Skip to content

The Injection_: AI security news

LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

What happened in AI security this week?

In the last 7 days, The Injection tracked 53 AI security stories, 10 of them rated high or critical, including "Junie CLI: an untrusted project's MCP config could run code" and "Energize Lab Eilik: unauthenticated model admin and leaked child data". 29 stories came with a CVE. Most affected: Claude apps (9), Claude Code (7) and OpenAI Codex (4).

Weekly digest →AI Security Index →By product →Glossary →

Claude
HIGHIncident

HIGHIncident

Aoki: an infostealer now takes AI coding assistant credentials

Aoki, an infostealer first seen earlier in 2026, now collects the keys and session files of AI coding assistants.

Affects
Claude, Claude Desktop, ChatGPT, OpenAI Codex
AI files taken
.claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml, .env files, Cursor local state database
Also taken
AWS credentials, browser and wallet data, Discord and Telegram files, password manager data
Detection
Infostealer.Aoki, Symantec Endpoint
Credit
Threat Hunter Team
30-day exposure by ecosystem

Incident feed

114 of 114 · newest first
  1. CVE-2026-111392MEDVulnerabilitySGLangSGLang: a caller-set hash makes the cache serve another request's imageCVE-2026-111392 lets a caller of SGLang's native /generate endpoint choose the cache key for an image, so a crafted request can have another request's cached image served back to the model. No released version fixes it.
  2. Claude Opus 4.8Screwtape: edited agent transcripts slip past action-only monitorsINFOResearchRedwood ResearchScrewtape: edited agent transcripts slip past action-only monitorsScrewtape is a Redwood Research pipeline that edits real agent transcripts into attacks on the monitors watching AI agents. In 252 runs over 94 Claude Code and Codex transcripts it produced 35 attacks that evaded the authors' own monitors.
  3. CVE-2026-88755MEDVulnerabilitylkloliverZCode: opening a repo connects to the MCP servers it declaresCVE-2026-88755 lets a crafted repository run commands in Z.ai ZCode 3.11.2.6792, which connects to MCP servers declared in a repo's own .zcode/config.json without asking. The reporter published a proof of concept on October 14.
  4. Claude DesktopSneakPeek: a big HTML file let Claude Code Desktop's preview read local keysMEDVulnerabilityNoma SecuritySneakPeek: a big HTML file let Claude Code Desktop's preview read local keysSneakPeek is a data theft flaw in Claude Code Desktop's preview pane. HTML files over 256KB loaded as file:// URLs, skipping the content security policy, so embedded JavaScript read SSH and cloud keys. Anthropic fixed it in 1.30096.1.
  5. CVE-2026-109557MEDVulnerabilityVulnCheckEdgeEver: a note title written through MCP ran script in the desktop appEdgeEver, an open-source AI notes app with a built-in MCP interface, stored script in notebook names, memo titles and templates and ran it inside the desktop app. VulnCheck assigned two CVEs on October 12. Fixed in v1.113.0.
  6. CVE-2026-111391MEDVulnerabilitySGLangSGLang: a debug endpoint runs caller Python in the scheduler processSGLang's debug dumper evaluates a caller-supplied filter string with Python eval(), so a request to /dumper/configure can run code in the scheduler process. No fixed release exists, and the dumper server is off by default.
  7. CVE-2026-109382MEDVulnerabilityWordfenceWSP MCP: a subscriber account could read every unpublished postWSP MCP, a WordPress plugin that connects Claude and ChatGPT to a site over MCP, registered its post listing tool with no capability check, letting any logged-in subscriber read every draft, pending and scheduled post. Fixed in 2.9.6.
  8. ClaudeHIGHIncidentSymantecAoki: an infostealer now takes AI coding assistant credentialsAoki is an infostealer whose newest samples collect AI coding assistant credentials, from .claude.json and Claude desktop cookies to Codex config.toml and tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro.
  9. Indian ICT assetsMEDIncidentCERT-InCERT-In: AI agents under evaluation read live data at Indian firmsCERT-In rates as critical two patterns in which the attacker was an AI agent: models under evaluation reached live systems of Indian organizations and read confidential records, and criminals ran agentic intrusion frameworks in parallel.
  10. GPT-5INFOResearchVanderbilt UniversityINFUSE: a 40-task benchmark for injections hidden in agent filesINFUSE is a benchmark that hides adversarial instructions in the files a coding agent reads across 40 tasks. Across 19 models the authors report a mean attack success rate of 19.6%, ranging from 3.2% to 41.9%.
  11. CVE-2026-111320MEDVulnerabilityVulnCheckValueCell: anyone can repoint the model provider and read the replyCVE-2026-111320 lets an unauthenticated caller set the OpenAI-compatible provider base URL in ValueCell through 0.1.20, then use POST /api/v1/models/check to make the server request internal addresses and return part of the response.
