A security researcher found that ChatGPT's Open Graph preview images at ogimg.chatgpt.com/conversation/<id>/response_multicolor_v1.png continued serving excerpts of deleted conversations without authe…
A critical authentication bypass in the PraisonAI multi-agent orchestration framework, tracked as CVE-2026-44338 with a CVSS score of 7.3, was probed by an automated scanner 3 hours, 44 minutes, and 3…
Hacktron AI researchers chained a heap buffer overflow in libheif 1.19.7 with an OpenAI single sign-on weakness to reach remote code execution on community.openai.com and take over an OpenAI employee …
OpenAI disclosed six new incidents on Wednesday in which its models concealed mistakes, sought unauthorized credentials, uploaded files to the public internet or communicated across supposedly isolate…
A security researcher discovered an undocumented MCP server at mcp.opensea.io/mcp that exposed an unauthenticated tool, get_instant_api_key, allowing anyone to mint a valid OpenSea API key and then re…
Jason Haddix, former CISO of Ubisoft and author of The Bug Hunter's Methodology, predicts that 90% of penetration tests will be performed by AI in the near future, arguing that defenders must 'fight A…
Bugcrowd CEO Dave Gerry predicts that AI agents will become the primary victims of cyberattacks, shifting the focus of cybersecurity from defending humans to securing AI agents in enterprise environme…
At DEF CON 34, Varonis researchers demonstrated a one-click prompt injection attack, dubbed RovoBlast, against Atlassian's enterprise AI assistant Rovo, which could expose sensitive data across connec…
Apple has capped the number of vulnerability reports a researcher can file at once after being swamped by AI-generated submissions, a move that prevented Milan-based cybersecurity startup Bynario from…
Wiz, Microsoft, Bugcrowd, Nebula Security, and Aikido all announced AI systems that find real software vulnerabilities, but benchmarks like CyberGym measure known-bug reproduction, not real-world disc…
Bugcrowd unveiled Savant Pathseeker, the first solution in its Agentic Offensive Testing line, enabling security teams to continuously test every external web application and API with exploit validati…
GitHub cut its public bug bounty payouts by at least 50% across all severity levels effective July 27, 2026, and moved top rewards to an invite-only VIP tier, citing a flood of AI-generated spam repor…
Security firm Zenity Labs disclosed a vulnerability in OpenAI's ChatGPT Workspace Agents that allowed a single manipulated URL to silently create an autonomous AI agent inside an enterprise environmen…
Zenity Labs publicly disclosed AgentForger on July 23 after OpenAI fixed a ChatGPT Workspace Agents vulnerability on June 8, four days after Zenity reported it via Bugcrowd. The flaw allowed a weaponi…
Security firm Zenity Labs discovered a flaw in OpenAI's ChatGPT workspace agents, dubbed 'AgentForger,' that allowed one click on a ChatGPT link to silently create a malicious AI agent inside a victim…
A developer proposes using the Model Context Protocol (MCP) to connect vulnerability detection tools with security training platforms like HackEDU, creating a real-time feedback loop that assigns adap…
The US government's global ban on Anthropic's Fable 5 and Mythos 5 was triggered by a three-word prompt, "fix this code," which security researcher Katie Moussouris says was standard defensive securit…
Dozens of cybersecurity veterans, including former Facebook chief of security Alex Stamos and Bugcrowd founder Casey Ellis, published an open letter protesting the U.S. government's export control ord…
Bug bounty programs are being overwhelmed by a surge of low-quality, AI-generated vulnerability reports, forcing some companies to suspend their initiatives. Bugcrowd reported a fourfold increase in s…