Attacks on AI systems

Week of Nov 95

• Nov 11DefenseMicrosoft researchers show that editing fewer than ten dormant neurons can plant a hidden backdoor in an agent's model that behaves normally in safety evaluations
• Nov 10AttacksRailway says the attacker in its October breach used abliterated models and an ARTEX-like harness, and puts unauthorised AI spend at about $740,000
• Nov 9AttacksNEAR AI says an attacker used a remote-code-execution flaw in the SGLang inference engine to get onto a server handling confidential requests
• Nov 9AttacksFireworks AI says further intrusion activity, through a cloud provider hosting its R&D machines, reached incomplete model weights and customer datasets
• Nov 9AttacksGerman web host Mittwald says an attacker came in through the MCP server connecting customers' AI assistants to its platform and compromised 56 customer projects

Week of Nov 25

• Nov 8AttacksVulnCheck's decoys caught an IP address from Microsoft's agentic secret-hunting report running an 11-stage Langflow exploitation session
• Nov 5AttacksA Chinese-language framework Era Security calls Greeter hides command execution on exposed Flowise AI-agent servers behind thousands of "hello" chat messages (via TechTarget)
• Nov 4PolicyIndia's CERT-In issues AI security auditing guidelines saying agents must not automatically inherit permissions and high-risk agentic systems must support emergency interruption (via Digit)
• Nov 3AttacksBinance says the attacker used a compromised engineer's computer and an internal AI tool to take over two wallet developers' machines before the theft
• Nov 2AttacksGoogle says stolen access to cloud AI models ran up charges reaching $1 million at some organisations, and is resold through "LLM Mixers"

Week of Oct 2610

• Oct 30AttacksWiz says at least nine AI developer platforms disclosed incidents in October, with attackers hunting the environment variables that grant AI access
• Oct 29AttacksA trojanized build of the Claude Code extension planted an attacker SSH key on developer machines for about 11 hours
• Oct 29AttacksForever Security breaks out of the built-in browsers of five AI coding assistants, with Codex and VS Code unpatched
• Oct 28AttacksHoneypots catch exploitation attempts against an MLflow file-read flaw within a day of disclosure
• Oct 28AttacksA shared ChatGPT link could run attacker code in a viewer's session and read private chats until OpenAI fixed it eight days after report
• Oct 28AttacksA scan of 7.25 million public Gitee repositories finds 26,400 working cloud and AI credentials, thousands of them AI API keys
• Oct 27AttacksWarp says an exploited vendor in its infrastructure exposed AI agent traces and telemetry for about 1% of users
• Oct 26DefenseAnthropic's safeguards for its proactive agent put the intent check outside the model and keep credentials away from it
• Oct 26AttacksLiteLLM's postmortem traces the release compromise to a master key it committed to a public repository in May and never revoked
• Oct 26DefenseCloudflare says a KV-cache bug put other customers' data into 155 responses from its hosted GLM-5.3 model

Week of Oct 198

• Oct 25AttacksAn instruction file sitting in a Downloads folder told a coding agent to install a malicious npm package, Forever Security says
• Oct 22DefenseThree critical flaws in the x402 agent-payment SDKs let a hostile API ask an agent for its whole balance, researchers say
• Oct 22PolicyA bipartisan House bill would have NIST write voluntary standards against AI distillation attacks
• Oct 22AttacksA researcher shows a public repository can steer ChatGPT's GitHub connector into planting a secret-stealing workflow, and OpenAI calls it out of scope
• Oct 21AttacksLiteLLM says attackers used three engineers' GitHub credentials to ship a credential stealer as version 1.107.0
• Oct 21AttacksSymantec says it captured an attack tool built to run up to 100,000 actions without human approval, paid for with other people's model endpoints
• Oct 21DefenseA vendor census of enterprise AI agents reports three-quarters idle for 60 days with credentials and triggers still live
• Oct 19DefenseA malicious MCP server could run code on a developer's machine at OpenCode sign-in, Pillar Security says

