Posts

TrapDoor Supply Chain — .cursorrules and CLAUDE.md Hijack AI Assistants

TrapDoor campaign weaponizes .cursorrules and CLAUDE.md files via cross-ecosystem supply chain attacks on npm, PyPI, and Crates.io to hijack AI coding assistants.

1Password + OpenAI — Just-in-Time Credentials for Codex Agents

1Password partners with OpenAI to deliver an Environments MCP Server for Codex, issuing just-in-time scoped credentials that never appear in prompts or model context.

Adaptive Security — 80% of employees use unapproved AI tools, 12% of companies govern them

Adaptive Security research reveals an 8-to-1 gap between shadow AI adoption and enterprise governance, with OAuth scopes representing the real data-exposure surface.

Anthropic — Glasswing discovers 10,000+ zero-days, only 97 patched so far

arXiv — HBHC Protocol Solves Zombie Agent Credential Revocation

New cryptographic protocol binds credential validity to parent liveness proofs, achieving 90× faster revocation than OAuth 2.0 for AI agent swarms.

arXiv OverEager — coding agents exceed authorized scope on benign tasks

New arXiv paper quantifies overeager actions in coding agents like Claude Code, Codex CLI, and Gemini CLI on harmless tasks.

Aikido Security — Laravel-Lang supply chain delivers cross-platform credential stealer

Over 233 malicious versions of popular Laravel-Lang PHP packages were injected with a credential-stealing backdoor via poisoned GitHub version tags targeting developer infrastructure.

LMDeploy CVE-2026-46517 — hardcoded trust_remote_code bypasses HF default-secure

MDPI — attack surfaces of malicious remote MCP servers across LLM platforms

New MDPI paper categorizes MCP server attack surfaces into LLM-passive and LLM-active frameworks across multiple platforms.

NVIDIA OpenShell — open-source secure sandboxed runtime for AI agents

NVIDIA open-sources OpenShell, a sandboxed execution runtime for autonomous AI agents with declarative YAML policy enforcement.

arXiv — ASPI Shows Clarification-Seeking Amplifies Prompt Injection in LLM Agents

New benchmark reveals that asking agents to seek clarification before acting increases prompt injection success from ~2% to ~35% across frontier models.

arXiv — Domain-Camouflaged Prompt Injections Evade LLM Injection Detectors

New paper shows injection detectors drop from 93.8% to 9.7% detection when payloads mimic target-domain vocabulary, revealing a systemic blind spot in multi-agent LLM security.

CISA Adds Langflow Origin Validation Flaw to KEV — Active Exploitation Confirmed

CISA added CVE-2025-34291, a critical origin validation error in the Langflow AI builder platform, to its Known Exploited Vulnerabilities catalog with a CVSS score of 9.4.

Google Threat Intel — LLM-Generated Morphing Malware and Automated Vulnerability Discovery

Splunk AI Toolkit — CVE-2026-20238 Improper Access Control

Splunk patches three vulnerabilities in its AI Toolkit, including CVE-2026-20238 allowing low-privilege attackers to bypass role-based access control and trigger DoS conditions.

TeamPCP — 20-Wave Supply-Chain Campaign Hits 500+ Tools, GitHub

Trump Scraps AI Executive Order on Frontier Model Oversight

Trump abruptly postponed a planned AI executive order that would have required pre-deployment government review of frontier models, after pressure from tech leaders.

WordPress 7.0 — AI Agent Infrastructure and API Key Theft Risk

WordPress 7.0 ships AI client, Connectors API, Abilities API, and an MCP adapter, centralizing high-value API keys across 43% of the web.

arXiv: AI Agents May Always Fall for Prompt Injections

New arXiv paper recasts prompt injection through Contextual Integrity theory, demonstrating an impossibility result: any defense tight enough to block attacks will also break legitimate agent workflows.

arXiv — Securing LLM Agents Needs Intent-to-Execution Integrity (2605.16976)

NUS/UCLA/Berkeley researchers propose intent-to-execution integrity as a correctness property for LLM agent security, analyzing defense gaps in systems like OpenClaw, NemoClaw, and SeClaw.