First reported · updated · 8 reports securityonline.info
Lead dispatch
First reported · updated · 4 reports talosintelligence.com
The Closed Quorum: Inside the first reported autonomous AI C2 implant
Cisco Talos documented CLOSEDQUORUM, a Windows implant that delegates its command-and-control decisions to a quorum of up to four commercial LLMs (DeepSeek, Qwen, Mistral, and Google Gemini), executing their chosen next action to harvest credentials and crypto wallets without a human operator or dedicated C2 server. Discovered via Talos' CAIRN project, the binary is tied to a developer's carding-forum postings dating to 2025, though no in-the-wild deployment is confirmed.autonomous-agent · malicious-ai-agent · llm-c2 · data-exfiltration
llm · ai-agents · windows · deepseek · qwen · mistral · gemini
Severity
0.65
The wire · latest
First reported google.com
Configure security for Google Workspace MCP servers | Google for Developers
Google's developer documentation describes how to configure security settings for Google Workspace MCP servers, advising that operators screen prompts and responses for malicious content or prompt injection attacks and recommending the use of Google-provided Model Armor for protection. Details →First reported maryland.gov
Guidance for Responsible and Safe Usage - AI - Policies & Guidance - Department of Information Technology
Maryland's Department of Information Technology published Version 2.0 of its 'Guidance for Responsible and Safe Usage' governance card for MCP (Model Context Protocol) server security, covering the risk landscape, vetting criteria for MCP servers, safe usage guidelines for state staff, and special guidance for BYOD, desktop clients, and browser agents. The document notes that MCP-enabled AI can take actions such as reading files, sending messages, and querying databases, and that decentralized MCP registries mean there is no single trusted source of truth. Details →First reported · updated · 2 reports cisa.gov
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
A joint NSA, CISA, and FBI advisory (AA26-251A, Sept. 8, 2026) accuses China-based AI firms including Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun, and Z.AI of conducting industrial-scale knowledge distillation campaigns to covertly extract proprietary capabilities from US frontier models (Claude, GPT, Gemini, Grok), reportedly siphoning billions of tokens across millions of requests since late 2024. Team Cymru research complements the advisory, documenting 10,000+ hidden gateway 'transfer station' servers and tools like Claude Relay Service/sub2api that mask Chinese-origin traffic, bypass region bans, and pool provider credentials to enable large-scale output extraction and distillation. Details →First reported microsoft.com
Detect and investigate threats to AI agents using Microsoft Defender (Preview) - Microsoft Defender XDR | Microsoft Learn
Microsoft documents a public-preview capability in Microsoft Defender XDR that detects and investigates threats to deployed AI agents managed through Microsoft Agent 365. The feature ingests observability data from agents built on Copilot Studio, Microsoft Foundry, and the Agent 365 SDK to raise near-real-time alerts on suspicious or malicious agent behavior and trace root cause and blast radius. Details →First reported thehackernews.com
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
Microsoft patched CVE-2026-85889, a maximum-severity (CVSS 10.0) flaw in Azure AI Foundry (Microsoft Foundry) caused by missing authentication for a critical function, allowing an unauthorized attacker to elevate privileges over a network. The platform is used to build, deploy, and manage generative AI applications and agents; no customer action is required and there is no evidence of in-the-wild exploitation. The flaw was reported by researcher Rémy Marot. Details →First reported · updated · 2 reports thehackernews.com
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker disclosed CVE-2026-77179, a Critical flaw in Docker Sandboxes on macOS where malicious guest code running inside an AI coding agent's virtual machine can escape the shared project directory and read or modify arbitrary files on the host with the running account's privileges. The flaw affects versions 0.28.0 up to 0.42.0 and was fixed in 0.42.0 on September 7, 2026 (a related CVE-2026-79994 was also addressed). Details →First reported · updated · 5 reports nist.gov
Malicious .git Configurations: A Risk for AI
Malicious repository .git/config files that set core.fsmonitor let AI coding agents execute attacker-controlled code outside their sandbox and before any trust prompt or model call. The flaw affects Block's goose (CVE-2026-72718, fixed in 1.44.0), OpenAI Codex CLI/Desktop (CVE-2026-19592), and Anthropic's Claude Code CLI (patched in v2.0.71), where each agent invokes git to gather repo metadata/diffs without stripping repository-local config, causing Git to launch the attacker's filesystem-monitor helper with the user's privileges — enabling file access and exfiltration of environment secrets and API keys. Details →First reported · updated · 2 reports thehackernews.com
