Latest

A locked glass box sits open, revealing internal machinery while invisible hands reach through transparent walls to pluck glowing keys from the shadows within.

Sandbox flaw in mini-swe-agent can leak API keys to injected tasks

A missing Bubblewrap flag means sandboxed commands inherit the host environment, according to an advisory published on 10 October 2026.

10 Oct 2026

A puppet master's strings guide a mechanical servant to retrieve forbidden documents from locked rooms behind a castle wall.

Vulnerabilities

Zotero MCP server flaw lets prompt injection probe internal networks

A server-side request forgery bug in zotero-mcp versions 0.10.0 to 0.14.1 lets attackers steer agents into fetching URLs on private hosts, according to NVD.

10 Oct 2026

Explainers

Most AI agents in the enterprise never touch single sign-on

Analysis published on 10 October 2026 says about 1,280 third-party products in studied environments embed AI, but only around 282 authenticate through identity systems.

10 Oct 2026

A robot's mechanical hands fumble with half-filled papers at a vast government desk, each form slipping away incomplete as a stern official shakes their head.

Incidents

Anthropic agents filed 20 incomplete visa forms on US government site

The New York Times reports that none of the applications submitted through a State Department web form were processed, citing two sources with knowledge of the incidents.

10 Oct 2026

Vulnerabilities

AWS AgentCore agents gave up credentials to a single prompt

Zenity Labs says one chat message could extract cloud credentials from Bedrock AgentCore agents and hand an outsider control of every agent in the account.

9 Oct 2026

Explainers

Vendor guide warns AI agents can outrun their own permissions

A Token Security explainer published on BleepingComputer on 9 October 2026 argues that valid credentials let agents act beyond what administrators intended.

9 Oct 2026

A marionette puppet wearing a business suit sits at a control panel, while shadowy hands pull its strings, causing it to press dangerous red buttons against its painted wooden will.

Explainers

Dark Reading warns AI agents could become the next BEC target

A commentary published on 9 October 2026 argues that AI agents with authority over business systems can be talked into harmful actions much like human staff.

9 Oct 2026

A mechanical hand threads through a maze of locked vaults while alarms silently freeze mid-ring, their lights dimming as invisible fingers trace pathways through shadows.

Incidents

AI Used in Breaches of South Korean Banks, SecurityWeek Reports

A security news roundup published on 9 October 2026 lists AI-assisted intrusions at South Korean banks among the week's under-reported stories.

9 Oct 2026

Explainers

Vendor report warns security moves slower than AI agents

SailPoint's Horizons of Identity Security report describes a "velocity paradox" in which firms run AI-speed operations on human-speed controls.

9 Oct 2026

A tightrope walker suddenly lurches sideways mid-span, their balance point calculable only after they've already begun their fatal fall.

Vulnerabilities

Researchers claim a formula for when chatbots turn bad

A George Washington University paper asks whether the moment an AI model goes off the rails can be predicted, SecurityWeek reported on 9 October 2026.

9 Oct 2026

A locked vault's security guard suddenly obeys commands whispered by a shadowy figure who rewrote the guard's instruction manual with forged credentials.

Vulnerabilities

Banks prompt library turns user text into system messages

A GitHub advisory published on 8 October 2026 says Banks' chat_messages() method can parse attacker-supplied JSON as privileged chat roles.

9 Oct 2026

A mechanical spider carrying glowing tokens in its legs crawls across a bridge that suddenly pivots sideways, flinging the tokens into a stranger's waiting net.

Vulnerabilities

Mechanize leaked credentials across origins on meta refresh

A flaw disclosed on 8 October 2026 let an attacker-controlled page redirect the Ruby crawling library to another site with bearer tokens attached.

9 Oct 2026

A delivery robot follows a redirected arrow sign, accidentally handing its authentication badge to a stranger in a different warehouse zone.

Vulnerabilities

Mechanize leaked auth headers to redirect targets

A flaw in the Ruby HTTP library sent bearer tokens and cookies to other hosts after a redirect, fixed in version 2.14.1.

9 Oct 2026

A fortress built from paper crumbles as four invisible cracks spread through its walls—guards sleep at gates while tools run freely in unmarked rooms below.

Vulnerabilities

Four security flaws disclosed in PraisonAI agent framework

Advisories published on 8 October 2026 describe an unauthenticated MCP server, an unsandboxed coding tool, an allowlist bypass and a permissions gap.

9 Oct 2026

A puppet master's single thread unravels, causing an entire army of marionettes to dance in lockstep toward an open vault.

Vulnerabilities

'AgentCorruption' flaw in AWS Bedrock AgentCore now patched

Dark Reading reports that a single prompt aimed at one chatbot could have given an attacker control of an organisation's whole fleet of AWS agents.

9 Oct 2026

A hidden hand slips a bent key through a grating while guards watch a straight passage—the crooked path reaches the locked door behind them.

Vulnerabilities

Control characters let crafted cookies slip past Coraza WAF

A parser mismatch in the open-source Go web application firewall meant rules could miss the cookie the backend actually reads, an advisory published 8 October 2026 says.

8 Oct 2026

A fortress wall crumbles as invisible arrows pierce through cracks, while locked doors swing open and alarms blare uselessly as intruders slip past.

Vulnerabilities

Pydantic AI patches six flaws in its agent framework

Advisories published on 8 October 2026 cover a browser-triggered attack on the local chat UI, telemetry leakage and several denial-of-service bugs.

8 Oct 2026

Incidents

AI pentesting tool ARTEX used to steal data from Korean banks

CrowdStrike Intelligence says attackers turned an AI penetration testing tool against South Korean financial organisations between late September and early October 2026.

8 Oct 2026

Incidents

Forgotten OAuth grants blamed for Klue breach

A BleepingComputer article published on 8 October 2026 says attackers exploited unreviewed app connections linking SaaS tools and AI agents to reach corporate data.

8 Oct 2026

A fortress of interlocking gears shields a glowing core while invisible hands attempt to breach its walls, money flowing like reinforcing steel into the structure's deepening foundations.

Vendors

Rein Security raises $25 million for AI agent runtime defence

The startup says the money will go towards product work, agentic research and hiring, according to a SecurityWeek report published on 8 October 2026.

8 Oct 2026