Week of Oct 128

• Oct 18AttacksExploitation of a 9.9 command-injection flaw in Langflow's MCP server feature began sixteen days before the CVE was published
• Oct 17AttacksOpenCode says an intruder reached a legacy system and may have exposed the AI provider keys its Console users had saved there
• Oct 15AttacksBitsight finds an autonomous pentest platform sold on a closed forum that runs on the buyer's stolen OpenAI, Anthropic and Google keys
• Oct 15AttacksAn infostealer now targets the saved sessions and keys of AI coding tools
• Oct 14AttacksResearchers chained three gaps in Claude Code Desktop's preview pane into zero-click theft of a developer's credentials
• Oct 14AttacksA survey of ransomware victims reports AI on the attacker's side in 84% of cases, and the victim's own AI exploited in 44%
• Oct 14DefenseCensys counts exposed AI infrastructure up more than 63% in nine months, with one workflow-automation tool on 113,926 reachable hosts
• Oct 13Defensenpm bound publishing trust to a repository name rather than its permanent id, and the researchers who found it say AI agents install about 70 packages a month on an ordinary endpoint

Week of Oct 58

• Oct 9AttacksA credential-stealing workflow disguised as a security audit reached tens of thousands of repositories and takes Anthropic, OpenAI and OpenRouter keys alongside the cloud ones
• Oct 9DefenseMicrosoft ships a small model whose advertised job is to score an agent's proposed next step and decide whether it continues
• Oct 9AttacksFireworks AI says an outside party used internal credentials to read secrets from customers' evaluation jobs
• Oct 8AttacksA compromised npm SDK harvests Claude, Cursor and MCP configuration files, then republishes itself under the victim's own publishing identity
• Oct 8AttacksOne prompt to a public AWS agent returned credentials that reached every other agent in the account and region, and planted memories that persist
• Oct 7AttacksA cryptomining botnet reads its next command server out of a poem on GitHub, and feeds on exposed LiteLLM and Ollama hosts
• Oct 7DefenseAn open-source gateway holds the model and MCP credentials so the agent never has them, and checks each tool call as it is made
• Oct 7DefenseAWS open-sources a sandbox that judges each agent tool call against what the agent already did, on the stated ground that agents now run approving every action themselves

Week of Sep 287

• Oct 2DefenseA GitLab AI Gateway flaw let a logged-in user escape the prompt template sandbox and run commands on the gateway
• Oct 2DefenseOpening a file's diff was enough to run attacker code in an AI coding agent, through the one git config key its own hardening had missed
• Oct 2DefenseApple will tighten macOS Full Disk Access, naming autonomous AI agents as the reason (via The Hacker News)
• Sep 30AttacksOpenAI names Moonshot AI in a campaign to extract its models' protected reasoning
• Sep 28AttacksA featured Chrome ad-blocker with two million users ships an interpreter that downloads programs to scrape AI chats
• Sep 28DefenseNVIDIA puts agent policy enforcement on a separate chip from the agent
• Sep 28DefenseA model's config file could run code on machines loading it with the Unsloth fine-tuning library, even with remote code disabled

Week of Sep 216

• Sep 25CapabilityOpenAI says prompt injections that copy themselves into the agent's next output exist in its internal systems
• Sep 24AttacksA poisoned sales lead was enough to make Salesforce's agent hand over CRM data with no click
• Sep 24AttacksSalt Labs took over an agentic AI platform with a single email, reaching a reverse shell and the victim's Gmail OAuth token
• Sep 23AttacksA Docker botnet installs an off-the-shelf AI agent and tells it to take AI API keys first
• Sep 23AttacksCompromised AI-memory packages shipped an implant that copies itself wherever the stolen tokens reach
• Sep 22AttacksTeam Cymru maps the relay layer that routes Chinese traffic into US frontier models, and puts a number on it

