Posts

Claroty Team82 — LLMs Discover Critical ICS Vulnerabilities Without Prior Disclosures

Claroty Team82 uses Claude Opus 4.6 to rediscover five critical ICS vulnerabilities on a Zenitel intercom platform without access to prior vulnerability details.

CVE-2026-27735 — MCP Reference Servers git_add Path Traversal

CVE-2026-27735 in MCP reference servers mcp-server-git allows path traversal via the git_add tool, staging files outside repository boundaries.

DesktopCommanderMCP SSRF (CVE-2026-10690) — MCP File Tool Exposes IMDS

Four Major AI Labs Use Incompatible Prompt-Injection Metrics

Anthropic, OpenAI, Google, and Meta each publish prompt-injection benchmarks in 2026, but no two labs measure the same threat — leaving buyers with no common baseline for model safety claims.

LibreChat CVE-2026-32625 — MCP URL Env-Var Interpolation Leaks Secrets

LibreChat ≤0.8.3 interpolates ${VAR} placeholders in user-supplied MCP server URLs against process.env, exfiltrating CREDS_KEY, JWT_SECRET, and MONGO_URI to attacker-controlled hosts.

Microsoft — Dependency Confusion npm Packages Profile Developer Environments

Microsoft uncovers 33 malicious npm packages using dependency confusion to deploy a reconnaissance payload that fingerprints developer environments for follow-on attacks.

arXiv — Trojan Backdoors in Agentic Workspaces Reach 95.5% ASR

New arXiv paper introduces ClawTrojan, a benchmark showing multi-step trojan injections in local agentic harnesses achieve 95.5% attack success on GPT-5.4, and proposes DASGuard as a dynamic defense.

IBM Langflow CVE-2026-7524 — Unauthenticated RCE via Symlink Archive Abuse

LibreChat MCP Credential Exfiltration (CVE-2026-44653/44654)

LibreChat ≤0.8.3 leaks decrypted MCP API keys and OAuth secrets to VIEW-only users; a paired auth bypass allows shared-agent editors to delete files globally.

Microsoft Build 2026 — Enterprise Agent Security with MDASH and Purview

Microsoft announces MDASH with 100+ specialized threat-hunting AI agents, agentic risk detection for Claude Code, Copilot, Codex, and OpenClaw via Purview, and agent identity through Entra managed service principals.

NousResearch hermes-agent CVE-2026-10548 — Improper Auth in Credential Pool Sync

A second credential-pool authentication bypass CVE hits NousResearch hermes-agent, this time in the Anthropic credential synchronization path.

Palo Alto Networks CVE-2026-0257 — Active Exploitation of GlobalProtect Auth Bypass

A PAN-OS GlobalProtect authentication bypass, initially rated medium, was escalated to critical after active exploitation. CISA added it to KEV.

Palo Alto Unit 42 — Red Hat npm Supply Chain Attack and Miasma Malware

A compromised Red Hat employee GitHub account delivered 32 trojanized @redhat-cloud-services npm packages with the Miasma payload, carrying valid SLSA provenance.

Permiseo — ChatGPhish Browser-Based Prompt Injection

Cisco AI Defense launches agent-security tooling suite

Cisco open-sourced MCP Scanner, Skill Scanner, DefenseClaw, and A2A Scanner to audit AI agent supply chains, MCP servers, and cross-agent communications.

Microsoft — CVE-2026-35435 Azure AI Foundry Agent Privilege Escalation

Microsoft patched a CVSS 8.6 flaw in Azure AI Foundry and M365 Published Agents that allowed forged authorization tokens to bypass access controls.

Push Security — LLMShare Campaign Abuses ChatGPT & Claude Share Links for Malware

Push Security uncovers LLMShare: a live malvertising campaign abusing ChatGPT and Claude share links to host fake outage pages and deliver malware from trusted AI domains.

Wiz — Miasma Supply Chain Attack on Red Hat npm Packages

NSA — MCP Security Guidance Warns AI Agent Protocol Adoption Outpaced Security

Aikido — OpenAI Codex Token Theft via codexui-android npm Package

A functional npm package with 29,000+ weekly downloads secretly exfiltrated Codex auth tokens and was distributed through malicious Android apps on Google Play.