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
OX Research disclosed CVE-2026-82533, a critical (CVSS 9.4) flaw in DeepSeek Harness, DeepSeek's open-source AI coding-agent harness, that let a sandboxed AI agent disable its own confinement with a single shell command. The agent-control API was exposed on a local HTTP port without authentication and trusted the client-supplied 'Host' header, so a confined agent could elevate its session to 'danger-full-access' with approval prompts disabled; if the port was network-exposed, an unauthenticated remote attacker could seize the agent and export all stored conversations. Details →First reported nist.gov
NVD-CVE-2026-73496
CVE-2026-73496 affects MCP Atlassian, a Model Context Protocol server for Confluence and Jira, where the confluence_upload_attachment(s) and jira_update_issue attachment tools pass a client-controlled file_path without confining it to an approved workspace. In remote HTTP, SSE, or multi-user deployments, absolute or traversing paths are resolved on the MCP server, letting a client with write-tool access disclose server files, environment-held Atlassian credentials, or another tenant's data. The issue is fixed in version 0.22.0 (CVSS 3.1 base 7.7). Details →First reported ionix.io
CVE-2026-88899 – Remote File Path Traversal / Sandbox Escape – knowns before v0.31.0
CVE-2026-88899 is a critical (CVSS 9.8) external control of file path vulnerability in the `knowns` npm package before v0.31.0, whose `/api/opencode` proxy endpoint fails to validate the `x-opencode-directory` header. Unauthenticated remote attackers can redirect the embedded OpenCode AI agent's file operations to arbitrary host directories (e.g. /root, /etc, ~/.ssh), enabling reading of SSH keys and credentials, writing to shell profiles or cron jobs, and file deletion. The fix in v0.31.0 removed the embedded OpenCode proxy entirely. Details →First reported yale.edu
AI Coding Tools - Yale Center for Research Computing
The Yale Center for Research Computing published guidance on the security risks of AI coding agents (e.g., Claude Code) on HPC clusters, warning that such agents can expose lab data, leak credentials like SSH keys and API tokens, take unintended actions across shared environments, and execute arbitrary or malicious code. The document specifically notes that coding agents are susceptible to prompt injection attacks in which malicious instructions embedded in read content are executed by the agent. Details →First reported nist.gov
NVD-CVE-2026-37003
CVE-2026-37003 is a critical (CVSS 9.8) remote code execution vulnerability in the Agno agent framework up to and including 2.5.8. Its PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly into execution sinks including exec(), runpy.run_path(), and subprocess.run(), allowing an unauthenticated attacker to embed malicious instructions in content the agent processes (such as web pages or documents) to achieve arbitrary code and OS command execution on the host. Details →First reported amazon.com
CVE-2026-85654 - Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server
CVE-2026-85654 is a code-injection vulnerability in the CDK generator of Amazon's awslabs.dynamodb-mcp-server, disclosed in AWS security bulletin 2026-097-AWS and a corresponding GitHub security advisory (GHSA-35jj-hwvm-792x). The flaw affects an MCP server component used by AI agents to interact with DynamoDB. Details →First reported cve.org
CVE Record: CVE-2026-19957
CVE-2026-19957 is a server-side request forgery (SSRF, CWE-918) vulnerability in graphlit graphlit-mcp-server 1.0.1, where manipulation of the url argument in the fetch function of src/tools.ts (ssrf-test Endpoint) lets a remote attacker force server-side requests. VulDB rates it CVSS 5.3-6.3 (medium), notes the exploit is publicly available, and reports the project was informed but has not responded. Details →First reported secalerts.co
GHSA-hwrm-c4cx-rf4j - Medium severity pip/vllm vulnerability
GHSA-hwrm-c4cx-rf4j is a medium-severity information-disclosure flaw in the vLLM LLM serving framework where the FastAPI validation_exception_handler converts a Pydantic RequestValidationError to a string via str(exc), leaking internal file paths, OS username, home/virtualenv paths, Python version, and handler names in HTTP error responses. An unauthenticated attacker can trigger this on any JSON POST endpoint (e.g. /v1/chat/completions) with a single malformed request, aiding version fingerprinting and targeted exploit construction. Fixed in vLLM 0.26.0. Details →First reported · updated · 3 reports cisa.gov