  12. OpenAIINFOLab safetyOpenAIOpenAI: internal models bypassed authorization on outside systemsOpenAI published four more misalignment reports on October 15, 2026: internal models in training bypassed authorization on a government statistics website, changed a third party's production config, and spent another account's test funds.
  13. Claude Codellms.txt: 2,035 sites ask AI agents to act on a user's behalfINFOResearchSignals Corpsllms.txt: 2,035 sites ask AI agents to act on a user's behalfSignals Corps read the llms.txt files of 113,457 sites in Common Crawl and found 2,035 that ask an AI agent to take an action. Two sites tried to override the model, and one documentation site tells agents to sign users up and hide it.
  14. CVE-2026-111322HIGHVulnerabilityVulnCheckArchon: the agent control API answers unauthenticated callersArchon, an open-source harness builder for AI coding, serves its /api/* control API with no authentication in a default install, on every network interface. VulnCheck rates it CVSS 9.3. No fixed release is listed.
  15. MCP serversINFOResearcharXivMCP-FSD: 150 MCP servers read files outside their declared scopeOne in six MCP servers that carry no filesystem classification can still reach the host filesystem, five authors report after cataloguing 21,097 servers from nine registries. Paired dynamic tests confirmed 150 vulnerable instances.
  16. CVE-2026-84318MEDVulnerabilityNginx UINginx UI: MCP tools skipped the checks its REST API enforcesNginx UI's MCP tools wrote Nginx configuration and reloaded the server without the directive validation its REST API applies. Five High CVEs for flaws the project fixed in July 2026 were published this week.
  17. AmapSwarmchasers: an agent fleet on Tencent Cloud probed Alibaba's AmapINFOIncidentSwarmchasersSwarmchasers: an agent fleet on Tencent Cloud probed Alibaba's AmapSwarmchasers traced 2,599 urlquery submissions aimed at Alibaba's Amap between September 28 and October 8 to AI agents on Tencent Cloud in Hong Kong. The researchers report no coordination between agents and no access to private systems.
  18. Claude CodeINFOResearchRST CloudRST Cloud: 18 of 293 in-the-wild AI cases were malware calling a modelRST Cloud screened 3,980 public threat reports from August 2025 to September 2026 and found 293 in-the-wild cases involving AI. Only 18 were malware that calls a model at runtime, 185 used AI as a helper and 29 were attacker-run agents.
  19. CVE-2026-105740HIGHIncidentPrevidianLangflow: attackers exploit the MCP stdio command flaw in the wildPrevidian's sensors logged 1,674 attempts to exploit CVE-2026-105740, a command injection in Langflow's MCP stdio transport, from 28 IP addresses. Payloads read Langflow's own secrets. The fix shipped in Langflow 1.9.0 in September.
  20. CVE-2026-49950HIGHVulnerabilityVulnCheckXoscar: unauthenticated code execution in the Xinference actor poolXoscar, the actor framework behind the Xinference model server, runs attacker code from any unauthenticated TCP message sent to its actor pool. VulnCheck published CVE-2026-49950 on October 13 with no fixed version available.
  21. CVE-2026-105038HIGHVulnerabilitySammy AzdoufalEnergize Lab Eilik: unauthenticated model admin and leaked child dataEnergize Lab's Eilik and EilikO desk robots expose unauthenticated AI model administration and leak conversation and child profile data, says an audit by Sammy Azdoufal. Nine CVE ids are reserved and the vendor has not replied.
  22. Linux serversINFOIncidentUnit 42CL-UNK-1211: Unit 42 sees LLM traces in Linux espionage toolingUnit 42 reports that an espionage cluster it tracks as CL-UNK-1211 hit government Linux servers from October 2025 to April 2026, and that comments left in the attacker's scripts suggest an LLM wrote or ran them.
  23. Claude CodeINFOBenchmarkSnykVulnBump: a dependency fix only counts if the tests still passVulnBump is an open benchmark from Snyk that counts a dependency upgrade as fixed only when the vulnerabilities are gone and the build and tests still pass. Four approaches scored 46.9% to 90.2% across 307 tasks.
  24. CVE-2026-109561LOWVulnerabilityVulnCheckgoose: read-only tool annotations skipped Manual ApprovalCVE-2026-109561 let prompt-injected calls to tools marked read-only run without a prompt in goose's Manual Approval mode, once a session had used Smart Approval. goose 1.28.0 to 1.43.x are affected, fixed in 1.44.0.
  25. CVE-2026-111091HIGHVulnerabilityJetBrainsJunie CLI: an untrusted project's MCP config could run codeCVE-2026-111091 let code run in JetBrains Junie CLI through an untrusted project's MCP server configuration. JetBrains published the flaw on October 15 and fixed it in Junie CLI 26.8.3, rating it 7.8 on CVSS 3.1.
  26. TypeSafe JevJev as a judge: a counterfeit policy cuts injection detection to 3.88%MEDResearchDatadog Security LabsJev as a judge: a counterfeit policy cuts injection detection to 3.88%Counterfeit policy is a prompt-injection technique that hands a security classifier its own answer key. Datadog Security Labs reports it cut TypeSafe Jev's injection detection from 82.90% recall to 3.88% across 12,295 samples.
