New records on the YFarmX AI Risk Radar: AI-security incidents as they are reported, with the type, severity, status and source on every record.https://yfarmx.com/en-GBhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0086/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0086/vLLM fails to clean up decode-side metadata for rejected requests in disaggregated setups, so a remote attacker submitting max_tokens=0 grows decode-worker memory until the worker restarts. Scored CVSS 3.1 7.5. The fix pull request was still open and unmerged when the record published on 17 September, so no patched version exists yet.Thu, 17 Sep 2026 00:00:00 GMTInfra VulnHighProof-of-concepthttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0087/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0087/Missing authentication on a critical function let an unauthorised network attacker elevate privileges, scored CVSS 3.1 10.0. Microsoft states the flaw is fully mitigated server-side with no customer action required and records no exploitation.Thu, 17 Sep 2026 00:00:00 GMTInfra VulnCriticalPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0092/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0092/Researcher Gal Weizman showed that an extension using ordinary permissions can speak from the vendor page the in-browser half of an agent trusts. On Comet, Edge, Opera Neon and Claude in Chrome that meant issuing the agent instructions, such as opening a victim's email and forwarding the finance messages. On Chrome it meant driving the acting half directly, reading local files and switching on the camera and microphone.Wed, 16 Sep 2026 00:00:00 GMTAgent HijackHighProof-of-concepthttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0080/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0080/The unauthenticated POST /api/v1/runs endpoint accepts attacker-controlled agent_yaml, and an approve field in that YAML marks execute_command as pre-approved, turning the require_approval decorator into a no-op. The chain gives full remote command execution with no credentials and no operator interaction, scored CVSS 3.1 9.8. Patched in praisonai 4.6.59 and praisonaiagents 1.6.59.Mon, 14 Sep 2026 00:00:00 GMTAgent HijackCriticalPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0088/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0088/Security firm Hacktron AI chained a libheif heap-overflow remote code execution in the Discourse forum software with an SSO misconfiguration on OpenAI's community forum, took over an employee's ChatGPT and Codex accounts, and opened a pull request inside an OpenAI internal repository. OpenAI shipped a fix roughly fourteen hours after disclosure, marked the report resolved on 1 September, and paid a bounty.Sun, 13 Sep 2026 00:00:00 GMTData LeakCriticalContainedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0089/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0089/Four denial-of-service advisories published together and fixed in 0.29.0: an unbounded cache_salt parameter that stalls the single scheduler thread, audio decoding that ignores the configured clip-size limit, sampler-subclass attribute shadowing that bypasses decoder-slot and GPU-memory limits, and remote media fetched in full across four ingress paths before size limits apply. CVSS scores run 3.7 to 6.5 and none carries a CVE yet.Sat, 12 Sep 2026 00:00:00 GMTInfra VulnMediumPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0081/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0081/Anthropic's fourth threat intelligence report, published 10 September, names four disrupted operations. GTG-20006, a Russian state actor, ran autonomous AI-driven workflows end to end against Ukrainian and European government targets, with agents modifying malware when defences detected it. GTG-50014, linked to ShinyHunters, harvested credentials at industrial scale, including one operator who scanned 1.8 million Android APKs for hardcoded secrets. GTG-10007, a Chinese exploit foundry, ran autonomous vulnerability research against a major security product. GTG-50029 is a single hacktivist's AI-built doxxing platform.Thu, 10 Sep 2026 00:00:00 GMTJailbreakCriticalIn the wildhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0082/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0082/On adk web installations where pytest is present, a crafted test-session replay dispatches a recorded function call straight to a tool resolved from an attacker's agent YAML, so naming a standard-library callable such as cProfile.run executes arbitrary code with no authentication. NVD scores it CVSS 3.1 10.0. The fix in v2.7.0 blocks the whole Python standard library from agent configs, replacing an incomplete denylist. This is Google's second ADK entry on this board, after the earlier builder-endpoint file read.Wed, 09 Sep 2026 00:00:00 GMTAgent HijackCriticalPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0078/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0078/Microsoft disclosed two bypasses in optional agent network filtering. Backslashes or mixed separators let the integrated browser interpret a URL differently from the policy checker; equivalent IPv4-mapped IPv6 addresses bypassed IPv4 entries in deny-only policies. Both require particular filter configurations and are fixed in 1.136.2. Each advisory assigns CVSS 3.1 8.2; neither reports confirmed exploitation.Tue, 08 Sep 2026 00:00:00 GMTAgent HijackHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0079/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0079/VS Code read remote agent host addresses and local-file permission grants from workspace configuration. Opening a crafted repository could connect the editor to an attacker-controlled host and permit local data access or code execution, even without trusting the workspace. Opening the repository required user interaction. Version 1.136.2 restricts these settings to global configuration.Tue, 08 Sep 2026 00:00:00 GMTAgent HijackHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0083/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0083/The