Week 44 · October 26 to November 1, 2026
AI security this week
In week 44 of 2026 (October 26 to November 1, 2026), The Injection tracked 6 AI security stories, 2 of them rated high or critical, including "Cloudflare Workers AI: GLM-5.3 answered 155 prompts with other tenants' data" and "OpenHands Agent SDK: the sandbox server listened on every interface". 2 stories came with a CVE. Most affected: Claude apps (2) and OpenAI Codex (1).
Top storyHIGH
OpenHands Agent SDK: the sandbox server listened on every interfaceCVE-2026-112346 let anyone who could reach an OpenHands sandbox port run commands as root and read its stored secrets.
What to do · Upgrade the OpenHands Software Agent SDK to 1.52.0 or later. Check whether any sandbox agent server answers on an address other than 127.0.0.1, and treat secrets held in an exposed workspace or secrets store as compromised.
High 2
HIGH
Vulnerability · VulnCheck · CVE-2026-112346 · CVSS 9.3
OpenHands Agent SDK: the sandbox server listened on every interfaceOpenHands Software Agent SDK before 1.52.0 published its sandbox agent server on every host interface with authentication turned off, VulnCheck reports, so anyone who could reach the port ran commands as root in the sandbox.
HIGH
Incident · Cloudflare
Cloudflare Workers AI: GLM-5.3 answered 155 prompts with other tenants' dataCloudflare's GLM-5.3 model on Workers AI returned data from other customers' requests in 155 responses between August 27 and September 9, after a KV cache pool smaller than the context window triggered an SGLang bug.
Medium 2
MED
Vulnerability · GitHub Advisory Database · CVE-2026-93328 · CVSS 9.3
Google MCP Toolbox: a storage tool copied host files out to any bucketGoogle's MCP Toolbox for Databases had a path traversal and missing authorization flaw in its cloud-storage source: an unauthenticated remote caller could copy host files to outside buckets and overwrite local files, CVE-2026-93328 says.
MED
Research · arXiv
SEMA-Auto: a multi-turn jailbreak that decides when to stopSEMA-Auto is a trained multi-turn attacker that reads each reply and decides on its own when to stop. The authors report 76.0% attack success at one attempt on DeepSeek-V4-Flash, in an average of three turns.
Info 2
INFO
Research · Trail of Bits
Trail of Bits: stable releases ship thousands of unfixed CVEsStable releases carry many known, unfixed security bugs, Trail of Bits reports: 4,562 unique CVEs across 1,128 Debian 13 source packages, and 2,006 in the Linux 5.10.y kernel branch. Maintainers applied 142 of its backports.
INFO
Research · Anthropic
Anthropic: Claude wrote exploit chains for Chrome, Safari, Android and LinuxAnthropic's Frontier Red Team says an unreleased Claude model found flaws in Chrome, Safari, Android, Windows and Linux and wrote working exploit chains for five, including a zero-click remote root bug in the Linux kernel.