Posts

T3MP3ST — Open-Source Framework Turns AI Coding Agents Into Autonomous Red Teamers

T3MP3ST orchestrates Claude Code, Codex, and Hermes agents through a recon-to-exploit kill chain with no additional API keys or cloud infrastructure.

CVE-2026-52830 — fast-mcp-telegram Path Traversal Bypasses Session Protection

Critical CVSS 9.4 path traversal in fast-mcp-telegram lets remote attackers bypass session controls and authenticate as the default legacy user via crafted Bearer tokens.

DataDome — AI Agent Identity Crisis Drives H1 2026 Threat Landscape

ICML 2026 — Prompt Injection as Role Confusion and CoT Forgery

ICML 2026 paper traces prompt injection to role confusion in LLMs and introduces CoT Forgery, a zero-shot attack achieving 60% success against frontier models.

LiteLLM Three-CVE RCE Chain — Default User to Full AI Gateway Compromise in Two Seconds

Unit 42 — Malicious OpenClaw Skills on ClawHub Delivered Infostealers and Crypto Fraud

Palo Alto Networks Unit 42 found five malicious OpenClaw skills on ClawHub that evaded VirusTotal and ClawScan, delivering macOS infostealers and running agentic financial fraud.

Alibaba Bans Claude Code Over Alleged Covert Environment Detection

Alibaba plans to ban Claude Code across workplaces after a Reddit user alleged the tool covertly detected Chinese AI labs and modified its system prompt.

arXiv — Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks

New research audits LangChain, LlamaIndex, and Stripe Agent Toolkit for per-call authorization — all three ship capability gating but none ships deterministic fail-closed authorization by default.

MPBench Exposes Memory Poisoning Attacks in LLM Agents

New research identifies 9 structural vulnerabilities in LLM agent memory systems and introduces MPBench, showing aggressive memory-writing agents are more exploitable and existing prompt injection defenses fail to cover memory poisoning.

Red-Teaming the Agentic Red-Team: Offensive Security Agents Have Shared Design Flaws

First in-depth security analysis of offensive security agents reveals shared design flaws enabling API key exfiltration, persistent footholds, and operator machine compromise even inside sandboxes.

NVIDIA — Fine-Tuned 30B Model Outperforms Frontier LLMs at Agent Exploitation

Black Hat 2026 briefing reveals a purpose-trained 30B open-source model achieves 56% exploit success rate against AI agents at 70-125x lower cost than frontier models.

Flowise CVE-2026-40933 — MCP stdio Transport RCE on Import

Obsidian Security discloses critical Flowise flaw where importing a malicious workflow file triggers remote code execution via MCP stdio transport.

Trend Micro — CVE-2026-33017 Langflow RCE Weaponized for Monero Mining on AI Servers

Threat actors exploit a CVSS 9.3 Langflow vulnerability to deploy custom Monero miners, turning exposed AI app endpoints into cryptojacking gateways.

LiteLLM PyPI Supply Chain Attack — Credential Stealer in Versions 1.82.7–1.82.8

LiteLLM PyPI package compromised — malicious versions 1.82.7 and 1.82.8 shipped a multi-stage credential stealer targeting cloud keys, CI/CD secrets, and crypto wallets.

METR — Frontier AI Risk Report: Rogue Deployment Assessment of Internal AI Agents

Mozilla 0DIN — Claude Code DNS Reverse Shell Attack via Poisoned Repository

Pentera — Claude Desktop Turned Into Double Agent via Personalization Sync

TOCTOU Attack Tricks AI Computer-Use Agents Into Clicking the Wrong Thing

Anthropic — Buffa Rust Library 0-Day: 22x Heap Amplification via Protobuf Unknown Fields

CVE-2026-50143 — Apify MCP Server Token Leak via Path Authority Injection

High-severity flaw in @apify/actors-mcp-server lets attackers inject malicious paths that leak Apify tokens to unauthorized parties.