Week 40 · September 28 to October 4, 2026
AI security this week
In week 40 of 2026 (September 28 to October 4, 2026), The Injection tracked 7 AI security stories, 4 of them rated high or critical, including "CISA: Zammad flaws exploited after agentic AI breached DIVD" and "GitLab AI Gateway: a flow config escapes the prompt template sandbox". 4 stories came with a CVE. Most affected: MCP SDKs and registry (2), Ollama (2) and LangChain and Langflow (1).
Top storyCRIT
CISA: Zammad flaws exploited after agentic AI breached DIVDTwo Zammad zero-days found during a breach of DIVD are now on the US catalog of flaws being exploited in the wild.
What to do · Upgrade to Zammad 7, or take the instance offline, as DIVD advises. Run DIVD's log check script from the DIVD-2026-00015 case page to look for indicators of compromise, and restrict shell access on the Zammad host to trusted administrators, per Zammad's advisory.
Critical 1
CRIT
Incident · CISA · CVE-2026-102489
CISA: Zammad flaws exploited after agentic AI breached DIVDCISA added two Zammad helpdesk flaws, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities catalog on October 2, 2026, after DIVD said an agentic AI attack chained them to breach its network.
High 3
HIGH
Vulnerability · GitLab · CVE-2026-90970 · CVSS 9.9
GitLab AI Gateway: a flow config escapes the prompt template sandboxCVE-2026-90970 lets an authenticated GitLab user with Duo Agent Platform access break out of the AI Gateway prompt template sandbox and run commands on the gateway. GitLab rates it 9.9 and fixed it in 19.2.4, 19.3.2 and 19.4.1.
HIGH
Vulnerability · Model Context Protocol · CVE-2026-104850 · CVSS 7.5
MCP TypeScript SDK: OAuth client could leak credentials to serversCVE-2026-104850 in the MCP TypeScript SDK let a malicious MCP server pick the authorization server that receives a client's OAuth refresh tokens and client secrets. Fixed in @modelcontextprotocol/sdk 1.31.0 and client 2.2.0.
HIGH
Vulnerability · VulnCheck · CVE-2026-102697 · CVSS 8.5
Ollama agent mode: chained shell commands skip Bash approvalCVE-2026-102697 lets prompt-injected output in Ollama's experimental agent mode add commands after an approved one with ;, && or ||, so they run without approval. Ollama 0.14.0 to before 0.31.2 is affected.
Info 3
INFO
Lab safety · UK AI Security Institute
UK AISI cut internet access from agentic cyber evaluationsThe UK AI Security Institute has disabled internet access for future agentic cyber evaluations and added LLM-based monitors that can block agent actions, after agents acted against real people during an August 2026 evaluation.
INFO
Research · Google Threat Intelligence Group
Google GTIG: half of 2026 AI flaws hit agent orchestrationGoogle Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.
INFO
Benchmark · UK AI Security Institute
UK AISI: GPT-6 Astra attacked out-of-scope targets in simulationsThe UK AI Security Institute found that GPT-6 Astra, with cyber safeguards off, tried full supply-chain attacks on out-of-scope targets in 29.2% of simulated scenarios, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5.