Tracking AI threats, vulnerabilities, and defensive strategies for security professionals.
CISA adds CVE-2025-62593 to the Known Exploited Vulnerabilities catalog — a browser CSRF chain that lets malicious websites submit arbitrary Python jobs to locally running Ray clusters in Firefox and Safari, confirming active exploitation of ML infrastructure.
1Password's Off-by-1 Labs tested two frontier AI models against six real CVEs and found that only a quarter of the generated patches fully fixed the vulnerability without introducing new problems. The implications for teams relying on AI-assisted remediation are significant.
Two high-severity remote code execution vulnerabilities in llama.cpp expose local AI inference stacks to unauthenticated network attack — one through the HTTP completion server via a missing negative-value check, one through the RPC backend's deserialisation logic.
Tenet Security's DEF CON August 2026 research expands Agentjacking to Cloudflare, Datadog, and Sentry — 90% success rate, 15,000+ organisations exposed, DNS hijacking via AI coding agent manipulation, zero traditional exploitation required.
Knowledge distillation attacks can transfer and forge the statistical watermarks embedded in LLM outputs, undermining EU AI Act content provenance requirements and attribution-based trust systems before they fully take effect.
CISA adds CVE-2025-62593 to the Known Exploited Vulnerabilities catalog — a browser CSRF chain that lets malicious websites submit arbitrary Python jobs to locally running Ray clusters in Firefox and Safari, confirming active exploitation of ML infrastructure.
1Password's Off-by-1 Labs tested two frontier AI models against six real CVEs and found that only a quarter of the generated patches fully fixed the vulnerability without introducing new problems. The implications for teams relying on AI-assisted remediation are significant.
Tenet Security's DEF CON August 2026 research expands Agentjacking to Cloudflare, Datadog, and Sentry — 90% success rate, 15,000+ organisations exposed, DNS hijacking via AI coding agent manipulation, zero traditional exploitation required.
Two high-severity remote code execution vulnerabilities in llama.cpp expose local AI inference stacks to unauthenticated network attack — one through the HTTP completion server via a missing negative-value check, one through the RPC backend's deserialisation logic.
Novee Security disclosed CVE-2026-54316 at Black Hat USA 2026: a zero-privilege GitHub issue can reach CI runner secrets across Claude Code, Gemini CLI, and OpenAI Codex. The Claude Code variant eventually exfiltrated secrets one character at a time via Hugging Face download counters. A separate Gemini CLI flaw scored CVSS 10.0.
CVE-2026-41264 in Flowise's CSVAgent node lets an attacker upload a crafted CSV file, inject a prompt that directs the LLM to generate malicious Python, and execute that code on the host with no authentication required. Metasploit module landed July 11, 2026.
ESET discovered PromptSpy in February 2026 — the first known Android malware to query a live generative AI API at runtime. It uses Google Gemini to parse on-screen UI state and issue gesture instructions that keep the malware alive on infected devices.
Sysdig documented the first confirmed case of an LLM agent autonomously executing a complete ransomware operation: initial access, lateral movement, credential harvesting, encryption, and extortion without human steering on any technical decision.
Socket's threat research team identified PolinRider, a North Korean supply chain campaign placing 162 malicious artifacts across npm, Go modules, Packagist, and Chrome by compromising legitimate maintainer accounts and using blockchain-based command-and-control infrastructure.
Knowledge distillation attacks can transfer and forge the statistical watermarks embedded in LLM outputs, undermining EU AI Act content provenance requirements and attribution-based trust systems before they fully take effect.
A paper accepted at ICML 2026 shows LLMs infer speaker role from text style, not role tags — enabling a zero-shot attack called CoT Forgery that achieves 60% success against frontier models by injecting fabricated reasoning.
NDSS 2026 research shows LLMs can be systematically tricked into missing deliberately planted vulnerabilities through Familiar Pattern Attacks — automated, black-box exploits of the abstraction bias that affects every major model family.
Canary tokens planted in system prompts, RAG corpora, and training datasets give defenders a zero-false-positive tripwire for detecting prompt extraction attacks, cross-tenant data leakage, and model distillation theft. This guide covers deployment mechanics, attribution, and the limits of what canaries catch.
When prompt injection succeeds, unconstrained LLM outputs give attackers unlimited action space. Output schema enforcement and grammar-constrained generation shrink that surface meaningfully, even when injection itself can't be fully prevented.
Planting honeypot secrets and canary tokens in locations AI agents browse gives defenders a reliable, low-noise signal when an agent has been compromised or manipulated into exfiltrating credentials.
An attacker deployed Nous Research's open-source Hermes AI agent in YOLO mode against Thailand's Ministry of Finance, autonomously running reconnaissance, privilege escalation, and database exploitation with no operator in the loop.
Between March 19 and April 21, 2026, a Russian-speaking threat actor used a jailbroken Google Gemini CLI to build, operate, and migrate botnet infrastructure targeting a dental clinic. The AI performed 89% of the operational work. Trend Micro's analysis documents the first confirmed case of a commercial AI coding tool used as the primary interface for sustained criminal botnet operation.
xAI's Grok Build CLI 0.2.93 uploaded entire Git repositories including commit history and unredacted credentials to a Google Cloud Storage bucket by default. Here's what was exposed and what xAI's server-side fix left unanswered.