Bishop Fox Releases "Otto Support" MCP Security CTF
Bishop Fox published otto-support, an open-source vulnerable MCP server CTF with 19 tools across 4 privilege levels for hands-on AI agent security training.
Posts
High-signal AI/security/automation notes.
Filter: All AI Vulnerabilities & CVEs (346)Tools & Comparisons (2)AI Security Research (209)Agent & Supply Chain Security (707)
IBM X-Force — OpenClaw as a Case Study in Agentic AI Vulnerability
LangChain HTMLHeaderTextSplitter SSRF Redirect Bypass (CVE-2026-41481)
Palo Alto Unit 42 — Autonomous AI Multi-Agent System Attacks Cloud Infrastructure
Palo Alto Networks Unit 42 built Zealot, a multi-agent PoC that autonomously chains SSRF, credential theft, and data exfiltration against GCP.
Zero Day Initiative — AI-Driven Bug Submission Surge Forces Major Programs to Pause
The Zero Day Initiative reports a 490% year-over-year increase in submissions; the Internet Bug Bounty program closes, and open-source maintainers describe a deluge of AI-discovered vulnerabilities shifting from noise to genuine risk.
CSA Research — ZionSiphon AI-Assisted ICS Malware Targeting Water Infrastructure
CSA research note details ZionSiphon, ICS malware using MCP-based C2 with LLM-assisted analysis for sabotage of Israeli water treatment and desalination facilities.
Adversa AI — IICL Bypasses GPT-5.4 Safety While GPT-5 Remains Immune
Adversa AI demonstrates a 60% jailbreak success rate on GPT-5.4 using Involuntary In-Context Learning, while GPT-5 and GPT-5-mini show 0% — a safety regression introduced after the GPT-5 generation.
CanisterSprawl — Self-Propagating npm Worm Installs LLM Proxy Backdoor
CanisterSprawl worm compromises npm and PyPI packages, installing covert LLM proxy infrastructure and self-propagating across publisher accounts.
Flowise — CSV Agent Prompt Injection RCE and Cluster of New CVEs (CVE-2026-41264)
LangWatch Scenario — Open-Source Multi-Turn Red-Teaming Framework for AI Agents
LangWatch releases Scenario, an open-source red-teaming framework that uses multi-turn Crescendo attack chains to find vulnerabilities in production AI agents with tool access.
OpenClaw — Six CVEs Cover Agentic Consent Bypass, RCE, SSRF, and Authorization Gaps
Six CVEs published for OpenClaw covering agentic consent bypass, node-scoped RCE, SSRF guard gaps, and platform authorization failures across Slack, Discord, and profile management.
Paperclip AI — Unauthenticated RCE via Four-Flaw Authorization Chain (CVE-2026-41679)
TeamPCP — Checkmarx KICS Docker and Bitwarden CLI Compromised in Escalating Supply Chain Campaign
TeamPCP returns with a triple-pronged supply chain assault across Docker Hub, npm, and PyPI in 48 hours, compromising KICS security scanner images, Bitwarden CLI, and xinference.
Vercel Breach via Context.ai — Third-Party AI Tool OAuth Cascade
Anthropic Officially Launches Project Glasswing — $100M Commitment, 12 Partners, Thousands of Zero-Days Found
Anthropic officially announces Project Glasswing with AWS, Apple, Microsoft, Google and 8 other partners, committing $100M in Mythos Preview credits after the model autonomously discovered thousands of zero-day vulnerabilities across major OSes and browsers.
“Comment and Control” — Prompt Injection Hijacks Claude Code, Gemini CLI & Copilot via GitHub
A new cross-vendor prompt injection class weaponizes GitHub PR titles, issue bodies and comments to hijack AI coding agents and steal CI/CD credentials — affecting Claude Code, Gemini CLI and GitHub Copilot Agent.
Comment and Control — Prompt Injection Leaks Secrets in Three AI Coding Agents
A single prompt injection in a GitHub PR title caused Claude Code, Gemini CLI, and GitHub Copilot Agent to leak their own credentials — rated CVSS 9.4 Critical by Anthropic.
Forcepoint X-Labs Finds 10 Indirect Prompt Injection Payloads on Live Websites
Forcepoint X-Labs telemetry detected 10 verified indirect prompt injection payloads actively deployed on public websites — targeting API key theft, data destruction and financial fraud via AI agents.
LiteLLM PyPI Compromised — Multi-Stage Credential Stealer in 3M-Download Package
Malicious versions of the widely used litellm package were published to PyPI, deploying a three-layer credential stealer that harvested cloud keys, SSH credentials, Kubernetes tokens, and crypto wallets.