Posts

LLMjacking: Five Routes Attackers Use to Steal Inference

Kodem Security and Intezer research maps five methods threat actors use to access LLM inference for free, from underground offensive models to exposed self-hosted servers.

Miasma npm Worm Hits 57 Packages via binding.gyp

A self-replicating npm worm named Miasma compromised 57 packages across 286 malicious versions, using binding.gyp to execute at install time and steal multi-cloud credentials.

Microsoft — Framework CVEs: Prompt Injection to RCE Across Semantic Kernel, CrewAI, LangChain

NSA Issues MCP Security Guidance for AI Agent Protocol

The NSA released a Cybersecurity Information Sheet warning that MCP adoption has outpaced its security model, citing weak access controls, open-ended serialization, and unsafe tool execution.

Nx Console VS Code Extension — Poisoned Extension Breaches 3,800 GitHub Internal Repos

A poisoned Nx Console VS Code extension (CVE-2026-48027) exfiltrated developer credentials and led to the theft of 3,800 internal GitHub repositories by TeamPCP.

OpenAI — ChatGPT Lockdown Mode to Block Prompt-Injection Exfiltration

OpenAI launched Lockdown Mode for ChatGPT on June 6, 2026 — an optional toggle that disables outbound-connected features to break the data-exfiltration leg of prompt-injection attacks.

Sophos X-Ops — Threat Actors Use AI Coding Agents to Build EDR Evasion Frameworks

Sophos observed a threat actor using Cursor and Claude Opus agents to develop and test an EDR-evasion framework tied to ransomware deployment and data theft operations.

Trail of Bits Bypasses ClawHub, Cisco & Vercel AI Skill Scanners

Trail of Bits demonstrates multiple bypass techniques against AI skill scanners from ClawHub, Cisco, and Vercel, showing that automated scanning alone cannot secure agent skill ecosystems.

Adversa AI — Coding Agent RCE Roundup: SymJack, TrustFall, Copirate 365

A cluster of recent disclosures reveals widespread RCE vulnerabilities across AI coding agents: SymJack affects six tools via symlink hijacking, TrustFall enables one-click RCE through regressed trust dialogs, and Copirate 365 demonstrates persistent Copilot backdoors at DEF CON.

RyotaK — Claude Code GitHub Actions Supply Chain Compromise via Permission Bypass

CloudSEK AIVigil — Unauthenticated MCP Server Led to SSRF and AWS Credential Theft

HTTP/2 Bomb — OpenAI Codex Chains Decade-Old DoS Into Web Server Crash

JFrog — IronWorm: Rust-Based npm Worm with eBPF Rootkit Targets AI/Dev Tooling

JFrog discovers IronWorm, a Rust-built self-replicating npm worm with eBPF kernel rootkit that harvests AI developer credentials (Codex, Anthropic, Gemini, Cursor) and propagates via GitHub.

Kiteworks — The Lethal Trifecta: Why Most AI Agents Are Structurally Exploitable

Kiteworks research identifies a lethal trifecta — any AI agent that accesses private data, processes untrusted content, and can communicate externally is structurally exploitable, confirmed by documented production failures.

Miasma Worm Targets AI Coding Agents via GitHub Repo Config Injection

A parallel arm of the Miasma worm campaign pushes malicious commits to 120+ GitHub repos, exploiting Claude Code, Cursor, and VS Code auto-run features to detonate a credential harvester on folder open.

Microsoft — Updated Agentic AI Failure Modes Taxonomy (7 New)

Microsoft expanded its agentic AI failure modes taxonomy with seven new categories covering supply chain, goal hijacking, CUA visual attacks, and MCP/plugin abuse.

Adversa SymJack — Symlink-Hijack RCE in AI Coding Agents

VIPER-MCP Scans 40,000 Repos, Finds 106 Zero-Days in MCP Servers

VIPER-MCP framework scanned ~40,000 open-source MCP server repositories and discovered 106 zero-day taint-style vulnerabilities, producing 67 CVEs to date.

Anthropic Frontier Red Team — AI Cyber Threats Mapped to MITRE ATT&CK

CVE-2026-45497 — Microsoft 365 Copilot Critical Command Injection RCE

Microsoft disclosed CVE-2026-45497, a CVSS 9.8 critical RCE via command injection in the M365 Copilot orchestration engine, silently patched in the cloud.