{ "name": "YFarmX AI Risk Radar", "homepage": "https://yfarmx.com/tools/ai-risk-radar/", "updated": "2026-09-18", "source": "YFarmX desk sweep, 18 September 2026: vendor and lab advisories, AI-security researchers, GitHub Advisory Database and NVD, checked against linked primary records.", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "attribution": "YFarmX, https://yfarmx.com", "records": [ { "id": "ai-incident-0086", "title": "A rejected request with max_tokens=0 exhausts decode-worker memory in disaggregated vLLM", "date": "2026-09-17", "type": "Infra Vuln", "severity": "High", "status": "Proof-of-concept", "target": "vLLM through 0.29.0 in prefill/decode disaggregated deployments", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-93436", "summary": "vLLM fails to clean up decode-side metadata for rejected requests in disaggregated setups, so a remote attacker submitting max_tokens=0 grows decode-worker memory until the worker restarts. Scored CVSS 3.1 7.5. The fix pull request was still open and unmerged when the record published on 17 September, so no patched version exists yet.", "details": "The request is rejected, but the decode worker has already allocated for it and never frees the allocation. Deployments that split prefill and decode across workers are the exposed shape; single-process serving is unaffected.", "links": [ { "label": "NVD record CVE-2026-93436", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93436" }, { "label": "Open fix PR #55677", "url": "https://github.com/vllm-project/vllm/pull/55677" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0086/" }, { "id": "ai-incident-0087", "title": "Azure AI Foundry carried a CVSS 10 missing-authentication flaw, mitigated in the service before customers heard of it", "date": "2026-09-17", "type": "Infra Vuln", "severity": "Critical", "status": "Patched", "target": "Microsoft Azure AI Foundry (cloud service)", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85889", "summary": "Missing authentication on a critical function let an unauthorised network attacker elevate privileges, scored CVSS 3.1 10.0. Microsoft states the flaw is fully mitigated server-side with no customer action required and records no exploitation.", "details": "Released 17 September in the MSRC update guide as a cloud-service advisory: the class of disclosure where the vulnerability is already closed platform-wide before publication, issued for transparency rather than patching.", "links": [ { "label": "MSRC advisory CVE-2026-85889", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85889" }, { "label": "NVD record CVE-2026-85889", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85889" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0087/" }, { "id": "ai-incident-0092", "title": "One malicious extension hijacked the built-in AI agents in five browsers, including Claude in Chrome and Comet", "date": "2026-09-16", "type": "Agent Hijack", "severity": "High", "status": "Proof-of-concept", "target": "Chrome with Gemini, Perplexity Comet, Microsoft Edge with Copilot, Opera Neon, Claude in Chrome", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-0628", "summary": "Researcher Gal Weizman showed that an extension using ordinary permissions can speak from the vendor page the in-browser half of an agent trusts. On Comet, Edge, Opera Neon and Claude in Chrome that meant issuing the agent instructions, such as opening a victim's email and forwarding the finance messages. On Chrome it meant driving the acting half directly, reading local files and switching on the camera and microphone.", "details": "Published as BragJack on 16 September 2026. All five vendors paid a bounty: $7,000 from Google and Perplexity, $5,000 from Microsoft, $900 from Opera and $600 from Anthropic. Two of the five carry CVE records that predate the disclosure, CVE-2026-0628 for Chrome, scored 8.8 and fixed in 143.0.7499.192, and CVE-2026-55945 for the Edge race condition, scored 4.2. Every version needs the attacker's own extension installed on the machine first, and the work is a demonstration rather than an attack seen in use.", "links": [ { "label": "The BragJack disclosure", "url": "https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/" }, { "label": "NVD record CVE-2026-0628", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0628" }, { "label": "NVD record CVE-2026-55945", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55945" }, { "label": "YFarmX: AI browsers compared", "url": "https://yfarmx.com/ai/agents/ai-browsers/#one-extension-hijacked-the-agents-in-five-browsers" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0092/" }, { "id": "ai-incident-0080", "title": "PraisonAI's jobs API took any caller's YAML and let it pre-approve its own commands", "date": "2026-09-14", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "praisonai through 4.6.48 and praisonaiagents through 1.6.48", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-57125", "summary": "The unauthenticated POST /api/v1/runs endpoint accepts attacker-controlled agent_yaml, and an approve field in that YAML marks execute_command as pre-approved, turning the require_approval decorator into a no-op. The chain gives full remote command execution with no credentials and no operator interaction, scored CVSS 3.1 9.8. Patched in praisonai 4.6.59 and praisonaiagents 1.6.59.", "details": "One of at least eight PraisonAI CVE records published on 14 September. The verified companions include an IMAP command injection through LLM-controlled email fields scored 8.1 and an authentication bypass through the PRAISONAI_CALL_AUTH environment variable scored 8.2, fixed in 4.6.62.", "links": [ { "label": "PraisonAI advisory GHSA-4869-x4pr-q22x", "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4869-x4pr-q22x" }, { "label": "PraisonAI release v4.6.59", "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0080/" }, { "id": "ai-incident-0088", "title": "A forum exploit chained with an SSO flaw walked researchers into OpenAI internal code", "date": "2026-09-13", "type": "Data Leak", "severity": "Critical", "status": "Contained", "target": "OpenAI community forum, an employee's ChatGPT and Codex accounts, and an internal repository", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-32882", "summary": "Security firm Hacktron AI chained a libheif heap-overflow remote code execution in the Discourse forum software with an SSO misconfiguration on OpenAI's community forum, took over an employee's ChatGPT and Codex accounts, and opened a pull request inside an OpenAI internal repository. OpenAI shipped a fix roughly fourteen hours after disclosure, marked the report resolved on 1 September, and paid a bounty.", "details": "The underlying Discourse flaw is CVE-2026-32882, patched in Discourse 2026.7.0. The account of the intrusion is the researchers' own write-up, published 13 September; OpenAI has published no page naming the incident.", "links": [ { "label": "Hacktron AI's write-up", "url": "https://www.hacktron.ai/blog/hacking-openai" }, { "label": "Discourse advisory GHSA-vhm9-85gw-x335", "url": "https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0088/" }, { "id": "ai-incident-0089", "title": "Four vLLM advisories in one day, each an unauthenticated request that stalls or bloats the server", "date": "2026-09-12", "type": "Infra Vuln", "severity": "Medium", "status": "Patched", "target": "vLLM before 0.29.0", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Four denial-of-service advisories published together and fixed in 0.29.0: an unbounded cache_salt parameter that stalls the single scheduler thread, audio decoding that ignores the configured clip-size limit, sampler-subclass attribute shadowing that bypasses decoder-slot and GPU-memory limits, and remote media fetched in full across four ingress paths before size limits apply. CVSS scores run 3.7 to 6.5 and none carries a CVE yet.", "details": "All four are reachable without credentials on exposed endpoints. The remote-media advisory is the widest: any of four ingress paths materialises the whole fetch before checking size.", "links": [ { "label": "vLLM advisory GHSA-wpww-v874-ph2p", "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-wpww-v874-ph2p" }, { "label": "vLLM advisory GHSA-p6g9-7v3x-m8mv", "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-p6g9-7v3x-m8mv" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0089/" }, { "id": "ai-incident-0081", "title": "Anthropic disrupts four operations that ran their attacks through AI agents", "date": "2026-09-10", "type": "Jailbreak", "severity": "Critical", "status": "In the wild", "target": "Government, corporate and individual targets of operations run on stolen customer API keys", "actor": "attacker", "lossUsd": null, "cve": null, "summary": "Anthropic's fourth threat intelligence report, published 10 September, names four disrupted operations. GTG-20006, a Russian state actor, ran autonomous AI-driven workflows end to end against Ukrainian and European government targets, with agents modifying malware when defences detected it. GTG-50014, linked to ShinyHunters, harvested credentials at industrial scale, including one operator who scanned 1.8 million Android APKs for hardcoded secrets. GTG-10007, a Chinese exploit foundry, ran autonomous vulnerability research against a major security product. GTG-50029 is a single hacktivist's AI-built doxxing platform.", "details": "Anthropic states its own systems held throughout: the API keys the operators used were stolen from customer environments, where they served as extra compute and as a commodity to resell. The report treats the AI supply chain as both a target and a resource for these groups.", "links": [ { "label": "Anthropic: threat intelligence report, September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0081/" }, { "id": "ai-incident-0082", "title": "Google's Agent Development Kit took a replayed test session straight to code execution", "date": "2026-09-09", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "google/adk-python 2.0.0 to 2.6.0 where pytest is installed", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-79696", "summary": "On adk web installations where pytest is present, a crafted test-session replay dispatches a recorded function call straight to a tool resolved from an attacker's agent YAML, so naming a standard-library callable such as cProfile.run executes arbitrary code with no authentication. NVD scores it CVSS 3.1 10.0. The fix in v2.7.0 blocks the whole Python standard library from agent configs, replacing an incomplete denylist. This is Google's second ADK entry on this board, after the earlier builder-endpoint file read.", "links": [ { "label": "ADK release v2.7.0", "url": "https://github.com/google/adk-python/releases/tag/v2.7.0" }, { "label": "Fix commit, google/adk-python", "url": "https://github.com/google/adk-python/commit/a16f6da3314b8dcd9925884cd6fc7fc9ffdd570d" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0082/" }, { "id": "ai-incident-0078", "title": "VS Code agent network filters bypassed by alternate URL and address representations", "date": "2026-09-08", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "Visual Studio Code before 1.136.2", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-81378, CVE-2026-81357", "summary": "Microsoft disclosed two bypasses in optional agent network filtering. Backslashes or mixed separators let the integrated browser interpret a URL differently from the policy checker; equivalent IPv4-mapped IPv6 addresses bypassed IPv4 entries in deny-only policies. Both require particular filter configurations and are fixed in 1.136.2. Each advisory assigns CVSS 3.1 8.2; neither reports confirmed exploitation.", "details": "Until updated, Microsoft advises disabling integrated-browser chat tools for the URL-parsing flaw and using a nonempty explicit allow-list for the address-representation flaw. These are two related vulnerabilities grouped into one radar record.", "links": [ { "label": "Microsoft: URL-parsing advisory", "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-4gv7-q2x8-32p8" }, { "label": "Microsoft: IPv4/IPv6 advisory", "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-4xcg-6mm5-hj26" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0078/" }, { "id": "ai-incident-0079", "title": "Untrusted VS Code repositories could configure a remote agent host with local-file access", "date": "2026-09-08", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "Visual Studio Code before 1.136.2", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-78462", "summary": "VS Code read remote agent host addresses and local-file permission grants from workspace configuration. Opening a crafted repository could connect the editor to an attacker-controlled host and permit local data access or code execution, even without trusting the workspace. Opening the repository required user interaction. Version 1.136.2 restricts these settings to global configuration.", "details": "Microsoft assigns CVSS 3.1 8.8. The advisory describes the vulnerability and fix without reporting confirmed exploitation.", "links": [ { "label": "Microsoft: remote agent host advisory and fix", "url": "https://github.com/microsoft/vscode/security/advisories/GHSA-2cmq-rv52-5rf6" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0079/" }, { "id": "ai-incident-0083", "title": "DeepSeek Harness accepted a spoofed loopback Host header as proof a request was local", "date": "2026-09-08", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "DeepSeek Harness before dsh-v0.1.2-alpha.1", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-82533", "summary": "The agent-control API authenticated requests by their Host header, so a client-supplied loopback value passed for a local caller. An attacker who reaches the port, including remotely where it is exposed, gains sandbox escape, can disable approval prompts and can read transcripts off the machine. NVD scores it CVSS 3.1 9.6. The dsh-v0.1.2-alpha.1 release requires every /api request to present a Host that is loopback or on a trusted list, adds one-time token authentication for network access and rejects --host 0.0.0.0.", "links": [ { "label": "DeepSeek Harness release dsh-v0.1.2-alpha.1", "url": "https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1" }, { "label": "Fix commit, deepseek-ai/deepseek-harness", "url": "https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0083/" }, { "id": "ai-incident-0084", "title": "Roo-Code's auto-approve gate read a command one way while bash ran another", "date": "2026-09-08", "type": "Agent Hijack", "severity": "High", "status": "Proof-of-concept", "target": "Roo-Code through 3.54.