High-signal AI/security/automation notes.
Cursor partners with Chainguard to embed hardened container images and malware-resistant library versions directly into agentic coding workflows, routing dependency resolution away from vulnerable public registries.
Forcepoint researchers found 10 verified indirect prompt injection payloads on live websites, ranging from financial fraud and API key theft to recursive data destruction.
Three coordinated supply chain attacks struck npm, PyPI, and Docker Hub between April 21–23, 2026 — all targeting developer and CI/CD credentials.
New arXiv paper presents GAAP, an agent execution environment that deterministically enforces user-specified data-sharing policies without trusting the agent or LLM.
ACL 2026 Findings paper demonstrates that LLMs and guardrail models are vulnerable to moral-value manipulation attacks, exploiting pluralism alignment to bypass safety filters.
Bishop Fox published otto-support, an open-source vulnerable MCP server CTF with 19 tools across 4 privilege levels for hands-on AI agent security training.
Palo Alto Networks Unit 42 built Zealot, a multi-agent PoC that autonomously chains SSRF, credential theft, and data exfiltration against GCP.
The Zero Day Initiative reports a 490% year-over-year increase in submissions; the Internet Bug Bounty program closes, and open-source maintainers describe a deluge of AI-discovered vulnerabilities shifting from noise to genuine risk.
CSA research note details ZionSiphon, ICS malware using MCP-based C2 with LLM-assisted analysis for sabotage of Israeli water treatment and desalination facilities.
Adversa AI demonstrates a 60% jailbreak success rate on GPT-5.4 using Involuntary In-Context Learning, while GPT-5 and GPT-5-mini show 0% — a safety regression introduced after the GPT-5 generation.
CanisterSprawl worm compromises npm and PyPI packages, installing covert LLM proxy infrastructure and self-propagating across publisher accounts.
LangWatch releases Scenario, an open-source red-teaming framework that uses multi-turn Crescendo attack chains to find vulnerabilities in production AI agents with tool access.
Six CVEs published for OpenClaw covering agentic consent bypass, node-scoped RCE, SSRF guard gaps, and platform authorization failures across Slack, Discord, and profile management.
TeamPCP returns with a triple-pronged supply chain assault across Docker Hub, npm, and PyPI in 48 hours, compromising KICS security scanner images, Bitwarden CLI, and xinference.