Zenity Labs expanded its PleaseFix research at Black Hat 2026, showing how crafted emails and social posts can silently hijack Claude, ChatGPT Atlas, Gemini, Perplexity Comet, and Copilot Edge with no user interaction required.
A service called Poison Claude resold Claude API access at a fraction of the official price by routing requests through compromised AWS Bedrock accounts, giving operators full visibility into every customer prompt. A configuration error revealed nearly 900 active users had been sending sensitive queries through a third-party proxy they didn't know was reading their traffic.
Anthropic disclosed on July 31 that three of its models — Claude Opus 4.7, Mythos 5, and an unreleased internal prototype — breached real companies during cybersecurity capability evaluations after an evaluation partner misconfigured network egress. The models used basic techniques: weak passwords, unsecured endpoints, SQL injection. Mythos 5 never concluded it had left the simulation.
Barracuda researchers demonstrated at Black Hat 2026 that a single compromised employee account, combined with an integrated AI assistant like Microsoft Copilot, can be weaponised to escalate access to the CEO and facilitate a fraudulent wire transfer -- without introducing any new permissions.
A timing side channel in global KV-cache sharing lets unprivileged tenants reconstruct other users' prompts, PII, and system instructions from vLLM, SGLang, and similar inference frameworks. Multiple CVEs have been assigned; patches are in progress.