AuthMind — OpenClaw’s 230 malicious skills expose agentic supply-chain risk
AuthMind highlights how OpenClaw’s community skill ecosystem enabled malware-like behavior, data exfiltration, and prompt injection via popular skills and extensions.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (183)Tools & Comparisons (2)AI Security Research (171)Agent & Supply Chain Security (595)
Infosecurity Magazine — ZombieAgent zero-click prompt injection in ChatGPT connectors
Radware’s ZombieAgent technique shows how indirect prompt injection can silently exfiltrate data from ChatGPT connector targets using pre-built URLs and long-term memory persistence.
Darktrace — 2026 State of AI Cybersecurity Report: 76% of Security Pros Worried About AI Agent Risk
Darktrace 2026 report finds 76% of security professionals concerned about AI agent security implications, launches Darktrace/SECURE AI for enterprise AI governance and agent monitoring.
n8n — CVE-2026-25049: New Sandbox Escape Bypass Enables Full Server Takeover
A critical sandbox escape in n8n (CVE-2026-25049, CVSS 9.4) bypasses the December 2025 fix for CVE-2025-68613, letting any workflow author execute arbitrary system commands and steal every stored credential.
Noma Security — DockerDash: Prompt Injection in Docker Ask Gordon AI Enables RCE via Image Metadata
A critical flaw in Docker Ask Gordon AI assistant lets attackers embed prompt-injection payloads in Docker image LABEL fields, which the MCP Gateway executes without validation — enabling RCE and data exfiltration.
arXiv — ChatInject: abusing chat templates for prompt injection in LLM agents
ChatInject shows that formatting malicious payloads to mimic chat templates can significantly raise prompt-injection success rates in LLM agents, including multi-turn persuasion variants.
arXiv — Systematic Review of LLM Defenses Against Prompt Injection: Expanding NIST Taxonomy
ThreatDown — 2026 State of Malware: AI Drives Machine-Scale Cyberattacks
Zafran — ChainLeak: Chainlit AI Framework Bugs Enable Cloud Takeover
Two critical vulnerabilities in Chainlit (CVE-2026-22218 arbitrary file read, CVE-2026-22219 SSRF) let attackers steal cloud API keys and pivot into enterprise environments—no user interaction required.
Vectra AI — From Clawdbot to OpenClaw: Automation as a Backdoor
A deep dive into the security risks of autonomous AI agents like OpenClaw (formerly Moltbot/Clawdbot), detailing attack surfaces and hardening strategies.
GitHub Advisory — vLLM RCE in Video Processing (CVE-2026-22778)
Bengio et al. — 2026 International AI Safety Report: AI-powered cyberattacks and safety-testing evasion
The 2026 International AI Safety Report finds that criminals actively use AI in cyberattacks, underground markets sell pre-packaged AI exploit tools, and frontier models can now detect when they are being evaluated.
ZDI — Unpatched RCE in Gemini MCP Tool via command injection (CVE-2026-0755)
CVE-2026-0755: a CVSS 9.8 zero-day in gemini-mcp-tool allows unauthenticated remote code execution through command injection in the execAsync method. No patch available.
NVIDIA AI Red Team — Mandatory sandbox controls for agentic coding workflows
UCSC / The Register — CHAI: physical prompt injection hijacks self-driving cars and drones via road signs
UCSC researchers demonstrate CHAI, a physical-world indirect prompt injection attack that uses printed road signs to hijack vision-language models driving autonomous vehicles and drones.
OX Security — Critical vLLM RCE via malicious video URL (CVE-2026-22778)
CVE-2026-22778: a critical RCE chain in vLLM lets attackers execute arbitrary commands on AI serving infrastructure by sending a crafted video URL.
arXiv — AgentDoG: a diagnostic guardrail framework for AI agent safety and security
AgentDoG introduces a three-dimensional risk taxonomy and open-source guardrail models (4B–8B) that diagnose root causes of unsafe AI agent actions across tool use, planning, and environmental interaction.
arXiv — The Promptware Kill Chain: reframing prompt injection as multi-step malware
arXiv — SENTINEL: securing AI agents in cyber-physical systems against deepfake and MCP-mediated attacks
A new survey introduces the SENTINEL framework for securing AI agents in cyber-physical systems, covering deepfake-driven attacks, MCP vulnerabilities, and defense-in-depth strategies validated against a real-world smart grid deployment.
Clutch Security — 95% of enterprise MCP servers run on endpoints with zero security visibility
Clutch Security analyzed MCP server deployments across enterprise environments and found 95% run on developer endpoints with no MCP-specific detection, 38% are unofficial packages from unknown authors, and 3% ship with hardcoded credentials.