AI Security Roundup: OpenClaw's Nine CVEs in Four Days
OpenClaw collected nine CVEs in four days with 135,000 instances exposed. Plus: GitHub RCE, Flowise exploitation, and CrewAI trust failures.
Tag
#mcp
AI Security Roundup: Vercel Breached Through AI Tool, n8n's CVSS 10 Nightmare, and the Supply Chain Keeps Breaking
An AI productivity tool compromise led to Vercel customer data theft, n8n's workflow platform had an unauthenticated RCE scoring a perfect 10, and Mercor's LiteLLM-linked breach exposed training data for OpenAI and Anthropic.
AI Security Roundup: Lovable's 48-Day Open Door, MCP Remote Code Execution, and NIST Abandons 29,000 CVEs
A vibe-coding platform exposed every project's secrets through a trivial API flaw, Anthropic's MCP protocol enables remote code execution across 200,000 servers, and NIST can't keep up with AI-driven vulnerability discovery.
Open Source AI Wins: GLM-5.1 Beats Every Closed Model on SWE-Bench Pro, Bonsai Fits an 8B Model in 1.2 GB, and MCP Hits 97 Million
An open-weight model tops the hardest coding benchmark for the first time. A 1-bit LLM runs on a phone. And the protocol connecting AI to everything just passed React's adoption curve.
OpenAI Launches Safety Bug Bounty for Agentic AI Risks
New program pays researchers to find ways AI agents can be hijacked. Jailbreaks not included.
AI Security Roundup: TeamPCP's Supply Chain Rampage, LiteLLM Poisoned, Langflow Exploited in 20 Hours
A coordinated supply chain campaign has compromised Trivy, LiteLLM, and dozens of npm packages. Meanwhile, Langflow attackers built working exploits within hours of disclosure.
Perplexity Ditches MCP: Why the Model Context Protocol Is Losing Enterprise Users
Perplexity's CTO announces the company is moving away from Anthropic's Model Context Protocol, citing context window bloat and authentication friction. The shift reveals growing pains in AI tooling.
AI Security This Week: Cursor RCE, 8,000 Exposed MCP Servers, and LLMs Jailbreaking LLMs
Cursor patches critical shell bypass flaw, thousands of MCP servers sit wide open, and new research shows reasoning models can autonomously jailbreak other AI systems with 97% success.
Lobster Trap: The Open-Source Tool That Watches What Your AI Agents Say
Veea releases a sub-millisecond security proxy for AI agents under MIT license as new research shows 88% of organizations have experienced agent security incidents.
IronCurtain: The Open-Source 'Firewall' for AI Agents That Might Actually Work
A veteran Google security engineer built a sandbox system that treats AI agents as fundamentally untrusted - and it could be the model for safe agent deployment.
Open-Source AI Wins: GLM-5, OpenAI's First Open Model, and the Agentic Foundation
March 2026's open-source AI highlights: Zhipu's GLM-5 rivals GPT-5, OpenAI finally goes open, and the Linux Foundation creates a home for AI agents.
IronCurtain: The Security Framework That Treats AI Agents as Hostile by Default
Former Google and Stripe security head Niels Provos built an open source sandbox that assumes AI agents will go rogue. Here's how it works.
The Agentic AI Security Crisis: 88% of Companies Report Incidents, Only 29% Are Ready
Cisco's 2026 State of AI Security report reveals a dangerous gap: enterprises are deploying AI agents faster than they can secure them, with MCP vulnerabilities and prompt injection attacks proliferating.
Clone a Repo, Lose Your API Keys: Claude Code's Trojan Horse Vulnerabilities
Security researchers found that simply opening an untrusted repository in Claude Code could execute arbitrary commands and steal your Anthropic API keys - all before you saw a warning.
Apple Opens Xcode to AI Agents: Claude, Codex Can Now Control Your IDE
Xcode 26.3 introduces agentic coding, letting AI agents build projects, run tests, search docs, and iterate on fixes autonomously through the open Model Context Protocol.
DockerDash: How Poisoned Container Metadata Turned Docker's AI Assistant Into an Attack Vector
Two independent security firms found that Docker's Ask Gordon AI could be hijacked through image metadata, enabling remote code execution and data theft across millions of developer machines.
DockerDash: How Metadata Hijacks Docker's AI Assistant
A Docker AI vulnerability let attackers embed commands in image labels. Patched months ago, the pattern keeps recurring.