Oasis Security — ClawJacked OpenClaw WebSocket takeover
Oasis Security details ClawJacked, a localhost WebSocket attack chain that let any website hijack OpenClaw agents and brute-force gateway passwords, fixed in v2026.2.25+.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (177)Tools & Comparisons (2)AI Security Research (163)Agent & Supply Chain Security (585)
arXiv — Jailbreaking LLMs & VLMs: mechanisms and unified defenses
A new survey maps jailbreak attacks and defenses across LLMs and VLMs, proposing a unified, layered defense model.
ServiceNow — AI Platform RCE (CVE-2026-0542)
ServiceNow patches CVE-2026-0542, an unauthenticated RCE in the ServiceNow AI Platform sandbox, with updates for hosted and self-hosted deployments.
GitHub Advisory — vLLM trust_remote_code bypass RCE
A vLLM config path instantiates classes from auto_map without honoring trust_remote_code, enabling remote code execution when loading model configs.
GitLab Advisory — MCP Go SDK case-folding bug (CVE-2026-27896)
CVE-2026-27896 in the MCP Go SDK breaks JSON-RPC field strictness via case-insensitive and Unicode-folded matching, enabling method/params confusion.
GitLab Advisory — mcp-server-git path traversal (CVE-2026-27735)
CVE-2026-27735 allows path traversal in mcp-server-git’s git_add tool, letting attackers stage files outside the repo boundary for potential exfiltration.
MIT AI Agent Index — transparency gaps in agent safety reporting
The 2025 AI Agent Index surveys 30 deployed agents and finds major gaps in safety disclosures, testing transparency, and accountability.
Orca Security — RoguePilot GitHub Copilot prompt injection
Orca Security details RoguePilot, a passive prompt injection in GitHub Codespaces that can coerce Copilot to exfiltrate GITHUB_TOKENs.
arXiv — Analysis of LLMs against prompt injection and jailbreak attacks
A new arXiv study benchmarks prompt-injection and jailbreak robustness across open-source LLMs and finds lightweight defenses are bypassable.
Endor Labs — Six OpenClaw vulnerabilities via AI SAST
Endor Labs details six patched OpenClaw vulnerabilities (SSRF, auth bypass, path traversal) found via agentic data-flow analysis, with CVEs and GHSAs covering tool and webhook attack paths.
SD Times — MCP privacy and security gaps
SD Times highlights MCP security and privacy gaps, including prompt injection risk, server verification challenges, and runtime policy enforcement needs.
arXiv — Agentic AI as a cybersecurity attack surface
A new arXiv paper maps agentic AI runtime supply-chain threats, from context injection to tool supply-chain abuse, and proposes zero-trust runtime defenses.
arXiv — Silent Egress: implicit prompt injection makes LLM agents leak without a trace
Silent Egress shows how URL preview prompt injection can trigger stealthy data exfiltration in tool-using LLM agents, and why network egress controls matter.
IBM — X-Force Threat Intelligence Index 2026
IBM’s 2026 X-Force Threat Intelligence Index flags AI-accelerated attacks, dark‑web trading of AI chatbot credentials, and a surge in exploitation of public‑facing apps.
Provos.org — IronCurtain agent sandbox architecture
IronCurtain proposes MCP-proxy sandboxing with policy enforcement and isolated execution modes for personal AI agents.
OpenReview — Jailbreaking the Matrix with Nullspace Steering
Researchers propose a circuit-level jailbreak method (HMNS) that suppresses attention heads and injects nullspace perturbations to bypass safety defenses with fewer queries.
arXiv — LLM-agent threat model and attack taxonomy survey
A survey of LLM agent ecosystem threats that unifies input-level prompt attacks with protocol-level exploits and maps real incidents to a single threat model.
Check Point Research — Claude Code hooks/MCP RCE
Check Point details Claude Code project configuration flaws enabling hook/MCP command execution and API key exfiltration when opening untrusted repos.
CrowdStrike — 2026 Global Threat Report: AI-accelerated adversaries
CrowdStrike’s 2026 Global Threat Report highlights prompt-injection abuse of GenAI tools, LLM-enabled malware, and faster breakout times.
Trail of Bits — Comet prompt-injection audit
Trail of Bits details how prompt injection against Perplexity’s Comet browser could exfiltrate Gmail data via agentic browsing tools.