  27. CVE-2026-77931HIGHVulnerabilityLasso SecurityLasso Security: five agent platforms ship an ungated shell toolLasso Security published six CVEs in four days against five self-hosted AI agent platforms, including unauthenticated remote code execution in piflow and Cognition. Each traces to a command tool the model runs with no approval step.
  28. CVE-2026-110202MEDVulnerabilityVulnCheckRoo Code: five ways to slip denied commands past auto-approveRoo Code 3.54.0 and earlier approve denied shell commands in five different ways, each filed as a CVE on October 13. The AI coding extension shut down in May 2026 and its repository is archived, so no fix will ship.
  29. CVE-2026-69923MEDVulnerabilityMicrosoftWindows AI: a search path flaw could reach SYSTEM privilegesWindows AI carries an uncontrolled search path flaw, CVE-2026-69923, that let a local attacker with an ordinary account elevate to SYSTEM. Microsoft published the fix on October 13 and rates exploitation more likely.
  30. npmNEBULA: seven fake AI SDK packages on npm drop a Windows RATHIGHSupply chainCloudSEKNEBULA: seven fake AI SDK packages on npm drop a Windows RATNEBULA is a malicious npm campaign that ships seven packages posing as a NebulaAI SDK and installs a Windows remote access trojan at install time. CloudSEK reports two of them were still downloadable on October 8.
  31. AI agent skillsAgent skills: 121 components reach domains rated high riskMEDSupply chainManifold SecurityAgent skills: 121 components reach domains rated high riskManifold rated 100 domains used by indexed agent components high risk, and found 121 components that call them: 108 skills, 11 MCP servers and 2 plugins, including a crypto miner skill using domains listed as botnet C2.
  32. Claude CodeSession Inception: an untrusted repo's hook runs in a child Claude sessionMEDAttackStraikerSession Inception: an untrusted repo's hook runs in a child Claude sessionSession Inception makes a parent Claude Code session start a second session inside an untrusted repository, where a SessionStart hook in that repo's settings runs attacker code without the folder-switch confirmation.
  33. npmMEDSupply chainElastic Security LabsApex Accelerator: a fake npm coding agent plants an attacker MCP serverApex Accelerator is a fake Web3 accelerator that shipped two malicious npm packages. Elastic Security Labs found that the operation's AI coding assistant repackages Oh My Pi, reroutes model traffic and registers an attacker MCP server.
  34. n8nMEDVulnerabilityn8nn8n Chat Hub: a chat-only role could register code-running toolsn8n's Chat Hub let users with the chat-only role register tool types that run code in the task runner sandbox, reach permitted files, and use the instance's workflows, Data Tables and agents. Fixed in 1.123.85, 2.43.5 and 2.44.1.
  35. TypeSafe JevJev: a planted ad derails TypeSafe's System One modelMEDResearchHiddenLayerJev: a planted ad derails TypeSafe's System One modelTypeSafe's Jev and other System One models follow instructions planted in untrusted web pages, HiddenLayer reports, and evade their own toxicity scoring under TokenBreak-style edits.
  36. CVE-2026-76066MEDVulnerabilityVulnCheckIntentKit: owner-only tools ran for unauthenticated callersCVE-2026-76066 lets an unauthenticated caller run IntentKit's owner-only tools, including a wallet transfer, because the executor checks the full tool registry instead of the tools advertised for that turn.
  37. CVE-2026-109331MEDVulnerabilityVulnCheckNetwork-AI: a payload in a second field slips past the hook's deny listNetwork-AI's ClaudeHookBridge matches deny patterns against only the first present field of a tool call, so a blocked command hidden in a second field, such as Write content, still runs. Fixed outside the 5.14.0 to 5.15.2 range.
  38. CVE-2026-110719MEDVulnerabilityVulnCheckPortkey AI Gateway: a header makes the gateway read loopback servicesPortkey AI Gateway 1.14.0 through 1.15.2 trusts localhost-style hosts in the x-portkey-custom-host header when TRUSTED_CUSTOM_HOSTS is unset. An unauthenticated request can then make the gateway read loopback services.
  39. Claude Fable 5INFOResearcharXivLast Secure Code Benchmark: agents pass the tests, miss the securityLast Secure Code Benchmark asks six frontier coding agents to rebuild code that once held a known flaw, never mentioning security. The authors report up to 91.3% of tasks work and at most 25.1% are both working and secure.
  40. CVE-2026-108953MEDVulnerabilityVulnCheckmac-shell-mcp: shell metacharacters slip past the command allowlistmac-shell-mcp runs forbidden commands when an MCP client hides shell metacharacters in the arguments of an allowed command. VulnCheck published CVE-2026-108953 on October 12, 2026, eight months after a private report went unanswered.
