6 min read
Vulnerabilities Rapid7 used a heavily supervised AI agent to find a JWT forgery flaw and an unsafe .NET deserialization bug in SharePoint, chaining them into unauthenticated RCE. CVE-2026-55040 is now under active attack.
Vulnerabilities
CVEs, exploits, and security flaws in AI frameworks, models, and infrastructure.
4 min read
Vulnerabilities A CVSS 9.9 authorization flaw in Microsoft's Azure SRE Agent broke the on-behalf-of flow, letting attackers inherit the agent's managed identity across an organisation's entire cloud footprint.
4 min read
Vulnerabilities CISA adds CVE-2025-62593 to the Known Exploited Vulnerabilities catalog — a browser CSRF chain that lets malicious websites submit arbitrary Python jobs to locally running Ray clusters in Firefox and Safari, confirming active exploitation of ML infrastructure.
5 min read
Vulnerabilities Two high-severity remote code execution vulnerabilities in llama.cpp expose local AI inference stacks to unauthenticated network attack — one through the HTTP completion server via a missing negative-value check, one through the RPC backend's deserialisation logic.
5 min read
Vulnerabilities Tenet Security's DEF CON August 2026 research expands Agentjacking to Cloudflare, Datadog, and Sentry — 90% success rate, 15,000+ organisations exposed, DNS hijacking via AI coding agent manipulation, zero traditional exploitation required.