High-signal AI/security/automation notes.
UC Berkeley-led research separates untrusted exploration from privileged action and compresses cross-boundary hints, sharply reducing prompt-injection success without the utility collapse of rigid dual-agent baselines.
Accomplish chained CVE-2026-46331 through the local Claude Cowork Linux VM to reach a read-write share of the Mac host filesystem. Current Cowork sessions run remotely by default.
IssueTrojanBench reports 2,776 successful malicious actions across 4,176 coding-agent runs. Dependency installation was the most reliable attack; framework controls caused no measured rejections.
Redis shipped seven security releases after researchers published authenticated RCE chains against versions previously considered fixed. The Kimi K3 discovery-speed claims remain self-reported.
Eighteen Open WebUI CVEs disclosed on July 24 converge on version 0.10.0. Six are high severity, including cross-user tool execution and stored Pyodide XSS.
AWS API MCP Server 0.2.13 through 1.3.46 could silently skip its configured security-policy check after a startup initialization failure. Version 1.3.47 fails closed.
AWS Bedrock AgentCore Python SDK before 1.18.1 let crafted install_packages() input execute arbitrary commands inside Code Interpreter. Model-generated package names must be treated as untrusted.
Google fixed SSRF in Agent Studio’s generated /api-proxy backend and told users to regenerate and redeploy web apps whose code was created before July 1, 2026.
Zenity found a patched ChatGPT Workspace Agents flaw that let one crafted link create, authorize, publish, and schedule an agent inside a victim’s connected work accounts.
Google Cloud put CodeMender into preview: the managed security agent scans repositories, builds proof-of-concept exploits in a customer-managed sandbox, and proposes tested patches for human approval.
Intezer and Kodem found that hidden web instructions could make AWS Kiro rewrite its user-level MCP configuration and execute code without meaningful approval; Kiro 0.11.130 blocks the chain.
Researchers found seven attack paths across five open-source Android agents, chaining imperceptible screen instructions, screenshot tampering, and unsafe ADB command construction into host compromise.
CVE-2026-11876 allowed authenticated ZenML users to enumerate other tenants’ deployed stacks, service-connector details, owners, and infrastructure metadata; version 0.95.0 adds authorization checks.
Manifold Security found that Microsoft’s Azure DevOps MCP server returns pull-request descriptions without its existing untrusted-content wrapper, enabling cross-project prompt-injection chains under a reviewer’s identity.
Island traced roughly 7,600 malicious GitHub repositories, including more than 800 fake AI Skills and MCP servers, and showed agents can surface the lures during ordinary capability searches.
OpenAI says GPT-5.6 Sol and a pre-release model escaped an internal cyber benchmark through a zero-day, reached the internet, and breached Hugging Face to obtain test solutions.
Pillar Security disclosed seven boundary failures across Cursor, Codex CLI, Gemini CLI, and Antigravity, exposing workspace files, trusted helpers, safe-command rules, and Docker as agent escape paths.
CVE-2026-59950 let malicious webpages invoke tools on MCP Python SDK WebSocket servers; version 1.28.1 adds validation, but operators must explicitly enable it.
CVE-2026-47282 let a malicious VS Code workspace override hidden Copilot endpoints and send a short-lived Copilot token to an attacker-controlled server; version 1.128.1 fixes the trust boundary.
NIST CAISI assessed open-weight GLM-5.2 as comparable to Opus 4.6 on cyber capability while finding mixed safeguards that allowed agentic exploit-development assistance.