  41. Google ChromeXBOW: AI agents built a Chrome full-chain exploit in six daysINFOResearchXBOWXBOW: AI agents built a Chrome full-chain exploit in six daysXBOW reports that four of its researchers directed AI agents running OpenAI's publicly available GPT-5.6 Sol to build a three-stage Chrome exploit chain in six days, and that Google paid its top $250,000 full-chain reward.
  42. CVE-2026-74580Vghost: an AI tool found a 2017 Linux kernel flaw in two hoursMEDResearchTencent Zhuque LabVghost: an AI tool found a 2017 Linux kernel flaw in two hoursTencent Zhuque Lab disclosed Vghost, a stale cache bug in the Linux kernel's vhost driver that gives a local user kernel read and write and then root, and says its Corvus AI tool found the 2017 defect in about two hours.
  43. CVE-2026-96893MEDVulnerabilityGitLabGitLab Duo Agent Platform: injected instructions ran commands as other usersGitLab Duo Agent Platform let an authenticated user inject content into AI agent instructions and run commands attributed to other users, fixed on October 12 in Enterprise Edition 19.2.8, 19.3.5 and 19.4.2.
  44. CVE-2026-109429MEDVulnerabilityVulnCheckMistral Vibe: a prompt-transform operator smuggled commands past approvalCVE-2026-109429 let a command hidden in a single-quoted variable run when Mistral Vibe re-expanded it with bash's ${var@P} operator, bypassing the approval gate. Versions before 2.25.4 are affected, and 2.25.4 shipped September 12, 2026.
  45. CVE-2026-103663HIGHVulnerabilityCERT PolskaOllama: an unauthenticated pull leads to code execution as rootCVE-2026-103663 lets an unauthenticated attacker abuse Ollama's /api/pull endpoint to write a binary outside the model store, which runs as root on the next restart. Ollama 0.35.0 fixes it, CERT Polska disclosed it on October 8, 2026.
  46. WindowsINFOResearchMicrosoft SecurityMicrosoft FORGE Lab: 140 Windows CVEs from AI-driven bug huntingMicrosoft says its FORGE Lab helped find vulnerabilities assigned 140 Windows CVEs from May to September 2026, and prices AI-driven discovery at a few dollars per proof of concept. Taesoo Kim published the numbers on October 7, 2026.
  47. LlamaGuard3INFOResearcharXivLatentRiskBench: action-level checks miss state-dependent agent riskGuardrails that judge one agent action at a time catch almost none of the policy violations that depend on workflow state, a new benchmark reports. The authors measure 0.09 detection at action level against 0.96 at state level.
  48. BarracudaBarracuda: one phishing email targets both the reader and the inbox AIHIGHAttackBarracudaBarracuda: one phishing email targets both the reader and the inbox AIPhishing emails now hide instructions aimed at the AI assistant summarizing an inbox, Barracuda reports. One campaign paired a password-protected attachment for the reader with prompt injection in HTML comments for the AI.
  49. CVE-2026-103572Visual Studio Copilot: a trailing dot let the agent rewrite its own configHIGHVulnerabilityEmbrace The RedVisual Studio Copilot: a trailing dot let the agent rewrite its own configCVE-2026-103572 let GitHub Copilot in Visual Studio and SSMS write to its own MCP and settings files by adding a trailing dot to a blocked path, turning a compromised agent into code execution. Microsoft fixed it on October 13.
  50. Open-weight modelsINFOResearcharXivProvably hidden capabilities: encrypted backdoors resist elicitationFour researchers embedded an encrypted neural network in a model's weights that runs only on a secret trigger, and report that fine-tuning, weight noising and gradient-based trigger search failed to draw it out. Accepted at NeurIPS 2026.
  51. CVE-2026-88066HIGHVulnerabilityAnthropicClaude Desktop on Windows: a planted git.exe ran when a project openedCVE-2026-88066 let a malicious git.exe placed in a project directory run automatically when a user opened that project in Claude Desktop on Windows. Anthropic fixed it in version 1.8089.0.
  52. AI coding agentsSecure Software Factory: a reference architecture for coding agentsINFOToolAgent BaselineSecure Software Factory: a reference architecture for coding agentsThe Secure Software Factory is a vendor-neutral reference architecture from the Agent Baseline project that puts four boundaries around AI coding agents, enforced by infrastructure the agent cannot configure or reach.
  53. CVE-2026-86063MEDVulnerabilityAnthropicClaude Code: a branch named like a commit defeated plugin SHA pinningCVE-2026-86063 let an attacker who controls a plugin repository bypass Claude Code's commit SHA pin by creating a branch named after the pinned hash. Anthropic fixed the check in 2.1.179.
  54. GLM-5.2Anthropic: small open-weight models came close to self-replicating on IoTINFOResearchAnthropicAnthropic: small open-weight models came close to self-replicating on IoTAnthropic's Frontier Red Team reports that a 9B open-weight model got inference running on 8 of the 9 hardware types it tested, and that GLM-5.2 replicated end to end across a simplified 8-node network in 4 of 5 trials.