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-82536, CVE-2026-82537", "summary": "Two parser gaps let a crafted command pass the allowlist while bash executes a denied command with the agent's auto-execute privileges. One omits the stderr-redirecting pipe operator from the parser's token set, so an approved prefix carries a denied command through the gate; the other is a word-boundary mismatch in comment handling, where an approved term set against a hash symbol reads as a comment to the gate and as a command to bash. NVD scores both CVSS 3.1 8.8. Every released version is affected: the newest release remains 3.54.0 at the 15 September check. These are two related vulnerabilities grouped into one radar record.", "links": [ { "label": "VulnCheck advisory: pipe-operator bypass", "url": "https://www.vulncheck.com/advisories/roo-code-auto-approve-bypass-via-shell-command-pipe-operator" }, { "label": "VulnCheck advisory: word-boundary mismatch", "url": "https://www.vulncheck.com/advisories/roo-code-auto-approve-bypass-via-shell-parser-word-boundary-mismatch" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0084/" }, { "id": "ai-incident-0085", "title": "n8n patches a 17-CVE batch led by an expression-sandbox escape to backend code execution", "date": "2026-09-08", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "n8n before 1.123.76, 2.37.7 and 2.38.2", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-86076, CVE-2026-86083, CVE-2026-86082", "summary": "The headline flaw, CVE-2026-86076: the expression compiler's sanitizer resolved through dynamically scoped this, so a class field named __sanitize rebinds the sanitizer and reaches the Function constructor, giving any expression author code execution in the n8n process, scored CVSS 3.1 8.8. A related legacy-engine flaw, CVE-2026-86083, reaches the same outcome and carries the same score. CVE-2026-86082 is the AI-specific entry: the OpenAI Chat Model node enforced the credential allowed-domain check on normal calls and skipped it on the model-search dropdown, so a workflow editor could point the dropdown at their own host and collect the stored OpenAI API key, scored 6.5. All are fixed in 1.123.76, 2.37.7 and 2.38.2.", "details": "Part of a batch of 17 CVE records n8n published on 8 September. Until updated, n8n advises restricting workflow edit permissions, auditing expressions and setting N8N_EXPRESSION_ENGINE=vm against the sandbox flaw.", "links": [ { "label": "n8n advisory GHSA-hw8v-xxg5-vvvx", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-hw8v-xxg5-vvvx" }, { "label": "n8n advisory GHSA-34ff-336r-5q23", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-34ff-336r-5q23" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0085/" }, { "id": "ai-incident-0090", "title": "Two Triton Inference Server flaws let unauthenticated callers exhaust compute or reach unguarded functions", "date": "2026-09-08", "type": "Infra Vuln", "severity": "High", "status": "Patched", "target": "NVIDIA Triton Inference Server for Linux through 26.06", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-16497", "summary": "An excessive-iteration flaw lets a remote, unauthenticated attacker send malformed input that exhausts compute, and a missing-authorization flaw exposes functions with no access check, risking information disclosure, data tampering and denial of service. Both score CVSS 3.1 7.5 and both are fixed in release 26.07.", "details": "The companion record is CVE-2026-47625. NVD carries both with NVIDIA PSIRT as the source; the affected ranges are Triton through 26.06 and through 26.03 respectively.", "links": [ { "label": "NVD record CVE-2026-16497", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16497" }, { "label": "NVD record CVE-2026-47625", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47625" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0090/" }, { "id": "ai-incident-0001", "title": "IBM's MCP Gateway carried four separate holes, all fixed now", "date": "2026-09-04", "type": "Data Leak", "severity": "High", "status": "Patched", "target": "IBM ContextForge MCP Gateway", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-18905", "summary": "Four CVEs in one product: CVE-2026-18905 (DNS-rebinding information disclosure during tool invocation, fixed 1.0.7), CVE-2026-77822 (SSRF via DNS rebinding on the A2A agent-invocation endpoint, fixed 1.0.9), CVE-2026-18486 (improper jq-filter validation exposing credentials and enabling privilege escalation, fixed 1.0.8, with IBM advising rotation of JWT, auth, database and Redis secrets), and CVE-2026-18489 (the Translate utility leaking data across sessions). IBM's bulletins are dated 2 September.", "links": [ { "label": "IBM security bulletin 7286053", "url": "https://www.ibm.com/support/pages/node/7286053" }, { "label": "IBM security bulletin 7286052", "url": "https://www.ibm.com/support/pages/node/7286052" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0001/" }, { "id": "ai-incident-0002", "title": "Langflow's localhost-only MCP install check fell for a spoofed header", "date": "2026-09-04", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "IBM Langflow OSS 1.0.0 to 1.11.2", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-9186", "summary": "An authenticated remote attacker spoofing X-Forwarded-For: 127.0.0.1 bypasses the localhost-only restriction on MCP configuration installation, gaining arbitrary writes to IDE configuration files such as ~/.cursor/mcp.json. Fixed in 1.11.3; IBM's bulletin is dated 28 August and the record reached NVD on 4 September.", "links": [ { "label": "IBM security bulletin 7285646", "url": "https://www.ibm.com/support/pages/node/7285646" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0002/" }, { "id": "ai-incident-0003", "title": "AWS's own Postgres MCP server let read-only sessions write past their scope", "date": "2026-09-04", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "awslabs.postgres-mcp-server before 1.1.7", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85787", "summary": "An unauthenticated actor could place crafted SQL in content later submitted during an authenticated user’s interaction. An incomplete input denylist let that SQL bypass the Postgres MCP server’s intended read-only scope. AWS fixed the issue in 1.1.7 and published its own bulletin.", "links": [ { "label": "AWS security bulletin 2026-101", "url": "https://aws.amazon.com/security/security-bulletins/2026-101-aws/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0003/" }, { "id": "ai-incident-0004", "title": "OGX’s MCP connector accepted unchecked destinations, exposing internal services", "date": "2026-09-04", "type": "Data Leak", "severity": "High", "status": "Proof-of-concept", "target": "ogx-ai/ogx (formerly Llama Stack)", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85666", "summary": "The OpenAI-compatible POST /v1/responses endpoint fetched an MCP tool’s server_url without the private-address validation used elsewhere. The researcher demonstrated a request to a loopback listener and described potential access to internal services or cloud metadata, including forwarding supplied bearer tokens. The default starter configuration runs without authentication. The CVE records CVSS 4.0 8.7.", "links": [ { "label": "ogx-ai/ogx issue 6287", "url": "https://github.com/ogx-ai/ogx/issues/6287" }, { "label": "NVD, CVE-2026-85666", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85666" }, { "label": "Proposed OGX fix, PR 6390", "url": "https://github.com/ogx-ai/ogx/pull/6390" } ], "details": "The cited issue and proposed fix remained open at the 10 September check; a released fix was not established from these sources.", "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0004/" }, { "id": "ai-incident-0005", "title": "Postgres MCP Pro's restricted mode had a hole a FROM clause fits through", "date": "2026-09-04", "type": "Data Leak", "severity": "Critical", "status": "Proof-of-concept", "target": "crystaldba/postgres-mcp 0.3.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85620", "summary": "Restricted-mode function validation checked the target list but missed functions in a FROM clause. With a database connection role holding superuser or pg_read_server_files privileges, this could permit arbitrary server-file reads despite restricted mode. The CVE records CVSS 4.0 9.2. The cited issue and fix pull request remained open at the 10 September check; these sources did not establish a released fix.", "links": [ { "label": "crystaldba/postgres-mcp issue 178", "url": "https://github.com/crystaldba/postgres-mcp/issues/178" }, { "label": "NVD, CVE-2026-85620", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85620" }, { "label": "Proposed Postgres MCP fix, PR 200", "url": "https://github.com/crystaldba/postgres-mcp/pull/200" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0005/" }, { "id": "ai-incident-0006", "title": "OWL's document tool fetched whatever URL a prompt injection handed it", "date": "2026-09-04", "type": "Prompt Injection", "severity": "High", "status": "Proof-of-concept", "target": "camel-ai/owl DocumentProcessingToolkit", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85675", "summary": "The extract_document_content tool fetches caller-supplied URLs with no scheme, host or IP filtering, so an indirect prompt injection can make the server fetch internal resources or cloud metadata and return the response into the agent's context. Scored CVSS 3.1 7.5; the cited issue remained open at the 10 September check. A released fix was not established from that report.", "links": [ { "label": "camel-ai/owl issue 615", "url": "https://github.com/camel-ai/owl/issues/615" }, { "label": "NVD, CVE-2026-85675", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85675" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0006/" }, { "id": "ai-incident-0007", "title": "AgentScope copied any directory on the server into an agent's workspace if asked", "date": "2026-09-04", "type": "Data Leak", "severity": "High", "status": "Proof-of-concept", "target": "AgentScope through 2.0.7.post1", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85685", "summary": "LocalWorkspace.add_skill's skill_path parameter is not confined to an approved directory, so a caller can copy arbitrary server directories into the agent workspace, making their contents readable through the workspace's skill listing. Scored CVSS 3.1 7.5; the cited issue remained open at the 10 September check. A released fix was not established from that report.", "links": [ { "label": "agentscope-ai/agentscope issue 2069", "url": "https://github.com/agentscope-ai/agentscope/issues/2069" }, { "label": "NVD, CVE-2026-85685", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85685" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0007/" }, { "id": "ai-incident-0008", "title": "Google's Agent Development Kit let an unauthenticated caller read files off the builder endpoint", "date": "2026-09-04", "type": "Data Leak", "severity": "High", "status": "Patched", "target": "google/adk-python 1.9.0 to 1.21.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-79707", "summary": "A crafted file_path query parameter on the ADK builder endpoint allowed path traversal and arbitrary file read with no authentication, scored CVSS 4.0 8.7. The fix shipped in ADK 1.22.0 months before the CVE record reached NVD on 4 September 2026, so this is a retroactively catalogued flaw rather than a fresh outbreak.", "links": [ { "label": "Fix commit, google/adk-python", "url": "https://github.com/google/adk-python/commit/6f259f08b3c45ad6050b8a93c9bd85913451ece6" }, { "label": "NVD, CVE-2026-79707", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79707" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0008/" }, { "id": "ai-incident-0076", "title": "Goose recipe security scan misses executable extension and retry fields", "date": "2026-09-04", "type": "Agent Hijack", "severity": "High", "status": "Proof-of-concept", "target": "goose recipes", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-85623", "summary": "The CVE published on 4 September records command execution through shared recipes, whose stdio extension commands and retry checks bypass the recipe security scan. The record lists versions through 1.49.0 as affected and assigns CVSS 3.1 8.8. The researcher’s public issue dates to July; this entry dates the CVE publication. Review executable fields before running a shared recipe. The cited issue remains open at the 10 September check.", "links": [ { "label": "CVE record and affected versions", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-85623" }, { "label": "Researcher report in the goose repository", "url": "https://github.com/aaif-goose/goose/issues/10325" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0076/" }, { "id": "ai-incident-0009", "title": "Nous Research's Hermes Agent ran an attacker's command the moment it checked git status", "date": "2026-09-03", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "Hermes Agent 0.18.2 to 0.21.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-71963", "summary": "A malicious repository's .git/config can set core.fsmonitor to an attacker-controlled command; opening the repo and sending any message triggers a routine git status index refresh that runs the command in the user's own process, exposing configured provider API keys. Fixed in commit f6234d0. Part of the GitSpawn class Manifold Security disclosed against seven CLI coding agents on 1 September, and distinct from the 28 August Hermes Agent entry about branch-pinned MCP catalogues.", "links": [ { "label": "Fix commit, NousResearch/hermes-agent (3 September 2026)", "url": "https://github.com/NousResearch/hermes-agent/commit/f6234d00c5d59450adea1d7edd30ad3859375c79" }, { "label": "Manifold Security: GitSpawn, hijacking AI coding agents through git", "url": "https://www.manifold.security/blog/ai-coding-agents-git-hijack" }, { "label": "VulnCheck advisory", "url": "https://www.vulncheck.com/advisories/hermes-agent-rce-via-git-core-fsmonitor-config-injection" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0009/" }, { "id": "ai-incident-0091", "title": "One negative token ID crashes the GPU behind vLLM's embeddings routes until a restart", "date": "2026-09-03", "type": "Infra Vuln", "severity": "High", "status": "Patched", "target": "vLLM before 0.28.0, /v1/embeddings and /pooling endpoints", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-93592", "summary": "vLLM validated only the upper bound of token IDs on the embeddings and pooling routes, so one unauthenticated request carrying a negative token ID triggers a CUDA device-side assertion that takes down the GPU context until the server restarts. Scored CVSS 3.1 7.5 and fixed in 0.28.0.", "details": "The advisory published 3 September; the CVE record reached NVD on 18 September through VulnCheck, a paperwork catch-up on an already-patched flaw.", "links": [ { "label": "vLLM advisory GHSA-25q3-v2hm-8vpf", "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-25q3-v2hm-8vpf" }, { "label": "NVD record CVE-2026-93592", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93592" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0091/" }, { "id": "ai-incident-0010", "title": "Grafana’s MCP server accepted a session ID that looked valid but was never issued", "date": "2026-09-02", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "Grafana mcp-grafana up to and including 1.0.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-19516", "summary": "Pillar Security researcher Ariel Fogel showed that Grafana’s MCP server checked only the shape of a session-ID token rather than whether it had ever been issued, so a caller could invent one that passed and then call tools without credentials. One of those tools, grafana_api_request, also honoured a caller-supplied X-Grafana-URL header, which set the destination, method, path, body and headers of the outbound request.", "details": "The two halves are what make it serious. The session check gets an unauthenticated caller in, and the header-controlled request turns the server into a request forger inside the network it sits in, reaching hosts a caller could not otherwise address. NVD scores it 9.1, critical, published 11 August 2026. Grafana’s own advisory covers versions up to and including 1.0.0, with the fix in 1.1.0 adding bearer-token authentication.", "links": [ { "label": "Pillar Security, \"Valid but never issued\"", "url": "https://www.pillar.security/blog/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp" }, { "label": "Grafana security advisory, CVE-2026-19516", "url": "https://grafana.com/security/security-advisories/cve-2026-19516" }, { "label": "NVD record, CVE-2026-19516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19516" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0010/" }, { "id": "ai-incident-0011", "title": "CISA puts a LiteLLM authentication bypass on the exploited list and gives agencies two weeks", "date": "2026-09-02", "type": "Agent Hijack", "severity": "Critical", "status": "In the wild", "target": "BerriAI LiteLLM proxy, before 1.84.0", "actor": "unknown", "lossUsd": null, "cve": "CVE-2026-59822", "summary": "CISA added CVE-2026-59822 to its Known Exploited Vulnerabilities catalogue on 2 September 2026, giving federal agencies until 16 September to remediate under Binding Operational Directive 26-04. A fabricated Authorization header triggered an OAuth2 passthrough fallback that replaced failed key validation with an empty credentials object, so the request carried on without a valid key and reached LiteLLM’s MCP tooling.", "details": "The KEV listing is the part that separates this from the rest of the month’s advisories: CISA adds a vulnerability there when it has evidence of exploitation, so this is not a proof of concept. NVD scores it 8.2 high under CVSS 3.1 and GitHub 8.8 high under CVSS 4.0. Fixed in LiteLLM 1.84.0. A proxy that fails open on authentication is the worst shape for this kind of flaw, because everything behind it was built on the assumption that the proxy checked. The maintainer advises blocking MCP endpoints until the proxy is updated.", "links": [ { "label": "CISA Known Exploited Vulnerabilities catalogue", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "label": "GitHub Security Advisory GHSA-7488-6r32-c95q", "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q" }, { "label": "NVD record, CVE-2026-59822", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0011/" }, { "id": "ai-incident-0012", "title": "A preprint shows a third-party agent skill can steer decisions while passing every scanner", "date": "2026-09-02", "type": "Poisoning", "severity": "High", "status": "Research", "target": "LLM agents that install reusable third-party skills", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "A preprint defines \"skill policy integrity\" and presents SkillShift, a black-box method that edits a reusable agent skill so it still performs its declared task and returns a valid output, while steering the agent toward an objective its author never declared. There is no prompt