OpenAI paused internal development of its upcoming Astra model on August 7 after evaluations found the system can autonomously develop working zero-day exploits against hardened real-world targets wit…
Anthropic expanded access to its Claude Mythos 5 cybersecurity model and launched a $35 million open-source security fund, according to SecurityWeek. The move is seen as a strategic effort to maintain…
Zoom has patched a zero-click vulnerability, tracked as CVE-2026-53413 and dubbed 'Zoomsday' by security firm A Security, that allowed any meeting guest to execute code on another attendee's PC via th…
Pillar Security researchers demonstrated an agent-to-agent privilege boundary failure in Google's Agent Development Kit (ADK) repository, where a low-privilege triage agent could be manipulated via pr…
Barracuda Networks researchers demonstrated a proof-of-concept attack where an attacker who compromises a regular employee's Microsoft 365 mailbox uses Copilot as an accomplice to conduct internal rec…
Microsoft Corp. said on August 3 that its vulnerability rewards programs awarded more than $20 million to 562 security researchers from 64 countries during the fiscal year ended June 30, 2026, both pr…
Barracuda published a controlled proof-of-concept on August 4 showing how an attacker could use Microsoft Copilot after compromising an employee email account to escalate to a CEO account and redirect…
Pillar Security disclosed on August 3 two now-patched privilege-boundary weaknesses in Google's Agent Development Kit for Python repository, one allowing prompt injection to cross from a public triage…
Cybersecurity researchers at Tel Aviv University and Intuit have identified a new attack called 'hallusquatting' that exploits AI coding assistants' tendency to hallucinate non-existent software packa…
A security analysis by Symbiotic Security found that 98% of 1,072 Supabase-backed vibe-coded apps had at least one security issue, with 16% containing critical flaws. An academic study by Deng et al. …
Nebula Security used its AI-driven bug-hunting tool VEGA to discover GhostLock (CVE-2026-43499), a 15-year-old use-after-free vulnerability in the Linux kernel that allows any logged-in user to gain r…
CISA added an authorization-bypass vulnerability in Langflow, a visual framework for building AI-agent workflows, to its Known Exploited Vulnerabilities catalog on July 7, 2026, giving federal agencie…
CISA is using Anthropic Mythos to audit federal code repositories for vulnerabilities, according to reports from Reuters, SecurityWeek, and The Next Web. The Attack Surface Evaluation team has already…
Zscaler discovered malicious websites using indirect prompt injection to manipulate autonomous AI agents, including campaigns tied to crypto-payments and fake DeFi decisions. The attacks exploit agent…
Security researchers at Flatt.tech disclosed a critical supply-chain vulnerability in Anthropic's Claude Code GitHub Actions integration that a single malicious GitHub issue, pull request, or comment …
In June 2026, attackers exploited Meta's AI-powered support chatbot to take over high-profile Instagram accounts, including the Obama White House account, by convincing the AI to perform account recov…