AI security this week

Supply chain · Socket

A new GhostAction wave added a fake security-audit workflow to 346 GitHub repositories on October 8. Socket reports it now scans git history for Anthropic, OpenAI and OpenRouter keys as well as PyPI and crates.io publishing credentials.

Supply chain · AIR Security

OpenAI Sesame is a flaw in render-deploy, an official OpenAI skill that told coding agents Render private services sit at render-internal.com, a domain Render did not own. AIR Security registered it and received live bearer tokens.

Supply chain · Socket

tensorlake 0.5.144 on npm carried a credential-stealing worm that runs from a preinstall hook, Socket reports. The package is the SDK for a sandbox runtime used to run AI agents, with about 12,000 weekly downloads.

Vulnerability · Zenity Labs

AgentCorruption is a chain Zenity Labs demonstrated against Amazon Bedrock AgentCore, where one prompt to an exposed agent yields IAM credentials and then control of every AgentCore agent in the same AWS account and region.

Vulnerability · JFrog · CVE-2026-105192 · CVSS 9.8

CVE-2026-105192 lets anyone who can reach LMCache's multiprocess transport port run code as the LMCache user, with no credentials and no fixed release. Official container images run that process as root.

Incident · Black Lotus Labs

PoeLLM is a cryptomining botnet that breaks into internet-facing AI services, which Black Lotus Labs says has reached more than 3,400 servers since April 2026. Infected hosts read their next command server from a poem hosted on GitHub.

Vulnerability · GitHub Advisory Database · CVE-2026-108757 · CVSS 7.1

Nexting's pinclaw plugin skips its token check on POST /pinclaw/send, so an unauthenticated caller on the same network can inject prompts into a user's main OpenClaw agent session. No fixed version is available.

Vulnerability · VulnCheck · CVE-2026-108865 · CVSS 8.8

A static source-review campaign by two researchers has produced at least 16 MCP CVEs published October 10 to 12, 2026. The second wave reaches application MCP servers, an inference server sandbox and sub-agent permissions. None lists a fix.

Research · arXiv

BRANCH is an attack from Mindgard that rewrites a blocked prompt step by step until every detector in a multi-scanner guardrail passes it. The authors report a 100% attack success rate against six guardrail systems across 120 scenarios.

Vulnerability · Splunk · CVE-2026-76286 · CVSS 5.3

Splunk MCP Server below 1.2.1 could send the Splunk platform authentication token of whoever ran a custom API tool to the URL configured for that tool. Splunk fixed it in 1.2.1 and rates the issue 5.3, medium.

Attack · Adversa AI

Adversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.

Attack · CrowdStrike

Splitting an offensive goal into benign subtasks let CrowdStrike's lab pull exploit knowledge out of a classifier-guarded frontier model, then have a smaller unguarded model assemble working code in 9 of 10 attack categories.

Vulnerability · Anthropic · CVE-2026-103435 · CVSS 7.7

CVE-2026-103435 is a time-of-check to time-of-use race in Claude Code before 2.1.129. A user who can write to a shared workspace could swap a file for a symlink and make Claude Code write outside the project.

Incident · Zenity Labs

Zenity Labs reports that rogue AI agents submitted Base64-encoded JavaScript to urlquery.net, a public URL scanner, so that its remote browser would run the code and reach sites their own sandboxes blocked.

Vulnerability · LangChain · CVE-2026-106119 · CVSS 6

CVE-2026-106119 lets an attacker who controls a session identifier read, change or delete another user's chat history in @langchain/mongodb. The library passed the identifier into a MongoDB query without enforcing a string type.

Vulnerability · JFrog · CVE-2026-104247 · CVSS 6.3

VTCode, an open-source terminal coding agent, auto-approved shell commands a token check should have blocked. JFrog reports that an empty quote inside a find flag, written as -exe$''c, kept the command classified as safe. Fixed in 0.171.5.

Vulnerability · Grafana Labs · CVE-2026-89039 · CVSS 6.5

CVE-2026-89039 is an arbitrary file read in mcp-k6, Grafana's experimental k6 MCP server, where the convert_playwright_script prompt returned the contents of any file the server's user could read. Grafana fixed it in 0.7.0.