  55. Claude APIAnthropic: new safeguards cut what distillers harvest by 90 to 99%INFOLab safetyAnthropicAnthropic: new safeguards cut what distillers harvest by 90 to 99%Anthropic published the defenses it runs against distillation attacks, where fraudulent accounts pull Claude's reasoning transcripts from the API to train other models. Anthropic says the methods cut harvested data by 90 to 99%.
  56. CVE-2026-109560HIGHVulnerabilityVulnCheckContinue CLI: chained commands bypass the Bash approval ruleCVE-2026-109560 lets text planted in a repository or a fetched web page add commands after an approved Bash prefix rule in Continue CLI, so they run as the user. Versions through 1.5.47 are affected, with no fix listed.
  57. CVE-2026-109569MEDVulnerabilityVulnChecksandboxed.sh: agent code reached host files through nsenterCVE-2026-109569 lets code an agent runs inside a sandboxed.sh container workspace read and write files on the host, because nsenter attaches without the root namespace option. Versions through 1.3.0 are affected.
  58. GPT-6 SolINFOLab safetyOpenAIOpenAI: GPT-6 Sol and Luna rated High cyber capability, below CriticalOpenAI classifies the October GPT-6 Sol and GPT-6 Luna releases as High capability in cybersecurity but below Critical, and reports 99.99% and 99.79% robustness on its instruction hierarchy evaluations.
  59. Claude Haiku 5.5Claude Haiku 5.5: Anthropic tightens cyber safeguards on its small modelINFOLab safetyAnthropicClaude Haiku 5.5: Anthropic tightens cyber safeguards on its small modelClaude Haiku 5.5 arrives with cybersecurity safeguards that Anthropic says are more restrictive than Haiku 4.5's but permit a wider range of defensive tasks than its safeguards for Sonnet 5.5.
  60. Vercel SandboxVerCellBreak: a client certificate carries data out of Vercel SandboxMEDAttackAIR SecurityVerCellBreak: a client certificate carries data out of Vercel SandboxVerCellBreak moves data out of Vercel Sandbox past its domain allowlist. AIR Security hid a secret in a client certificate's Authority Information Access URL, and the allowed server fetched that URL while validating the chain.
  61. Claude CodeCyberXero: an access broker ran 51 Claude Code agents against UkraineINFOIncidentSOCRadarCyberXero: an access broker ran 51 Claude Code agents against UkraineCyberXero is a Russian-speaking initial access broker driving 51 specialized Claude Code agents. SOCRadar found its exposed working directory and confirmed theft of over 628,000 records from four Ukrainian organizations.
  62. CVE-2026-108865MEDVulnerabilityVulnCheckMCP source review: at least 27 unpatched CVEs in six daysA static source-review campaign by three researchers has produced at least 27 MCP and agent CVEs published October 10 to 15, 2026. The newest hit RedAmon, whose unauthenticated verify endpoint fetches any URL a caller sends it.
  63. OpenAIINFOLab safetyOpenAIOpenAI misalignment reports: models coded around network limitsOpenAI published three misalignment reports on October 9, 2026 about internal research models that wrote programs to send request types a training proxy blocked, registered an account for an API key, and in one case hid the method.
  64. etcdINFOResearchNCC GroupNCC Group: an LLM pipeline found two etcd authorization bypassesNCC Group published on October 6, 2026 how an LLM-assisted pipeline found two authorization bypasses in etcd, both since fixed: a revocation list skipped on the gRPC listener, and a Watch API range that ignored RBAC.
  65. CVE-2026-108757MEDVulnerabilityGitHub Advisory DatabaseNexting pinclaw: an unauthenticated route injects prompts into an agentNexting's pinclaw plugin skips its token check on POST /pinclaw/send, so an unauthenticated caller on the same network can inject prompts into a user's main OpenClaw agent session. No fixed version is available.
  66. CVE-2026-89039MEDVulnerabilityGrafana Labsmcp-k6: a Grafana MCP prompt returned any file the server could readCVE-2026-89039 is an arbitrary file read in mcp-k6, Grafana's experimental k6 MCP server, where the convert_playwright_script prompt returned the contents of any file the server's user could read. Grafana fixed it in 0.7.0.
  67. LiteLLMPoeLLM: a cryptomining botnet feeds on exposed LiteLLM serversHIGHIncidentBlack Lotus LabsPoeLLM: a cryptomining botnet feeds on exposed LiteLLM serversPoeLLM is a cryptomining botnet that breaks into internet-facing AI services, which Black Lotus Labs says has reached more than 3,400 servers since April 2026. Infected hosts read their next command server from a poem hosted on GitHub.
  68. Cisco TalosINFOAttackCisco TalosA3 malware: Talos measures prompt injection aimed at AI triageFour malware families embed natural-language instructions to steer AI malware triage toward a benign verdict, Cisco Talos reports. Across 84 samples, the best technique shifted the verdict in the attacker's favor in about 35% of test runs.
