AI security this week

Vulnerability · VulnCheck · CVE-2026-122135 · CVSS 8.6

Mistral Vibe ran commands from a repository's own Git configuration at session start, before the trust prompt appeared. Francisco Rosales of Manifold Security found three such flaws, all fixed by version 3.0.3.

Incident · GitBook

An attacker using AI agents reached some of GitBook's infrastructure credentials on November 2, 2026. Integration tokens, Git Sync secrets, API tokens and questions sent to GitBook Assistant may be exposed. Customers must rotate secrets.

Vulnerability · JFrog · CVE-2026-96455 · CVSS 8.8

Reachy Mini, the open-source robot from Pollen Robotics and Hugging Face, exposes an unauthenticated install endpoint that runs attacker code as root. JFrog published the full chain on November 3 and recommends blocking port 8000.

Supply chain · Glow Labs

AI coding agents pick deprecated Model Context Protocol servers out of their training data and install them, Glow Labs reports. The archived servers carry four high-severity flaws, including a prompt-injection RCE, and no fix is coming.

Vulnerability · VulnCheck · CVE-2026-82033 · CVSS 8.6

DeepSeek Harness left its local web control plane unauthenticated, so any process on the machine could start a session, run the agent's bash and filesystem tools, and answer the human approval prompts itself.

Vulnerability · SurrealDB

SurrealDB's MCP server accepted a backslash-escaped backtick as the end of an identifier, letting attacker input run as raw SurrealQL through MCP tool calls. SurrealDB fixed the flaw in version 4.0.0 and credits ARSB.

Vulnerability · Instatic · CVE-2026-121458 · CVSS 6.5

Instatic's AI and MCP content read tools skipped the object-level authorization checks its HTTP API applies, letting any user with chat and own-content rights read other users' private drafts. Fixed in 0.0.21; found by Sriman Aluvala.

Research · Technion

Voluntary Servitude is an injection that carries no instructions: a fabricated safety warning in content an agent reads makes the agent rule out the safe option on its own. Two detectors scored the payloads benign, the authors report.

Supply chain · Check Point Research

Haiou is a jailbreak bundle for OpenAI Codex that rewrites the agent's global instructions so that greetings return an advertisement for an opaque LLM gateway. Check Point Research found no sign the gateway itself is malicious.

Vulnerability · VulnCheck · CVE-2026-120492 · CVSS 6.3

Chainlit 2.12.0 does not reject semicolons when it checks an MCP URL against its allowlist, so a "..;" segment reaches paths the operator never granted. VulnCheck published CVE-2026-120492 on November 2 and lists no fixed version.

Incident · Google Threat Intelligence Group

LLMjacking cost one organization nearly $1 million in under 8 hours, Google Threat Intelligence Group reports. An illicit gateway called Jet Night ran more than 500,000 model calls on stolen keys and resold the access for about $60 a month.

Research · Dynatrace

Poisoned MCP tool descriptions made agents carry out the attacker's action in 22.9% of 9,720 tested combinations, Dynatrace researchers report, and a code audit of the 12 frameworks found no intentional defense in any of them.

Benchmark · Collinear AI

Collinear AI released CWE-bench v2 on November 3, 2026: 100 open tasks across 91 CWE types where an agent must find and fix a real security weakness without breaking the code. The best model passes 67.8% on the first attempt.

Research · Trail of Bits

Stable releases carry many known, unfixed security bugs, Trail of Bits reports: 4,562 unique CVEs across 1,128 Debian 13 source packages, and 2,006 in Linux 5.10.y. Its Codex-assisted program has delivered fixes for 149 CVEs.

Incident · Kaspersky

Kaspersky found CyberStrikeAI, an open-source AI pentest framework, in attacks on education organizations in Africa and Latin America. A server-side model chose each command, and the chain reached domain administrator in 3 to 4 days.

Tool · Anthropic

FlashProve is an open-source prototype from Anthropic that uses zero-knowledge proofs to show a reply came from a committed set of model weights, without revealing them. Anthropic measures proving at about 72 times the cost of vLLM.