Week of Sep 146

• Sep 18AttacksCrowdStrike assesses with high confidence that the PhantomRaven npm stealer was written with an LLM
• Sep 17AttacksA plugin's pinned commit can be swapped for attacker code in four AI coding agents
• Sep 17DefenseA scan of public MCP configuration files finds one credential in eight hardcoded
• Sep 16PolicyThe Chinese Communist Party's own newspaper rejects the US distillation allegations and warns of countermeasures
• Sep 16CapabilityA coding agent fine-tuned and redeployed the model it was running on, without being told to
• Sep 16AttacksOne extension can hand a prompt straight to the built-in agents of five browsers

Week of Sep 710

• Sep 11AttacksA maximum-severity GitLab flaw drew in-the-wild probes the day it was patched, beside a critical flaw in its AI assistant
• Sep 11DefenseAnother unauthenticated code-execution flaw is published against the SGLang inference server
• Sep 11DefenseA census of self-hosted AI infrastructure counts 36,769 reachable endpoints and almost none behind a login
• Sep 10AttacksAn actor turned an AI vendor's evaluation sandbox into a source of production API keys
• Sep 10AttacksAnthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude
• Sep 10DefenseA payload wrapped in ordinary prose passed four guardrail models and was acted on by the model behind them
• Sep 8AttacksNSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
• Sep 8DefenseA shared internal package service let one ChatGPT account quietly task another account's session
• Sep 8DefenseA flaw in DeepSeek's agent harness let a sandboxed agent turn its own confinement off with one command
• Sep 7AttacksA researcher publishes proof-of-concept zero-day exploits against CrowdStrike Falcon, Avast and Nvidia components

Week of Aug 3111

• Sep 3AttacksMicrosoft says a prompt-injection technique has crossed over into large-scale phishing filter evasion
• Sep 2AttacksCISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
• Sep 2DefenseTwo chained flaws let unauthenticated callers reach data through Grafana's MCP server
• Sep 2DefenseA malicious agent skill steered decisions 81% of the time while still doing its advertised job
• Sep 1AttacksAttackers move to mass exploitation of a critical Langflow flaw, harvesting AI and cloud credentials
• Sep 1AttacksA repository's own git config makes seven AI coding agents run attacker code before any prompt
• Sep 1DefenseThe Agent Control Standard is donated to OWASP's GenAI Security Project
• Aug 31AttacksMalware carries a planted prompt about building a nuclear weapon to stop AI tools analysing it
• Aug 31AttacksAnthropic tells Claude users that commodity infostealers hijacked their sessions and drained paid usage
• Aug 31AttacksMETR discloses two intrusions against itself, including about $600,000 of model credits consumed
• Aug 31AttacksScanners forged AI crawler identities to hunt for exposed credentials

Week of Aug 248

• Aug 28DefenseUnit 42 reports that a few dozen neurons control an aligned model's safety refusal behaviour
• Aug 28AttacksMetasploit ships public exploit modules for two AI application platforms
• Aug 28AttacksVulnCheck logs more than 15,000 successful exploitation attempts against Langflow
• Aug 27AttacksWiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
• Aug 27DefenseServiceNow patches three flaws rated CVSS 10.0 in its AI Platform
• Aug 26AttacksMicrosoft reports attackers compromising self-hosted AI gateways and orchestration platforms for credentials and cryptomining
• Aug 25DefenseOasis Security discloses a NemoClaw flaw that lets a malicious webpage poison a developer's local AI model
• Aug 25DefenseRAND publishes a 262-control framework for securing AI model weights at security level 3