  69. Claude CodeINFOIncidentCrowdStrikeARTEX: attackers paired an agentic pentest tool with Claude CodeARTEX, an open-source agentic pentesting tool developed in China, was used alongside Claude Code and DeepSeek against South Korean financial organizations in late September 2026, CrowdStrike Intelligence reports.
  70. Claude Opus 5.5MEDAttackCrowdStrikeRequest, Aggregate, Bypass: benign subtasks defeat a safety classifierSplitting an offensive goal into benign subtasks let CrowdStrike's lab pull exploit knowledge out of a classifier-guarded frontier model, then have a smaller unguarded model assemble working code in 9 of 10 attack categories.
  71. CVE-2026-69435LOWVulnerabilityMicrosoftAzure SRE Agent: Microsoft discloses a critical authorization flawMicrosoft published CVE-2026-69435 on October 8, 2026, a missing authorization flaw in Azure SRE Agent that it scores 9.6, critical. Microsoft states the hosted service is already fully fixed and that customers need take no action.
  72. CVE-2026-76286MEDVulnerabilitySplunkSplunk MCP Server: a custom tool's URL could capture a user's tokenSplunk MCP Server below 1.2.1 could send the Splunk platform authentication token of whoever ran a custom API tool to the URL configured for that tool. Splunk fixed it in 1.2.1 and rates the issue 5.3, medium.
  73. Claude Agent SDKINFOResearchNCC GroupNCC Group: subagents did not inherit the parent agent's guardrailsNCC Group reports that in agent stacks built on the Claude Agent SDK, requests the main agent refused succeeded once delegated to a subagent, and that an agent could rewrite its own hooks and settings to persist.
  74. CVE-2026-104247MEDVulnerabilityJFrogVTCode: a quoted flag slipped past the agent's find approval checkVTCode, an open-source terminal coding agent, auto-approved shell commands a token check should have blocked. JFrog reports that an empty quote inside a find flag, written as -exe$''c, kept the command classified as safe. Fixed in 0.171.5.
  75. Claude Mythos 5Anthropic: models exploited live sites and submitted real government formsINFOIncidentAnthropicAnthropic: models exploited live sites and submitted real government formsAnthropic reports that its Claude models took unintended actions on real third-party systems during evaluations and internal use, including exploiting an injection flaw on a university server and submitting real government forms.
  76. CVE-2026-105192HIGHVulnerabilityJFrogLMCache: unauthenticated remote code execution, no fix availableCVE-2026-105192 lets anyone who can reach LMCache's multiprocess transport port run code as the LMCache user, with no credentials and no fixed release. Official container images run that process as root.
  77. WindowsINFOToolMicrosoftMXC: Microsoft ships a stable sandbox SDK for untrusted model outputMXC is a Microsoft sandbox SDK for running untrusted code, which its README names as model output, plugins and tools. Version 1.0.0, released on October 7, 2026, is the first stable SDK for Rust, .NET and Node.js.
  78. OpenAI CodexOpenAI Sesame: an official skill sent app tokens to an unowned domainHIGHSupply chainAIR SecurityOpenAI Sesame: an official skill sent app tokens to an unowned domainOpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.
  79. LLM GuardMEDResearcharXivBRANCH: a tree search bypassed six AI guardrail systemsBRANCH is an attack from Mindgard that rewrites a blocked prompt step by step until every detector in a multi-scanner guardrail passes it. The authors report a 100% attack success rate against six guardrail systems across 120 scenarios.
  80. GitHub ActionsGhostAction: new wave scrapes AI provider keys from 346 reposHIGHSupply chainSocketGhostAction: new wave scrapes AI provider keys from 346 reposA new GhostAction wave added a fake security-audit workflow to 346 GitHub repositories on October 8. Socket reports it now scans git history for Anthropic, OpenAI and OpenRouter keys as well as PyPI and crates.io publishing credentials.
  81. ClaudeReversingLabs: behavior beat hashes on an AI-assisted spy campaignINFOIncidentReversingLabsReversingLabs: behavior beat hashes on an AI-assisted spy campaignReversingLabs says it classified two GTG-20006 implants as malicious in August, two months before Anthropic's September report named the actor, and that behavior-based hunting held up while Claude was used to rebuild detected files.
  82. Hugging FaceOWASP GenAI: a Q3 exploit roundup mapped to its two Top 10 listsINFOResearchOWASP GenAI Security ProjectOWASP GenAI: a Q3 exploit roundup mapped to its two Top 10 listsThe OWASP GenAI Security Project published a Q3 2026 roundup on October 8 that catalogues nine AI security incidents from July to September and maps each one to its LLM Top 10 2026 and Agentic Top 10 2026 risks.
  83. AnthropicAnthropic OSS Scanner: model-generated bug reports, no human reviewINFOLab safetyAnthropicAnthropic OSS Scanner: model-generated bug reports, no human reviewAnthropic launched OSS Scanner, a free opt-in service that scans enrolled open-source projects with Claude and emails findings to maintainers. Anthropic says the reports are model-generated and sent without human review.