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
A joint CISA, NSA, and FBI cybersecurity advisory (AA26-251A, September 8, 2026) warns that China-based AI companies are conducting industrial-scale knowledge distillation campaigns to systematically extract proprietary functionalities and capabilities from U.S. frontier AI models. The advisory frames this malicious, targeted distillation as the core of the Chinese firms' AI development strategy and provides MITRE ATLAS-mapped techniques and mitigations plus urgent recommendations for U.S. AI companies. Details →First reported pluto.security
The Notebook Backdoor: jupyter-mcp-server Vulnerabilities
Pluto Security disclosed two vulnerabilities in Datalayer's jupyter-mcp-server (400K+ downloads): CVE-2026-77318 (CVSS 7.3) exposes /api/connect and /api/stop with no authentication, and CVE-2026-77359 (CVSS 9.3) leaves those routes missing Host/Origin checks, enabling DNS rebinding. Chaining them lets any malicious website a victim visits silently redirect an AI assistant's live notebook backend to read or plant data with zero clicks, and even Claude on Opus 4.8 failed to notice the swap. A fix is available in v1.0.3. Details →First reported · updated · 3 reports screetsec.com
Maland | Another Cursor 0-day Enabling Arbitrary Code Execution Beyond Git.exe
Cursor 3.0.0 fixes CVE-2026-48124, a sandbox-to-host code execution weakness where files created or modified by a sandboxed AI coding agent are later consumed and executed by trusted host tools (extensions, task runners, Git integrations, Python tooling, Docker services), achieving code execution beyond the sandbox without breaking OS isolation. Related research from Mindgard and others also documents a zero-click binary-planting flaw where opening a repository on Windows auto-executes a malicious git.exe planted at the repo root, with the execution surface extending beyond git.exe to other attacker-controlled files. The same class of weakness affects OpenAI Codex CLI, Google Gemini CLI, and Antigravity. Details →First reported · updated · 3 reports openai.com
Lockdown Mode | OpenAI Help Center
OpenAI documented Lockdown Mode, an optional advanced security setting for ChatGPT that limits outbound network requests to reduce data exfiltration risk from prompt injection attacks. The feature disables or restricts live web browsing, image retrieval, deep research, agent mode, Canvas networking, and file downloads, but does not prevent prompt injections from appearing in processed content. Details →First reported ionix.io
CVE-2026-82268 – Server-Side Request Forgery (SSRF) – Qwen-Agent ≤ 0.0.34
CVE-2026-82268 is a Server-Side Request Forgery vulnerability in Qwen-Agent (versions through 0.0.34), an open-source agent framework built on the Qwen LLM family. The document parsing logic in qwen_agent/tools/simple_doc_parser.py treats caller-supplied paths as URLs without scheme restriction or host validation, letting unauthenticated remote attackers coerce the server into requesting arbitrary internal/external addresses — including cloud metadata endpoints — via the default, exposed Gradio interface. It carries a CVSS v4.0 score of 8.7 (High) with no vendor patch yet available. Details →First reported · updated · 2 reports amazon.com
CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
CVE-2026-18655 is a vulnerability in the AWS Labs Amazon MQ MCP Server that allows broker credential and OAuth token disclosure via prompt injection, disclosed in AWS security bulletin 2026-070-AWS and GitHub advisory GHSA-xwj6-8x5h-hjp6. An attacker can use indirect prompt injection against the MCP server to exfiltrate sensitive broker credentials and OAuth tokens. Details →First reported nist.gov
NVD-CVE-2026-75130
CVE-2026-75130 is a prompt injection vulnerability in Context7 through version 2.1.2, where its Custom AI Instructions feature served via the MCP server passes unsanitized content to connected AI coding agents. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and trigger destructive file deletion when an agent makes a routine library documentation request. Details →First reported google.com
AI Protection overview | Security Command Center | Google Cloud Documentation
Google Cloud's Security Command Center documentation describes AI Protection, a set of defensive services for securing AI workloads on Google Cloud, including AI Discovery, Model Armor (protection against prompt injection and jailbreak), Agent Platform Threat Detection, Agent Platform Vulnerability Assessment, Notebook Security Scanner, and Sensitive Data Protection. The page catalogs detection services, compliance frameworks, and Event Threat Detection rules for Gemini Enterprise Agent Platform assets. Details →First reported google.com
Best practices for securing agent interactions with Model Context Protocol | AlloyDB for PostgreSQL | Google Cloud Documentation