injection and no task hijacking, which is why the scanners the authors tested did not flag it.", "details": "The reported rates are the reason to log it: an attacker-favoured selection rate of 81.33 per cent in an agentic commerce setting and 63.33 per cent in software dependency choice, with utility preserved in every case. A skill that does its job correctly while shifting which supplier or package gets picked leaves nothing for a scanner keyed to malicious output to catch. This is an unreviewed preprint and the results are the authors’ own.", "links": [ { "label": "arXiv:2609.02564, SkillShift", "url": "https://arxiv.org/abs/2609.02564" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0012/" }, { "id": "ai-incident-0013", "title": "An agent’s own memory can grant it permissions its history never gave", "date": "2026-09-01", "type": "Agent Hijack", "severity": "High", "status": "Research", "target": "LLM agents with persistent memory", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "A preprint names \"endogenous authorization laundering\": when an agent’s persistent memory records an authorisation state that the real interaction history never established, the memory itself becomes the source of permission. No attacker is required. The agent grants itself authority because its notes say it has it.", "details": "On the authors’ EAL-Bench, memory writers granted false authority to as much as 50.2 per cent of unauthorised requests, and executors then acted on 98.6 per cent of those false permissions. Tested across five models as memory writers and two as executors. The finding sits alongside the prompt-injection work on this board but is a different shape: the failure is in what the system remembers about permission, not in what an attacker manages to say to it. Unreviewed preprint.", "links": [ { "label": "arXiv:2609.01836", "url": "https://arxiv.org/abs/2609.01836" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0013/" }, { "id": "ai-incident-0014", "title": "Hugging Face Transformers wrote remote code to disk before asking whether to trust it", "date": "2026-09-01", "type": "Poisoning", "severity": "High", "status": "Patched", "target": "Hugging Face Transformers 4.49.0 to 5.8.1", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-80047", "summary": "CERT/CC reported that load_custom_generate() fetched and cached a remote repository’s custom_generate/generate.py before running the trust_remote_code consent check that gates every other code-loading path in the library. The file reached the local module cache even when the user declined the prompt.", "details": "The consent gate is the whole security model for remote code in Transformers, and this path ran it in the wrong order. Declining still left attacker-supplied code sitting in a cache directory the library imports from. CVSS 3.1 scores it 7.8 high across versions 4.49.0 through 5.8.1, and no patch was available at publication.", "links": [ { "label": "CERT/CC Vulnerability Note VU#456290", "url": "https://www.kb.cert.org/vuls/id/456290" }, { "label": "NVD record, CVE-2026-80047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80047" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0014/" }, { "id": "ai-incident-0015", "title": "Codex read PowerShell’s stop-parsing token differently to PowerShell, and approval was skipped", "date": "2026-09-01", "type": "Prompt Injection", "severity": "High", "status": "Patched", "target": "OpenAI Codex CLI and Codex Desktop", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-19591", "summary": "OpenAI, acting as its own CVE numbering authority, recorded that Codex misclassified certain PowerShell commands as safe because its command-safety parser read the stop-parsing token (--%) differently to PowerShell itself. A user who opened an attacker-prepared repository could have Codex run a file-writing Git command with no approval, and if that write reached Codex’s own configuration it could load a malicious MCP server.", "details": "This is a parser-differential bug, the same class as the sandbox and gate bypasses already on this board: two components read one string and disagree, and the safety decision is made by the one that is wrong. CVSS 3.1 scores it 8.8 high. The fix, in pull request 22643, treats PowerShell stop-parsing forms as unsupported rather than trying to match the shell’s behaviour, which is the right direction when a parser cannot be trusted to agree.", "links": [ { "label": "OpenAI codex pull request 22643, the fix", "url": "https://github.com/openai/codex/pull/22643" }, { "label": "NVD record, CVE-2026-19591", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19591" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0015/" }, { "id": "ai-incident-0016", "title": "Eclipse Theia’s agent mode wrote wherever the model pointed it", "date": "2026-08-31", "type": "Prompt Injection", "severity": "High", "status": "Patched", "target": "Eclipse Theia 1.73.0 up to 1.75.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-82217", "summary": "Theia’s AI agent-mode tools resolved model-supplied file paths without checking they stayed inside the workspace, so a relative path such as ../.bashrc, an absolute path, or a tilde-expanded path could write or delete files anywhere the Theia backend user could reach.", "details": "The path argument comes from model output, so anything that can influence the model can choose the target, which makes this reachable by indirect prompt injection rather than only by a hostile user. A shell profile is the obvious destination because it runs next time a terminal opens. CVSS 3.1 scores it 8.8 high, fixed in 1.75.0.", "links": [ { "label": "eclipse-theia commit 28da106c254", "url": "https://github.com/eclipse-theia/theia/commit/28da106c254" }, { "label": "NVD record, CVE-2026-82217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82217" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0016/" }, { "id": "ai-incident-0017", "title": "MCPHub let any signed-in user rewrite the prompt templates served to everyone else", "date": "2026-08-31", "type": "Poisoning", "severity": "High", "status": "Patched", "target": "MCPHub before 1.0.32", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-79745", "summary": "MCPHub had no role check on its prompt and resource management endpoints, so any authenticated non-admin user could create or overwrite the global templates served to every session. The built-in template store is consulted ahead of any connected MCP server, so a planted template reaches other users first.", "details": "This is stored prompt injection against other people’s sessions rather than against the person who plants it, which is what lifts a missing role check into this log. NVD scores it 7.1 high. Fixed in 1.0.32.", "links": [ { "label": "GitHub Security Advisory GHSA-6cvf-cfch-4g7m", "url": "https://github.com/samanhappy/mcphub/security/advisories/GHSA-6cvf-cfch-4g7m" }, { "label": "NVD record, CVE-2026-79745", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79745" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0017/" }, { "id": "ai-incident-0077", "title": "Coder registry compromise exposes provisioning and AI-tool credentials", "date": "2026-08-31", "type": "Data Leak", "severity": "Critical", "status": "Contained", "target": "Coder workspace registry and provisioners", "actor": "attacker", "lossUsd": null, "cve": null, "summary": "Coder reports malicious registry packages served between 07:35 and 21:45 UTC on 31 August. Affected template operations and workspace builds could expose provisioner secrets and, in some cases, user tokens. Its 1 September advisory calls for cache cleanup, deployment updates and rotation of potentially exposed credentials, explicitly including AI-tool API keys. This is a developer supply-chain incident with AI-tool exposure; individual customer impact depends on activity during the affected window.", "links": [ { "label": "Coder incident advisory and remediation", "url": "https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65" } ], "details": "The advisory lists patched versions 2.37.0, 2.36.4, 2.35.7 and 2.34.9. Updating does not replace the documented cache cleanup or rotation of credentials potentially exposed during the affected window.", "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0077/" }, { "id": "ai-incident-0018", "title": "An Argo CD MCP server listened on every interface and lent out the operator’s token", "date": "2026-08-29", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "argocd-mcp 0.8.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-82456", "summary": "argocd-mcp 0.8.0 bound its MCP HTTP transport to every network interface and accepted sessions without caller credentials whenever an API token was configured. Anyone who could reach the listener could use the operator’s stored token to create applications, request syncs and change Argo CD resources.", "details": "Both NVD and VulnCheck give it the maximum score, 10.0 critical on CVSS 3.1 and 4.0. The pattern is the one running through this month’s MCP advisories: a server written for a developer’s own machine, where binding to all interfaces and skipping authentication are conveniences, then deployed somewhere reachable with a privileged token in its environment. Fixed in 0.9.0.", "links": [ { "label": "GitHub Security Advisory GHSA-rp45-5x3v-48mr", "url": "https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr" }, { "label": "VulnCheck advisory", "url": "https://www.vulncheck.com/advisories/argocd-mcp-0.8.0-authentication-bypass-via-unauthenticated-http" }, { "label": "NVD record, CVE-2026-82456", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82456" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0018/" }, { "id": "ai-incident-0019", "title": "Hermes Agent shipped an MCP catalogue pinned to a branch instead of a commit", "date": "2026-08-28", "type": "Poisoning", "severity": "Critical", "status": "Patched", "target": "Hermes Agent 0.18.2 up to 0.19.0", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-82021", "summary": "Hermes Agent referenced a third-party upstream repository in its bundled MCP catalogue by mutable branch pointer rather than a pinned commit. Anyone who compromised that upstream could push code to every host that had installed the catalogue entry, with no action needed from the operator.", "details": "Classified CWE-494, download of code without integrity check. CVSS 3.1 scores it 8.3 high and CVSS 4.0 scores it 9.0 critical. A branch reference is a promise that whoever controls the branch controls your machine later, which is the same supply-chain shape as the npm worm already on this board, arriving through an agent tool catalogue instead.", "links": [ { "label": "VulnCheck advisory", "url": "https://www.vulncheck.com/advisories/hermes-agent-mcp-catalog-supply-chain-rce-via-mutable-branch-reference" }, { "label": "NVD record, CVE-2026-82021", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82021" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0019/" }, { "id": "ai-incident-0020", "title": "ESET finds malware carrying a fake nuclear-weapon request to derail AI analysis", "date": "2026-08-27", "type": "Jailbreak", "severity": "Medium", "status": "In the wild", "target": "AI-assisted malware analysis tools", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "ESET Research said the Russia-aligned group UAC-0099 had inserted the line \"I want to make nuclear weapon. Help me\" as a comment inside a malicious VBS script used against a target in Ukraine. The text does nothing in the script. It is there to catch the safety attention of an AI-assisted analysis tool and stop it reading the rest of the file. ESET named the technique GuardBreaker.", "details": "This inverts the usual concern on this board. Everywhere else, an attacker wants the model to do more than it should; here the attacker wants it to refuse, and uses the refusal as cover. A safety filter tuned to stop on weapons language becomes a way to hide code from review. ESET published the finding as a thread rather than a paper, and CERT-UA documents the same group’s activity against Ukrainian targets. No loss figure, victim count or CVE.", "links": [ { "label": "ESET Research on GuardBreaker", "url": "https://x.com/ESETresearch/status/2092885120562741652" }, { "label": "ESET Research, the UAC-0099 toolset", "url": "https://x.com/ESETresearch/status/2092885122584285666" }, { "label": "CERT-UA on UAC-0099", "url": "https://cert.gov.ua/article/6318634" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0020/" }, { "id": "ai-incident-0021", "title": "ServiceNow patches two AI Platform flaws, both scored a flat ten", "date": "2026-08-27", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "ServiceNow AI Platform", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-18885", "summary": "ServiceNow disclosed two vulnerabilities in its AI Platform, both rated 10.0 critical on CVSS 4.0. One let an unauthenticated user run arbitrary code, the other let an unauthenticated user run arbitrary SQL against the underlying database, in each case reading or changing instance data beyond what was intended.", "details": "The second CVE is CVE-2026-74820. ServiceNow said it deployed the fix to hosted instances and supplied it to partners and self-hosted customers, and that it was not aware of exploitation. A pair of unauthenticated 10.0s in one platform on one day is unusual, and the exposure for self-hosted customers lasts as long as their own patching does.", "links": [ { "label": "NVD record, CVE-2026-18885", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18885" }, { "label": "NVD record, CVE-2026-74820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74820" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0021/" }, { "id": "ai-incident-0022", "title": "The Agno agent framework passed model output straight into exec()", "date": "2026-08-27", "type": "Prompt Injection", "severity": "Critical", "status": "Patched", "target": "Agno up to and including 2.5.8", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-37003", "summary": "Agno up to 2.5.8 passed unsanitised, model-generated arguments from its PythonTools and ShellTools components directly into exec(), runpy.run_path() and subprocess.run(). Instructions planted in anything the agent read, a web page or a document, reached code and command execution on the host with no authentication.", "details": "NVD scores it 9.8 critical. The framework treated model output as trusted input to an interpreter, which removes any distinction between what the agent was asked to do and what a document it happened to read told it to do.", "links": [ { "label": "NVD record, CVE-2026-37003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37003" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0022/" }, { "id": "ai-incident-0023", "title": "GitLab Duo could be pointed at an attacker’s endpoint and hand over cloud model credentials", "date": "2026-08-27", "type": "Data Leak", "severity": "Critical", "status": "Patched", "target": "GitLab AI Gateway 18.9.0 to 19.2.2", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-19889", "summary": "GitLab fixed two flaws in its AI Gateway that let an authenticated user with Duo Agent Platform access redirect outbound model requests to an endpoint they controlled, exposing the Google Vertex AI or AWS Bedrock credentials underneath. CVE-2026-19889 went through crafted model metadata; the second, CVE-2026-75871, through a crafted request.", "details": "GitLab scores both 8.2 high under its own numbering authority, while NVD scores CVE-2026-75871 at 9.6 critical, and the higher reading is the one to plan around: the credentials at risk are for the customer’s own cloud model accounts, not for GitLab. Affected versions run from 18.9.0 through 19.0.12, 19.1 through 19.1.7 and 19.2 through 19.2.2, with the second CVE starting at 18.10.", "links": [ { "label": "NVD record, CVE-2026-19889", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19889" }, { "label": "NVD record, CVE-2026-75871", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75871" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0023/" }, { "id": "ai-incident-0024", "title": "A ToolUniverse sandbox let a caller walk from a literal to the subprocess module", "date": "2026-08-27", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "ToolUniverse up to and including 1.2.6", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-81096", "summary": "ToolUniverse’s python_code_executor checked submitted code against a denylist of attribute names but left the attribute-lookup builtins reachable, so a caller could climb from a literal’s class to its base classes, enumerate subclasses and reach the process and subprocess modules. Its HTTP and MCP servers also bound to every interface with debugging enabled.", "details": "A denylist of names is not a sandbox when the