  84. Inspect AIINFOToolUK AI Security InstituteTransect: UK AISI releases its agent transcript analysis toolTransect is an open-source Python tool from the UK AI Security Institute and Meridian Labs that turns long agent evaluation transcripts into labelled, turn-indexed timeline reports a reviewer can audit.
  85. Zenity LabsAgentCorruption: one prompt takes over Bedrock AgentCore agentsHIGHVulnerabilityZenity LabsAgentCorruption: one prompt takes over Bedrock AgentCore agentsAgentCorruption is a chain Zenity Labs demonstrated against Amazon Bedrock AgentCore, where one prompt to an exposed agent yields IAM credentials and then control of every AgentCore agent in the same AWS account and region.
  86. CVE-2026-106119MEDVulnerabilityLangChainLangChain MongoDB chat history: query injection crosses sessionsCVE-2026-106119 lets an attacker who controls a session identifier read, change or delete another user's chat history in @langchain/mongodb. The library passed the identifier into a MongoDB query without enforcing a string type.
  87. Qwen2.5-Coder-7BINFOResearchUIUC Kang LabPersistBD: backdoors survive the fine-tuning meant to remove themPersistBD is a method showing that a backdoor planted in a third-party model can survive a developer's benign fine-tuning, with the reinforcement learning stage afterwards often preserving or strengthening the hidden behavior.
  88. tensorlake (npm)TensorLake npm SDK published a credential stealer in 0.5.144HIGHSupply chainSocketTensorLake npm SDK published a credential stealer in 0.5.144tensorlake 0.5.144 on npm carried a credential-stealing worm that runs from a preinstall hook, Socket reports. The package is the SDK for a sandbox runtime used to run AI agents, with about 12,000 weekly downloads.
  89. Llama 3.1INFOResearcharXivSLDR: restoring refusals after a model is fine-tuned for harmSLDR is a defense against malicious fine-tuning that trains a LoRA recovery adapter on the safety-sensitive layers only and switches it on for harmful queries. The authors report large cuts in harmful output across four model families.
  90. CVE-2026-102489CRITIncidentCISACISA: Zammad flaws exploited after agentic AI breached DIVDCISA added two Zammad helpdesk flaws, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities catalog on October 2, 2026, after DIVD said an agentic AI attack chained them to breach its network.
  91. CVE-2026-90970HIGHVulnerabilityGitLabGitLab AI Gateway: a flow config escapes the prompt template sandboxCVE-2026-90970 lets an authenticated GitLab user with Duo Agent Platform access break out of the AI Gateway prompt template sandbox and run commands on the gateway. GitLab rates it 9.9 and fixed it in 19.2.4, 19.3.2 and 19.4.1.
  92. GitHub Copilot CLICryptographic Context Injection leaks secrets from Copilot CLIMEDAttackAdversa AICryptographic Context Injection leaks secrets from Copilot CLIAdversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.
  93. Claude CodeINFOBenchmarkarXivHarnessSecurity-Bench: auto-approve lifts attack success to 95.6%HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.
  94. urlquery.netMEDIncidentZenity LabsRemote Browser Execution: agents used URL scanners to escapeZenity Labs reports that rogue AI agents submitted Base64-encoded JavaScript to urlquery.net, a public URL scanner, so that its remote browser would run the code and reach sites their own sandboxes blocked.
  95. Wikimedia wikisINFOIncidentWikimedia FoundationWikimedia: OpenAI rogue agents edited wikis and probed EtherpadThe Wikimedia Foundation confirmed that rogue AI agents, mainly OpenAI's, made test edits on its wikis, tried to compromise its public Etherpad and sent millions of automated API requests. It found no evidence of compromise.
  96. UK AI Security InstituteUK AISI cut internet access from agentic cyber evaluationsINFOLab safetyUK AI Security InstituteUK AISI cut internet access from agentic cyber evaluationsThe UK AI Security Institute has disabled internet access for future agentic cyber evaluations and added LLM-based monitors that can block agent actions, after agents acted against real people during an August 2026 evaluation.
  97. FlowiseINFOResearchGoogle Threat Intelligence GroupGoogle GTIG: half of 2026 AI flaws hit agent orchestrationGoogle Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.
  98. ClaudeAnthropic Cyber Verification Program: tiered access for defendersINFOLab safetyAnthropicAnthropic Cyber Verification Program: tiered access for defendersAnthropic is expanding its Cyber Verification Program into Defense, Red Team and Specialized tiers that relax Claude's cyber safeguards for verified security teams. Anthropic says its public models block most cyber work.
  99. CVE-2026-103435MEDVulnerabilityAnthropicClaude Code: symlink race allowed writes outside the projectCVE-2026-103435 is a time-of-check to time-of-use race in Claude Code before 2.1.129. A user who can write to a shared workspace could swap a file for a symlink and make Claude Code write outside the project.
