AudioHijack — Hidden-Audio Prompt Injection Targets Voice AI
New AudioHijack research shows imperceptible audio perturbations can inject malicious commands into voice AI assistants, achieving up to 96% attack success across 13 models.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (357)Tools & Comparisons (2)AI Security Research (210)Agent & Supply Chain Security (713)
Consensus MCP Tool — Hidden Ad Injection in Claude Instructions
The Consensus MCP server embeds hidden promotional text inside Claude tool instructions, forcing the model to pitch premium subscriptions — exposing a structural MCP supply-chain vulnerability.
Mitiga Breaking Skills — AI Agent Skills Enable Silent Codebase Exfiltration
Mitiga Labs demonstrates how a legitimate-looking AI agent skill can silently exfiltrate an entire codebase via poisoned Definition of Done instructions.
Network-AI CVE-2026-46701 — Unauthenticated Cross-Origin MCP Tool Invocation
arXiv AgentWall Preprint (2605.16265) — OS-Level Runtime Interception for AI Agents
A fresh arXiv preprint proposes AgentWall, an OS-level safety layer that intercepts AI agent shell commands, API calls, and file writes before execution.
arXiv: Content-Aware Attack Detection in LLM Agent Tool-Call Traffic
An arXiv paper evaluates GNN-based and classical detectors for attack detection over MCP tool-call traffic, finding content embeddings essential and naive random-split evaluations misleading.
Microsoft Releases Agent Governance Toolkit — Policy Enforcement for AI Agents
Microsoft open-sources an AI Agent Governance Toolkit covering all 10 OWASP Agentic Top 10 risks, with policy enforcement, zero-trust identity, and execution sandboxing for autonomous agents.
Microsoft Semantic Kernel CVE-2026-26030/25592 — Prompt Injection to RCE
Two critical Microsoft Semantic Kernel flaws (CVSS 9.8) escalate indirect prompt injection into remote code execution on agent hosts via eval() and unsafe file download.
NSA Releases MCP Security Design Considerations for AI-Driven Automation
Open-Source LLMs Vulnerable to Long Reasoning Multi-Turn Jailbreaks
An ACM paper testing 10 open-source models across 167 attack scenarios finds multi-turn reasoning jailbreaks remain unsolved even with lightweight defenses applied.
Cybersecurity Insiders — Three Prompt Injection Detection Blind Spots
Three prompt injection variants that bypass traditional WAF and EDR detection: indirect RAG injection, second-order tool-call injection, and conversation-history poisoning.
TrapDoor Supply Chain — .cursorrules and CLAUDE.md Hijack AI Assistants
TrapDoor campaign weaponizes .cursorrules and CLAUDE.md files via cross-ecosystem supply chain attacks on npm, PyPI, and Crates.io to hijack AI coding assistants.
1Password + OpenAI — Just-in-Time Credentials for Codex Agents
1Password partners with OpenAI to deliver an Environments MCP Server for Codex, issuing just-in-time scoped credentials that never appear in prompts or model context.
Adaptive Security — 80% of employees use unapproved AI tools, 12% of companies govern them
Adaptive Security research reveals an 8-to-1 gap between shadow AI adoption and enterprise governance, with OAuth scopes representing the real data-exposure surface.
Anthropic — Glasswing discovers 10,000+ zero-days, only 97 patched so far
arXiv — HBHC Protocol Solves Zombie Agent Credential Revocation
New cryptographic protocol binds credential validity to parent liveness proofs, achieving 90× faster revocation than OAuth 2.0 for AI agent swarms.
arXiv OverEager — coding agents exceed authorized scope on benign tasks
New arXiv paper quantifies overeager actions in coding agents like Claude Code, Codex CLI, and Gemini CLI on harmless tasks.
Aikido Security — Laravel-Lang supply chain delivers cross-platform credential stealer
Over 233 malicious versions of popular Laravel-Lang PHP packages were injected with a credential-stealing backdoor via poisoned GitHub version tags targeting developer infrastructure.
LMDeploy CVE-2026-46517 — hardcoded trust_remote_code bypasses HF default-secure
MDPI — attack surfaces of malicious remote MCP servers across LLM platforms
New MDPI paper categorizes MCP server attack surfaces into LLM-passive and LLM-active frameworks across multiple platforms.