Novee — CVE-2026-26268 AI Coding Agent RCE in Cursor IDE
CVE-2026-26268 shows how AI coding agents in Cursor IDE can be tricked into executing arbitrary code via malicious Git hooks embedded in untrusted repositories.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (348)Tools & Comparisons (2)AI Security Research (209)Agent & Supply Chain Security (707)
Hugging Face LeRobot — CVE-2026-25874 Unauthenticated RCE via Pickle Deserialization
LiteLLM — CVE-2026-42208 SQL Injection Exploited Within 36 Hours
OX Security — MCP STDIO Systemic RCE Flaw Affecting 200K AI Agent Servers
OpenAI Pushes Frontier AI Models Into Government Cyber Defense
OpenAI and Anthropic met with the White House national cyber director, Congress, and federal agencies to propose deploying frontier AI models for government cybersecurity operations.
PromptMink — North Korean-Linked Supply Chain Attack Uses Claude Opus to Plant Malware
ReversingLabs traces a North Korean-linked supply chain attack where a Claude Opus co-authored commit introduced PromptMink malware into an npm crypto trading agent.
Sunwood-ai-labs MCP Server — CVE-2026-7593 OS Command Injection
CVE-2026-7593 exposes OS command injection in the Sunwood-ai-labs command-executor-mcp-server, an unpatched MCP tool integration that allows remote arbitrary command execution.
AISI: GPT-5.5 Matches Mythos on Offensive Cyber Tasks
UK AI Safety Institute evaluates GPT-5.5 at 71.4% on Expert-tier cyber tasks, with a universal jailbreak found in six hours.
arXiv: Comparative Evaluation of AI Agent Security Guardrails
New arXiv paper benchmarks DKnownAI Guard against AWS Bedrock Guardrails, Azure Content Safety, and Lakera Guard across recall and false-positive metrics.
ArXiv — Indirect Prompt Injection in the Wild: 15.3K Instances Across 24.8M Hosts
First large-scale empirical study of indirect prompt injections on the web identifies 15.3K validated instances across 11.7K pages, with compliance rates up to 8% on smaller models.
Microsoft — Frontier AI Accelerates Vuln Discovery, Calls for Faster Patching & Responsible Release
Palo Alto Networks to Acquire Portkey AI Gateway
Palo Alto Networks announces acquisition of Portkey, positioning the AI Gateway as a mission-critical control plane for autonomous agent communications and security.
[un]prompted 2026 — Netflix Researchers on Source-to-Sink LLM Vulnerability Discovery
Netflix security engineers Scott Behrens and Justice Cassel present "Source to Sink: Improving LLM Vuln Discovery" at [un]prompted 2026, covering end-to-end approaches for finding vulnerabilities in large language model systems.
Anthropic — Claude Security Public Beta for Vulnerability Scanning
Anthropic launches Claude Security in public beta, an AI-powered tool that scans codebases for vulnerabilities and suggests patches for enterprise customers.
Anthropic SDK — CVE-2026-41686 Insecure File Permissions
CVE-2026-41686 is a medium-severity flaw in the Anthropic TypeScript SDK where BetaLocalFilesystemMemoryTool creates world-readable memory files, risking agent state exposure.
Bishop Fox — AIMap Open-Source AI Infrastructure Scanner
Bishop Fox releases AIMap, an open-source platform for discovering and attack-testing exposed AI agent infrastructure at internet scale.
BufferZoneCorp — Poisoned Ruby Gems & Go Modules Target CI Pipelines
A new supply chain campaign publishes sleeper packages across RubyGems and Go modules that harvest credentials, tamper with GitHub Actions, and plant SSH backdoors — with payloads impersonating Claude Code.
CISA & Five Eyes — Joint Guidance on Secure Agentic AI Deployment
CISA, NSA, and four allied national cyber agencies publish joint guidance warning that agentic AI is already in critical infrastructure with insufficient safeguards, urging zero-trust and least-privilege controls.
IBM Langflow Desktop — CVE-2026-6543 Command Injection (CVSS 8.8)
CVE-2026-6543 is a critical command injection vulnerability in IBM Langflow Desktop (versions 1.0.0–1.8.4) allowing authenticated attackers to execute arbitrary OS commands — risking exposure of model API keys, agent configs, and RAG knowledge bases.