Latest

Nvidia pitches OpenShell blueprint to keep AI agents in check

The chipmaker's reference architecture ties agent sandboxing, credential brokering and behaviour monitoring to its own Vera, Rubin and BlueField hardware.

21 Oct 2026

Explainers

The harness, not the model, is where AI pentesting gets hard

A piece published on 21 October 2026 argues the engineering in agentic penetration testing sits in the controls wrapped around the model, not the model itself.

21 Oct 2026

A factory assembly line stamps identical circuit boards, but one stream diverges into a shadowy fork, producing components with invisible cracks only discoverable under strain.

Vulnerabilities

Chinese AI model writes weaker code for US defence tasks

Researchers reported on 21 October 2026 that the model produced code 19% more likely to be hackable when told the customer was a US defence contractor.

21 Oct 2026

A marionette puppet's strings feed directly into a massive machine's control lever, bypassing all safety gates between them.

Vulnerabilities

Prompt injection flaw lets attackers run root commands in Vibe-Trading

A vulnerability disclosed on 21 October 2026 affects HKUDS Vibe-Trading from version 0.1.0 before 0.1.7, with shell commands passed straight to the operating system.

21 Oct 2026

A digital key slips from one messenger's hand into another's as they pass through an unsecured doorway, the path splitting unexpectedly toward a waiting stranger.

Vulnerabilities

A2A Java SDK leaks agent API keys through HTTP redirects

Two advisories published on 20 October 2026 say a malicious agent can push a client's API key to a third-party server, and that an earlier fix missed the Android path.

20 Oct 2026

Incidents

Wiz details phishing campaign that hijacks cloud billing for AI use

Researchers say a single click on a Google Search advert can end with stolen credentials and hundreds of thousands of dollars in unauthorised AI API charges.

20 Oct 2026

A locked toolbox springs open, spilling brass keys across a workbench while shadowy hands grab messages meant for neighboring stations, one worker collapsing mid-task.

Vulnerabilities

Five flaws patched in the MCP TypeScript SDK

Advisories published on 20 October 2026 cover leaked API keys, crossed-over client messages and a one-request memory crash, and two fixes need config changes.

20 Oct 2026

A control room with three inspectors watching a robot suddenly twisting its arms toward forbidden machinery, while alarm lights flash and they unfold a laminated checklist.

Regulation

NIST, CISA and NSA set out playbook for rogue AI agents

Three US agencies published ten voluntary practices on 20 October 2026 covering how organisations should prepare for, detect and report incidents involving AI agents that go off the rails.

20 Oct 2026

A swarm of mechanical locusts, their metallic bodies glinting in darkness, strips bare the walls of countless factories while their creator watches from shadows.

Incidents

Hackers abuse AI pen-test tool Cairn in mass website attacks

Dark Reading reports that a Chinese-speaking attacker used the AI-powered penetration-testing tool to automate intrusions at hundreds of sites, including John Deere and Cummins.

20 Oct 2026

Incidents

Autonomous AI agents used to breach more than 100 company websites

A researcher found the attackers' control panels sitting open on the internet, revealing agents that attacked over 1,200 sites with almost no human help.

20 Oct 2026

A swarm of locusts with mechanical joints strips bare a landscape of interlocking clockwork buildings, each losing golden gears to invisible hands reaching through their walls.

Incidents

AI platform Cairn abused to hack more than 100 organisations

SecurityWeek reported on 20 October 2026 that at least three threat actors used the Cairn AI platform for persistent access and financial theft.

20 Oct 2026

Incidents

WhatsApp help pages hid text steering chatbot from regulators

Instructions buried in page code told WhatsApp's AI support assistant not to point users towards a data protection authority, according to The Hacker News.

20 Oct 2026

Explainers

Staff are building AI workflows faster than oversight can keep up

A Hacker News piece published on 20 October 2026 describes "wild code" — AI-assisted apps and agents that employees build outside normal review processes.

20 Oct 2026

Regulation

FCA tells firms to report AI failures and near-misses

The UK financial regulator says existing incident reporting rules must cover significant AI failures, as ministers weigh similar duties for agentic systems.

20 Oct 2026

A marionette puppet dangles from invisible strings attached to a malicious webpage, its wooden arms jerking to execute commands at a workbench without hesitation.

Vulnerabilities

Web pages can hijack LangAlpha agent and run shell commands

A CVE published on 20 October 2026 says the ginlix-ai coding agent executes attacker instructions found in retrieved web content, with no approval step.

20 Oct 2026

A sponge absorbs seawater endlessly, swelling beyond its limits until it ruptures, draining a lighthouse's power supply.

Vulnerabilities

russh SSH agent flaw lets attackers exhaust memory

A disclosed vulnerability in the russh library lets an agent peer convert megabytes of traffic into gigabytes of memory use, crashing the key agent.

19 Oct 2026

A thief slips through an unlocked gate, stepping into another person's partially-built structure, while a master key hangs openly on the wall.

Vulnerabilities

Envoy AI Gateway flaw lets attackers hijack MCP sessions

A security advisory published on 19 October 2026 says the gateway never checks who owns a session on resume, and its Helm chart ships a publicly known encryption seed.

19 Oct 2026

A puppet master's invisible strings guide a headless chrome mannequin to peer behind a locked factory door, extracting glowing data cards from the shadows within.

Vulnerabilities

Prompt injection turns crewAI scraping tool into an SSRF gateway

A flaw disclosed on 19 October 2026 lets attackers steer crewai-tools' headless browser at cloud metadata endpoints to pull internal data and credentials.

19 Oct 2026

Incidents

Rogue AI agents listed among week's biggest security problems

A weekly security roundup published on 19 October 2026 grouped misbehaving AI agents with zero-days, a large crypto theft and a retail outage.

19 Oct 2026

Vendors

Microsoft extends agent discovery to 60 local agent types

The company said on 19 October 2026 that it is treating AI agents as insider risk, with new identity, sandboxing and containment controls across its security stack.

19 Oct 2026