High-signal AI/security/automation notes.
A cluster of recent disclosures reveals widespread RCE vulnerabilities across AI coding agents: SymJack affects six tools via symlink hijacking, TrustFall enables one-click RCE through regressed trust dialogs, and Copirate 365 demonstrates persistent Copilot backdoors at DEF CON.
JFrog discovers IronWorm, a Rust-built self-replicating npm worm with eBPF kernel rootkit that harvests AI developer credentials (Codex, Anthropic, Gemini, Cursor) and propagates via GitHub.
Kiteworks research identifies a lethal trifecta — any AI agent that accesses private data, processes untrusted content, and can communicate externally is structurally exploitable, confirmed by documented production failures.
A parallel arm of the Miasma worm campaign pushes malicious commits to 120+ GitHub repos, exploiting Claude Code, Cursor, and VS Code auto-run features to detonate a credential harvester on folder open.
Microsoft expanded its agentic AI failure modes taxonomy with seven new categories covering supply chain, goal hijacking, CUA visual attacks, and MCP/plugin abuse.
VIPER-MCP framework scanned ~40,000 open-source MCP server repositories and discovered 106 zero-day taint-style vulnerabilities, producing 67 CVEs to date.
Microsoft disclosed CVE-2026-45497, a CVSS 9.8 critical RCE via command injection in the M365 Copilot orchestration engine, silently patched in the cloud.
GitGuardian publishes a practical MCP governance framework covering authentication standards, scope control, secrets lifecycle, and credential exposure detection for multi-agent deployments.
Three independent scans in June 2026 show ~40% of remote MCP servers run without authentication, while Trend Micro found CVSS 9.8 command-injection flaws in unofficial cloud MCP implementations.
An independent assessment of 100 production AI agents finds only 11% pass basic security, with coding and computer-use agents carrying the highest risk.
Claroty Team82 uses Claude Opus 4.6 to rediscover five critical ICS vulnerabilities on a Zenitel intercom platform without access to prior vulnerability details.
CVE-2026-27735 in MCP reference servers mcp-server-git allows path traversal via the git_add tool, staging files outside repository boundaries.