restrictions, and an agent can use a symbolic link inside an approved workspace to reach files outside the sandbox, including cloud credentials and SSH keys. The flaw is rated High (CVSS 3.1 8.2, CVSS 4.0 7.3) and is classified as CWE-59.

Google's Threat Intelligence Group and Mandiant report that LLMjacking attacks, in which attackers abuse stolen LLM API keys, are generating fraudulent cloud charges, with some organizations losing over $100,000 in a single day and cumulative charges reaching $1,000,000. Attackers resell access through LLM mixers such as Jet Night, which passed nearly one million dollars in token costs to one victim organization. The researchers also observed attackers exploiting CVE-2026-40217 in LiteLLM to run arbitrary code on the server.

An authenticated user with Machine Learning read access in one Kibana space can read audit and error messages of data frame analytics jobs in other spaces they are not authorized to access. The flaw is an authorization bypass through a user-controlled key (CWE-639). Exposed messages can include destination index names, analyzed field names and failure information.

Google's Threat Intelligence Group and Mandiant warned that attackers are conducting LLMjacking, a resource hijacking tactic in which they obtain an organization's LLM API key or cloud identity token through phishing, source code leaks, misconfigured environments, or exposed client-side code. Some organizations reported fraudulent charges above $100,000 in a single day, with cumulative losses reaching $1 million before access was revoked. The charges are paid by the legitimate account owner.

Check Point Research analyzed the Haiou jailbreak bundle, a Chinese-language prompt package targeting OpenAI Codex that weakens model guardrails for hacking-related tasks. The bundle installs security-focused Skills and modifies Codex configuration files so that advertisements for the author's paid, OpenAI-compatible LLM gateway are injected into subsequent agent responses, which Check Point classifies as prompt adware. Researchers also observed the bundle on a misconfigured webserver alongside Cobalt Strike, the Ladon framework and the VulnClaw agent, used by a cybercrime actor.

Google Threat Intelligence Group (GTIG) warns of LLMjacking campaigns in which cybercriminals hijack enterprise cloud and model access and resell it through underground subscription services called LLM Mixers. GTIG reports that fake cloud charges can exceed $100,000 in a single day, and that cumulative charges reached $1 million in some incidents before access was revoked. The source text is cut off mid-sentence while describing a follow-on actor that exploited a user ID rebinding vulnerability in the LiteLLM gateway.

A China-linked group tracked as VAPOR PANDA used the AI-powered penetration testing framework ARTEX to target more than 200 organizations in at least 14 countries over 11 days beginning October 17, according to CrowdStrike, with post-exploitation activity confirmed at nine. Microsoft separately reported that another China-linked group, Storm-0940, used ARTEX to automate attacks that in some cases gained privileged cloud access in less than three hours.

CVE-2026-116635 affects the deployment status component of the AWS Serverless MCP Server, versions below v0.2.1 of awslabs.aws-serverless-mcp-server. Under certain conditions, an improper limitation of a pathname to a restricted directory might let an actor who can influence the MCP agent read JSON files outside the intended deployment status directory. Where write access has been enabled, the same flaw might allow creating or overwriting JSON files outside that directory.

CVE-2026-120497 is a stored cross-site scripting flaw in the HTML report generator of the aidlc-traceability CLI, an open source tool formerly published in the awslabs/aidlc-workflows repository. An actor who can modify a project's AI-DLC artifact files can embed script through crafted artifact titles or descriptions, which then runs in the browser of a user who opens a generated HTML traceability report. Affected versions are >=0.1.0 and earlier than commit 96cf0ea.

DBHub's read-only mode can be bypassed on its MySQL and MariaDB connectors. The SQL parser treats "--" as a comment even when MySQL and MariaDB would not, so a payload such as "SELECT 1--1;DROP TABLE victim" passes the read-only check while the database executes the DROP TABLE, which allows writes and DDL when a database is exposed to an AI agent. The advisory states that PostgreSQL is not affected by this path.

Mandiant and Google Threat Intelligence Group describe LLMJacking, in which threat actors hijack enterprise access to large language models and generate fraudulent cloud charges, sometimes exceeding $100,000 in a single day and reaching $1 million cumulatively before access was revoked. Attackers reach backend model resources directly, either by finding publicly exposed LLM endpoints such as /api/create or by using stolen cloud identity tokens, with exposed or stolen cloud identity tokens described as the dominant initial access vector. The report also tracks specialized "LLM Mixers" that resell unauthorized LLM access to underground subscribers.

IBM disclosed two critical Langflow flaws that let a remote attacker with no account bypass authentication or run arbitrary code. Every release from 1.0.0 through 1.12.8 is affected, and neither flaw is listed in CISA's Known Exploited Vulnerabilities catalog as of its October 30 update.

A malicious version of Anthropic's Claude Code extension, distributed through the Cursor VS Code Extension Marketplace, attempted to install a persistent SSH backdoor on developers' Windows and macOS machines. Cursor removed the compromised versions 2.1.312 and 2.1.313 after they had been available for about 11 hours on October 29. Anthropic said its own systems and official channels were not affected.

A tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 of anthropic.claude-code, was published to the Cursor VS Code Extension Marketplace on October 29 and stayed live for about 11 hours. The modified code ran during module loading on macOS and Windows, collected host information, and attempted to set up a reverse SSH tunnel and persistence, though Cursor says the SSH step likely failed without admin rights. Anthropic says it did not build or publish the modified versions and that its official channels were not affected.