Our latest AI Coding and Open Source Risk webinar examines what this means for security and engineering teams, drawing on data from 300 enterprise leaders. More dependencies mean more vulnerabilities to review, more remediation work, and a backlog that can quietly keep growing. Users running an affected release should move to a version outside the affected range. VulnCheck’s CVE Numbering Authority (CNA) record assigns it a CVSS v4 score of 8.7 and a CVSS v3.1 score of 8.8, with user interaction required and no attacker authentication required. There is no fix on the Windows and WSL path, according to Luz, where v0.0.34 added a Windows installation that carries a warning instead. Aikido’s test system is a single-page web application backed by a GraphQL API carrying the two flaws described in the original incident.
The company said it reported the issue to Microsoft in December 2025 and that patches shipped on August 18, 2026. The flaws, which the researchers collectively named CoSnitch , turn in part on an undocumented URL parameter that the assistant itself surfaced during testing. The tool was approved, but the AI behaved in ways nobody had anticipated.
But ASSET Research Group’s tests show agents can still combine instructions across them in the same working context, so no single fragment has to contain the whole mal… Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks. A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. There is no evidence that the technique has spread successfully in the wild, and the same paper reports that a review of archived posts from Moltbook, the social network for AI agents, found no successful agent-to-agent propagation despite several attempts.
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Markey said it would address how details on recent AI incidents have only been made public in “piecemeal” fashion. The bill would establish an independent board with subpoena power to investigate cybersecurity incidents, including those involving AI. OpenAI has announced that it’s pausing some “internal activities” involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity. The attack targets coding tools that connect to outside servers over the Model Context Protocol (MCP), the open standard that lets AI assistants call external tools. Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them.
The AI security company, which has codenamed the technique “Cryptographic Context Injection ,” said the transfer completed without a confirmation step and with no visible warning in its proof-of-concept demonstration. Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. The problem is how quickly generated code can bring new open-source components into your environment.
- A user opens a browser tab, pastes data into a chat assistant, and nothing is installed.
- They arrive inside software the enterprise already runs, and they arrive without a decision.
- “The message, document service and redirect can therefore appear trustworthy until the browser reaches attacker-controlled infrastructure….
- If teams can suddenly create many times more code, security can also end up with many more components, dependencies, findings, and fixes to manage.
- It’s what an attacker can do with that access next.
The employee followed its advice, inadvertently making a large volume of sensitive data available to unauthorized engineers for over two hours. The company said it has attempted the attack 20 times since June with a 40% success rate, and that the failures cam… Asked which build was tested, Adversa https://www.gakuseimansion.info/getting-started-next-steps-50/ told The Hacker News the target was the Grok web chat at grok.com running Grok 4.5 Fast, and that the attack was reproduced once on August 19, 2026. “When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process,” TrendAI, Trend Micro’s enterprise cybersecurity business, said in a report published Thursday. Your team may then need to assess vulnerabilities, licensing, maintenance, ownership, and whether that package should be there at all. The Real Problem Is What AI Adds to Your Stack AI coding itself is not the issue.
Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more than 2,500 organizations. The work, released as a preprint on August 10, 2026, tests the technique in a simulated six-agent coding collaboration and in a chain of paired agents modeled on OpenClaw , the open-source autonomous assistant formerly known https://www.softarmy.com/15696/download-easy-peasy-passwords.html as Clawdbot and Moltbot . Notably, one of the sites has been built using Lovable , an artificial intelligence (AI)-powered website builder, highlighting how readily available tools can further lower the barrier and make it easier to launch convincing new malicious sites.
Each row gives an organization’s name and domain, a count of secrets exposed, a count of runs, and a label reading High or Medium. CloudSEK has published the dataset as a public lookup , searchable by name or domain and filterable by confidence. Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads.
A one-paragraph warning added to an agent’s system prompt reduced spread to near zero across the payloads https://www.23ch.info/how-i-became-an-expert-on-13/ tested. Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim’s Copilot session. Shadow AI is the unapproved use of AI tools Shady AI is when employees use approved AI tools in unapproved, unexpected, or poorly governed ways Shadow AI happens outside the organization’s visibility. An engineer used an approved AI agent to analyze it, but the agent posted its response publicly without approval. The incident began when a Meta employee posted a technical question on an internal forum. There is no patch, no CVE identifier, and no user-facing workaround, and the writeup does not report any exploitation in the wild.
The activity , per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms , including Shinhan Bank and Yegaram Savings Bank. Given that personal agents will reach corporate systems whether approved or not, you might be wondering what the best way is to block them. Their agents already manage their home time, and managing their work time is the next logical step. Less than a year after the first release of the open-source agent now called OpenClaw, the juggernauts are putting their weight behind the idea that each of us needs a personal assistant. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data outside. A user opens a browser tab, pastes data into a chat assistant, and nothing is installed.
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN . Even AI assistants are getting their own instructions hidden inside phishing messages now. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. A Market Stalled at the Starting Line Despite years of investment in identity and access management, the market’s overall security maturity has hit a wall.
- It said an uploaded file was enough to make the assistant gather internal data and send it out through a URL request, with no separate approval step.
- Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.
- Every organization should now question what secrets they are handing to AI and how well those secrets are protected once they reach an MCP server.
- Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet.
- The dangerous part of a stolen identity isn’t always the initial login.
The test removed the person holding the top place and moved the user up one position. The agent booked sessions months beyond the window the site allowed. “The message, document service and redirect can therefore appear trustworthy until the browser reaches attacker-controlled infrastructure….