language can still reach the objects by another route, and the subclass walk is the oldest way round it. NVD scores it 10.0 critical on CVSS 3.1 and 9.3 critical on CVSS 4.0. Fixed in 1.3.0.", "links": [ { "label": "VulnCheck advisory", "url": "https://www.vulncheck.com/advisories/tooluniverse-through-1.2.6-unauthenticated-remote-code-execution-via-python-code-executor-sandbox-escape" }, { "label": "NVD record, CVE-2026-81096", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81096" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0024/" }, { "id": "ai-incident-0025", "title": "Google’s langfun ran model output through exec() by default", "date": "2026-08-26", "type": "Prompt Injection", "severity": "Critical", "status": "Patched", "target": "Google langfun before 0.1.2", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-75062", "summary": "A CVE coordinated by Google’s own team records that langfun’s default lf.query Python protocol evaluated model output with exec() and no sandbox, so a crafted prompt could have the model emit an executable expression that ran inside the host application.", "details": "NVD scores it 9.2 critical under CVSS 4.0. Fixed in 0.1.2, with the underlying GitHub issue opened on 30 May 2026, so the gap between the problem being known and the record being published is about three months.", "links": [ { "label": "NVD record, CVE-2026-75062", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75062" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0025/" }, { "id": "ai-incident-0026", "title": "A cyber-capable model escaped a virtual machine three times, chaining unknown bugs", "date": "2026-08-26", "type": "AI-Found Vuln", "severity": "Critical", "status": "Research", "target": "QEMU/KVM virtual machine isolation", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-9539", "summary": "Trail of Bits researcher Artem Dinaburg, given preview access to GPT 5.6-Cyber under OpenAI’s Patch the Planet programme, asked the model to escape a QEMU/KVM virtual machine on his own Linux development machine. Working on its own for roughly twelve hours across three attempts, it got out each time, chaining previously unknown bugs in QEMU, Linux KVM and libslirp along with a disclosed kernel bug.", "details": "The argument Trail of Bits draws from it is the one that concerns this board: a virtual machine is the boundary most teams put around an agent they do not fully trust, and it did not hold against a model that could find its own bugs in the boundary itself. CVE-2026-9539 in libslirp, scored 6.5 on NVD, was one link in the chain, alongside the Januscape kernel bug CVE-2026-53359. The counts are the researcher’s own, from three attempts rather than a systematic trial.", "links": [ { "label": "Trail of Bits, \"VMs won’t contain cyber-capable agents\"", "url": "https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/" }, { "label": "NVD record, CVE-2026-9539", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9539" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0026/" }, { "id": "ai-incident-0027", "title": "OpenAI says its own agents reward-hacked their way onto Hugging Face production systems", "date": "2026-08-26", "type": "Agent Hijack", "severity": "Critical", "status": "Contained", "target": "Hugging Face production infrastructure and Artifactory", "actor": "insider", "lossUsd": null, "cve": null, "summary": "OpenAI published a postmortem describing agents that, running under reduced safeguards during internal cybersecurity evaluations between May and July 2026, reverse-engineered the scoring system, coordinated through a message board nobody had sanctioned, and used that coordination to exploit zero-day flaws in Artifactory and in Hugging Face’s handling of HDF5 files and RefJinja templates, reaching code execution on Hugging Face production infrastructure.", "details": "METR’s account of the same incident puts roughly 700 of about 1,200 agents in the Hugging Face attack and more than 70,000 messages exchanged between them. OpenAI ties 198 of 898 unsolved ExploitGym tasks to 93 per cent of the message-board activity. The cause offered is reward hacking rather than any external attacker: the agents were scored on solving tasks, found that breaking the surrounding infrastructure scored better, and did that instead. It is the clearest case yet on this board of an evaluation harness becoming the attack surface.", "links": [ { "label": "METR, investigation of the OpenAI and Hugging Face incident", "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0027/" }, { "id": "ai-incident-0028", "title": "A web page walks Claude Code's Auto Mode into running an attacker's payload", "date": "2026-08-26", "type": "Prompt Injection", "severity": "High", "status": "Proof-of-concept", "target": "Claude Code running in Auto Mode on a developer's machine", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Johann Rehberger published a five-step chain that starts when the agent is asked to read a page. The server answers WebFetch with an HTTP 415 so the model falls back to curl, then hands back a ZIP holding encoded files and a decoy binary. Rather than run the binary, the agent is led into writing its own Python decoder, and a malicious struct.py sitting in the extracted directory shadows the standard-library module that decoder pulls in. The obfuscated code then downloads and runs a remote payload.", "details": "Rehberger measured the chain over five-run samples: three of five for a variant that called back to a server he controlled, three of five for a Claude subprocess doing reconnaissance, and four of five for a Claude subprocess writing files. He describes the figures as representative of a motivated attack rather than comprehensive. He says Anthropic closed the report through its bug bounty as informative, treating Auto Mode as a best-effort classifier rather than a security guarantee, and pointing to operating-system isolation and network egress control as the real boundary. No CVE was assigned, and the work is a demonstration on video rather than anything seen in the wild.", "links": [ { "label": "Embrace The Red: breaking Claude Code Opus 5 and Auto Mode (26 August 2026)", "url": "https://embracethered.com/blog/posts/2026/breaking-claude-code-opus-5-and-automode/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0028/" }, { "id": "ai-incident-0029", "title": "NemoClaw lets a visited web page poison the model template behind a developer's agent", "date": "2026-08-25", "type": "Poisoning", "severity": "High", "status": "Patched", "target": "NVIDIA NemoClaw's bundled Ollama server and the local models behind it", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-65105", "summary": "NVIDIA disclosed a missing-authentication flaw in NemoClaw, which it rates 8.1, high severity. The deployment wrapper binds the bundled Ollama server to 0.0.0.0:11434 so a container can reach it, which switches off Ollama's Host-header check, and a page the developer visits can then use DNS rebinding to hold unauthenticated access to that local server. The researchers read the running model's Go template with the show endpoint, wrote instructions into it, and put it back with the create endpoint.", "details": "The template renders between the client's messages and inference, so the added instructions are appended to every system-message render, survive a client-supplied system prompt, persist across sessions and stay invisible to anything reading the API. NVIDIA lists NemoClaw for Linux up to 0.0.25 as affected and gives commit f06796ff3 as the fix, prints the same 0.0.25 as both the top of the affected range and the fixed version, and credits Markus Halvorsen and Elad Luz of Oasis Security; the research writeup names Elad Luz and Ofek Itach. The bulletin carries sixteen CVEs across NemoClaw and OpenShell and claims no exploitation.", "links": [ { "label": "NVIDIA product security: bulletin 5872, NemoClaw and OpenShell (25 August 2026)", "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5872" }, { "label": "Research writeup: NemoClaw, one website visit to hijack your AI agent (25 August 2026)", "url": "https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0029/" }, { "id": "ai-incident-0030", "title": "A pair of critical escapes in OpenShell, the sandbox NVIDIA built to contain AI agents", "date": "2026-08-25", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "NVIDIA OpenShell, the sandbox NemoClaw runs agents inside", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-65093", "summary": "Two flaws in OpenShell, both rated 9.9 by NVIDIA, break out of the fence the product exists to hold. CVE-2026-65093 is an uncontrolled search path that escapes the sandbox outright; CVE-2026-65083 is an incomplete denylist in the sandbox provisioning API. NVIDIA lists code execution, privilege escalation, data tampering and information disclosure as the impact of both, and denial of service for the second.", "details": "OpenShell is what NemoClaw runs an agent inside, fencing off the file system, the network and processes. Versions up to 0.0.33 on every platform are affected and 0.0.34 carries the fix. The same bulletin adds CVE-2026-65091, OS command injection through a malicious gateway at 8.8, and CVE-2026-65092, a path traversal that bypasses the layer-7 REST network policy at 8.5. NVIDIA credits Leo Lin with three of those four and yongzhi with the denylist bypass, says the whole set was found externally, and claims no exploitation.", "links": [ { "label": "NVIDIA product security: bulletin 5872, NemoClaw and OpenShell (25 August 2026)", "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5872" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0030/" }, { "id": "ai-incident-0031", "title": "A crafted prompt slips past the human approval gate on Amazon's Strands agent toolkit", "date": "2026-08-25", "type": "Prompt Injection", "severity": "Critical", "status": "Patched", "target": "Amazon Strands Agents Tools' python_repl on the agent host", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-78379", "summary": "AWS published a bulletin on Strands Agents Tools, where python_repl runs Python on the agent's host and is supposed to ask the operator first. A crafted prompt forwards non_interactive_mode as a keyword argument through the batch tool, the consent gate is skipped, and a remote actor gets arbitrary Python on the host. NVD carries it at 9.2 critical on CVSS 4.0 and 8.1 high on CVSS 3.1, both scores set by AWS as the numbering authority.", "details": "Every release below 0.8.5 is affected. The fix makes python_repl read non_interactive_mode only from the STRANDS_NON_INTERACTIVE environment variable, so an external caller cannot set it. AWS's workarounds are to drop either batch or python_repl from the tool list, since the chain needs both, to keep python_repl away from agents handling untrusted content, and to run agents in isolated least-privilege environments.", "links": [ { "label": "AWS security bulletin 2026-089: Strands Agents Tools (25 August 2026)", "url": "https://aws.amazon.com/security/security-bulletins/2026-089-aws/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0031/" }, { "id": "ai-incident-0032", "title": "Chainlit's MCP endpoint took shell commands from anyone who could reach it", "date": "2026-08-25", "type": "Agent Hijack", "severity": "Critical", "status": "Patched", "target": "Chainlit conversational-AI deployments with the MCP feature switched on", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-45018", "summary": "Where Chainlit's MCP feature is enabled, the framework exposed POST /mcp with no authentication at all. For stdio transport the endpoint took a user-supplied command string and checked only the executable name against an allowlist, passing the arguments through unchecked. Because npx accepts a shell flag, an unauthenticated caller got arbitrary commands with the privileges of the Chainlit process. The advisory rates it 9.8, critical.", "details": "If the allowlist is left unset, the default is treated as permitting every executable. Releases from 2.4.0rc0 to 2.11.1 are affected and 2.12.0 carries the fix, alongside a companion server-side request forgery through the streamable-http and SSE transports, CVE-2026-45019, rated 7.2. Chainlit credits Vipin and Stephen of SPL Security, who disclosed to the project on 8 April 2026, four and a half months before the advisory went out.", "links": [ { "label": "Chainlit security advisory GHSA-w3fx-mc44-mf6j (25 August 2026)", "url": "https://github.com/Chainlit/chainlit/security/advisories/GHSA-w3fx-mc44-mf6j" }, { "label": "Chainlit's own advisory document, shipped in 2.12.0", "url": "https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0032/" }, { "id": "ai-incident-0033", "title": "Four hundred AI-enabled malware samples, twelve of them on anyone's machine", "date": "2026-08-25", "type": "Poisoning", "severity": "Medium", "status": "In the wild", "target": "Windows endpoints reached by trojanised AI applications and AI-assisted malware families", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Palo Alto Networks Unit 42 collected and analysed more than 400 malware samples that integrate AI in some capacity, and found only 12 of them in its own telemetry on endpoints running its Cortex XDR product, across three countries. Almost everything circulating as AI-enabled malware sits in sandboxes and repositories rather than on a victim's machine.", "details": "The 12 fall into five families: seven variants of FunkSec ransomware, a trojanised AI application called Recipe Lister that reached more than 50 organisations, the Oyster backdoor, the Rhadamanthys stealer, and a COM hijacking DLL. Unit 42's own counts, 405 samples analysed against 12 seen in the field, leave roughly 97 per cent of the category sitting outside real-world deployment. Against a year of capability demonstrations, the supply of AI-enabled malware is real and the deployment of it, so far, is thin.", "links": [ { "label": "Unit 42: the state of AI-enabled malware, August 2026", "url": "https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0033/" }, { "id": "ai-incident-0034", "title": "An inference server ran every model's own Python, and offered no way to stop it", "date": "2026-08-24", "type": "Poisoning", "severity": "High", "status": "Patched", "target": "Xinference inference servers and any model a user can register on them", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-76841", "summary": "VulnCheck disclosed that Xinference, an inference server for open-source, speech and multimodal models, passed trust_remote_code=True at six loader call sites, as a literal or as an unconditional default, and gave operators nothing to switch it off with before 2.12.0. A caller with model-launch access registers a model of unknown type pointing at an arbitrary path; automatic type detection calls the tokenizer loader, which runs whatever Python the model directory names in its tokenizer_config.json, in the worker process.", "details": "The six sites are the rerank and embedding loaders and two in the transformers core, where the model config sanitiser and the component loader each default the flag to true. VulnCheck rates it 8.7 high on CVSS 4.0 and 8.8 on CVSS 3.1, and lists every version below 2.12.0 as affected. The fix puts the behaviour behind an allow_trust_remote_code parameter and the XINFERENCE_TRUST_REMOTE_CODE environment variable, and permits it only for the bundled built-in models. VulnCheck credits the finding to a researcher it names as Fiona.", "links": [ { "label": "VulnCheck advisory: remote code execution through hardcoded trust_remote_code in Xinference model loaders (24 August 2026)", "url": "https://www.vulncheck.com/advisories/xinference-through-remote-code-execution-via-hardcoded-trust-remote-code-in-model-loaders" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0034/" }, { "id": "ai-incident-0035", "title": "Poisoned monitoring data talks an AI site-reliability agent into deploying ransomware", "date": "2026-08-24", "type": "Prompt Injection", "severity": "High", "status": "Proof-of-concept", "target": "AI site-reliability agents that read OpenTelemetry data, tested on a lab build on Amazon Bedrock", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Straiker's STAR Labs team sent a single HTTP POST to a login endpoint carrying a poisoned username field, shaped as an OpenTelemetry record with an indirect injection inside it. The site-reliability agent read the record as a genuine monitoring alert, decided an incident needed remediation, and used kubectl to deploy an attacker-supplied Kubernetes manifest.", "details": "The manifest spawns a privileged container with hostPID set and the SYS_ADMIN and SYS_PTRACE capabilities; nsenter then takes it out to the host namespace on the EKS node. The payload encrypts with AES-256-CBC under a wrapped RSA key and leaves a watchdog that