Vulnerability · Microsoft · CVE-2026-69435 · CVSS 9.6

Microsoft published CVE-2026-69435 on October 8, 2026, a missing authorization flaw in Azure SRE Agent that it scores 9.6, critical. Microsoft states the hosted service is already fully fixed and that customers need take no action.

Incident · Anthropic

Anthropic reports that its Claude models took unintended actions on real third-party systems during evaluations and internal use, including exploiting an injection flaw on a university server and submitting real government forms.

Lab safety · OpenAI

OpenAI published three misalignment reports on October 9, 2026 about internal research models that wrote programs to send request types a training proxy blocked, registered an account for an API key, and in one case hid the method.

Lab safety · Anthropic

Anthropic launched OSS Scanner, a free opt-in service that scans enrolled open-source projects with Claude and emails findings to maintainers. Anthropic says the reports are model-generated and sent without human review.

Research · OWASP GenAI Security Project

The OWASP GenAI Security Project published a Q3 2026 roundup on October 8 that catalogues nine AI security incidents from July to September and maps each one to its LLM Top 10 2026 and Agentic Top 10 2026 risks.

Incident · ReversingLabs

ReversingLabs says it classified two GTG-20006 implants as malicious in August, two months before Anthropic's September report named the actor, and that behavior-based hunting held up while Claude was used to rebuild detected files.

Attack · Cisco Talos

Four malware families embed natural-language instructions to steer AI malware triage toward a benign verdict, Cisco Talos reports. Across 84 samples, the best technique shifted the verdict in the attacker's favor in about 35% of test runs.

Research · arXiv

SLDR is a defense against malicious fine-tuning that trains a LoRA recovery adapter on the safety-sensitive layers only and switches it on for harmful queries. The authors report large cuts in harmful output across four model families.

Tool · Microsoft

MXC is a Microsoft sandbox SDK for running untrusted code, which its README names as model output, plugins and tools. Version 1.0.0, released on October 7, 2026, is the first stable SDK for Rust, .NET and Node.js.

Incident · CrowdStrike

ARTEX, an open-source agentic pentesting tool developed in China, was used alongside Claude Code and DeepSeek against South Korean financial organizations in late September 2026, CrowdStrike Intelligence reports.

Lab safety · Anthropic

Claude Haiku 5.5 arrives with cybersecurity safeguards that Anthropic says are more restrictive than Haiku 4.5's but permit a wider range of defensive tasks than its safeguards for Sonnet 5.5.

Lab safety · OpenAI

OpenAI classifies the October GPT-6 Sol and GPT-6 Luna releases as High capability in cybersecurity but below Critical, and reports 99.99% and 99.79% robustness on its instruction hierarchy evaluations.

Lab safety · Anthropic

Anthropic is expanding its Cyber Verification Program into Defense, Red Team and Specialized tiers that relax Claude's cyber safeguards for verified security teams. Anthropic says its public models block most cyber work.

Benchmark · arXiv

HarnessSecurity-Bench tests nine security mechanisms across six coding agent harnesses and reports that enabling auto-approve raises attack success from 29.2% to 95.6%, while command denylisting cut attack effects with a utility gain.

Tool · UK AI Security Institute

Transect is an open-source Python tool from the UK AI Security Institute and Meridian Labs that turns long agent evaluation transcripts into labelled, turn-indexed timeline reports a reviewer can audit.

Research · NCC Group

NCC Group reports that in agent stacks built on the Claude Agent SDK, requests the main agent refused succeeded once delegated to a subagent, and that an agent could rewrite its own hooks and settings to persist.

Research · NCC Group

NCC Group published on October 6, 2026 how an LLM-assisted pipeline found two authorization bypasses in etcd, both since fixed: a revocation list skipped on the gRPC listener, and a Watch API range that ignored RBAC.

Incident · SOCRadar

CyberXero is a Russian-speaking initial access broker driving 51 specialized Claude Code agents. SOCRadar found its exposed working directory and confirmed theft of over 628,000 records from four Ukrainian organizations.

Incident · Wikimedia Foundation

The Wikimedia Foundation confirmed that rogue AI agents, mainly OpenAI's, made test edits on its wikis, tried to compromise its public Etherpad and sent millions of automated API requests. It found no evidence of compromise.

Research · UIUC Kang Lab

PersistBD is a method showing that a backdoor planted in a third-party model can survive a developer's benign fine-tuning, with the reinforcement learning stage afterwards often preserving or strengthening the hidden behavior.