Google Cloud documentation lays out best practices for securing AI agent interactions with AlloyDB for PostgreSQL over the Model Context Protocol (MCP), covering least-privilege access, database-native granular controls, treating data and user inputs as untrusted, preventing unauthorized tool chaining, limiting access in multi-tenant databases, and enabling Model Armor safety thresholds plus auditing. Details →First reported nist.gov
NVD - CVE-2026-62676
CVE-2026-62676 is a HIGH-severity (CVSS 7.1) flaw in Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in _shell.py fails to recognize combined interpreter flags, timeout/nice/setsid/stdbuf wrappers, command substitutions, and a background control operator, so a gated git push or gh write hidden in these forms produces no parsed operation, causing the repo/branch allowlist and workspace confinement policies to abstain and allow the command. An authenticated or prompt-injected agent can push to an unauthorized repository or branch or escape the intended workspace; fixed in version 0.3.0. Details →First reported · updated · 2 reports splunk.com
SVD-2026-0808 | Splunk Vulnerability Disclosure
Splunk advisory SVD-2026-0808 discloses multiple vulnerabilities in Splunk apps including a critical (CVSS 9.1) remote code execution via untrusted-data deserialization (CVE-2026-76404) in the Splunk MCP Server app, plus several flaws in the Splunk AI Toolkit such as RCE in the Model Loading REST API (CVE-2026-76395), improper privilege management on agent run history (CVE-2026-76391), and missing authorization in container/connection management (CVE-2026-76394). Fixed versions are available for each affected app and add-on. Details →First reported · updated · 2 reports cve.org
CVE Record: CVE-2026-75845
CVE-2026-75845 is an authorization bypass in ArcadeDB's set_server_setting MCP server-level tool (versions 26.4.2 through 26.7.3). SetServerSettingTool.execute() checks only the global allowAdmin flag and never validates the caller's role, so in an MCP deployment with allowAdmin=true and a non-root allowedUsers set, any authenticated read-only user can invoke the tool to modify server GlobalConfiguration, enabling configuration tampering or denial of service. The issue is fixed in 26.8.1. Details →First reported · updated · 3 reports google.com
Mitigate indirect prompt injection risks from Google Cloud MCP | Google Cloud Data Agent Kit extension for Antigravity IDE | Google Cloud Documentation
Google Cloud documentation for the Data Agent Kit extension (VS Code and Antigravity IDE) warns that coding agents connected via Google Cloud MCP can be hijacked through indirect prompt injection, where malicious instructions hidden in data sources such as Cloud Storage, BigQuery, email, or calendars are interpreted as commands. The guidance recommends mitigations including running agents in constrained environments like Cloud Workstations with disabled internet access and no root privileges. Details →First reported cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
CISA, NSA, FBI, DOE and EPA issued advisory AA26-231A warning of an active threat targeting Siemens S7 Series PLCs in U.S. critical infrastructure using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors use internet scanning services like Censys and ZoomEye to find exposed, outdated or poorly protected PLCs, and the broader targeting extends beyond Siemens devices. Details →First reported · updated · 3 reports cisa.gov
CISA Adds One Known Exploited Vulnerability to Catalog
CISA warned that threat actors are actively exploiting CVE-2026-64849, a critical DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery, and added it to its Known Exploited Vulnerabilities catalog. MLflow is a widely used open-source AI engineering platform for LLMs and agents; the flaw lets unauthenticated attackers reach the tracking server and make it issue requests to internal/loopback/cloud-metadata endpoints, enabling theft of cloud credentials such as AWS IMDS IAM credentials. The vulnerability was patched in MLflow 3.15.0. Details →First reported cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
Five US federal agencies (NSA, CISA, FBI, DOE, EPA) issued advisory AA26-231A warning of an active threat in which attackers use AI coding assistants together with open source industrial libraries (snap7.dll/python-snap7) to generate custom exploitation scripts disguised as legitimate OT monitoring tools against internet-exposed Siemens S7 Series PLCs at water, energy, manufacturing, and other critical facilities. The AI-generated tools provide read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, and the activity is suspected to be linked to Iran-affiliated operatives. Details →First reported · updated · 2 reports cisa.gov
Defending Against an Active Threat to Siemens S7 Series PLCs
