Category
Microsoft's Azure AI Foundry hit with a maximum-severity privilege escalation, Langflow exploited within hours of disclosure, and LiteLLM discloses three vulnerabilities after surviving a supply chain attack.
The fastest-growing GitHub project ever just became the biggest AI agent security disaster of 2026. Here's what happened and why it matters.
Threat actors turned Anthropic's accidental source code leak into a malware delivery pipeline within hours. Meanwhile, four unpatched CrewAI vulnerabilities let attackers chain prompt injection into full remote code execution.
ChatGPT now tracks 70% more data types than last year. Meta AI harvests 95% of possible categories. And with FISA Section 702 expiring April 20, the data broker loophole that lets agencies buy your AI conversations without a warrant hangs in the balance.
A class-action lawsuit alleges Perplexity embedded hidden trackers that sent full conversation transcripts to Meta and Google—even in Incognito mode.
OpenClaw went from one CVE to nine in four days, with 12% of its marketplace confirmed malicious. Plus: ChatGPT's patched DNS exfiltration flaw.
Google's real-time translation feature now works with any headphones on iOS, supporting 70+ languages. The catch: unlike Apple's on-device approach, everything goes to the cloud.
The fastest-growing open source project in GitHub history has become 2026's first major AI security disaster, with 135,000+ exposed instances, 9 CVEs in 4 days, and malware-laced skills.
Reddit begins requiring human verification for suspicious accounts using passkeys, biometrics, and Sam Altman's controversial World ID. Here's what it means for privacy.
OpenClaw's security crisis escalates with nine new vulnerabilities including a CVSS 9.9 admin bypass, plus researchers confirm nearly 1 in 8 marketplace skills steal user data.
The supply chain attackers behind Trivy are now wiping Iranian infrastructure, hiding malware in audio files, and extorting enterprises with help from LAPSUS$.
TeamPCP's supply chain campaign continues with a WAV file steganography attack on Telnyx. Meanwhile, three vulnerabilities in LangChain and LangGraph can leak files, secrets, and conversation histories.
A misconfigured CMS exposed 3,000 internal documents revealing Anthropic's most powerful model yet—one the company says could 'exploit vulnerabilities in ways that far outpace defenders.'
A calorie tracking app trusted with your weight, meals, and fitness goals was wide open. The Firebase misconfiguration let anyone read the entire database without credentials.
Nine independent artists accuse Google of training its AI music generator on YouTube uploads without permission—and extracting voiceprints without consent under Illinois biometric privacy law.
After 12% of ClawHub skills turned out to be malware and 135,000 instances were exposed, Cisco releases DefenseClaw and OpenClawd adds verified skill screening. The AI agent ecosystem is racing to catch up.
Georgia Tech researchers tracking real CVEs find 35 vulnerabilities from AI-generated code in March alone—and estimate the actual number is 10x higher.
GitHub's new data policy uses Free, Pro, and Pro+ user interactions to train AI models by default. Your private repo code while using Copilot is fair game unless you disable it.
135,000+ GitHub stars. Four critical CVEs. 12% of its marketplace poisoned with malware. OpenClaw's rise to fame came with a security crisis that every AI agent user needs to understand.
A coordinated supply chain campaign has compromised Trivy, LiteLLM, and dozens of npm packages. Meanwhile, Langflow attackers built working exploits within hours of disclosure.
Security scanners become attack vectors, AI agent platforms get RCE'd before patches exist, and 400+ GitHub repos fall to GlassWorm. Plus: a new secrets scanner built for AI coding agents.
TeamPCP hijacked 75 of 76 version tags in Trivy's GitHub Actions, turning the popular vulnerability scanner into a sophisticated credential harvesting operation.
Browser extensions are harvesting ChatGPT and Claude conversations for sale. Here's what's happening and how to protect yourself.
New research reveals multimodal LLMs are vulnerable to hidden instructions embedded in images. Mind maps, steganography, and physical signage all bypass text-based safety filters.
