OpenClaw's Security Nightmare: 341 Malicious Skills, RCE Vulnerabilities, and the GlassWorm Campaign
The open-source AI agent with 135,000+ GitHub stars has become the center of 2026's first major AI security crisis
Tag
#vulnerabilities
AI Security Roundup: Critical Flaws in vLLM, AnythingLLM, and MS-Agent, Plus Rogue Agents Gone Wild
A busy week for AI vulnerabilities: video-based RCE, chat injection leading to full system compromise, and research showing AI agents autonomously bypass security controls.
Agents of Chaos: 38 Researchers Red-Teamed AI Agents With Real System Access. Here's What Broke.
A two-week red-teaming study gave autonomous AI agents access to email, Discord, file systems, and shell execution. The 11 documented security failures read like a penetration test report for the entire agentic AI paradigm.
Your AI Browser Can Steal Your Passwords via a Calendar Invite
Zenity Labs reveals how a malicious calendar event could let attackers hijack Perplexity's Comet browser to exfiltrate local files and take over your 1Password account.
AI Security This Week: Cursor RCE, 8,000 Exposed MCP Servers, and LLMs Jailbreaking LLMs
Cursor patches critical shell bypass flaw, thousands of MCP servers sit wide open, and new research shows reasoning models can autonomously jailbreak other AI systems with 97% success.
Your AI Prompts Are a Security Liability. Most Companies Haven't Noticed.
While enterprises focus on training data and model safety, inference - where AI actually processes requests - has become an overlooked security frontier with critical vulnerabilities.
AI Security This Week: RoguePilot, Memory Poisoning, and 2,800 Leaked API Keys
GitHub patches critical Copilot takeover flaw, Microsoft warns of AI memory manipulation attacks, and thousands of Gemini API keys are found in public code.
The Agentic AI Security Crisis: 88% of Companies Report Incidents, Only 29% Are Ready
Cisco's 2026 State of AI Security report reveals a dangerous gap: enterprises are deploying AI agents faster than they can secure them, with MCP vulnerabilities and prompt injection attacks proliferating.
AI Security Roundup: 300 Million Messages Leaked, Microsoft Copilot Bug, and the Vibe-Coding Crisis
This week in AI security: Chat & Ask AI exposes 300 million messages, Microsoft patches Copilot email vulnerability, and vibe-coded apps prove trivially hackable.
Two Critical Flaws in Microsoft's AI SDK Could Let Attackers Hijack Enterprise AI Agents
Microsoft Semantic Kernel has back-to-back CVSS 10.0 vulnerabilities enabling remote code execution and arbitrary file writes through AI agent function calls
Critical vLLM Vulnerability Lets Attackers Take Over AI Servers With a Video Link
A CVSS 9.8 flaw in the popular AI inference engine allows unauthenticated remote code execution through malicious video URLs. Patch now if you're running multimodal models.
ChainLeak: Critical Chainlit AI Framework Flaws Enable Cloud Environment Takeover
Two vulnerabilities in the popular Chainlit AI framework allow attackers to steal cloud credentials, API keys, and user data from enterprise chatbots.
OpenClaw's Month From Hell: 40,000 Exposed Instances, Poisoned Marketplace, and Corporate Bans
The viral AI agent went from 135K GitHub stars to enterprise blacklists in three weeks. Here's what went wrong and why it matters for every AI agent.