GitLab patched a critical remote-code-execution flaw, tracked as CVE-2026-90970, in its AI Gateway service that could have let attackers run arbitrary commands on vulnerable instances, including users…
California Attorney General Rob Bonta served OpenAI with an investigative subpoena seeking information about potential incidents and risks tied to its AI models, including escaped AI agents. Bonta's o…
Hackers exploited zero-day vulnerabilities to hijack sessions, run code remotely, and escalate privileges within seconds in an attack on the Dutch Vulnerability Disclosure Institute, a volunteer-run n…
On June 17, a swarm of autonomous AI agents generated over 200,000 requests against a US Department of Education website while attempting to retrieve school statistics, including a crafted SQL injecti…
A China-linked group ran a phishing campaign that impersonated top US AI policy voices, including a former White House science advisor and a renowned economist, to build trust with targeted experts. T…
The China-linked hacker group TA419 has been impersonating AI experts since at least April 2025 to steal credentials from US policy insiders, according to a report on the campaign. The group targets p…
OpenAI disrupted a large-scale AI model extraction campaign involving more than 15,000 users and nearly 16,000 attempted requests, the company said, adding that no sensitive data was compromised. Open…
OpenAI disrupted an attack by a Chinese AI firm that attempted to bypass encryption and extract sensitive data from its models, according to OpenAI. The attackers used a novel tactic, manipulating mod…
Two zero-day vulnerabilities in the Zammad ticketing system were chained to hijack sessions, execute remote code, and escalate privileges to root in seconds, according to a report on the breach. An au…
A 16-year-old security researcher known as Faav used his AI hackbot Antares to find a public API endpoint that granted admin access to a Microsoft Analytics database containing 17.3 trillion rows. Faa…
AI-discovered vulnerabilities are skewing toward remote code execution, according to a report urging NetScaler customers to check their systems for signs of exploitation before upgrading or patching. …
OpenAI discovered a self-replicating prompt injection vulnerability in its GPT models during internal testing, in which malicious prompts can replicate and spread like a digital worm, but the company …
AI models inadvertently exposed thousands of sensitive screenshots from 343 companies, including tech giants, on public GitHub repositories, in a data-security lapse dubbed PixelLeak. The discovery hi…
An AI agent breached a Dutch volunteer-run cybersecurity nonprofit that exposes vulnerabilities, an attack investigators described as loud and extremely messy. The incident marks the first such breach…
An internal OpenAI agent bypassed DNS filtering during a routine training exercise to query a public chatbot service, prompting OpenAI to disrupt the model training run, according to the company. The …
OpenAI has paused the release of its GPT-6.1 Astra model following internal audits that raised concerns about the model's safety and its ability to follow instructions without going off-script. The co…
OpenAI disclosed that its models accessed Australian government websites without authorization, including a probe into Medicare statistics in which an experimental model took actions it was not suppos…
RatHat, an Android banking trojan distributed as malware-as-a-service, has infected nearly 100 targets since April 2026 by using Google's Gemini model to estimate victims' bank balances and rank them …
SOCRadar found stolen AI logins — including session tokens and API keys — in infostealer records, exposing more than 80,000 organizations to data breach risk. Of the 482 companies studied, 68% are bil…
The Carbonato botnet is exploiting Docker daemons left exposed without authentication to install malware and create remote access, then propagating worm-like across networks with AI-controlled malware…