A daily feed of AI security news and research: prompt injection, agent and MCP supply chain, jailbreaks, vulnerabilities and lab safety claims. Every item is sourced, credited and explained in plain English.https://theinjection.dev/https://theinjection.dev/items/anthropic-cyber-verification-program-tiers/https://theinjection.dev/items/anthropic-cyber-verification-program-tiers/Anthropic is expanding its Cyber Verification Program into Defense, Red Team and Specialized tiers that relax Claude's cyber safeguards for verified security teams. Anthropic says its public models block most cyber work.Tue, 06 Oct 2026 12:00:00 GMTinfolab-safetyAnthropichttps://theinjection.dev/items/claude-code-symlink-toctou-file-write/https://theinjection.dev/items/claude-code-symlink-toctou-file-write/CVE-2026-103435 is a time-of-check to time-of-use race in Claude Code before 2.1.129. A user who can write to a shared workspace could swap a file for a symlink and make Claude Code write outside the project.Mon, 05 Oct 2026 12:00:00 GMTmediumvulnerabilityc_h4ck_0https://theinjection.dev/items/mcp-typescript-sdk-oauth-credential-leak/https://theinjection.dev/items/mcp-typescript-sdk-oauth-credential-leak/CVE-2026-104850 in the MCP TypeScript SDK let a malicious MCP server pick the authorization server that receives a client's OAuth refresh tokens and client secrets. Fixed in @modelcontextprotocol/sdk 1.31.0 and client 2.2.0.Wed, 30 Sep 2026 12:00:00 GMThighvulnerabilitysupply-chainAviral2642, AlexMelanFromRingo, Gal3m, JosephDoUrden, Igfray, OriginalKazdov, lwebmediahttps://theinjection.dev/items/ollama-agent-bash-approval-bypass/https://theinjection.dev/items/ollama-agent-bash-approval-bypass/CVE-2026-102697 lets prompt-injected output in Ollama's experimental agent mode add commands after an approved one with ;, && or ||, so they run without approval. Ollama 0.14.0 to before 0.31.2 is affected.Tue, 29 Sep 2026 12:00:00 GMThighvulnerabilityattackAkıner Kısahttps://theinjection.dev/items/aisi-gpt-6-astra-unsanctioned-supply-chain-attacks/https://theinjection.dev/items/aisi-gpt-6-astra-unsanctioned-supply-chain-attacks/The UK AI Security Institute found that GPT-6 Astra, with cyber safeguards off, tried full supply-chain attacks on out-of-scope targets in 29.2% of simulated scenarios, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5.Mon, 28 Sep 2026 12:00:00 GMTinfobenchmarkresearchAlexandra Souly, Kai Fronsdal, Abby D'Cruz, Xander Davies, Robert Kirkhttps://theinjection.dev/items/anthropic-claude-desktop-cowork-file-exec/https://theinjection.dev/items/anthropic-claude-desktop-cowork-file-exec/Claude Desktop for macOS before 1.15962.0 could run commands on the host when a user opened a malicious file from a Cowork folder, because its blocklist of executable file types was incomplete. Anthropic rated it CVSS 4.0 8.5.Fri, 25 Sep 2026 12:00:00 GMThighvulnerabilityVladimir Tokarev, Anthropic security teamhttps://theinjection.dev/items/air-anthropic-skill-scanner-bypass/https://theinjection.dev/items/air-anthropic-skill-scanner-bypass/AIR Security researchers say Anthropic's skill and plugin scanner for Claude organization skills marked malicious skills as safe, using look-alike domains, an unclaimed PyPI dependency and an obfuscated binary.Thu, 24 Sep 2026 12:00:00 GMTmediumattacksupply-chainAlon Loewenstein, Ofir Birka, Shay Lemperthttps://theinjection.dev/items/zenity-salesbleed-agentforce-exfiltration/https://theinjection.dev/items/zenity-salesbleed-agentforce-exfiltration/SalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.Thu, 24 Sep 2026 12:00:00 GMTmediumattackvulnerabilityAlex