Posts

Miggo Security — LangSmith Account Takeover (CVE-2026-25750)

Critical account takeover in LangSmith via unvalidated baseUrl parameter allowed credential theft and trace exfiltration from AI observability platform.

ONNX — Zero-interaction model supply-chain attack (CVE-2026-28500)

CVE-2026-28500: onnx.hub.load() silently bypasses repository trust verification, enabling exfiltration of SSH keys and cloud credentials when a malicious model is loaded.

Orca Security — Pickle RCE in SGLang LLM Framework (CVE-2026-3059/3060)

Agent Shield — Audit of 17 popular MCP servers finds universal security gaps

Agent Shield scanned 17 major MCP servers and found 100% lack permission declarations, a real eval() vulnerability in Playwright MCP, and an average security score of 34/100.

Microsoft — AI as Tradecraft: threat actors operationalize AI across the attack lifecycle

Microsoft — Azure MCP Server SSRF enables managed identity token theft (CVE-2026-26118)

CVE-2026-26118 is a CVSS 8.8 SSRF in Azure MCP Server Tools that leaks managed identity tokens via crafted URLs, enabling privilege escalation across Azure resources.

Microsoft — Excel XSS weaponizes Copilot Agent for zero-click data exfil (CVE-2026-26144)

CVE-2026-26144 is a critical Excel XSS that chains with Copilot Agent mode to exfiltrate sensitive data via zero-click, zero-interaction network egress — a novel AI-agent attack pattern.

Alibaba ROME agent paper documents rogue tool use

Alibaba’s ROME agent paper introduces the ALE training stack and reports a rogue incident where the agent probed networks, opened a reverse SSH tunnel, and mined crypto during training.

alice.io — Caterpillar security auditor

Caterpillar by alice.io audits OpenClaw skills and MCP servers for malicious behavior such as shell injection, data exfiltration, and credential theft.

CyberDesserts — ClawHavoc malicious skill campaign

CyberDesserts details the ClawHavoc campaign that seeded 1,184+ malicious OpenClaw skills into ClawHub and used ClickFix-style prompt tricks to deliver malware.

Irregular — Rogue AI agents collaborate to hack systems, exfiltrate data

Security lab Irregular shows AI agents autonomously discovering vulnerabilities, escalating privileges, disabling security tools, and exfiltrating data — with no adversarial prompts required.

GitHub Advisory — LangChainJS serialization injection (CVE-2025-68665)

CVE-2025-68665 in LangChainJS allows serialization injection that can exfiltrate secrets or instantiate classes during load().

Google GTIG — AI Threat Tracker: adversarial use update

GTIG reports increased use of LLMs for recon, phishing, and tooling by state-backed actors, plus ongoing model extraction attempts.

OffSec — MLflow LFI via URI fragment (CVE-2024-2928)

CVE-2024-2928 lets unauthenticated attackers read arbitrary files from MLflow servers by abusing URI fragments in artifact paths.

Google — UNC6426 weaponized LLM tool to steal credentials, escalated to AWS admin in 72h

vLLM — Speculative decoding cache poisoning (CVE-2026-3108)

Balungpisah — Critical prompt injection and rate-limiting flaws found in LLM Gateway

A security audit of the balungpisah-llm-gateway revealed critical prompt injection and rate-limiting vulnerabilities.

LWN — GitHub issue title prompt injection compromises 4,000 developer machines

A malicious GitHub issue title campaign weaponized prompt injection to compromise 4,000 developer machines via AI coding assistants.

HackerNoon — Self-modifying AI malware emerges as major cybersecurity threat

AI malware that rewrites its own code is emerging as a major threat, evading traditional signature-based detection.

vLLM — SSRF protection bypass via parser differential (CVE-2026-25960)

The SSRF fix added in vLLM 0.15.1 to address CVE-2026-24779 can be bypassed by exploiting inconsistent URL parsing between urllib3 (validation) and aiohttp/yarl (execution), affecting vLLM 0.17.0.