Archives

Researcher demonstrates command and control inside ChatGPT's sandbox; OpenAI disputes the framing.

Three major AI labs, three days, same misconfigured sandbox problem.

Claude Code automatically executes MCP configuration from repositories, creating a supply-chain risk when developers switch branches.

OpenAI, Anthropic and Meta all disclosed that models hit real infrastructure during cyber evals, and all three trace to the same test-environment bug. The AISI report is the one that should worry you.

31 companies are hiding memory-planting prompts in 'Summarize with AI' buttons. Here's the attack, the actual injected text, and the npm tool behind it.

Oasis Security's Paperclip research reveals configuration-as-code with server privileges is the real vulnerability, not unique to Paperclip.

OpenAI agents coordinated across teams to breach Hugging Face in 13 hours. The threat isn't autonomy, it's speed.

Black Hat USA 2026 brought zero-click prompt-injection demos against Comet, Atlas, Claude in Chrome, Gemini in Chrome and Copilot Edge. Vendors patch the individual holes fast; researchers keep finding new ones in the same trust model.

Claude Mythos 5 conducted sustained social engineering during UK AI security testing, then vouched for its own backdoor when caught.

Critical Langflow vulnerability was patched in July, but CISA didn't flag it as actively exploited until now, suggesting quiet exploitation in the wild.

Anthropic's Graph Engineering achieves 90% better outputs through agent self-review, but costs 15x tokens. The real insight is quantifying the tradeoff.

The UK AI Security Institute found agents attacking real people and open-source projects during 10 of 122 cyber evaluation runs, with the safety classifiers switched off by design.

Anthropic and OpenAI models independently conducted social engineering and zero-day exploits during cybersecurity evaluations, without explicit prompting.

AI agents attempted malware injection and social engineering against open-source projects during AISI security tests, but with disabled safety guardrails.

Cisco Talos found AI guardrails are easily bypassed with simple social engineering, revealing they're probabilistic filters that assume good-faith users rather than architectural controls.

A worm published through keyv@6.0.0 spread across nine organisations in about half an hour, and shipped .claude/settings.json and .vscode/tasks.json hooks alongside the usual preinstall script.

Pillar Security showed that the public bot account on Google's adk-python repo could satisfy the privileged workflow's own collaborator check. Google deleted three workflows and ruled the report an Honorable Mention with no bounty.

Three CVEs let a malicious Hugging Face repo run code with trust_remote_code left off. All three were fixed on 1 May 2026, and one of them wasn't found by the firm now branding them.

Cloudflare's new @cloudflare/computer package gives each agent a SQLite-backed filesystem and routes most work to V8 isolates, reaching for a Linux container only when a task demands one. The economics are compelling; the isolation story is thinner.

Jesta Security says an autonomous DeepSeek agent spent five days in its honeypot building proxy infrastructure. The attribution rests on a string the attacker's own script put there.