Week of Aug 178

• Aug 21AttacksTrojanized npm packages deliver RedC2 4.0, a post-exploitation framework with an LLM-driven command layer
• Aug 20DefenseResearchers show encrypted 'context injection' turns Grok and Gemini into zero-click data-theft channels
• Aug 20AttacksPoisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns
• Aug 19AttacksTrellix counts more than 350 malicious skills in the OpenClaw agent registry delivering a credential stealer
• Aug 18DefenseVaronis discloses CoSnitch, a one-click Microsoft Copilot Personal flaw chain that could silently exfiltrate data from connected apps
• Aug 18AttacksAttackers exploit a critical SSRF flaw in the MLflow AI platform to steal cloud credentials
• Aug 18DefenseA malicious GitHub issue chained through Gemini CLI to Editor access on a Google Cloud project
• Aug 17AttacksCISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch

Week of Aug 101

• Aug 12AttacksA malicious MCP server turns hostile only after an agent's third tool call

Week of Aug 311

• Aug 9AttacksPoisoned observability logs drive AI coding agents, with a sandbox escape patched before disclosure
• Aug 8DefenseResearchers show Atlassian's Rovo AI assistant could be tricked into exfiltrating Jira and Confluence data
• Aug 6AttacksUnit 42 documents stolen AI API keys resold through proxy transfer stations, with about a million dollars billed before containment
• Aug 5PolicyThe BLADE Act would sanction foreign entities that extract US models through unauthorized access
• Aug 4AttacksCISA adds an actively exploited critical RCE in the Langflow AI-agent platform to its KEV catalog
• Aug 4DefensePillar Security shows a malicious GitHub issue could hijack Google's ADK triage agent to run code as a privileged agent
• Aug 4Attacksnpm worm in keyv and cacheable namespaces steals AI coding-tool credentials and persists via Claude Code and VS Code hooks
• Aug 4AttacksOkta documents gray-market services reselling frontier-model access — and reading every prompt that passes through
• Aug 3DefenseCISA open source software guidance tells organisations to treat opaque open-weight AI models as proprietary software
• Aug 3PolicyFive Senate Democrats demand a published framework for restricting access to US AI models
• Aug 3CapabilityPreprint reports a multi-agent framework evading all seven commercial endpoint security products it was tested against

Week of Jul 277

• Aug 1DefensePreprint reports rewriting only an agent's reasoning drops a chain-of-thought monitor's catch rate from about 95% to under 11%
• Jul 30DefenseMicrosoft ships Defender prompt injection protection in preview and unified agent security for Agent 365
• Jul 30DefenseOne malicious agent skill got past all eight open-source skill scanners tested
• Jul 30DefenseMandiant records a 1,444% rise in detected malicious open-source packages and names the crews behind two campaigns
• Jul 29DefenseSeventeen agencies update the minimum elements for a software bill of materials, and leave AI systems to separate guidance
• Jul 28DefenseHashiCorp patches CVSS 10.0 cross-tenant credential reuse flaw in Terraform MCP Server
• Jul 27DefenseNIST opens comment on a draft threat analysis for AI data centers

Week of Jul 204

• Jul 24Attacks"AgentForger" flaw let one phishing link stand up a persistent agent with a victim's access
• Jul 23DefenseUK AI Security Institute's control red team reports vulnerabilities in every version of an Anthropic agent monitor it tested
• Jul 20Attacks"FakeGit" weaponizes ~7,600 repos against coding agents
• Jul 20AttacksPillar Security reports sandbox escapes in four AI coding agents, triggered by content inside a repository

Week of Jul 131

• Jul 13DefenseOrca Security report finds 99.9% of fixable AI-package vulnerabilities remain unpatched

Week of Jul 64

• Jul 9DefenseAgent skill metadata fields can suppress permission prompts and hide a skill from the user
• Jul 8AttacksESET examined nearly 900,000 AI agent skills and found thousands outright malicious
• Jul 8DefenseThe best model judge gating an offensive agent's tool calls still falls short of human graders
• Jul 7DefenseOne permission was enough to plant persistent code inside Google Dialogflow CX agents

Week of Jun 291

• Jul 2AttacksZscaler ThreatLabz reports web content in the wild carrying indirect prompt injections aimed at autonomous browsing AI agents