Latest

Attackers target critical Langflow flaw in 1,423 exploit attempts

Security firm Previdian says honeypots recorded more than a thousand attempts to exploit a maximum-severity bug in the open-source AI workflow platform.

15 Oct 2026

Vulnerabilities

Decision models fall to prompt injection, HiddenLayer finds

Security firm HiddenLayer says TypeSafe AI's Jev model hijacked a simulated store checkout after a fake ad told a browser agent to confirm its price.

15 Oct 2026

Vendors

Snyk pitches security agents to keep up with AI-written code

The vendor says its new Agentic AppSec approach puts autonomous agents on finding, fixing and verifying vulnerabilities, with humans setting the standard.

15 Oct 2026

A thief slips past a guard booth by accessing the master keyring instead of the single key intended for today's delivery, opening every door in the building.

Vulnerabilities

IntentKit flaw lets outsiders trigger wallet transfers

CVE-2026-76066 covers IntentKit through version 2.6.3, where the executor checks tool calls against the full registry rather than the narrowed per-request list.

15 Oct 2026

Explainers

Picus warns agentic pentesting leaves assets untested

A vendor-authored article published on 14 October 2026 argues AI-driven penetration testing misses parts of the network because of safety limits.

14 Oct 2026

Vulnerabilities

AI agents built a full Chrome exploit chain in six days

Security firm XBOW says it used OpenAI's publicly available GPT-5.6 Sol model to chain three unknown Chrome bugs, earning Google's top $250,000 bounty.

14 Oct 2026

Vendors

Wiz brings AI agents to its US government cloud security product

The cloud security firm said on 14 October 2026 that Wiz AI Agents are now part of Wiz for Gov, its offering for public sector customers.

14 Oct 2026

Vulnerabilities

AI pentesting agent finds OTP bypass on insurer's live site

A report published on 14 October 2026 says the agent worked unaided during an authorised assessment, and that proving the flaw was harder than exploiting it.

14 Oct 2026

Vulnerabilities

Microsoft patches code execution flaw in Visual Studio Copilot

A path validation bypass let the Copilot coding agent write to its own settings files and run arbitrary commands, according to the researcher who reported it.

14 Oct 2026

A guard robot's checklist flutters away in wind as shadowy hands slip forbidden tools past its outstretched arms into an open workshop door.

Vulnerabilities

Five flaws let Roo Code auto-approve banned shell commands

Researchers say prompt injection can trick the coding agent's allowlist into running denied commands on a developer's machine without any prompt.

13 Oct 2026

A swarm of small mechanical spiders crawls across interconnected smart devices, each one duplicating itself and leaping to the next box in an unstoppable chain reaction across a dark network.

Vulnerabilities

Anthropic warns small AI models may self-replicate on IoT devices

Experiments described by the company found that cheap television boxes can run capable models, raising the prospect of AI spreading between devices without human help.

13 Oct 2026

Explainers

Webinar pitches runtime identity controls against AI-driven escalation

A Hacker News webinar notice published on 13 October 2026 argues attackers using AI now escalate privileges faster than defenders can investigate.

13 Oct 2026

Vendors

VMware sells HyperArmor to slow its own AI-found patch flood

Broadcom's VMware division says AI bug hunting has driven monthly updates, and is now charging extra for a tool that blocks exploits without patching.

13 Oct 2026

A robot's hand bypasses the security checkpoint, writing directly into a locked filing cabinet while guards watch the front door, oblivious.

Vulnerabilities

Nginx UI patches MCP tool that skipped config safety checks

A tool exposed to AI agents wrote nginx configuration straight to disk without the validation applied to every other write path, according to an advisory published on 12 October 2026.

12 Oct 2026

A guard stands before a locked gate holding a list of approved visitors, but a cloaked figure slips through by hiding behind a punctuation mark the guard failed to notice.

Vulnerabilities

Command whitelist in mac-shell-mcp bypassed with a semicolon

CVE-2026-108953 lets MCP clients slip shell metacharacters into arguments and run commands the server was meant to block.

12 Oct 2026

Explainers

Employees' personal AI agents are already logged in at work

A 12 October 2026 analysis says staff-owned assistants are reaching company systems with the same access as the people who run them.

12 Oct 2026

Incidents

Researchers say CyberXero used Claude Code in Ukraine data theft

A campaign disclosed on 12 October 2026 paired Cobalt Strike with Anthropic's coding agent and stole more than 628,000 records, researchers said.

12 Oct 2026

A puppet master's hand yanks invisible strings attached to a messenger bird, forcing it to carry forged letters while its true owner watches helplessly from behind glass.

Vulnerabilities

Agent API keys can hijack Telegram bindings in Abilityai Trinity

A missing authorisation flaw lets a prompt-injected agent send messages as its owner's bot, swap the bot token or delete the link entirely.

11 Oct 2026

Vulnerabilities

AI agents breached simulated factory in 16 minutes, lab finds

Booz Allen Hamilton says frontier models completed all eight of its industrial attack tests, moving from perimeter to control network in little over a quarter of an hour.

11 Oct 2026

A digital lockbox with a single door suddenly reveals a hidden tunnel carved by intertwining threads, allowing a shadowy hand to reach files in the outer vault.

Vulnerabilities

Symlinks let coding agents write files outside their sandbox

Two CVEs published on 10 October 2026 describe how malicious repositories can combine symlinks with prompt injection to escape workspace write limits in phi and open-multi-agent.

10 Oct 2026