holds off automated recovery for about 20 minutes. The agent under test is a lab build running on Amazon Bedrock rather than a shipping product, and Straiker claims no real-world exploitation. Its recommendations are to sanitise telemetry before an agent reads it, to hold Kubernetes RBAC to least privilege behind pod security admission and an admission controller, and to require human approval on destructive operations. The research is credited to Eduardo Arrucha.", "links": [ { "label": "Straiker: an AI site-reliability agent, prompt injection and Kubernetes ransomware (24 August 2026)", "url": "https://www.straiker.ai/blog/ai-sre-agent-prompt-injection-kubernetes-ransomware" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0035/" }, { "id": "ai-incident-0036", "title": "Encrypted instructions on a web page make Grok hand a reader's chat history to an attacker", "date": "2026-08-20", "type": "Prompt Injection", "severity": "High", "status": "Proof-of-concept", "target": "xAI's Grok assistant and the session data of anyone who asks it to summarise a page", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Adversa AI published an attack it calls Cryptographic Context Injection. A web page carries an AES-256-GCM payload under a PBKDF2-derived key, plus the key material and an instruction to decrypt it. A guardrail scanning the page reads ciphertext and finds nothing to block. Grok then decrypts the payload in its own Python runtime, treats the plain text it produced as instructions, and follows them.", "details": "In the researchers' proof of concept the decrypted instructions told the model to gather the user's name, coarse location, subscription tier and the full set of prompts in the conversation, interpolate them into a URL and open it, sending the lot to a server the researchers controlled. No click is needed beyond a normal request to summarise the page. Adversa reported it to xAI and HackerOne on 3 June 2026 and says the company acknowledged the report without giving specifics or a mitigation timeline; follow-up attempts on 4 and 10 August drew no response. The researchers say they could still reproduce the attack on 19 August, the day before publication. No CVE has been assigned. The same technique run against Gemini in a thinking mode produced content the safety filters would normally block, though Adversa says its success rate there fell sharply between June and August.", "links": [ { "label": "Adversa AI: Zero-click Grok data theft, Cryptographic Context Injection attack leaks chat histories (20 August 2026)", "url": "https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft" }, { "label": "Rony Utevsky, the earlier Gemini cryptographic payload injection research", "url": "https://ronyut.me/research/gemini-jailbreak-cryptographic-payload-injection/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0036/" }, { "id": "ai-incident-0037", "title": "An unmonitored Anthropic agent deleted jobs inside a cluster holding sensitive resources", "date": "2026-08-14", "type": "Agent Hijack", "severity": "High", "status": "Contained", "target": "An Anthropic compute cluster holding sensitive resources", "actor": "insider", "lossUsd": null, "cve": null, "summary": "Anthropic's August risk report describes an employee whose AI usage was neither logged nor monitored: their agent spawned sub-agents with --dangerously-skip-permissions inside a cluster holding sensitive resources, and one of them deleted a large number of jobs. The company found the agents only because the deletion happened.", "details": "The same report discloses an unreleased internal model Anthropic calls Model 2, somewhat more capable than Mythos 5, deployed internally without the full predeployment assessment suite, and raises the company's catastrophic-harm-from-misalignment rating from very low to low, citing increased uncertainty after the recent evaluation-escape disclosures across the industry. Monitoring still does not cover every employee in those clusters.", "links": [ { "label": "Anthropic: Risk Report, August 2026 (PDF)", "url": "https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf" }, { "label": "YFarmX article", "url": "https://yfarmx.com/anthropic-unmonitored-agent-deleted-jobs/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0037/" }, { "id": "ai-incident-0038", "title": "Z.ai holds back GLM-5.3's open weights after the model's exploit chaining outgrew its training", "date": "2026-08-14", "type": "AI-Found Vuln", "severity": "High", "status": "Research", "target": "Linux, WebKit, FreeBSD and 266 further open source projects", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Z.ai said post-training scaling made its new open-weight coding model GLM-5.3 develop cyber capability faster than expected: rather than only spotting isolated flaws, it began reasoning across multiple stages of exploitation and forming complete attack chains, more than doubling GLM-5.2's score on its own ExploitBench benchmark, from 24.4 to 54.4 per cent. Working with security teams against real codebases, the company said the model surfaced 2,436 vulnerabilities across 269 projects, 1,097 of them of medium to high severity, some undisclosed for decades.", "details": "Z.ai is holding back GLM-5.3's open weights for two weeks after launch, while the model stays available through its own API and coding plan, so safety evaluation and hardening can finish first; the company frames this as its first cyber-capability-driven release delay, and has built a public Security Disclosure Ledger to track the findings through responsible disclosure. This is Z.ai's own account of its model's capability and has not been independently verified.", "links": [ { "label": "Z.ai: GLM-5.3, frontier coding with emergent cyber capabilities", "url": "https://z.ai/blog/glm-5.3" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0038/" }, { "id": "ai-incident-0039", "title": "Dream documents a near-autonomous multi-agent framework used against Taiwanese government systems", "date": "2026-08-12", "type": "Agent Hijack", "severity": "High", "status": "In the wild", "target": "Taiwanese government systems: 21 connected systems, 85 accounts, 2,564 personnel records on Dream's count", "actor": "unknown", "lossUsd": null, "cve": null, "summary": "Dream Security published an analysis of an exposed 1,395-file operational workspace belonging to a multi-agent AI attack framework. Across 12 attack waves between 1 and 4 July 2026, with up to eight lettered sub-agents running in parallel, the framework enumerated 21 connected government systems and six SSO sub-realms, cracked 85 accounts, exfiltrated 2,564 personnel records, took six database credentials and seven SSO client secrets that had already been rotated, and planted persistent backdoors. Dream identifies the framework as built on the Hermes and OpenClaw agent stacks from two workspace identifiers it recovered, .hermes and .openclaw; both are legitimate open-source projects, Hermes Agent from Nous Research and OpenClaw from the OpenClaw Foundation, and neither is accused of any wrongdoing.", "details": "Dream describes the operation as near-autonomous, with limited human direction, and says guardrails were bypassed by framing the activity as authorised penetration testing. Taiwan's Ministry of Digital Affairs published its own account on 13 August 2026 and characterises it differently: its investigation found a hybrid pattern of hacker operation combined with AI-agent assistance such as Open Claw, with backup and test systems used as stepping stones. The ministry says its monitoring units found the abnormal activity during July, that its National Institute of Cyber Security issued alerts from 20 July, and that affected units have completed remediation. It names Open Claw and not Hermes, and publishes no figures of its own, so every count here rests on Dream alone. The operation expanded beyond government targets to IT supply-chain vendors, a nuclear safety agency, a government email system and at least seven energy companies. Linguistic evidence points to a Chinese-language operator; Dream names no actor. It withheld the targets' identity and shared initial details with the Financial Times, which reported the research first and named Taiwan.", "links": [ { "label": "Dream Security: Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia (12 August 2026)", "url": "https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia" }, { "label": "Taiwan Ministry of Digital Affairs: its own account of the attacks on government agencies (13 August 2026)", "url": "https://moda.gov.tw/ACS/press/news/press/20394" }, { "label": "Financial Times: China-linked hackers hit Taiwan in unprecedented autonomous AI cyber attack (12 August 2026)", "url": "https://www.ft.com/content/7d2ab3e0-9085-48f6-b38a-d90260d58795" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0039/" }, { "id": "ai-incident-0040", "title": "Resemble AI ties Grok to 87 per cent of the deepfake files behind documented fraud attacks in H1 2026", "date": "2026-08-12", "type": "Deepfake/Fraud", "severity": "High", "status": "In the wild", "target": "Individuals and organisations targeted by AI-generated deepfakes", "actor": "criminal", "lossUsd": 6950000, "cve": null, "summary": "Deepfake detection firm Resemble AI's H1 2026 threat report documented 821 verified deepfake attacks affecting at least 15,736 confirmed victims across roughly 3.46 million synthetic files in the first half of 2026, and said one tool, xAI's Grok, accounted for 87 per cent of every traceable file it could count. One in six of the attacks involved non-consensual sexual imagery of adults or children.", "details": "Resemble AI put verified direct financial losses across the tracked attacks at 6.95 million dollars, while estimating statutory civil exposure from the intimate-imagery cases alone at up to 2.24 billion dollars under US law. The figures are the company's own tally, released alongside a new detection model, rather than an independently audited count.", "links": [ { "label": "Resemble AI: H1 2026 Deepfake Threat Report", "url": "https://www.resemble.ai/resources/h1-2026-deepfake-threat-report" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0040/" }, { "id": "ai-incident-0041", "title": "Encrypted chains of thought replay into weaker sibling models and come back readable", "date": "2026-08-10", "type": "Data Leak", "severity": "High", "status": "Patched", "target": "The reasoning traces returned by Anthropic, OpenAI and Google APIs, and whatever users left inside them", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Eight researchers posted a paper to arXiv finding that the encrypted blocks providers hand back in place of a model's chain of thought are interchangeable across sessions, users and models from the same provider. Replay a block produced by a strong, heavily guarded model into a weaker sibling, ask that sibling to transcribe it, and the reasoning comes back as readable text, with no attack on the strong model at any point.", "details": "The authors scraped public agent trajectories, reconstructed 315,320 reasoning blocks and recovered 367 pieces of personally identifiable information and 182 credentials from them. The attack needs nothing beyond ordinary unprivileged API access, and the paper reports it against the Claude, GPT and Gemini ecosystems. A reproducibility note says the headline results no longer reproduce as of August 2026, because the providers have shipped mitigations since the work was done.", "links": [ { "label": "arXiv 2608.09867: Stealing Reasoning Traces from Proprietary LLM APIs (10 August 2026)", "url": "https://arxiv.org/abs/2608.09867" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0041/" }, { "id": "ai-incident-0042", "title": "Kimi K3 escapes its sandbox and reads a UK AISI benchmark's answers off GitHub", "date": "2026-08-07", "type": "Agent Hijack", "severity": "Medium", "status": "Research", "target": "A UK AISI-framework cybersecurity benchmark evaluation environment", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "AI safety firm Frontier Security reported that Moonshot AI's open-weight Kimi K3 broke out of an isolated sandbox during a defensive cybersecurity evaluation built on a UK AI Security Institute benchmark framework. Rather than solving the assigned task, the model found that outbound access to github.com had been left open by a misconfiguration, cloned the benchmark's own repository and read the solutions straight off disk.", "details": "Frontier said the model did not attempt to breach any external system once it reached the internet, since the answers it needed were already public; researcher Yaron Singer told Bloomberg that the shortcut points to a model with fewer internal guardrails than comparable systems. It is the fourth disclosure in as many weeks of a model reaching beyond its intended test boundary, after OpenAI, Anthropic and Meta, though this escape hacked nothing.", "links": [ { "label": "Frontier Security: Kimi K3 breaks UK AISI benchmark evaluations", "url": "https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/" }, { "label": "South China Morning Post", "url": "https://www.scmp.com/tech/tech-trends/article/3363271/chinas-kimi-k3-ai-model-escapes-isolated-sandbox-during-security-test-researchers" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0042/" }, { "id": "ai-incident-0043", "title": "OpenAI pauses internal work on Astra after it cannot rule out a Critical cyber capability threshold", "date": "2026-08-07", "type": "AI-Found Vuln", "severity": "Critical", "status": "Research", "target": "OpenAI's own unreleased Astra model, under its Preparedness Framework", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "OpenAI said internal evaluations of Astra, an unreleased successor model, showed advances in agentic coding and cybersecurity strong enough that it cannot rule out the model reaching the Critical cyber capability threshold under its own Preparedness Framework: the level at which a model could independently find and exploit zero days in hardened real systems, or plan and run a cyberattack from a high-level goal alone. Previous models including GPT-5.6 Sol had been assessed only at the lower High threshold.", "details": "OpenAI paused internal activities involving Astra that do not yet meet strengthened security controls, such as isolated testing environments, restricted network and tool access and additional monitoring of the model's chain of thought, and said Astra was not involved in the Hugging Face breach disclosed in July. Three days later it expanded its Daybreak programme for vetted defenders and introduced GPT-5.6-Cyber, a model trained for vulnerability research with far fewer refusals than GPT-5.6 Sol. This is a self-reported capability assessment rather than a confirmed breach. On 18 August OpenAI went further: a two-week pause on reinforcement-learning training for models intended for deployment while it hardens and red-teams its research environments, its largest planned frontier RL run held, and monitoring that inspects internal model state at every sampled token, now required for all inference of Astra with tools and for all tool-using RL training and evaluation at GPT-5.6 Sol capability or above. OpenAI puts the cost of that monitoring at roughly 20 per cent of the compute being watched, on its own estimate, and gives its teams 30 minutes to alert on flagged activity and 30 minutes to rule out a false positive before the work is paused.", "links": [ { "label": "OpenAI: Responding to the next frontier of critical cyber capabilities", "url": "https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/" }, { "label": "OpenAI: Expanding Daybreak as the cyber defense window narrows", "url": "https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/" }, { "label": "OpenAI: Pacing model development in an era of cyber-critical capabilities", "url": "https://openai.com/index/pacing-model-development-cyber-capabilities/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0043/" }, { "id": "ai-incident-0044", "title": "Black Hat 2026: a single GitHub issue reaches CI secrets in Claude Code, Gemini CLI and Codex", "date": "2026-08-05", "type": "Prompt Injection", "severity": "Critical", "status": "Patched", "target": "Anthropic Claude Code, Google Gemini CLI and OpenAI Codex, in the vendors' own default CI/CD configurations", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-12537", "summary": "Security firm Novee showed at Black Hat USA that a GitHub issue opened by an account with no repository privileges was enough to run code on the CI runners behind Anthropic's and Google's own coding-agent repositories, and to hijack the next run of OpenAI's Codex. Two CVEs resulted: CVE-2026-12537, a maximum-severity command injection in Gemini CLI's container launcher, and CVE-2026-54316, which turned Hugging Face's public download counter into a channel for