agent-control API authenticated requests by their Host header, so a client-supplied loopback value passed for a local caller. An attacker who reaches the port, including remotely where it is exposed, gains sandbox escape, can disable approval prompts and can read transcripts off the machine. NVD scores it CVSS 3.1 9.6. The dsh-v0.1.2-alpha.1 release requires every /api request to present a Host that is loopback or on a trusted list, adds one-time token authentication for network access and rejects --host 0.0.0.0.Tue, 08 Sep 2026 00:00:00 GMTAgent HijackCriticalPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0084/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0084/Two parser gaps let a crafted command pass the allowlist while bash executes a denied command with the agent's auto-execute privileges. One omits the stderr-redirecting pipe operator from the parser's token set, so an approved prefix carries a denied command through the gate; the other is a word-boundary mismatch in comment handling, where an approved term set against a hash symbol reads as a comment to the gate and as a command to bash. NVD scores both CVSS 3.1 8.8. Every released version is affected: the newest release remains 3.54.0 at the 15 September check. These are two related vulnerabilities grouped into one radar record.Tue, 08 Sep 2026 00:00:00 GMTAgent HijackHighProof-of-concepthttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0085/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0085/The headline flaw, CVE-2026-86076: the expression compiler's sanitizer resolved through dynamically scoped this, so a class field named __sanitize rebinds the sanitizer and reaches the Function constructor, giving any expression author code execution in the n8n process, scored CVSS 3.1 8.8. A related legacy-engine flaw, CVE-2026-86083, reaches the same outcome and carries the same score. CVE-2026-86082 is the AI-specific entry: the OpenAI Chat Model node enforced the credential allowed-domain check on normal calls and skipped it on the model-search dropdown, so a workflow editor could point the dropdown at their own host and collect the stored OpenAI API key, scored 6.5. All are fixed in 1.123.76, 2.37.7 and 2.38.2.Tue, 08 Sep 2026 00:00:00 GMTAgent HijackHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0090/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0090/An excessive-iteration flaw lets a remote, unauthenticated attacker send malformed input that exhausts compute, and a missing-authorization flaw exposes functions with no access check, risking information disclosure, data tampering and denial of service. Both score CVSS 3.1 7.5 and both are fixed in release 26.07.Tue, 08 Sep 2026 00:00:00 GMTInfra VulnHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0001/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0001/Four CVEs in one product: CVE-2026-18905 (DNS-rebinding information disclosure during tool invocation, fixed 1.0.7), CVE-2026-77822 (SSRF via DNS rebinding on the A2A agent-invocation endpoint, fixed 1.0.9), CVE-2026-18486 (improper jq-filter validation exposing credentials and enabling privilege escalation, fixed 1.0.8, with IBM advising rotation of JWT, auth, database and Redis secrets), and CVE-2026-18489 (the Translate utility leaking data across sessions). IBM's bulletins are dated 2 September.Fri, 04 Sep 2026 00:00:00 GMTData LeakHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0002/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0002/An authenticated remote attacker spoofing X-Forwarded-For: 127.0.0.1 bypasses the localhost-only restriction on MCP configuration installation, gaining arbitrary writes to IDE configuration files such as ~/.cursor/mcp.json. Fixed in 1.11.3; IBM's bulletin is dated 28 August and the record reached NVD on 4 September.Fri, 04 Sep 2026 00:00:00 GMTAgent HijackHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0003/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0003/An unauthenticated actor could place crafted SQL in content later submitted during an authenticated user’s interaction. An incomplete input denylist let that SQL bypass the Postgres MCP server’s intended read-only scope. AWS fixed the issue in 1.1.7 and published its own bulletin.Fri, 04 Sep 2026 00:00:00 GMTAgent HijackHighPatchedhttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0004/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0004/The OpenAI-compatible POST /v1/responses endpoint fetched an MCP tool’s server_url without the private-address validation used elsewhere. The researcher demonstrated a request to a loopback listener and described potential access to internal services or cloud metadata, including forwarding supplied bearer tokens. The default starter configuration runs without authentication. The CVE records CVSS 4.0 8.7.Fri, 04 Sep 2026 00:00:00 GMTData LeakHighProof-of-concepthttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0005/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0005/Restricted-mode function validation checked the target list but missed functions in a FROM clause. With a database connection role holding superuser or pg_read_server_files privileges, this could permit arbitrary server-file reads despite restricted mode. The CVE records CVSS 4.0 9.2. The cited issue and fix pull request remained open at the 10 September check; these sources did not establish a released fix.Fri, 04 Sep 2026 00:00:00 GMTData LeakCriticalProof-of-concepthttps://yfarmx.com/tools/ai-risk-radar/ai-incident-0006/https://yfarmx.com/tools/ai-risk-radar/ai-incident-0006/The extract_document_content tool fetches caller-supplied URLs with no scheme, host or IP filtering, so an indirect prompt injection can make the server fetch internal resources or cloud metadata and return the response into the agent's context. Scored CVSS 3.1 7.5; the cited issue remained open at the 10 September check. A released fix was not established from that report.Fri, 04 Sep 2026 00:00:00 GMTPrompt InjectionHighProof-of-concept