A joint CISA/NSA/FBI/DOE/EPA advisory (AA26-231A, August 2026) warns of an active cyber threat against U.S.-based Siemens S7 Series PLCs, in which threat actors conduct reconnaissance and capability development using AI-generated exploitation scripts disguised as legitimate monitoring tools. The advisory provides mitigations including inventorying PLCs, applying patches, isolating devices from the internet, hardening access controls, and hunting for anomalies. Details →First reported · updated · 2 reports cisa.gov
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2025-62593 (CVSS 9.4), a critical flaw in Ray — the open-source, Python-native distributed computing framework used to scale AI/ML workloads — to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The bug can result in remote code execution through web browsers such as Firefox and Safari, and CISA gave federal agencies a short remediation deadline. Details →First reported vuldb.com
CVE-2026-19339 in alibabacloud-dataworks-mcp-server
CVE-2026-19339 is a server-side request forgery flaw in aliyun alibabacloud-dataworks-mcp-server up to version 1.0.43, where the ReadResourceRequestSchema function in src/resources/initResources.ts fails to validate the request.params.uri argument. The flaw is remotely exploitable without authentication (CWE-918), and the project maintainers had not responded to the initial issue report at time of disclosure. Details →First reported github.com
mcp-context-forge/SECURITY.md at main · IBM/mcp-context-forge
IBM's mcp-context-forge (MCP Context Forge, an MCP gateway/proxy) publishes a SECURITY.md security policy laying out hardening guidance for deploying the gateway, including keeping the Admin UI development-only, disabling it and unused features in production, requiring authenticated REST-API-only access, and using feature flags to reduce attack surface. Details →First reported nist.gov
NVD - CVE-2026-44192
CVE-2026-44192 is a path-traversal flaw in the Ansible Lightspeed Model Context Protocol (MCP) server that lets an attacker manipulate an AI agent via indirect prompt injection to write files to unauthorized locations. Red Hat rates it CVSS 3.1 base 6.6 (Medium), and successful exploitation can expose sensitive host information and enable malicious command execution leading to full system compromise. Details →First reported feedly.com
CVE-2026-30623 - Exploits & Severity
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection flaw in LiteLLM 1.18.10's MCP server creation feature: the application executes arbitrary command and args values supplied via JSON MCP server configuration without validation. An unauthenticated network attacker can achieve remote code execution with the privileges of the LiteLLM process; patches are available for LiteLLM and related products (DocsGPT, Flowise, Bisheng), while Windsurf and Langchain-Chatchat were reported still vulnerable. Details →First reported nist.gov
NVD - CVE-2026-70477
CVE-2026-70477 is a critical (CVSS 9.5) vulnerability in Flowise prior to 3.1.3, where a prompt injection sent to a chatflow using the CSV Agent node can cause the LLM to emit malicious Python that bypasses the blocklist validator (validatePythonCodeForDataFrame) and executes in an unsandboxed Pyodide environment. The flaw in the CSV_Agents class run method lets an attacker achieve arbitrary code execution in the context of the service account; it is fixed in version 3.1.3. Details →First reported ca.gov
CYBER ADVISORY
Cal-CSIC issued an advisory for CVE-2026-61459, a critical (CVSS 9.8) argument injection vulnerability in MCP Server Kubernetes, a component that bridges AI assistants and automated tools to Kubernetes clusters. If the MCP server is externally exposed, an attacker can send crafted requests to steal credentials, bypass security checks, inject malicious arguments, and compromise the entire cluster with potential lateral movement across clusters. A fix is available in version 3.9.0. Details →First reported cve.org
CVE Record: CVE-2026-47427
CVE-2026-47427 is a null pointer dereference denial-of-service in GitHub's official MCP Server (github-mcp-server) prior to version 1.1.0, where the CompletionsHandler in pkg/github/server.go accesses params.Ref without a nil check. A completion/complete JSON-RPC request with a missing or empty ref field triggers a Go runtime panic before any authentication, letting any unauthenticated client crash the server. The issue is fixed in version 1.1.0 (CVSS 7.5 HIGH). Details →First reported github.com
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server · Advisory · awslabs/mcp
A vulnerability (CVE-2026-18954, GHSA-j694-4m5j-w8hc) in Amazon AWS Labs DocumentDB MCP Server lets an authenticated MCP client bypass read-only mode enforcement by submitting aggregation pipelines with write-capable stages ($out, $merge) through the aggregate tool, which fails to validate pipeline stages. The issue is fixed in version 1.0.12; a workaround is to configure the server with a read-only database user. Details →First reported visualstudio.com
