ls ./category/ai --page 2
Models, agents and the new attack surface they create.
Irregular has explained the cause of the worst of the three incidents Anthropic disclosed in July: a fictional target was given a name that matched a real, little-known website. Claude Opus 4.7 broke into it across four runs and reached a production database — and in two of those runs it reasoned that the real company must be part of the exercise, and carried on.
It uses Google DeepMind's SynthID-Text, biasing word choice with a cryptographic key. It needs long passages, barely marks factual sentences or code, and a rewrite removes it entirely. The detector is not public yet.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Tenet Security's GhostJacking turns monitoring data into an instruction channel for AI agents, chaining to cloud pivot, exfiltration and persistence. A separate Cursor CLI flaw let a cloned repo run commands before any trust prompt appeared.
For two years OpenAI told the court it could not search its own training corpus. A court-ordered deposition in April produced a database of 78 million conversations and a tool built to log regurgitation. The sanctions motion asks the court to decide the fact question without the evidence.
The viral version says a hacker exposed 2 million stolen songs. The number is one line item from one of ten sources, it is ten times smaller than what Suno told a court in 2024, and the labels had the real figure in discovery two months earlier. Underneath it is a breach Suno described as involving no sensitive personal information.
'AI Sidebar with DeepSeek, ChatGPT, Claude and more' had 300,000 installs and a 4.6-star rating before Google removed it in January. It returned in August, clean for eleven days, then shipped a 21-line addition.
Two poisoned releases in March, published with a token stolen in the Trivy breach and kept alive by an incomplete rotation. CloudSEK's dataset of 434,000 captured files now maps possible exposure across 2,500+ organisations.
GPT-5.6-Cyber completes 95.0% of requests on OpenAI's advanced cybersecurity evaluation, against 1.5% for the base model. It is not on the API. You apply to Daybreak Red, and someone decides.
Varonis got it with a URL parameter that pre-fills the chat — patched, $6,000 bounty. PromptArmor got it with white text inside an uploaded PDF, disclosed on 23 May and still unfixed when they published on 5 August.
ASSET Research Group's GhostSplice technique fragments an exfiltration request across MCP tool descriptions and tool results. No single piece looks wrong. The agent assembles it. Several models went from 0% to 100%.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
Mitiga found prompt-exfiltration tradecraft in the wild — malicious natural-language instructions in .cursorrules and CLAUDE.md that make the agent collect prompts, tokens and environment variables and send them onward. Also: 1,230+ hardcoded API keys sitting in AI instruction files.
Datadog Security Labs found that trusting a project is enough. In Codex, a project-scoped MCP config starts an attacker-controlled process; in Claude Code, a project-controlled PATH gets a repository wrapper executed by Claude's own Git probes. Neither needs a model response or an approval prompt.
Novee Security took Claude Code, Gemini CLI and OpenAI Codex to Black Hat and found the same structural bug in all three: one component marks a value safe, a later component acts on it with more authority. Gemini CLI's carries a CVSS 4.0 of 10.0.
OpenAI, Anthropic, Meta and Moonshot models have all reached systems outside their evaluation environments, and a UK AISI agent tried to socially engineer a vulnerability into an open-source project. The tests strip the safeguards on purpose — which is what makes an escape serious.
Jesta Security exposed a lab, watched a DeepSeek-powered agent work it for five days across 871 sessions, then steered the agent into printing its own model string mid-attack. Its target list held 1,283 hosts with working credentials.
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.
Inference hooks landed in beta for Enterprise in early August, inspecting prompts and tool calls across Claude chat, Claude Code and Cowork before they reach the model.
OWASP has ranked it the top LLM vulnerability three years running. What changed in 2026 is that agents now hold real credentials, so a successful injection is a full system compromise.
Astra produced machine-checkable Lean 4 proofs for ten open problems across eight fields of math — for about $2,000 in compute. The proofs are on GitHub under Apache 2.0, so nobody has to take OpenAI's word for it.