Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (344)Tools & Comparisons (2)AI Security Research (209)Agent & Supply Chain Security (707)
Microsoft — Poisoned MCP Tool Descriptions Make AI Agents Silently Exfiltrate Company Data
Microsoft research demonstrates how attackers can hijack enterprise AI agents through poisoned MCP tool descriptions, triggering silent data exfiltration without breaking any access rules.
Unit 42 — Phantom Squatting: Attackers Weaponize AI-Hallucinated Domains for Phishing and Malware
Unit 42 found 250,000 unregistered domains hallucinated by LLMs — adversaries are pre-registering them to intercept AI-agent traffic.
Cursor CVE-2026-26268 — Sandbox Escape Lets Attackers Achieve RCE via Prompt Injection in AI Coding Agent
Critical sandbox escape in Cursor AI editor chains prompt injection through MCP manipulation to achieve arbitrary code execution on developer machines.
Djinn Stealer — SimpleHelp CVE-2026-48558 Exploit Targets MCP Configs and AI Dev Credentials
New Djinn Stealer deployed via SimpleHelp RMM exploit specifically harvests MCP configs, AI coding assistant tokens, and cloud credentials from developer machines.
MCP Protocol Rewrite — Session IDs Removed, Security Decisions Shifted to Developers
The biggest MCP rewrite since launch removes session IDs to fix session hijacking but shifts authentication and authorization decisions to server implementers.
Mini Shai-Hulud Worm — 170+ npm and PyPI Packages Compromised in Self-Replicating AI Supply Chain Attack
PromptSnatcher — Chrome Ad-Blockers Secretly Intercepting AI Chats
Two Chrome ad-blocker extensions with 100K+ users have been caught silently exfiltrating full conversation histories from ChatGPT, Claude, Gemini, and five other AI platforms.
Rapid7 — Modernizing Vulnerability Standards for the AI Era
Rapid7 presented a White House policy paper arguing that CVE, CVSS, NVD, and KEV infrastructure were built for human-speed discovery and cannot keep pace with AI-driven vulnerability research.
Wake Forest — 282 iOS AI Apps Leak LLM API Keys in Network Traffic
Wake Forest study finds 282 of 444 iOS AI apps expose API keys or open relays in plaintext network traffic, enabling LLMjacking and unauthorized inference theft.
CVE-2026-33017 — Langflow RCE Exploited for Monero Mining on AI Servers
CVE-2026-33017 (CVSS 9.3) in Langflow allows unauthenticated RCE via Python code injection, actively exploited to deploy Monero cryptominers on AI infrastructure.
CVE-2026-40933 — Flowise MCP stdio RCE: 1-Click Server Takeover via Malicious Workflow
Forbes — Gartner Tells CISOs to Block All AI Browsers as Prompt Injection Defenses Fail
Gartner advises blocking ChatGPT Atlas and Perplexity Comet as CrowdStrike reports prompt injection at 90+ organizations and AI-enabled attacks surge 89%.
Miasma — LeoPlatform Supply Chain Attack Expands to Go, Targets AI Coding Assistants
Miasma malware compromises 23 LeoPlatform npm packages and expands to Go ecosystem, targeting AI coding assistant persistence and GitHub Actions credential theft.
Mitiga — Poisoned Coding Test Turns AI Agent Into Attacker, 1,230+ Repos Leaking API Keys
Mitiga Labs scanned 50,000+ AI instruction files and found 1,230+ repos leaking API keys via poisoned CLAUDE.md and .cursor/rules — plus a real incident where a fake interview repo stole AWS credentials in under two minutes.
Mozilla 0DIN — Clean GitHub Repo Delivers Reverse Shell via AI Coding Agents
VentureBeat — Prompt Injection Exploits Enterprise AI Design Flaws Across Agents, RAG, and Model Routers
VentureBeat analysis shows prompt injection remains the top enterprise AI attack vector, targeting multi-agent architectures, RAG pipelines, and model routers with cross-model, memory, and context overflow techniques.
Microsoft — AutoJack RCE chain hijacks AutoGen Studio agents via MCP WebSocket
AutoJack is a three-bug chain in Microsoft AutoGen Studio where a malicious webpage hijacks a browsing AI agent into executing arbitrary commands on the developer host through an unauthenticated local MCP WebSocket.
Black Hat 2026 — First Copilot Sandbox Escape, AI Agent Exploitation & Offensive Models
Black Hat USA 2026 briefings reveal the first Copilot sandbox escape, trust-handoff failures across major AI vendors, and a 30B open-source model that outperforms frontier LLMs at agent exploitation.