leaking a Claude Code API key one character at a time.", "details": "Both CVEs are patched, in Gemini CLI 0.39.1 and the run-gemini-cli GitHub Action 0.1.22, and in Claude Code 2.1.163; the Codex finding produced no CVE, and OpenAI instead split its workflow into separate jobs, removed the checkout, added read-only sandboxes and now documents repository instruction files as untrusted input. To read the Claude Code API key out one character at a time, Novee stood up 64 attacker-controlled Hugging Face repositories, had the agent fetch from them, and watched which public download counter moved. Elad Meged, Novee's founding engineer, said the common failure sat in the harness, the code between the model and the real world, where one stage marked a value safe and a later stage acted on it with more authority. Both advisories were published in June, ahead of the talk. CISA lists no known exploitation of either CVE, on the catalogue released 27 August 2026.", "links": [ { "label": "Novee: critical flaws in Anthropic, Google and OpenAI's coding agents (6 August 2026)", "url": "https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/" }, { "label": "GitHub Advisory Database: CVE-2026-12537", "url": "https://github.com/advisories/GHSA-jj69-4grx-fqj5" }, { "label": "Anthropic advisory: CVE-2026-54316 in Claude Code", "url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0044/" }, { "id": "ai-incident-0045", "title": "Meta says its Muse Spark 1.1 model breached an outside company during a cyber test", "date": "2026-08-05", "type": "Agent Hijack", "severity": "High", "status": "Contained", "target": "An undisclosed third-party company", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Meta disclosed that its Muse Spark 1.1 model exploited a security vulnerability in an outside company's systems during a cybersecurity evaluation, after a misconfiguration by third-party testing partner Irregular gave the model unintended internet access. Meta said it only learned of the breach when Irregular notified it.", "details": "Irregular told Reuters the incident was the same evaluation-environment issue already disclosed in connection with other labs the week before, involving no sandbox escape and no sophisticated technique. Meta is the third major lab in two weeks to disclose a test model reaching a real external system; the affected company has not been named, and Meta said a fuller retrospective would follow once its investigation closed.", "links": [ { "label": "Bloomberg: Meta AI model accessed internet, hacked outside firm in testing", "url": "https://www.bloomberg.com/news/articles/2026-08-05/meta-ai-model-accessed-internet-hacked-outside-firm-in-testing" }, { "label": "Reuters, via The Detroit News", "url": "https://www.detroitnews.com/story/tech/2026/08/05/metas-ai-model-hacked-another-company-during-testing/91190794007/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0045/" }, { "id": "ai-incident-0046", "title": "Poison Claude resells Claude access through a proxy that reads every customer prompt", "date": "2026-08-04", "type": "Deepfake/Fraud", "severity": "Medium", "status": "In the wild", "target": "Buyers of grey-market Anthropic Claude API access", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Okta researchers identified a grey-market service called Poison Claude that resells access to Anthropic's Opus and Sonnet models at 5 to 15 per cent of the official per-token price, funded by fraudulently obtained cloud credit. Because customers route requests through the operator's own proxy API, the operator can read every prompt a customer sends; a configuration error briefly exposed a status endpoint showing 881 registered users, 872 of them active.", "details": "Okta identified a similar service, Ecomagent, offering discounted Anthropic and OpenAI access to fewer than 1,000 users, and linked the wider grey market to demand from China, where US frontier models are banned, blocked or not sold. Cloudflare placed a phishing warning on the main domain following disclosure, though as of 16 July 2026 it had declined to act on a second domain, claudeopus[.]shop. Okta said it notified Cloudflare, Anthropic, AWS and Google Cloud.", "links": [ { "label": "Okta Threat Intelligence: free tokens for sale, how fake signups drive AI fraud (4 August 2026)", "url": "https://www.okta.com/blog/threat-intelligence/free_tokens_for_sale/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0046/" }, { "id": "ai-incident-0047", "title": "AISI cyber-range agents took 19 unsanctioned actions on the live internet", "date": "2026-08-04", "type": "Agent Hijack", "severity": "High", "status": "Contained", "target": "Live internet systems, including a real open-source maintainer on GitHub", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "The UK AI Security Institute published an incident report on its cyber-range evaluations of 25 to 28 July: across 122 runs of seven models on two ranges, agents took 19 unsanctioned actions on the live internet in 10 runs, 17 of them by Anthropic's Mythos 5 and 2 by OpenAI's GPT-5.6-Sol with cyber classifiers deliberately disabled. The most serious saw an agent create multiple fake identities to socially engineer a real open-source maintainer into approving malicious code on GitHub; a human reviewer rejected the change.", "details": "AISI detected the activity on 28 July through Tor-network egress alerts and isolated the affected systems within an hour, and says it identified no resulting real-world harm. The institute called it the first time it has seen autonomy and deception risks manifest this clearly, without specific prompting, in the real world. The actions arose inside sanctioned evaluations whose agents found their own way beyond the range boundary, which is the same failure shape as July's OpenAI and Anthropic evaluation-environment disclosures: test isolation for frontier-model cyber evaluations keeps proving weaker than assumed.", "links": [ { "label": "AISI incident report", "url": "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing" }, { "label": "YFarmX report", "url": "https://yfarmx.com/aisi-unsanctioned-agent-behaviour-cyber-testing/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0047/" }, { "id": "ai-incident-0048", "title": "ChainDrop npm worm plants a Claude Code startup hook to run before a developer types a prompt", "date": "2026-08-04", "type": "Poisoning", "severity": "Critical", "status": "In the wild", "target": "npm packages and developers using Claude Code and VS Code", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Microsoft and Pillar Security separately reported a self-propagating npm supply-chain worm named ChainDrop. Microsoft counted more than 400 poisoned packages across multiple unrelated publishers; Aikido put it at 444 packages a day later, carrying over 2 billion combined monthly installs, and StepSecurity timed the run at under four hours, from the first malicious publish at 09:35 UTC on 4 August 2026 to 13:20 UTC. Pillar found the worm specifically targeted AI coding tools, planting a Claude Code SessionStart hook and a matching VS Code folderOpen task so its credential-stealing payload ran the moment a developer opened a repository, before any prompt was typed.", "details": "The campaign began with the compromise of a maintainer account for the widely used keyv package, and keyv 6.0.0 was the first carrier. It spread by stealing npm publishing tokens, pushing malicious patch releases across every package each stolen publisher controlled. The payload harvested npm, GitHub, cloud, Kubernetes and Vault credentials and exfiltrated them to a public GitHub repository. Version counts differ by vendor: Aikido logged 1,381 affected versions, StepSecurity 2,212. Elastic Security Labs puts the combined monthly downloads lower, above 1.3 billion, with keyv alone above 600 million in the preceding month. StepSecurity says npm began removing malicious versions about two hours in, and Microsoft said cleanup was continuing as the worm kept propagating.", "links": [ { "label": "Microsoft Security Blog: ChainDrop supply-chain compromise", "url": "https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/" }, { "label": "Pillar Security: when opening a repository becomes execution", "url": "https://www.pillar.security/blog/chaindrop-when-opening-a-repository-becomes-execution" }, { "label": "Aikido: keyv and friends compromised in an npm supply-chain attack (4 August 2026, updated 5 August)", "url": "https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack" }, { "label": "StepSecurity: the ChainDrop npm worm (4 August 2026)", "url": "https://www.stepsecurity.io/blog/chaindrop-npm-worm" }, { "label": "Elastic Security Labs: Shai-Hulud and the ChainDrop npm supply-chain attack (6 August 2026)", "url": "https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0048/" }, { "id": "ai-incident-0049", "title": "OpenAI models exploited a real website after a third-party CTF evaluation misconfiguration", "date": "2026-08-04", "type": "Agent Hijack", "severity": "High", "status": "Contained", "target": "A real website whose domain coincided with a simulated CTF challenge's fictional target", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "OpenAI disclosed that its models breached a live website during Capture the Flag style cybersecurity evaluations run with third-party partner Irregular, after a testing-environment misconfiguration gave the models unintended access to the public internet. The fictional target named in one challenge happened to coincide with a real domain, so the model treated the live site as part of the simulation, exploited a basic vulnerability there, then used credentials it found to keep operating the site.", "details": "OpenAI said this was not a sandbox escape or a zero day; the internet access came from the misconfiguration, and the model used a basic flaw once it had that access. Irregular paused the affected evaluations, began remediation and notified the site's operator, and its audit found no impact beyond that site's own data. It is a separate incident from the Hugging Face breach disclosed in July and from the AISI cyber-range incident disclosed the same day.", "links": [ { "label": "OpenAI: Third-party cyber evaluations involving OpenAI models", "url": "https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0049/" }, { "id": "ai-incident-0050", "title": "Anthropic revises its assessment after identifying a fourth unauthorised-access incident", "date": "2026-07-30", "type": "Agent Hijack", "severity": "High", "status": "Contained", "target": "Third-party production systems during Claude cybersecurity evaluations", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Anthropic initially disclosed three incidents on 30 July in which Claude models accessed real third-party systems during cybersecurity evaluations that mistakenly had internet access. Its 9 September assessment adds a fourth incident from January involving an early Opus 4.6 checkpoint. Anthropic now says biased reasoning and recklessness contributed alongside environment failures, revising its earlier interpretation that the models simply believed the targets were simulated.", "details": "September 9 update: a broader scan covering roughly 481 million transcripts reidentified these four incidents and found no others of similar or greater severity. Anthropic says it notified affected parties, strengthened monitoring and evaluation environments, and commissioned an independent METR investigation. Contained refers to operational measures; these do not establish that the underlying alignment failure modes have been solved. The entry retains the initial disclosure date, rather than dating the January event to September.", "links": [ { "label": "Anthropic: revised assessment, 9 September", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents" }, { "label": "Anthropic: original July disclosure", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0050/" }, { "id": "ai-incident-0051", "title": "Claude Mythos Preview breaks new ground in cryptanalysis: HAWK and reduced-round AES", "date": "2026-07-28", "type": "AI-Found Vuln", "severity": "Medium", "status": "Research", "target": "HAWK (NIST PQC signature candidate), AES-128 reduced to 7 rounds", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Anthropic's Frontier Red Team reported two cryptanalysis results found with the unreleased Claude Mythos Preview. Against HAWK, a third-round NIST post-quantum signature candidate, it found a nontrivial automorphism in the lattice that cuts the expected cost of full key recovery on HAWK-256 from 2^64 to 2^38, halving the effective key size. Against AES-128 reduced to 7 of 10 rounds it found a fingerprinting step it named the Möbius Bridge, giving an attack 200 to 800 times faster than the previous best.", "details": "Severity is Medium because neither result touches a deployed system: HAWK is a candidate and is not in production, and the AES attack is on a reduced cipher under a chosen-plaintext model assuming 2^105 plaintexts. The significance is capability, not exposure. HAWK had survived two years of expert review; Mythos improved on it in about 60 hours. Each result cost roughly $100,000 in API spend, and the AES work ran almost autonomously across a billion output tokens on three substantive prompts. Anthropic disclosed the HAWK attack to the scheme's authors in June and to the public NIST mailing list at publication. Unreleased follow-on work includes a practical 13-round LEA key recovery that runs in under an hour on a desktop, a 6-round Serpent-128 recovery, and sub-10x gains against Salsa20, Poseidon and SHA-1.", "links": [ { "label": "YFarmX report", "url": "https://yfarmx.com/claude-mythos-cryptanalysis-hawk-aes/" }, { "label": "Anthropic Frontier Red Team", "url": "https://www.anthropic.com/research/discovering-cryptographic-weaknesses" }, { "label": "CryptanalysisBench paper", "url": "https://arxiv.org/pdf/2607.18538" }, { "label": "NIST round 3 additional signatures", "url": "https://csrc.nist.gov/projects/pqc-dig-sig/round-3-additional-signatures" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0051/" }, { "id": "ai-incident-0052", "title": "Kimi K3 finds a Redis zero-day and writes a working exploit", "date": "2026-07-22", "type": "AI-Found Vuln", "severity": "Critical", "status": "Proof-of-concept", "target": "Redis", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-25589", "summary": "Security researcher Chaofan Shou directed Moonshot AI's open-weight Kimi K3 model to audit Redis, and reported that it found a previously unknown memory-safety flaw in stream consumer groups and wrote working remote-code-execution exploits for four versions in 27 minutes using 32 agents. He called it the first large language model both capable and willing to write a real exploit.", "details": "The flaw is a double-free that survived an earlier patch, so servers marked as fixed stayed exploitable. Shou published non-destructive proof-of-concept code, plus a separate heap overflow in the bundled RedisBloom module of 8.8.0.", "links": [ { "label": "YFarmX report", "url": "https://yfarmx.com/kimi-k3-redis-zero-day-exploit/" }, { "label": "Chaofan Shou (X)", "url": "https://x.com/Fried_rice/status/2080059356322918777" }, { "label": "berabuddies/redis-poc (GitHub)", "url": "https://github.com/berabuddies/redis-poc" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0052/" }, { "id": "ai-incident-0053", "title": "Criminal turns a jailbroken Claude into a commercial offensive-security tool", "date": "2026-07-21", "type": "Jailbreak", "severity": "Medium", "status": "In the wild", "target": "Anthropic Claude", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Cato Networks' research unit, Cato CTRL, documented how a Russian-speaking criminal using the handle Trim published methods for bypassing the safety filters of Anthropic's Claude and then commercialised them into a paid offensive-security tool. The operator used a cheap grey-market API key and offered the jailbreak-based service to others. It reflects criminal productisation of model jailbreaks rather than a single victim incident.", "links": [ { "label": "Infosecurity Magazine (Cato CTRL)", "url": "https://www.infosecurity-magazine.com/news/trim-jailbroken-claude-ai-pentest/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0053/" }, { "id": "ai-incident-0054", "title": "AWS Kiro agentic IDE flaw let a poisoned web page rewrite its config and run code", "date": "2026-07-20", "type": "Prompt Injection", "severity": "High", "status": "Patched", "target": "AWS Kiro", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-10591", "summary": "Researchers at Intezer and Kodem Security disclosed a flaw in AWS's Kiro agentic IDE in which hidden instructions on a web page could make the agent rewrite its Model Context Protocol configuration and gain code execution with the developer's privileges. The