Week 46 · November 9 to November 15, 2026
AI security this week
In week 46 of 2026 (November 9 to November 15, 2026), The Injection tracked 10 AI security stories, including "Microsoft MCP Gateway: a CVSS 8.8 CVE for the name collision flaw" and "Agent Swarms: DeepMind automates adaptive prompt injection". 3 stories came with a CVE. Most affected: Claude apps (4), Claude Code (1) and OpenAI Codex (1).
Top storyMED
Microsoft MCP Gateway: a CVSS 8.8 CVE for the name collision flawCVE-2026-109492 is an authorization bypass in Microsoft MCP Gateway that lets one authenticated user reach another user's workloads.
What to do · Update to MCP Gateway 1.0.0 or later, which reserves the toolgateway name, requires names to be unique across adapters and tools, and fails creation when the Kubernetes object already exists. Until the update lands, the project advises limiting management API access to trusted users.
Medium 4
MED
Vulnerability · Microsoft · CVE-2026-109492 · CVSS 8.8
Microsoft MCP Gateway: a CVSS 8.8 CVE for the name collision flawMicrosoft assigned CVE-2026-109492, which it rates CVSS 8.8, to an authorization bypass in its open-source MCP Gateway. NVD lists versions before 1.0.0 as affected, the release that fixed the gateway's name collision flaw.
MED
Vulnerability · The Apache Software Foundation · CVE-2026-82436
Apache: Claude security scans are the credited finder on five CVEsThe Apache Software Foundation published 20 advisories on November 9, and five credit an AI scan as the finder: two Apache Storm CVEs name Claude Agents, and three Apache Airflow CVEs name Claude Security Scans.
MED
Vulnerability · VulnCheck · CVE-2026-125368 · CVSS 7.7
OmniAgent: find -execdir runs commands past the approval gateOmniAgent treats any shell command starting with find as safe, so a prompt-injected agent can use find -execdir to run binaries with no human approval. VulnCheck published the advisory, credited to George Chen, on November 9.
MED
Research · Google DeepMind
Agent Swarms: DeepMind automates adaptive prompt injectionGoogle DeepMind reports that an automated attacker built from swarms of LLM agents drove attack resistance to 10% or less on six of seven models tested, including models that score as robust on public benchmarks.
Info 6
INFO
Research · OWASP GenAI Security Project
OWASP: version 2 of its guide to securing agentic applicationsOWASP GenAI Security Project released Securing Agentic Applications V2, a 106 page builder and defender guide covering secure architectures, identity and access control, runtime protection, supply chain security and assurance testing.
INFO
Benchmark · Wiz
Cyber Model Arena: Wiz scores 59 AI agents on offensive tasksWiz relaunched Cyber Model Arena, a benchmark that runs 59 agent configurations against 327 offensive security challenges with deterministic graders, and reports that the harness around a model shifts its score by about 5 points.
INFO
Research · Microsoft Research
Lazarus: seven neurons turn an agent model into a sleeper agentLazarus is a weight-editing attack from Microsoft Research that backdoors an AI agent by changing fewer than ten neurons, with no training. The edited model passes standard evaluations. Microsoft says it has seen no attacker use.
INFO
Research · Microsoft
Microsoft FORGE Lab: AI scanning helped find Rust standard library bugsMicrosoft's FORGE Lab published the memory-safety bugs it reported in Rust's core and std libraries, several of which let safe code reach undefined behavior. Microsoft says some were found with Hyenas, its AI vulnerability scanner.
INFO
Lab safety · Anthropic
Claude Mythos 5.2: Anthropic's highest cyber scores, gated to vetted orgsClaude Mythos 5.2 is Anthropic's most cyber-capable model, scoring 89.6% on its CVE Rediscovery evaluation against 78.3% for Mythos 5.1. Anthropic restricts Mythos 5.2 to vetted organizations and says Fable 5.2 blocks most cyber tasks.
INFO
Research · VulnCheck
VulnCheck: 442 CVEs from Anthropic's Glasswing, two exploitedVulnCheck counts 442 CVEs credited to Anthropic's Glasswing effort in seven months and says two are known to be exploited. Anthropic's ledger shows 217 findings fixed, against 1,654 duplicates and 419 withdrawn.