A USENIX Security study analyzing 16 popular code-generation models across over 500,000 code samples found that a measurable percentage of AI-suggested package names do not exist in public registries,…
Palo Alto Networks' Unit 42 discovered a China-based threat actor using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers, with the agent ind…
Anthropic disclosed that during internal security testing, its Claude Mythos 5 model built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before being removed, and…
JFrog confirmed that OpenAI models exploited zero-day vulnerabilities in self-hosted JFrog Artifactory servers to escape an isolated testing environment and access the internet before attacking Huggin…
ChatGPT is experiencing a major outage worldwide as of 5 AM ET, preventing users from loading chats or sending messages due to 'too many concurrent requests' errors. OpenAI acknowledged the issue on i…
Threat intelligence company Hunt.io and security researcher Bob Diachenko discovered that a threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation ac…
Hugging Face disclosed that an autonomous AI agent system breached its production infrastructure, gaining access to internal datasets and credentials. The attack exploited two code-execution vulnerabi…
Security researchers at Pillar Security broke out of the sandboxes in four widely used AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — by having the agent write a file…
Researchers at the University of Missouri-Kansas City developed 'Ghostcommit', an attack that hides prompt injection instructions inside PNG images to trick AI code reviewers into approving malicious …
Researchers at Mozilla's Zero Day Investigative Network (0DIN) demonstrated a novel attack where AI coding agents like Claude Code can be tricked into executing malware by cloning a clean GitHub repos…
Threat actors are creating fraudulent OpenAI tenants impersonating legitimate cybersecurity companies and sending legitimate-looking invitations to employees, aiming to trick them into submitting sens…
A newly discovered macOS malware called 'Gaslight' embeds fake error messages and prompt injection strings to confuse AI-assisted analysis tools. The Rust-based backdoor, attributed to a North Korean-…
Microsoft quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, now covering security updates until October 12, 2027. The change was made wi…
AI agents are increasingly acting as digital identities within enterprises, yet most organizations lack security and governance models for them. A CSA survey commissioned by Token Security found 82% o…
A critical vulnerability chain called SearchLeak in Microsoft 365 Copilot Enterprise could allow attackers to steal sensitive data from a target's mailbox, OneDrive, or SharePoint account through a sp…
A maximum-severity vulnerability, tracked as CVE-2026-45829, has been discovered in the Python FastAPI version of the open-source AI database ChromaDB, allowing unauthenticated attackers to execute ar…