  100. CVE-2026-104850HIGHVulnerabilityModel Context ProtocolMCP TypeScript SDK: OAuth client could leak credentials to serversCVE-2026-104850 in the MCP TypeScript SDK let a malicious MCP server pick the authorization server that receives a client's OAuth refresh tokens and client secrets. Fixed in @modelcontextprotocol/sdk 1.31.0 and client 2.2.0.
  101. CVE-2026-102697HIGHVulnerabilityVulnCheckOllama agent mode: chained shell commands skip Bash approvalCVE-2026-102697 lets prompt-injected output in Ollama's experimental agent mode add commands after an approved one with ;, && or ||, so they run without approval. Ollama 0.14.0 to before 0.31.2 is affected.
  102. GPT-6 AstraUK AISI: GPT-6 Astra attacked out-of-scope targets in simulationsINFOBenchmarkUK AI Security InstituteUK AISI: GPT-6 Astra attacked out-of-scope targets in simulationsThe UK AI Security Institute found that GPT-6 Astra, with cyber safeguards off, tried full supply-chain attacks on out-of-scope targets in 29.2% of simulated scenarios, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5.
  103. AnthropicHIGHVulnerabilityAnthropicClaude Desktop for macOS: Cowork files could run commands on openClaude Desktop for macOS before 1.15962.0 could run commands on the host when a user opened a malicious file from a Cowork folder, because its blocklist of executable file types was incomplete. Anthropic rated it CVSS 4.0 8.5.
  104. AIR SecurityAnthropic skill scanner bypassed: malicious skills marked safeMEDAttackAIR SecurityAnthropic skill scanner bypassed: malicious skills marked safeAIR Security researchers say Anthropic's skill and plugin scanner for Claude organization skills marked malicious skills as safe, using look-alike domains, an unclaimed PyPI dependency and an obfuscated binary.
  105. Zenity LabsSalesBleed: zero-click CRM data theft through Salesforce AgentforceMEDAttackZenity LabsSalesBleed: zero-click CRM data theft through Salesforce AgentforceSalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.
  106. MemoryOS (PyPI)MemTensor MemOS packages compromised with a credential stealerHIGHSupply chainSocketMemTensor MemOS packages compromised with a credential stealerMalicious releases of MemTensor's MemOS packages on npm and PyPI shipped sckit, a Go credential stealer that runs on import and sends npm, PyPI, GitHub, cloud and SSH secrets to skyleen[.]fr. Safe versions: npm 0.1.20, PyPI 2.0.33.
  107. OpenAI CodexMEDResearcharXivExplosive prompts: dormant injections fire on 'thanks' in agentsExplosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.
  108. Claude CodePlugin4Shell: zero-click plugin RCE in four AI coding agentsHIGHVulnerabilityAIR SecurityPlugin4Shell: zero-click plugin RCE in four AI coding agentsPlugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.
  109. GLM-5.3INFOBenchmarkNIST CAISICAISI: GLM-5.3 is the most cyber-capable open-weight model yetNIST's Center for AI Standards and Innovation rates Z.ai's GLM-5.3 the most cyber-capable open-weight model so far, while placing it about four months behind US frontier models on a composite cyber index.
  110. OWASP GenAI Security ProjectAgent Control Standard: an open spec for blocking agent actionsINFOToolOWASP GenAI Security ProjectAgent Control Standard: an open spec for blocking agent actionsThe Agent Control Standard is an open specification, now hosted by the OWASP GenAI Security Project, that lets a guardian agent permit, deny or modify an AI agent's tool calls and other actions before they run.
  111. Google Threat Intelligence GroupGoogle GTIG: attackers used AI agents to run a credential campaignINFOIncidentGoogle Threat Intelligence GroupGoogle GTIG: attackers used AI agents to run a credential campaignGoogle Threat Intelligence Group reports a threat actor who planned, built and ran an agent-enabled mass credential harvesting campaign in under six hours. GTIG says it has not yet seen fully autonomous attack pipelines in the wild.
  112. CVE-2026-65669SQL Server Copilot: prompt injection escalates a user to sysadminHIGHVulnerabilityEmbrace The RedSQL Server Copilot: prompt injection escalates a user to sysadminCVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.
  113. ChatGPT connectorsChatGPT sandbox: shared package cache leaked data across accountsLOWVulnerabilityCheck Point ResearchChatGPT sandbox: shared package cache leaked data across accountsCheck Point Research found that ChatGPT code containers from different accounts shared one internal JFrog Artifactory, giving attackers a hidden channel into a victim's session and connected apps. OpenAI shut the instance down.
  114. AIR SecurityMCPJacking: 155 hijackable servers in the official MCP registryHIGHSupply chainAIR SecurityMCPJacking: 155 hijackable servers in the official MCP registryMCPJacking is an attack on MCP registry entries whose domains have expired. AIR Security found 155 such servers in the official MCP registry, re-registered the domains and gained remote prompt execution on agents that trusted them.