High-signal AI/security/automation notes.
A real-world chatbot case study: guardrail enforcement only on the latest message, plus weak conversation/message binding. Old web/API problems still matter when an LLM is in the loop.
Snyk walks through why personal AI agents with email + shell/file tools are uniquely exposed to indirect prompt injection and social-engineering, and how small config choices (autonomy, approvals, exposure) change the threat model.
CVE-2026-22773: vLLM can be crashed when serving multimodal models using the Idefics3 implementation by sending a crafted 1×1 pixel image, resulting in an unhandled runtime error and engine termination.
vLLM patched an SSRF bug (CVE-2026-24779) in its multimodal MediaConnector URL fetching logic that could let attackers bypass hostname allowlists and hit internal network resources.
vLLM’s Semantic Router team describes a Mixture-of-Models (MoM) system running on AMD MI300X/MI355X that routes requests across multiple models using signals and rules.
Wiz recap of the ZeroDay.cloud 2025 competition: high-impact vulns across foundational cloud components, and attempted exploits targeting vLLM/Ollama (AI inference stack).
A new paper introduces PHISH, a black-box persona manipulation framework that gradually steers an LLM’s induced persona using adversarial conversational history alone.
A survey that connects prompt injection, model compromise, system/privacy attacks, and protocol vulnerabilities (MCP/A2A/etc.) into one end-to-end threat model for LLM agent workflows.
A new SoK paper surveys prompt injection attacks on agentic coding assistants (tools, skills, MCP), catalogs techniques, and argues for architectural mitigations.
A new arXiv paper describes “Thought-Transfer,” an indirect targeted poisoning technique that manipulates chain-of-thought traces (not questions/answers) to induce behaviors on unseen target tasks.
AWS confirmed a project-level misconfiguration where unanchored regex webhook filters in CodeBuild could allow a predictably-acquired GitHub actor ID to trigger privileged CI and potentially introduce inappropriate code.
Bitdefender reports an Android dropper that redirects to Hugging Face dataset repos to fetch frequently-changing malware payloads; what changed, why it matters, and what to do.
A threat campaign (“Bizarre Bazaar”) is targeting exposed or weakly authenticated LLM endpoints and MCP servers to steal compute, resell access, and attempt lateral movement.
Pillar Security reports a coordinated campaign (“Operation Bizarre Bazaar”) scanning for exposed LLM and MCP endpoints, validating access, and reselling it. Why it matters and what to do.
A new arXiv preprint proposes SBOM-driven vulnerability analysis that models dependencies and ‘cascaded’ vulnerability chains as graphs, aiming to move beyond isolated CVE scoring.
CISA, NCSC-UK, FBI and partners released guidance for designing and managing secure connectivity in operational technology (OT) environments as OT/IT interconnection expands attack surface.
Cisco describes its ‘Foundation AI’ security-native reasoning model, adaptive retrieval/search framework, and a PEAK threat-hunting assistant built as a multi-agent workflow with human oversight.
The curl project is winding down its bug bounty program after a surge in low-quality, AI-generated vulnerability submissions that strained maintainer capacity.
Three CVEs in Anthropic’s reference Git MCP server show how prompt injection + tool chaining can become file read/delete and even code execution primitives.
Fortinet says attackers abused FortiCloud SSO to log into other organizations’ FortiGate devices (CVE-2026-24858). What it means, why it matters, and what to do now.