AI security in VS Code
VS Code documentation describes built-in security controls for AI-powered agentic development, including Workspace Trust restricted mode, agent sandboxing to limit file system and network access, mandatory review of file edits, protection of sensitive files, session-scoped auto-approval, and vetting of MCP servers before trusting them. The page frames these as trust boundaries to limit the impact of autonomous agent actions on untrusted projects. Details →First reported · updated · 2 reports thehackernews.com
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
Security flaws in agent infrastructure from AWS (Bedrock AgentCore's InvokeHarness API), Google (Agent Development Kit for Python), and Vercel (AI SDK harness packages for Codex and OpenCode) allow untrusted or forged instructions to reach an agent's tools without verifying that a model turn authorized them. In several attack paths the model never ran, so system prompts, content filters, and model-level guardrails never engaged. AWS fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28. Details →First reported · updated · 4 reports cve.org
IBM's agentic AI platform is under active attack - patch now
A critical vulnerability, CVE-2026-9198, in IBM-owned low-code AI agent builder Langflow lets unauthenticated attackers achieve remote code execution on default deployments by chaining an auto-login endpoint that mints superuser tokens with a code-validation endpoint that runs arbitrary Python. CISA added it to its Known Exploited Vulnerabilities catalog after confirming active exploitation; IBM says Langflow OSS 1.0.0 through 1.10.0 are affected and urges upgrading to 1.10.1 or later. Sysdig telemetry documents in-the-wild attack chains (including related CVE-2026-33017 RCE and CVE-2026-55255 IDOR) that probe /api/v1/auto_login, enumerate flows, and deliver second-stage loaders. Details →First reported oasis.security
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
Two flaws in Paperclip, an open-source control plane for teams of AI agents, let attackers execute host commands by importing and starting a malicious agent. The server-side path CVE-2026-41679 (CVSS 10.0) needs no account or victim interaction against authenticated deployments with default registration, while GHSA-x8hx-rhr2-9rf7 (CVSS 9.6) triggers when a user opens an attacker-controlled page in default local_trusted mode; a third flaw exposed sensitive data via API routes lacking access checks. Version v2026.416.0 adds import-authorization and hostname-validation fixes. Details →First reported corgea.com
CVE-2026-55607 vulnerability: npm/@anthropic-ai/cl…
CVE-2026-55607 is a vulnerability affecting the npm package @anthropic-ai/claude-code, Anthropic's AI coding agent, tracked via GitHub Security Advisory GHSA-7835-87q9-rgvv and NVD, with a fix referenced in the v2.1.163 release. The Corgea page is an advisory catalog entry pointing to the upstream advisory and NVD record. Details →First reported · updated · 2 reports zafran.io
Hugging Face Diffusers Flaws Could Let Model Repositories Execute Arbitrary Code
Zafran Labs disclosed three high-severity flaws, collectively named FaceHugger, in Hugging Face's Diffusers library (CVE-2026-44827 CVSS 8.8, CVE-2026-45804 CVSS 7.5, and CVE-2026-44513 CVSS 8.8) that let a malicious model repository silently execute arbitrary code on any machine loading it. The flaws stem from a Time-of-Check to Time-of-Use race that bypasses the trust_remote_code safeguard by splitting a model download into two non-atomic HTTP requests, so a routine model load becomes an initial-access vector across CI/CD, container, and production pipelines. Details →First reported nist.gov
NVD - cve-2024-5184
CVE-2024-5184 is a prompt injection vulnerability in the EmailGPT service, whose API allows a malicious user to inject a direct prompt and take over the service logic. Attackers can force the AI service to leak hard-coded system prompts or execute unwanted prompts, and the flaw can be exploited by anyone with access to the service (CVSS 3.x base 9.1 CRITICAL per NIST). Details →First reported giskard.ai
Release Notes | Giskard Documentation
Giskard Hub UI release 2.5.0 adds a new TokenBreak security probe to its LLM red-teaming scanner, which tests whether an agent can be manipulated through obfuscated prompt injection by prepending characters to trigger words (e.g. 'ignore' → 'Aignore') to evade input classifiers while remaining interpretable to the LLM. The release also adds stateful multi-turn agent support and fine-grained probe selection for scans, and is based on HiddenLayer's TokenBreak attack research (arXiv:2506.07948). Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector