Posts

arXiv — BadSkill: Agent Supply Chain Backdoor Attacks via Model-in-Skill Poisoning

New research reveals BadSkill attack where malicious agent skills bundle poisoned models that activate hidden payloads only when specific semantic triggers are met.

arXiv:2604.11806 — Meerkat Detects Hidden Safety Violations in AI Agent Traces

New arXiv paper introduces Meerkat, a clustering-based system that automatically detects rare safety violations, benchmark cheating, and reward hacking across thousands of AI agent execution traces.

arXiv — Semantic Intent Fragmentation Attack on Multi-Agent AI Pipelines

New research introduces Semantic Intent Fragmentation (SIF) attack that bypasses LLM safety mechanisms by decomposing malicious requests into individually benign subtasks.

aws-mcp-server — Command Injection RCE (CVE-2026-5058, ZDI-26-246)

CVE-2026-5058 exposes critical pre-auth command injection in aws-mcp-server allowing arbitrary code execution on AI agent infrastructure connecting to AWS services.

badlogic — pi-mono code injection CVE-2026-5556 exposes AI coding agents

CVE-2026-5556 allows remote code injection in badlogic pi-mono coding agent via extension loader, demonstrating supply chain risks in AI development tooling ecosystems.

CSA — AI Agent Weaponization Threat Briefing

Cloud Security Alliance briefing warns of AI agents being weaponized as command-and-control platforms via prompt injection, while AI-generated code floods production with systematic vulnerabilities.

Tenable Research — Claude Code GitHub Action MCP Server RCE Vulnerability

Comment and Control — Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and Copilot Agent

Aonan Guan demonstrates Comment and Control, a cross-vendor prompt injection class that hijacks AI coding agents on GitHub Actions via PR titles and issue comments to steal repository secrets and API keys.

Depthfirst — $80M Series B for AI Security Platform

Depthfirst secured $80M Series B funding to expand its AI-native security platform, training specialized models for enterprise cybersecurity and accelerating autonomous vulnerability discovery.

Microsoft — GitHub Copilot privacy policy shifts to opt-out AI training model

Google DeepMind — AI Agent Traps Taxonomy Reveals Six Critical Vulnerability Classes

griptape — Path traversal CVE-2026-5595 affects AI agent file operations

Harness Engineering — LangChain Guardrails Tutorial for Safe AI Agents

Comprehensive guide to implementing input validation, output filtering, and behavioral guardrails for LangChain AI agents to prevent prompt injection and policy violations.

Check Point — HexStrike AI MCP Server Command Injection

LangChain-ChatChat — RCE via MCP STDIO Server Configuration (CVE-2026-30617)

CVE-2026-30617 is a CVSS 8.6 RCE in LangChain-ChatChat 0.3.1 allowing unauthenticated remote attackers to execute arbitrary commands via MCP STDIO server configuration.

Langflow — Critical vulnerability CVE-2026-33309

Langflow CVE-2026-33309 enables attackers to compromise AI workflow application logic and underlying infrastructure, posing critical risks to AI agent deployment environments.

Lyptus Research — AI offensive cyber capabilities doubling every 6 months

Lyptus Research study finds AI offensive cyber capabilities doubling every 5.7 months, with Opus 4.6 and GPT-5.3 Codex achieving 50% success rates on complex security tasks.

Endor Labs — Marimo CVE-2026-39987 Pre-Auth RCE

Critical pre-authentication remote code execution vulnerability in Marimo Python notebook framework allows attackers to gain full shell access without authentication.

nginx-ui — MCPwn: Unauthenticated MCP Endpoint Leads to Full Server Takeover (CVE-2026-33032)

CVE-2026-33032 exposes an unauthenticated MCP endpoint in nginx-ui (CVSS 9.8), enabling full nginx server takeover. Actively exploited in the wild with public PoC.

Oasis Security — Claude.ai prompt injection & data exfiltration

Oasis Security details Claudy Day, a chain of Claude.ai vulnerabilities enabling invisible prompt injection via URL parameters, conversation history exfiltration via Files API, and Google Ads targeting.