High-signal AI/security/automation notes.
Systemic GitHub Actions vulnerability class lets anonymous attackers hijack pipelines at Microsoft, Google AI Agent Development Kit, Apache, Cloudflare, and Python Software Foundation.
Zafran Security discloses DifyTap flaws enabling unauthenticated cross-tenant data theft in popular agentic AI platform.
OpenAI expands Daybreak initiative with GPT-5.5-Cyber model and Codex Security plugin to find, validate, and patch vulnerabilities at machine speed.
OWASP releases first MCP Top 10 framework as 30+ CVEs hit in early 2026, with 78.3% attack success rate and 82% path traversal exposure across MCP servers.
CVE-2026-12045 (CVSS 9.0) in pgAdmin 4 allows attackers to bypass AI Assistant read-only transaction protections and execute arbitrary commands via prompt injection.
Manifold Security discovers 23 ClawHub plugins squatting on official organizational scopes, highlighting supply chain risks in AI agent plugin ecosystems.
CVE-2026-54236 reveals that certain vLLM API routes and WebSocket handlers bypass global exception sanitization, leaking memory addresses and sensitive information in logs prior to v0.23.1rc0.
A coordinated campaign of 15 JetBrains IDE plugins published under seven vendor accounts exfiltrates AI provider API keys to an attacker-controlled server, with ~70,000 installs since October 2025.
North Korean state-sponsored Sapphire Sleet compromised the Mastra AI agent framework via NPM supply chain attack, injecting crypto-targeting malware into 141 packages.
OrcaRouter publishes its AI Threat Report 2026 covering 14 key risks across four categories, and makes its agent Firewall and input/output Guardrails free for all users.
Security Boulevard analysis finds the MCP ecosystem has 973 packages with 71% single-maintainer, 45% failure rate across 150+ LLMs for AI-generated code, and 55.8% provable vulnerability rate in formal verification.
SpecterOps demonstrates how SQL Server 2025 native AI features — sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL, AI_GENERATE_EMBEDDINGS — can be abused for stealthy data exfiltration and covert C2 channels.
CVE-2026-41523 and CVE-2026-54235 reveal how assert-based security checks and float validation gaps in vLLM enable RCE and GPU kernel manipulation.
Tenet Security demonstrates Agentjacking: injected Sentry error events hijack AI coding agents via MCP, achieving 85% execution rate across Claude Code, Cursor, and Codex.
CISA adds actively exploited LiteLLM command injection to KEV catalog; chained with Starlette CVE-2026-48710, it yields unauthenticated RCE on AI gateway hosts.
Socket researchers discovered 23 new malicious PyPI artifacts from the Shai-Hulud campaign, featuring split-staging loaders, native extension payloads, and LLM anti-analysis tricks targeting MCP developers.