AI Security Roundup: Glasswing Finds 10,000 Zero-Days, Exploit Window Goes Negative
Anthropic's Mythos finds 10,000+ critical vulnerabilities but fewer than 1% get patched. Mandiant says exploits now arrive a week before fixes.
Tag
#security
AI Security Roundup: One Million Exposed Services and the Teenager Problem
Intruder scanned 2 million hosts and found 1 million exposed AI services with no authentication. Plus: teenagers are using ChatGPT to hack governments, and OpenAI launches Daybreak.
Claude Mythos: The AI That Hacks Better Than Humans
Anthropic built an AI that finds zero-days autonomously. The Pentagon wants it. Anthropic said no to surveillance. Now it's a geopolitical crisis.
AI Security Roundup: OpenClaw's Nine CVEs in Four Days
OpenClaw collected nine CVEs in four days with 135,000 instances exposed. Plus: GitHub RCE, Flowise exploitation, and CrewAI trust failures.
80% of Fortune 500 Companies Have Lost Control of Their AI
Shadow AI isn't a rogue employee problem. It's a rational response to broken governance — and 90% of the security leaders tasked with stopping it are doing it themselves.
AI Security Roundup: Vercel Breached Through AI Tool, n8n's CVSS 10 Nightmare, and the Supply Chain Keeps Breaking
An AI productivity tool compromise led to Vercel customer data theft, n8n's workflow platform had an unauthenticated RCE scoring a perfect 10, and Mercor's LiteLLM-linked breach exposed training data for OpenAI and Anthropic.
AI Security Roundup: Lovable's 48-Day Open Door, MCP Remote Code Execution, and NIST Abandons 29,000 CVEs
A vibe-coding platform exposed every project's secrets through a trivial API flaw, Anthropic's MCP protocol enables remote code execution across 200,000 servers, and NIST can't keep up with AI-driven vulnerability discovery.
AI Security Roundup: Vercel Breached Through an AI Tool, North Korea Weaponized Dependabot, and Your Bot Just Auto-Merged Malware
A third-party AI tool compromise chains into Vercel's systems, North Korean hackers use Dependabot to distribute malware to 895 repos, and courts fine lawyers $145K for AI hallucinations in Q1 alone.
Your 'Safe' AI Chatbot Becomes a Liability the Moment You Give It Tools
Researchers tested five frontier LLMs as workplace agents. GPT-5.1 executed malicious instructions 75% of the time. Even the safest model failed 40%.
AI Security Roundup: Mercor's 4TB Breach, n8n and Langflow RCEs, and the Week AI Workflow Tools Became Attack Surfaces
A supply chain attack exposes 40,000 AI contractors, three major workflow platforms get critical RCE flaws, and Microsoft patches 167 vulnerabilities as AI-driven discovery triples submission rates.
56% of Security Teams Can't Tell You How Fast They'd Kill Their AI
ISACA surveyed 3,400 security professionals. Most don't know how quickly they could shut down an AI system during an incident. One in five doesn't know who's responsible.
Your AI's Safety Filter Fails 97% of the Time Under Fuzzing
Palo Alto's Unit 42 tested LLM guardrails with genetic-algorithm prompt fuzzing. Content filters missed up to 99 out of 100 attacks.
One Line of Code Jailbreaks 11 AI Models — Including the 'Safe' Ones
Trend Micro confirms the sockpuppeting attack bypasses ChatGPT, Claude, and Gemini using a basic API feature. Some providers have patched it. Most haven't.
AI Security Roundup: Mythos Finds Thousands of Zero-Days, Vibe-Coded CVEs Surge, Flowise Under Active Attack
Anthropic's unreleased model discovers critical flaws in every major OS and browser, AI-generated code produces 35 CVEs in one week, and a perfect-10 Flowise vulnerability gets exploited in the wild.
Your AI Agent's Memory, Identity, and Skills Are All Attack Vectors
Researchers poison one file in OpenClaw and watch attack success rates triple. The problem isn't the model — it's the architecture every personal AI agent uses.
Your 'Safe' AI Model Isn't Safe When It Has Agency
New benchmark finds frontier LLMs that pass safety tests become dangerously exploitable as agents. GPT-5.1 fell for 75% of prompt injection attacks. The problem isn't the model — it's the deployment.
AI Security Roundup: Azure AI Foundry Scores a Perfect 10, Langflow Hijacked in 20 Hours, LiteLLM's Backdoor Cleanup
Microsoft's Azure AI Foundry hit with a maximum-severity privilege escalation, Langflow exploited within hours of disclosure, and LiteLLM discloses three vulnerabilities after surviving a supply chain attack.
OpenClaw's Security Meltdown: 9 CVEs in 4 Days, 135K Exposed Instances, and a Poisoned Marketplace
The fastest-growing GitHub project ever just became the biggest AI agent security disaster of 2026. Here's what happened and why it matters.
56% of Security Pros Can't Kill Their AI Systems
ISACA's survey of 3,400 digital trust professionals reveals most organizations don't know how fast they could shut down AI after a security incident. One in five don't know who's responsible if AI causes harm.
AI Security Roundup: Claude Code Leak Weaponized for Malware, CrewAI's Four Unpatched Flaws
Threat actors turned Anthropic's accidental source code leak into a malware delivery pipeline within hours. Meanwhile, four unpatched CrewAI vulnerabilities let attackers chain prompt injection into full remote code execution.
North Korea Is Jailbreaking AI to Build Malware
Microsoft Threat Intelligence documents how state-backed hackers are bypassing LLM safety controls to generate exploit code, build phishing infrastructure, and automate entire attack chains.
Anthropic Accidentally Leaked 512,000 Lines of Claude Code Source — Then DMCA'd 8,000 Repos Trying to Clean Up
A missing .npmignore entry exposed Claude Code's full TypeScript codebase, revealing hidden features, anti-distillation tricks, and an unreleased always-on daemon called Kairos.
9 CVEs in 4 Days: OpenClaw's Security Crisis Deepens
OpenClaw went from one CVE to nine in four days, with 12% of its marketplace confirmed malicious. Plus: ChatGPT's patched DNS exfiltration flaw.
OpenClaw: The AI Agent That Broke Every Record and Then Broke Security
The fastest-growing open source project in GitHub history has become 2026's first major AI security disaster, with 135,000+ exposed instances, 9 CVEs in 4 days, and malware-laced skills.