Tracking AI threats, vulnerabilities, and defensive strategies for security professionals.
A DHS exclusion and removal order under FASCSA bars DeepSeek and software built on it from federal civilian IT. The order is dated July 24, 2026, so by our inference its 60-day exception window had probably closed before it became public.
GHSA-qx49-fqc8-xw99 (CVSS 7.5, no CVE) lets a malicious MCP server steer the official Python SDK's OAuth client to a token endpoint it controls. Fixed in 1.30.0 and 2.2.0, but some providers need a manual issuer setting.
Microsoft assesses that Storm-0940 used the open-source ARTEX agentic pentest framework after the ConnectWise Cloud Backup compromise, with privileged access in under three hours in multiple instances. Most targeting failed.
On October 21, 2026, malicious LiteLLM 1.107.0 wheels and Docker images carried a startup-hook credential stealer and a remote code loader. Timeline, IOCs and response steps.
A joint voluntary document from NIST, NSA and CISA sets out ten practices for handling incidents where AI agents take significant uninstructed actions during training and evaluation.
A DHS exclusion and removal order under FASCSA bars DeepSeek and software built on it from federal civilian IT. The order is dated July 24, 2026, so by our inference its 60-day exception window had probably closed before it became public.
Microsoft assesses that Storm-0940 used the open-source ARTEX agentic pentest framework after the ConnectWise Cloud Backup compromise, with privileged access in under three hours in multiple instances. Most targeting failed.
A joint voluntary document from NIST, NSA and CISA sets out ten practices for handling incidents where AI agents take significant uninstructed actions during training and evaluation.
GHSA-qx49-fqc8-xw99 (CVSS 7.5, no CVE) lets a malicious MCP server steer the official Python SDK's OAuth client to a token endpoint it controls. Fixed in 1.30.0 and 2.2.0, but some providers need a manual issuer setting.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two CVSS 9.2 flaws where out-of-memory errors and stale worker state corrupt memory. Wiz found them with AI models. Mechanism, exposure and fixes.
DEF CON 34 research from Cyera Research Labs traced a single architectural flaw in the Pyodide WebAssembly Python runtime into seven products, including two AI code-execution sandboxes, Cohere's Terrarium and Hugging Face's smolagents, yielding four CVEs rated 8.3 to 9.9.
Hunt.io reconstructed SecFlow and GLUTTON from five exposed directories: a Chinese-speaking operator's agent framework that swapped Claude, Qwen and DeepSeek behind one task interface and breached a Chinese district government.
Recorded Future tracks TAG-217, an opportunistic actor that paired the open-source ARTEX agentic pentesting framework with commercial LLMs against South Korean financial firms, then exposed its own working directories.
SOCRadar uncovered a phishing-as-a-service platform that rents out AI voice agents posing as Apple Support to trick stolen-iPhone victims into handing over their Activation Lock passcode.
COLM 2026 paper InjecMEM shows a single interaction, with no access to the memory store, can plant an optimized record that is later retrieved and steers a research agent's answers. Retrieve-time filters barely helped.
A new benchmark from Shanghai AI Laboratory tests six leading GUI agents against environmental injection attacks embedded in real Android apps. Every agent is vulnerable, attack success rates reach 66.9%, and stronger agents turn out to be more exploitable, not less.
Anthropic and EPFL researchers demonstrate that ideological and action payloads can spread between AI agents through editable system prompt state files, surviving 20-hop chains with no human intervention. One defensive measure stops them almost entirely.
Uber's Agentic AI Detection and Response system correlates LLM reasoning with MCP tool calls to catch prompt injection, credential leaks, and rogue agent behavior across thousands of production coding sessions.
Researchers from HKUST and NUS propose a tagging-and-filtering defense that asks LLMs to cite which instruction they are answering, cutting prompt injection success rates from over 80% to under 1% without any fine-tuning.
Google's Mandiant disclosed technical details of its Agentic Vulnerability Discovery Harness (AVDH), a multi-agent AI pipeline that found over 100 true-positive critical vulnerabilities in a stolen-repository incident response in two days, with 12 CVEs assigned so far.
On October 21, 2026, malicious LiteLLM 1.107.0 wheels and Docker images carried a startup-hook credential stealer and a remote code loader. Timeline, IOCs and response steps.
On June 18, 2026 an OpenAI agent got past blocks on a Services Australia Medicare statistics portal. OpenAI found it in August, emailed a public inbox on September 10, and later apologised.
A service called Poison Claude resold Claude API access at a fraction of the official price by routing requests through pooled accounts created through fake signups, giving operators full visibility into every customer prompt. A configuration error revealed nearly 900 active users had been sending sensitive queries through a third-party proxy they didn't know was reading their traffic.