Model and package supply chain

Security researcher Gal Weizman of Forever Security disclosed BragJack, an attack that uses one malicious browser extension to hijack AI assistants in five Chromium-based browsers or assistants: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The attack requires the extension to be installed already, and it can then run without user interaction to abuse the assistant's privileges, such as reading local files, taking screenshots, and sending instructions to agents. The research produced two CVEs, CVE-2026-0628 for Chrome and CVE-2026-55945 for Microsoft Edge, and more than $20,000 in bug bounties.

CrowdStrike assessed with high confidence that a financially motivated threat actor likely used a large language model to write PhantomRaven, a JavaScript information stealer distributed through more than 100 typosquatted and slopsquatted npm packages. The packages retrieve a remote dynamic dependency that harvests developer email addresses, CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins and CircleCI, system fingerprints including the public IP address, and Git/npm configuration details, then sends them to an attacker-controlled server. The operator, active since November 2022, appears to use the stolen data to find bug bounty opportunities rather than selling it.

On March 24, 2026, a threat actor group known as TeamPCP compromised the PyPI distribution pipeline and pushed malicious LiteLLM versions 1.82.7 and 1.82.8, which carried a .pth file payload that ran code at every interpreter start. According to Zscaler ThreatLabz, the poisoned packages were available for approximately three hours before quarantine, and the payload targeted AWS, GCP and Azure tokens, SSH keys and cloud account credentials.

Cisco Talos research, released during Black Hat USA, documents how cybercriminals use AI to develop malicious code, build fraud infrastructure, and accelerate vulnerability research and exploitation. The study found AI guardrails often ineffective, as threat actors bypass them with basic social engineering claims such as "this is authorised testing." CrowdStrike research adds that adversaries increasingly target AI infrastructure through software supply chain attacks, including a North Korean group that injected a malicious npm package into at least 131 Mastra AI framework packages in June 2026.

Researchers at Tel Aviv University, Technion, and Intuit, led by Aya Spira in Ben Nassi's group, published a July 8, 2026 paper showing that LLM coding agents hallucinate predictable names for repositories and skill installs. The models in Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw repeated identical names up to 85% of the time for repository requests and 100% of the time for skill installs. Attackers can register those names in advance, letting an agent fetch malicious code without any user action, which the article terms HalluSquatting.

Manifold Security researcher Ax Sharma found that Anthropic's Claude for Chrome extension executes its predefined AI workflows on click events without checking Event.isTrusted. A malicious extension with permission to modify content on claude.ai can inject one of nine task identifiers and generate a synthetic click, abusing Claude's access to Gmail, Google Docs, Google Calendar and Salesforce. The attack is limited to those nine workflows and requires the user to install the malicious extension first.