Posts

Bishop Fox — AIMap Open-Source AI Infrastructure Scanner

Bishop Fox releases AIMap, an open-source platform for discovering and attack-testing exposed AI agent infrastructure at internet scale.

BufferZoneCorp — Poisoned Ruby Gems & Go Modules Target CI Pipelines

A new supply chain campaign publishes sleeper packages across RubyGems and Go modules that harvest credentials, tamper with GitHub Actions, and plant SSH backdoors — with payloads impersonating Claude Code.

CISA & Five Eyes — Joint Guidance on Secure Agentic AI Deployment

CISA, NSA, and four allied national cyber agencies publish joint guidance warning that agentic AI is already in critical infrastructure with insufficient safeguards, urging zero-trust and least-privilege controls.

IBM Langflow Desktop — CVE-2026-6543 Command Injection (CVSS 8.8)

CVE-2026-6543 is a critical command injection vulnerability in IBM Langflow Desktop (versions 1.0.0–1.8.4) allowing authenticated attackers to execute arbitrary OS commands — risking exposure of model API keys, agent configs, and RAG knowledge bases.

Linux Kernel "Copy Fail" — 732-Byte Local Root Exploit Hits Every Major Distro Since 2017 (CVE-2026-31431)

n8n-mcp — SSRF Bypass via IPv4-Mapped IPv6 Addresses (CVE-2026-42349)

PyTorch Lightning — PyPI Package Compromised in Mini Shai-Hulud Supply Chain Attack

The popular PyTorch Lightning deep learning framework (31k+ GitHub stars) was compromised with credential-stealing malware in versions 2.6.2 and 2.6.3, part of the ongoing Mini Shai-Hulud campaign targeting AI infrastructure.

VentureBeat — Six Exploits Against AI Coding Agents, All Targeting Credentials

Six independent research teams demonstrated exploits against Codex, Claude Code, Copilot and Vertex AI — every single attack went for the credential, not the model.

Cequence Security — Agent Personas for Scoped MCP Privileges

Cequence Security released Agent Personas in its AI Gateway, solving the agent privilege escalation problem by mapping plain-English role descriptions to scoped virtual MCP endpoints.

DSN 2026 — First Cross-Entity Security Study of the MCP Ecosystem

University of Delaware researchers scanned 67,000+ MCP servers across six registries, revealing widespread server hijacking risks, tool metadata manipulation, and missing verification in MCP hosts.

MCPTox — Tool Poisoning Benchmark Shows 73% Attack Success Rate on MCP Agents

MCPTox benchmark evaluates 20 LLM agents against tool poisoning attacks on 45 real MCP servers — o1-mini hit 72.8% success rate, with more capable models often more vulnerable.

TeamPCP Escalates Mini Shai-Hulud Campaign to SAP npm and PyTorch Lightning

The TeamPCP supply-chain operation expanded from SAP npm packages to PyPI (PyTorch Lightning) and intercom-client within 48 hours, targeting AI and ML developer ecosystems.

Novee — Cursor IDE CVE-2026-26268: Git Hooks Enable RCE via AI Coding Agent

Novee researchers discovered a high-severity vulnerability in Cursor IDE (CVE-2026-26268, CVSS 8.1) where the AI coding agent autonomously triggers malicious Git hooks when opening attacker-controlled repositories.

NSFOCUS — AI-Scan Security Scanner for OpenClaw Ecosystem

NSFOCUS announced AI-Scan, a dedicated security scanner for the OpenClaw agent ecosystem covering CVE matching, credential leak detection, memory poisoning, and supply-chain risk.

RAGShield — Numerical Claim Manipulation in RAG Systems Evades Embedding Defenses

New research proves embedding-based RAG defenses miss 79-90% of numerical manipulations — changing a tax figure by $50,000 yields 0.9998 cosine similarity, invisible to detection.

SecureAuth — Agent Trust Registry Opens to the Public for AI Agent Governance

Wiz — Red Agent, AI-BOM, and Wiz Code Expand AI Application Security Platform

Wiz launches Red Agent for AI-driven vulnerability simulation, AI-BOM for framework inventory, and Wiz Code guardrails — expanding its AI Application Protection Platform from code to cloud edge.

ARMO — Why AI Supply Chain Scanning Misses Half the Risk

Most AI security scanners only cover packaged dependencies, missing the dynamic components agents load at runtime — model adapters, MCP connections, and first-invocation tools.

arXiv — LLMs Fail at Open-Ended Threat Hunting (3.8% Best Score)

A new benchmark tests five frontier LLMs on real-world threat hunting across 106 attack procedures — the best model flags only 3.8% of malicious events.

Lufsec — Model Context Protocol: 4 Trust Boundaries Attackers Are Exploiting

Four MCP trust boundaries — permissions, tools, inputs, and observability — that teams are getting wrong when connecting AI agents to real systems.