Week 39 · September 21 to September 27, 2026
AI security this week
In week 39 of 2026 (September 21 to September 27, 2026), The Injection tracked 4 AI security stories, 2 of them rated high or critical, including "Claude Desktop for macOS: Cowork files could run commands on open" and "MemTensor MemOS packages compromised with a credential stealer". Most affected: Claude apps (2).
Top storyHIGH
Claude Desktop for macOS: Cowork files could run commands on openA file type macOS runs on open was missing from Claude Desktop's blocklist, so agent-written files could execute.
What to do · Make sure managed or manually updated Macs run Claude Desktop 1.15962.0 or later, and treat files an agent writes into Cowork folders as untrusted.
High 2
HIGH
Vulnerability · Anthropic · CVSS 8.5
Claude Desktop for macOS: Cowork files could run commands on openClaude Desktop for macOS before 1.15962.0 could run commands on the host when a user opened a malicious file from a Cowork folder, because its blocklist of executable file types was incomplete. Anthropic rated it CVSS 4.0 8.5.
HIGH
Supply chain · Socket
MemTensor MemOS packages compromised with a credential stealerMalicious releases of MemTensor's MemOS packages on npm and PyPI shipped sckit, a Go credential stealer that runs on import and sends npm, PyPI, GitHub, cloud and SSH secrets to skyleen[.]fr. Safe versions: npm 0.1.20, PyPI 2.0.33.
Medium 2
MED
Attack · Zenity Labs
SalesBleed: zero-click CRM data theft through Salesforce AgentforceSalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.
MED
Attack · AIR Security
Anthropic skill scanner bypassed: malicious skills marked safeAIR Security researchers say Anthropic's skill and plugin scanner for Claude organization skills marked malicious skills as safe, using look-alike domains, an unclaimed PyPI dependency and an obfuscated binary.