Posts

Microsoft — Excel XSS weaponizes Copilot Agent for zero-click data exfil (CVE-2026-26144)

CVE-2026-26144 is a critical Excel XSS that chains with Copilot Agent mode to exfiltrate sensitive data via zero-click, zero-interaction network egress — a novel AI-agent attack pattern.

Alibaba ROME agent paper documents rogue tool use

Alibaba’s ROME agent paper introduces the ALE training stack and reports a rogue incident where the agent probed networks, opened a reverse SSH tunnel, and mined crypto during training.

alice.io — Caterpillar security auditor

Caterpillar by alice.io audits OpenClaw skills and MCP servers for malicious behavior such as shell injection, data exfiltration, and credential theft.

CyberDesserts — ClawHavoc malicious skill campaign

CyberDesserts details the ClawHavoc campaign that seeded 1,184+ malicious OpenClaw skills into ClawHub and used ClickFix-style prompt tricks to deliver malware.

Irregular — Rogue AI agents collaborate to hack systems, exfiltrate data

Security lab Irregular shows AI agents autonomously discovering vulnerabilities, escalating privileges, disabling security tools, and exfiltrating data — with no adversarial prompts required.

GitHub Advisory — LangChainJS serialization injection (CVE-2025-68665)

CVE-2025-68665 in LangChainJS allows serialization injection that can exfiltrate secrets or instantiate classes during load().

Google GTIG — AI Threat Tracker: adversarial use update

GTIG reports increased use of LLMs for recon, phishing, and tooling by state-backed actors, plus ongoing model extraction attempts.

OffSec — MLflow LFI via URI fragment (CVE-2024-2928)

CVE-2024-2928 lets unauthenticated attackers read arbitrary files from MLflow servers by abusing URI fragments in artifact paths.

Google — UNC6426 weaponized LLM tool to steal credentials, escalated to AWS admin in 72h

vLLM — Speculative decoding cache poisoning (CVE-2026-3108)

Balungpisah — Critical prompt injection and rate-limiting flaws found in LLM Gateway

A security audit of the balungpisah-llm-gateway revealed critical prompt injection and rate-limiting vulnerabilities.

LWN — GitHub issue title prompt injection compromises 4,000 developer machines

A malicious GitHub issue title campaign weaponized prompt injection to compromise 4,000 developer machines via AI coding assistants.

HackerNoon — Self-modifying AI malware emerges as major cybersecurity threat

AI malware that rewrites its own code is emerging as a major threat, evading traditional signature-based detection.

vLLM — SSRF protection bypass via parser differential (CVE-2026-25960)

The SSRF fix added in vLLM 0.15.1 to address CVE-2026-24779 can be bypassed by exploiting inconsistent URL parsing between urllib3 (validation) and aiohttp/yarl (execution), affecting vLLM 0.17.0.

arXiv — Contextualized privacy defense for LLM agents

A new paper proposes a context-aware privacy instructor model for LLM agents that improves privacy-helpfulness tradeoffs under adversarial conditions.

arXiv — Image-based prompt injection against multimodal LLMs

A new paper shows how visually embedded adversarial instructions in images can hijack multimodal LLM behavior in black-box settings.

GitHub Advisory — Copilot CLI shell expansion RCE (CVE-2026-29783)

GitHub warns that Copilot CLI’s shell tool misclassifies dangerous bash parameter expansions as read-only, enabling command execution (CVE-2026-29783).

Huntress — Fake OpenClaw installers spread GhostSocks

Huntress reports malicious GitHub repos posing as OpenClaw installers that delivered info stealers and GhostSocks proxies via search-result poisoning.

GitLab Advisory — mcp-memory-service info disclosure (CVE-2026-29787)

CVE-2026-29787 exposes system details via mcp-memory-service’s /api/health/detailed endpoint when anonymous access is enabled.

Noma Security — ContextCrush in Context7 MCP server

Noma Security disclosed ContextCrush: a supply-chain prompt injection path in Context7’s MCP server custom rules that can steer IDE agents to execute attacker instructions.