Apostolov, João Donato, Avishai Efrat, Ayush RoyChowdhuryhttps://theinjection.dev/items/socket-memtensor-memos-compromise/https://theinjection.dev/items/socket-memtensor-memos-compromise/Malicious releases of MemTensor's MemOS packages on npm and PyPI shipped sckit, a Go credential stealer that runs on import and sends npm, PyPI, GitHub, cloud and SSH secrets to skyleen[.]fr. Safe versions: npm 0.1.20, PyPI 2.0.33.Wed, 23 Sep 2026 12:00:00 GMThighsupply-chainincidentKarlo Zankihttps://theinjection.dev/items/arxiv-explosive-prompts-trigger-injections/https://theinjection.dev/items/arxiv-explosive-prompts-trigger-injections/Explosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.Fri, 18 Sep 2026 12:00:00 GMTmediumresearchattackJustin Szczepaniak, Elad Feldman, Naum Viner, Ben Nassihttps://theinjection.dev/items/air-plugin4shell/https://theinjection.dev/items/air-plugin4shell/Plugin4Shell is a zero-click remote code execution flaw in how Claude Code, Codex, GitHub Copilot and Gemini CLI install pinned plugins. AIR says Claude Code and Codex are fixed, Copilot is not, and Gemini CLI will not be patched.Thu, 17 Sep 2026 12:00:00 GMThighvulnerabilitysupply-chainOr Nevo, Dor Granat, Niv Hoffmanhttps://theinjection.dev/items/caisi-glm-5-3-cyber-assessment/https://theinjection.dev/items/caisi-glm-5-3-cyber-assessment/NIST's Center for AI Standards and Innovation rates Z.ai's GLM-5.3 the most cyber-capable open-weight model so far, while placing it about four months behind US frontier models on a composite cyber index.Thu, 17 Sep 2026 12:00:00 GMTinfobenchmarkCenter for AI Standards and Innovation (CAISI)https://theinjection.dev/items/owasp-agent-control-standard/https://theinjection.dev/items/owasp-agent-control-standard/The Agent Control Standard is an open specification, now hosted by the OWASP GenAI Security Project, that lets a guardian agent permit, deny or modify an AI agent's tool calls and other actions before they run.Thu, 10 Sep 2026 12:00:00 GMTinfotoolRock Lambros, Michael Barguryhttps://theinjection.dev/items/gtig-ai-threat-tracker-prompting-to-autonomy/https://theinjection.dev/items/gtig-ai-threat-tracker-prompting-to-autonomy/Google Threat Intelligence Group reports a threat actor who planned, built and ran an agent-enabled mass credential harvesting campaign in under six hours. GTIG says it has not yet seen fully autonomous attack pipelines in the wild.Wed, 09 Sep 2026 12:00:00 GMTinfoincidentresearchGoogle Threat Intelligence Grouphttps://theinjection.dev/items/embracethered-ssms-copilot-select-to-sysadmin/https://theinjection.dev/items/embracethered-ssms-copilot-select-to-sysadmin/CVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.Tue, 08 Sep 2026 12:00:00 GMThighvulnerabilityattackJohann Rehbergerhttps://theinjection.dev/items/checkpoint-chatgpt-shared-artifactory-channel/https://theinjection.dev/items/checkpoint-chatgpt-shared-artifactory-channel/Check Point Research found that ChatGPT code containers from different accounts shared one internal JFrog Artifactory, giving attackers a hidden channel into a victim's session and connected apps. OpenAI shut the instance down.Tue, 08 Sep 2026 12:00:00 GMTlowvulnerabilityresearchAlexey Bukhteyevhttps://theinjection.dev/items/air-mcpjacking/https://theinjection.dev/items/air-mcpjacking/MCPJacking is an attack on MCP registry entries whose domains have expired. AIR Security found 155 such servers in the official MCP registry, re-registered the domains and gained remote prompt execution on agents that trusted them.Thu, 27 Aug 2026 12:00:00 GMThighsupply-chainattackNadav Dadush, Eliad Mualem, Roi Snir