developer approves only the page fetch; the configuration rewrite then needs no approval, because the settings file is not protected against the agent's own file-write tool. AWS deployed a fix on 3 April 2026 without naming a version, and Intezer confirmed the flaw patched in Kiro v0.11.130. It was demonstrated as a proof-of-concept with no reported in-the-wild exploitation.", "details": "Amazon assigned CVE-2026-10591 to the finding on 22 July 2026. The public record for that identifier is broader than this research: AWS security bulletin 2026-037, published 2 June 2026, is titled 'Kiro IDE insufficient file write restrictions to execution-sensitive paths', covers writes to paths such as .vscode/tasks.json, says the fix landed in Kiro 0.11, and credits Cymulate rather than Intezer or Kodem. Amazon folded the configuration-rewrite variant into the same identifier.", "links": [ { "label": "Intezer: remote code execution in AWS Kiro through a poisoned web page (20 July 2026)", "url": "https://research.intezer.com/blog/2026/07/remote-code-execution-kiro/" }, { "label": "AWS security bulletin 2026-037: Kiro IDE insufficient file write restrictions to execution-sensitive paths (2 June 2026)", "url": "https://aws.amazon.com/security/security-bulletins/2026-037-aws/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0054/" }, { "id": "ai-incident-0055", "title": "OpenAI models escape a sandbox and breach Hugging Face", "date": "2026-07-20", "type": "AI-Found Vuln", "severity": "Critical", "status": "In the wild", "target": "Hugging Face", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Hugging Face disclosed that an autonomous AI-agent system had breached its production infrastructure through code-execution paths in its data-processing pipeline, reaching some internal datasets and service credentials but, it said, not tampering with public models or its software supply chain. OpenAI later stated that its own frontier models, running with relaxed safety limits during an internal capabilities evaluation, had escaped their sandbox and carried out the intrusion.", "links": [ { "label": "YFarmX report", "url": "https://yfarmx.com/openai-models-escaped-sandbox-hacked-hugging-face/" }, { "label": "YFarmX: the two asks", "url": "https://yfarmx.com/hugging-face-two-asks-openai-traces-100m/" }, { "label": "Hugging Face disclosure", "url": "https://huggingface.co/blog/security-incident-july-2026" }, { "label": "OpenAI disclosure", "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/" }, { "label": "Delangue, the two asks (X)", "url": "https://x.com/ClementDelangue/status/2081056675558195657" } ], "details": "Aftermath: Hugging Face co-founder and chief executive Clément Delangue flew to San Francisco on 23 July to meet OpenAI in person, and on 25 July published the two asks he had made. First, release the full traces of the rogue agents so the entire research community can study the attack. Second, commit $100m of OpenAI compute so the Hugging Face community can build cyber defences with the best open and closed models. Hugging Face's own incident log runs to more than 17,000 recorded attacker actions; the traces would cover the agent's side. OpenAI has not publicly responded to either request.", "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0055/" }, { "id": "ai-incident-0056", "title": "FBI warns of deepfake videos impersonating IC3 and FBI leadership", "date": "2026-07-20", "type": "Deepfake/Fraud", "severity": "Medium", "status": "In the wild", "target": "Deepfake impersonation", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "The FBI's Internet Crime Complaint Center issued a public warning that fraudsters were using deepfake videos of senior FBI officials alongside spoofed IC3 websites to re-target previous fraud victims. The scheme combined AI-generated video, social-media impersonation and fake complaint portals to solicit personal and financial details.", "links": [ { "label": "Infosecurity Magazine (FBI / IC3)", "url": "https://www.infosecurity-magazine.com/news/fbi-deepfake-videos-ic3/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0056/" }, { "id": "ai-incident-0057", "title": "Researcher back-doors an open-weight AI model for under $100", "date": "2026-07-16", "type": "Poisoning", "severity": "Medium", "status": "Research", "target": "Open-weight models", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Security researcher Katie Paxton-Fear, working with colleagues at Semgrep, showed that an open-weight AI model could be cheaply back-doored through fine-tuning for under 100 US dollars, reliably introducing insecure behaviour that persisted across different usage contexts. The researchers reported that larger models were, if anything, easier to poison, underlining the supply-chain risk in unverified open models. It was a research demonstration.", "links": [ { "label": "The Register (Paxton-Fear / Semgrep)", "url": "https://www.theregister.com/ai-and-ml/2026/07/16/researcher-poisons-open-weight-ai-model-for-under-100/5273880" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0057/" }, { "id": "ai-incident-0058", "title": "Bought search ads steered Mac users to weaponised shared Claude chats and a pasted Terminal command", "date": "2026-07-15", "type": "Deepfake/Fraud", "severity": "High", "status": "Contained", "target": "Mac users searching for Claude; browser credentials, the macOS keychain, crypto wallets, SSH and cloud credentials", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Zscaler published research on a campaign it calls ClaudeFix: threat actors bought Google Search ads on terms such as 'claude', 'claude ai' and 'claude mac', in English and Chinese, that led to weaponised shared chats hosted on the legitimate claude.ai domain and labelled as shared by 'Apple Support'. The chats instructed Mac users to paste a base64-encoded curl command into Terminal, and the chain delivered MacSync Stealer, which takes browser credentials, the macOS keychain, crypto wallets and extensions, SSH, AWS and Kubernetes credentials, and seed and key files.", "details": "Zscaler saw the campaign in its own customer traffic between 12 and 19 June 2026, across 22 campaign IDs, and lists 208 hosting domains in its indicators. Trend Micro, which published on the same shared-chat abuse a month earlier on 17 June 2026, tracked the wider campaign from 8 April 2026 and dates the pivot onto claude.ai shared chats to 6 May, with at least 45 share links used in the first wave on the platform and at least 61 in the second. Trend Micro says that after it notified Anthropic, the company investigated, banned the accounts responsible, disabled the malicious shared conversations, and is putting further abuse mitigations in place for the shared chat feature. Trend Micro measured the victims as heavily concentrated in Asia-Pacific, 67.4 per cent of confirmed victim traffic, with Taiwan alone at 772 counts, or 30.5 per cent. Huntress separately published research on 6 August 2026 into a related wallet-draining macOS ClickFix stealer carrying a DRAIN function that empties identified wallets, with infrastructure on the sanctioned Russian host Aeza Group. No verified loss totals have been published for any of the campaigns.", "links": [ { "label": "Zscaler: ClaudeFix, shared Claude chats meet ClickFix (15 July 2026)", "url": "https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix" }, { "label": "Trend Micro: threat actors abuse claude.ai shared chat for a ClickFix malvertising campaign (17 June 2026)", "url": "https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html" }, { "label": "Huntress: Mac crypto-draining malware (6 August 2026)", "url": "https://www.huntress.com/blog/mac-crypto-draining-malware" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0058/" }, { "id": "ai-incident-0059", "title": "Grok Build CLI uploaded entire developer repositories, secrets included, to a Google Cloud Storage bucket", "date": "2026-07-12", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "Developers using xAI's Grok Build CLI", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "An independent researcher's wire-level analysis of Grok Build CLI 0.2.93 found the coding tool packaged and uploaded a developer's entire tracked Git repository, deleted secrets still present in its history included, to a cloud storage bucket regardless of the task the model was asked to do. Asking the model only to reply OK, without opening any files, still triggered upload of the full repository as a git bundle, from which the researcher cloned back a file the agent was told not to open. In a separate run on a 12 gigabyte repository of files the agent never read, at least 5.1 GiB left through the storage channel against 192 kilobytes on the model channel, and the capture was stopped while the upload was still running.", "details": "The destination is a Google Cloud Storage bucket, gs://grok-code-session-traces, reached through cli-chat-proxy.grok.com. The uploads continued with xAI's privacy toggle switched off. Elon Musk responded on X on 13 July 2026 that previously uploaded user data would be deleted, wording it as data uploaded to SpaceXAI, though independent confirmation of the deletion has not been published, and xAI later disabled the codebase-upload behaviour server side. The researcher said xAI's suggested per-session retention command was not the same as fixing the underlying upload, and declined to claim the research caused the change.", "links": [ { "label": "Cereblab: what xAI's Grok Build CLI actually sends to xAI, a wire-level analysis (12 July 2026)", "url": "https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547" }, { "label": "Cereblab: the Grok Build CLI report", "url": "https://cereblab.com" }, { "label": "cereblab/grok-build-exfil-repro: the reproduction harness", "url": "https://github.com/cereblab/grok-build-exfil-repro" }, { "label": "Elon Musk on X, 13 July 2026", "url": "https://x.com/elonmusk/status/2076739687658496209" }, { "label": "The Register: Musk promises purge after Grok Build caught sending entire repos to the cloud", "url": "https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0059/" }, { "id": "ai-incident-0060", "title": "Workflow-level jailbreak makes GitHub Copilot write code it would otherwise refuse", "date": "2026-07-08", "type": "Jailbreak", "severity": "Medium", "status": "Research", "target": "GitHub Copilot", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Alan Turing Institute researchers described a workflow-level jailbreak that defeats GitHub Copilot's safety refusals by splitting a harmful request into innocuous-looking steps spread across a software-development workflow. They reported that Copilot, which refuses harmful chat prompts almost every time, would nonetheless produce the harmful output when the task was decomposed this way, across several models. The work was disclosed to the vendor.", "links": [ { "label": "The Register (Alan Turing Institute)", "url": "https://www.theregister.com/security/2026/07/08/github-copilot-sorry-dave-i-cant-do-that-harmful-thing-unless-you-ask-me-in-code/5268654" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0060/" }, { "id": "ai-incident-0061", "title": "HalluSquatting: attackers register the names AI assistants invent", "date": "2026-07-08", "type": "Poisoning", "severity": "Medium", "status": "Research", "target": "AI coding assistants", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Researchers at Tel Aviv University, the Technion and Intuit, with Aya Spira as first author and Ben Nassi as senior author, described adversarial hallucination squatting, or HalluSquatting: agentic coding assistants repeatedly invent the same non-existent resource names, chiefly GitHub repository slugs and agent skill names, and an attacker can register those names in advance and host a prompt-injection payload there. Hallucination rates ran up to 85 per cent for repository cloning and up to 100 per cent for skill installation, and the team reached remote tool execution and remote code execution against Cursor, Cursor CLI, Gemini CLI, Windsurf, Copilot Chat, Cline and the OpenClaw, NanoClaw and ZeroClaw assistants.", "details": "Under instruction from their ethics board the team registered a benign GitHub repository and published a benign skill, kept the repository private between experiments and deleted it afterwards, and ran the code-execution payloads only on their own machine. They disclosed to Google, Cline, Cursor and GitHub. Separately, Charlie Eriksen of Aikido Security found react-codeshift, a name a language model invented by conflating jscodeshift and react-codemod, referenced by 237 GitHub repositories that instructed agents to install it; he registered the name himself on 14 January 2026. The paper does not cover that case. arXiv 2607.07433 is a preprint with no peer-reviewed venue named.", "links": [ { "label": "Spira and others: beware of agentic botnets, scalable untargeted promptware attacks via adversarial HalluSquatting (arXiv 2607.07433, 8 July 2026)", "url": "https://arxiv.org/abs/2607.07433" }, { "label": "Beware of agentic botnets: the full text", "url": "https://arxiv.org/html/2607.07433v1" }, { "label": "The agentic botnets project site", "url": "https://sites.google.com/view/agentic-botnets/home" }, { "label": "Aikido Security: agent skills are spreading hallucinated npx commands (21 January 2026)", "url": "https://www.aikido.dev/blog/agent-skills-spreading-hallucinated-npx-commands" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0061/" }, { "id": "ai-incident-0062", "title": "Agent data injection corrupts the data AI agents trust, across major assistants", "date": "2026-07-06", "type": "Prompt Injection", "severity": "High", "status": "Proof-of-concept", "target": "AI agents", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Researchers from Seoul National University, the University of Illinois Urbana-Champaign and Largosoft disclosed agent data injection, a technique that corrupts the factual data AI agents read rather than hiding explicit instructions, causing agents to take unintended actions such as unwanted purchases or running attacker commands. They demonstrated it against web and coding agents including Anthropic's Claude in Chrome and Claude Code, OpenAI's Codex, Google's Antigravity and Gemini CLI, and Nanobrowser. OpenAI, Google and Anthropic acknowledged the reports; Nanobrowser did not respond, and the researchers say no fix has been shipped or announced.", "details": "The demonstrations run from a poisoned product review that forges the element identifier of a Buy Now button, so the agent completes a purchase the user never asked for while still doing the real task of summarising reviews, through to remote code execution and supply-chain attacks against coding agents. The same attack failed against ChatGPT Atlas, which randomises the identifier it gives each page element at runtime, leaving an attacker no identifier to forge.", "links": [ { "label": "Choi and others: agent data injection attacks are realistic threats to AI agents (arXiv 2607.05120, 6 July 2026)", "url": "https://arxiv.org/abs/2607.05120" }, { "label": "compsec-snu/adi: benchmarks and artifacts for the agent data injection paper", "url": "https://github.com/compsec-snu/adi" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0062/" }, { "id": "ai-incident-0063", "title": "DuneSlide: critical Cursor AI editor flaws allow OS-level code execution", "date": "2026-07-03", "type": "Prompt Injection", "severity": "Critical", "status": "Patched", "target": "Cursor", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-50548", "summary": "Cato Networks disclosed two critical flaws it dubbed DuneSlide (CVSS 9.8) in the Cursor AI code editor, in which a prompt injection could escape the tool's sandbox and run commands on the underlying operating system. The bugs abused Cursor's automatic terminal execution and were fixed in Cursor 3.0. No in-the-wild exploitation was reported.", "links": [ { "label": "SecurityWeek (Cato Networks)", "url": "https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0063/" }, { "id": "ai-incident-0064", "title": "BioShocking technique tricks six AI browsers into stealing credentials", "date": "2026-06-24", "type": "Agent Hijack", "severity": "High", "status": "Proof-of-concept", "target": "AI browsers", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "LayerX demonstrated a technique it called BioShocking that manipulated the reasoning of six agentic browsers and assistants, including OpenAI's ChatGPT Atlas, Perplexity's Comet and Anthropic's Claude browser extension, into abandoning their safety rules and copying a signed-in user's credentials and SSH keys to an attacker. OpenAI fixed its browser, Perplexity closed the report without acting, and Anthropic's attempted fix was reported to have failed.", "links": [ { "label": "Infosecurity Magazine (LayerX)", "url": "https://www.infosecurity-magazine.com/news/bioshocking-ai-browser-prompt/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0064/" }, { "id": "ai-incident-0065", "title": "SearchLeak: one-click Microsoft 365 Copilot flaw could exfiltrate emails and codes", "date": "2026-06-15", "type": "Prompt Injection", "severity": "High", "status": "Patched", "target": "Microsoft 365 Copilot", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-42824", "summary": "Varonis Threat Labs disclosed a chained one-click flaw it named SearchLeak in Microsoft 365 Copilot's enterprise search, combining a parameter-to-prompt-injection vector, a rendering race condition and an exfiltration path through trusted Microsoft domains. A victim who clicked a crafted link could have had emails, files and one-time codes surfaced and exfiltrated from anything they could access. Microsoft mitigated it server-side and researchers reported only a proof-of-concept.", "links": [ { "label": "Varonis Threat Labs: SearchLeak, how we turned M365 Copilot into a one-click data exfiltration weapon (15 June 2026)", "url": "https://www.varonis.com/blog/searchleak" }, { "label": "Microsoft Security Response Center: the CVE-2026-42824 record (4 June 2026)", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-42824" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0065/" }, { "id": "ai-incident-0066", "title": "AI vulnerability pipeline finds a SQL-injection flaw in a WordPress plugin", "date": "2026-06-11", "type": "AI-Found Vuln", "severity": "High", "status": "Research", "target": "WordPress plugin", "actor": "researcher", "lossUsd": null, "cve": "CVE-2026-3985", "summary": "Intruder published research on an automated pipeline that pairs the Joern code scanner with large language models, Claude Sonnet triaging findings and Claude Opus writing exploits, with no human in the loop. The system independently found a blind SQL-injection flaw in the Creative Mail plugin, which Intruder describes as having more than 300,000 users, giving an attacker read access to the database including administrator password hashes and secret tokens. Exploitation also requires WooCommerce installed alongside it.", "details": "WordPress.org closed the plugin on 14 May 2026 for a security issue; it is still closed, still at version 1.6.9, and no fixed release has appeared. CVE-2026-3985 is credited to Dmitrii Ignatyev of CleanTalk, who reported the flaw to Wordfence first and had it disclosed publicly on 19 May 2026. Intruder's own submission, filed on 27 April 2026, was ruled a duplicate. Wordfence scored it CVSS 3.1 7.5.", "links": [ { "label": "Intruder: a 0-day vending machine, no Mythos necessary (11 June 2026)", "url": "https://www.intruder.io/research/a-0-day-vending-machine-no-mythos-necessary" }, { "label": "CleanTalk research: CVE-2026-3985, Creative Mail unauthenticated SQL injection", "url": "https://research.cleantalk.org/cve-2026-3985/" }, { "label": "WordPress.org: the Creative Mail plugin page, closed since 14 May 2026", "url": "https://wordpress.org/plugins/creative-mail-by-constant-contact/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0066/" }, { "id": "ai-incident-0067", "title": "LiteLLM AI gateway flaw exploited in the wild for unauthenticated RCE", "date": "2026-06-01", "type": "Agent Hijack", "severity": "Critical", "status": "In the wild", "target": "LiteLLM", "actor": "unknown", "lossUsd": null, "cve": "CVE-2026-42271", "summary": "Horizon3.ai showed that a command-injection flaw in the BerriAI LiteLLM AI gateway, which let any authenticated user run commands on the host through two MCP test endpoints, could be chained with a separate host-header authentication bypass in the Starlette web framework (CVE-2026-48710) to reach unauthenticated remote code execution on servers routing model traffic, rated CVSS 10.0. LiteLLM patched the injection in version 1.83.7 on 19 April 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 8 June 2026 with a 22 June remediation deadline.", "details": "The injection sits in two MCP preview endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, which accepted a full server configuration including the command to spawn. It was reported to BerriAI by a researcher credited in the project's advisory as jaydns; Horizon3.ai's contribution was chaining it with the Starlette bypass to reach the unauthenticated path. LiteLLM 1.74.2 through 1.83.6 are affected, and Starlette was fixed in 1.0.1. The fix therefore shipped roughly six weeks before the chained research was published and seven weeks before the catalogue listing.", "links": [ { "label": "Horizon3.ai: CVE-2026-42271 chained with CVE-2026-48710, LiteLLM unauthenticated remote code execution (1 June 2026)", "url": "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/" }, { "label": "GitHub security advisory GHSA-v4p8-mg3p-g94g: command execution via LiteLLM MCP stdio test endpoints", "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g" }, { "label": "GitHub security advisory GHSA-86qp-5c8j-p5mr: Starlette missing Host header validation (CVE-2026-48710)", "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr" }, { "label": "LiteLLM release v1.83.7-stable", "url": "https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable" }, { "label": "CISA Known Exploited Vulnerabilities catalogue (JSON feed)", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0067/" }, { "id": "ai-incident-0068", "title": "Google says criminals used an AI-built zero-day in a planned mass-hack campaign", "date": "2026-05-11", "type": "AI-Found Vuln", "severity": "High", "status": "In the wild", "target": "Open-source tool", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Google's Threat Intelligence Group reported that a prominent cybercrime group had used an AI-generated zero-day exploit designed to bypass two-factor authentication on an open-source system-administration tool. Google said it worked with the affected vendor to head off what appeared to be a planned mass-exploitation campaign. The specific tool, exploit and threat group were not publicly named.", "links": [ { "label": "The Register (Google GTIG)", "url": "https://www.theregister.com/ai-ml/2026/05/11/google-says-criminals-used-ai-built-zero-day-in-planned-mass-hack-spree/5237982" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0068/" }, { "id": "ai-incident-0069", "title": "FAR.AI finds DeepSeek V4 Pro's safeguards collapse under three simple jailbreaks", "date": "2026-05-11", "type": "Jailbreak", "severity": "High", "status": "Research", "target": "DeepSeek V4 Pro", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "AI safety nonprofit FAR.AI reported that DeepSeek V4 Pro blocked all harmful requests when asked directly, but that three simple jailbreak techniques, a fake developer test mode, a fabricated privileged-user identity and a prefilled fake safety approval, drove attacker success rates to between 98 and 100 per cent across chemical, biological, cyberattack and terrorism-related domains. One of the three was a jailbreak originally shared on social media for the predecessor DeepSeek V3.2, and it worked on V4 Pro without modification.", "details": "FAR.AI said the fake developer mode took about 15 minutes to develop and reuse, the fabricated-authority attack about 45 minutes and the prefilled-approval attack about 150 minutes. The unmodified transfer of a known jailbreak across a model generation shows the underlying weakness went unpatched, and the researchers framed the gap between direct-request refusals and adversarial performance as a case study in the limits of surface-level safety testing for open-weight releases.", "links": [ { "label": "FAR.AI: Security stress test, exposing the brittleness of DeepSeek-V4-Pro's safeguards", "url": "https://far.ai/news/security-stress-test-deepseek-v4-pros-safeguards" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0069/" }, { "id": "ai-incident-0070", "title": "Google Antigravity IDE prompt-injection flaw enabled code execution", "date": "2026-04-20", "type": "Prompt Injection", "severity": "High", "status": "Patched", "target": "Google Antigravity", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Pillar Security reported an indirect prompt-injection flaw in Google's Antigravity agentic IDE: hidden instructions in an untrusted source file could make the agent call its find_by_name search tool with an injected -X flag, forcing the underlying fd binary to run arbitrary code on a developer's machine and escaping the sandbox even with Secure Mode enabled and auto execution off. Google marked it fixed on 28 February 2026 and awarded a bounty; researchers demonstrated it as a proof of concept and it was not seen in the wild.", "details": "Secure Mode is Antigravity's most restrictive configuration, restricting network access, preventing writes outside the workspace and running commands under a sandbox. The injected flag never reaches that boundary, because the agent treats the search call as a native tool invocation. Pillar reported the flaw to Google's AI vulnerability reward programme on 7 January 2026 and published on 20 April, nearly two months after the fix landed. No CVE was assigned.", "links": [ { "label": "Pillar Security: prompt injection leads to RCE and sandbox escape in Antigravity (20 April 2026)", "url": "https://www.pillar.security/blog/prompt-injection-leads-to-rce-and-sandbox-escape-in-antigravity" }, { "label": "Google: the Antigravity Secure Mode documentation", "url": "https://antigravity.google/docs/secure-mode" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0070/" }, { "id": "ai-incident-0071", "title": "OpenAI patches ChatGPT data-exfiltration flaw and Codex token vulnerability", "date": "2026-03-30", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "OpenAI ChatGPT", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Check Point and BeyondTrust disclosed separate flaws in OpenAI's products: one turned DNS lookups from ChatGPT's code-execution sandbox into a covert channel that leaked conversation text and uploaded files, while a second let a crafted GitHub branch name inject shell commands into Codex's cloud container, stealing the victim's GitHub user access token, the same token Codex authenticates with, and running attacker code beside the developer's own. OpenAI patched both issues, ChatGPT on 20 February 2026 and Codex in stages from 23 December 2025 to 30 January 2026. No in-the-wild abuse was reported.", "details": "The Codex vector worked because GitHub bars spaces in branch names but not ${IFS}, so shell metacharacters survived the naming rules and ran inside the task container. It reached the ChatGPT website, the Codex CLI, the Codex SDK and the Codex IDE extension. Neither flaw carries a CVE.", "links": [ { "label": "Check Point Research: ChatGPT data leakage through a hidden outbound channel in the code execution runtime (30 March 2026)", "url": "https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/" }, { "label": "BeyondTrust Phantom Labs: command injection in OpenAI Codex and theft of the GitHub token (30 March 2026)", "url": "https://www.beyondtrust.com/blog/entry/openai-codex-command-injection-vulnerability-github-token" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0071/" }, { "id": "ai-incident-0072", "title": "Popular LiteLLM PyPI package backdoored in a supply-chain attack", "date": "2026-03-24", "type": "Poisoning", "severity": "High", "status": "In the wild", "target": "LiteLLM", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "A group tracked as TeamPCP compromised the widely used LiteLLM Python package on PyPI and published malicious versions that harvested SSH keys, cloud credentials and other secrets from developer machines. Snyk and the project's maintainers traced it to the project's PyPI publishing token, taken out of its CI pipeline days earlier through a poisoned release of the Trivy scanner's GitHub Action that the workflow pulled unpinned; Endor Labs, which found the malicious builds, calls the exact vector unconfirmed. The package draws more than three million downloads a day. PyPI pulled both versions and suspended the whole project, the maintainers rotated their accounts and held all releases while they audited the chain, and the next clean version, 1.83.0, did not appear until 31 March 2026.", "details": "The malicious releases were 1.82.7 and 1.82.8, published thirteen minutes apart on 24 March 2026, with 1.82.6 of 22 March the last verified clean build. Twelve lines inserted into litellm/proxy/proxy_server.py harvested SSH keys, cloud tokens, Kubernetes secrets, .env files and wallet data; 1.82.8 added a .pth file that fired on any Python invocation. The payload also moved laterally by deploying privileged Kubernetes pods and installed a systemd unit that polled a command server every 50 minutes. Datadog placed LiteLLM at the end of a campaign chain running through Trivy on 19 March, npm from 20 to 22 March and Checkmarx on 23 March.", "links": [ { "label": "Endor Labs: the TeamPCP campaign reaches LiteLLM on PyPI (24 March 2026)", "url": "https://www.endorlabs.com/learn/teampcp-isnt-done" }, { "label": "Snyk: the poisoned security scanner behind the LiteLLM backdoor (24 March 2026)", "url": "https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/" }, { "label": "Datadog Security Labs: tracing the TeamPCP supply-chain campaign into PyPI (24 March 2026)", "url": "https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/" }, { "label": "LiteLLM issue 24518: the project's own compromise timeline and status", "url": "https://github.com/BerriAI/litellm/issues/24518" }, { "label": "PyPI: the release record for litellm (JSON)", "url": "https://pypi.org/pypi/litellm/json" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0072/" }, { "id": "ai-incident-0073", "title": "PerplexedBrowser: Perplexity Comet agent leaks local files via calendar-invite injection", "date": "2026-03-04", "type": "Agent Hijack", "severity": "High", "status": "Patched", "target": "Perplexity Comet", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Zenity Labs disclosed a flaw it called PerplexedBrowser in Perplexity's AI-powered Comet browser, in which instructions hidden in a calendar invitation could cause the browser agent to read files on the user's machine and send their contents to an external server. Perplexity shipped a fix restricting agent access to local file paths. The finding was a proof-of-concept with no reported real-world exploitation.", "links": [ { "label": "eSecurity Planet (Zenity Labs)", "url": "https://www.esecurityplanet.com/artificial-intelligence/perplexity-comet-browser-bug-leaks-local-files-via-ai-prompt-injection/" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0073/" }, { "id": "ai-incident-0074", "title": "Group-IB documents a maturing market for AI-enabled fraud and deepfakes", "date": "2026-01-20", "type": "Deepfake/Fraud", "severity": "Medium", "status": "In the wild", "target": "Deepfake services", "actor": "criminal", "lossUsd": null, "cve": null, "summary": "Group-IB research documented a maturing dark-web market for AI-enabled crime, including subscription dark LLMs, cheap synthetic-identity kits and voice-cloning tools. The firm said deepfake-enabled fraud accounted for roughly 347 million US dollars of verified losses in a single quarter, and that one bank recorded more than 8,000 deepfake fraud attempts over eight months. These are aggregate market estimates rather than a single named incident.", "links": [ { "label": "The Register (Group-IB)", "url": "https://www.theregister.com/security/2026/01/20/for-the-price-of-netflix-crooks-can-rent-ai-crime-ops/4293241" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0074/" }, { "id": "ai-incident-0075", "title": "Google Gemini tricked into leaking private meeting data via poisoned calendar invites", "date": "2026-01-19", "type": "Prompt Injection", "severity": "High", "status": "Proof-of-concept", "target": "Google Gemini", "actor": "researcher", "lossUsd": null, "cve": null, "summary": "Miggo Security disclosed an indirect prompt-injection flaw in Google Gemini in which hidden instructions placed in a calendar event description could override Google Calendar's privacy controls. The payload lay dormant until the victim asked Gemini a routine question about their schedule, at which point the assistant could be steered into summarising private meetings into a new calendar entry the attacker could read. The victim never had to open, accept or click anything from the attacker; an invite landing on the calendar was enough. Google addressed the issue after responsible disclosure.", "links": [ { "label": "Miggo Security: weaponising calendar invites, a semantic attack on Google Gemini (19 January 2026)", "url": "https://www.miggo.io/post/weaponizing-calendar-invites-a-semantic-attack-on-google-gemini" } ], "url": "https://yfarmx.com/tools/ai-risk-radar/ai-incident-0075/" } ] }