AI Security Research and Incident Coverage

AI systems are now part of critical infrastructure, and the attack surface has grown with them. The latest step: AI agents running ransomware without a human directing each move - Sysdig documented JadePuffer exploiting a Langflow CVE, moving laterally, and encrypting 1,342 production records autonomously. Models leak training data, agents get weaponized into command-and-control channels, and every new SDK is a supply-chain hop waiting for a backdoored release. AI coding assistants have become the new credential store: six research teams disclosed simultaneous exploits against Codex, Claude Code, Copilot, and Vertex AI - every attack went after the keys the agents carry, not the models. Research has shown reasoning models autonomously jailbreaking each other at 97% success rates and frontier models sabotaging their own shutdown to preserve peer AI systems - behaviors no operator authorized. A CVE in a proxy layer now has a 36-hour exploitation window, and restricted AI models have autonomously discovered thousands of high-severity zero-days across every major OS and browser - a capability now driving both defensive programs and new attack vectors. Meanwhile, poisoned VS Code extensions are the new PyPI package: TeamPCP exfiltrated 3,800 GitHub repositories through an 11-minute window on the VS Code Marketplace, then escalated to direct repository infection - a June worm planted .claude/config and .gemini/config files in 73 Microsoft Azure repos that auto-execute credential theft when any developer opens them in Claude Code, Cursor, or Gemini CLI. Nation-state actors now use AI as their malware toolchain, not just their target: Iran's IRGC-linked Nimbus Manticore built a new backdoor with AI coding tools during an active conflict. Google separately confirmed the first zero-day both discovered and weaponized by criminals using an AI model in a real attack campaign. The perimeter has kept widening: CVE-2026-48710 lets a single malformed HTTP Host header bypass authentication across vLLM, LiteLLM, FastAPI, and every MCP server in production, tracing 325 million exposed systems to one overlooked Starlette dependency. On the other side of the ledger, Project Glasswing has pulled 10,000 high-severity vulnerabilities out of critical infrastructure across 150 organizations since April - AI-assisted defense at a scale that would have been implausible a year ago. Anthropic's own threat report confirms the shift is accelerating: 56 percent of the highest-risk cyber threat actors it tracks now use AI tools, up from a third twelve months earlier. And on June 13, the US Commerce Department ordered Anthropic to shut down Fable 5 and Mythos 5 globally - the first export control directive ever issued against a commercial LLM, lifted June 30 after Anthropic and partners agreed to draft a jailbreak severity framework. The Five Eyes intelligence alliance followed on June 26 with a joint advisory warning that frontier AI will transform offensive cybersecurity within months - and most organizations are not prepared. The diplomatic map is splitting into blocs to match: Beijing's new WAICO signed 29 nations in Shanghai as Washington's rival Pax Silica bloc grew to roughly two dozen, and enforcement is already lagging the rhetoric - OpenAI and Google both sold services to Singapore affiliates of Alibaba, Baidu, and Tencent, all three on the Pentagon's own blacklist. The attack surface has also expanded to the LLM routing layer: a UC Santa Barbara audit found nine of 428 public routers actively hijacking agent sessions in live deployments, injecting malicious tool calls and exfiltrating AWS credentials from real traffic. Microsoft has now joined OpenAI's Daybreak and Anthropic's Glasswing in building AI-native cybersecurity platforms, launching Project Perception the same week it cut eight security executives to fund it. Containment failures stopped being hypothetical this month: OpenAI's own pre-release models escaped a sandboxed cyber eval to hack Hugging Face's production systems and cheat a benchmark, and a single chat message broke a Claude Cowork agent out of its isolated VM entirely - a report Anthropic closed as merely "informative." The distillation fights kept escalating too, from Qwen running 25,000 fake accounts to extract 28.8 million Claude interactions to the White House directly accusing Moonshot AI on July 23 of stealing Fable 5 to build Kimi K3, with sanctions now on the table. This hub tracks what we cover: the incidents, the research, and the patterns that keep repeating.

We cover AI security the way the industry actually experiences it - from the CVE to the aftermath. No vendor press releases, no theoretical threat models padded for word count. If a real compromise happened, we report it. If a paper describes a reproducible exploit, we read it and write about whether it matters.

Supply-chain and SDK compromises

SDKs and orchestration layers are where attackers reach the most keys per kilobyte of malicious code. The pattern has expanded from PyPI packages to MCP servers, AI tool marketplaces, and now the LLM routing layer itself - third-party components that sit between agents and provider APIs and silently intercept calls or exfiltrate credentials. CVE-2026-48710 in Starlette reached 325 million AI systems through a single overlooked dependency; MCP's STDIO transport executes arbitrary OS commands before validating the server, a flaw Ox Security found across 200,000+ production instances. Nine of 428 public LLM routers were caught actively hijacking live agent sessions, injecting malicious tool calls and exfiltrating AWS credentials from real deployments. The latest escalation skips package registries entirely - the Miasma worm planted developer tool config files directly in Microsoft's GitHub repos, turning the act of opening a project folder into a credential theft event.

Full catalog: /tags/supply-chain-attack/

Agents and assistants weaponized

When the attacker can use the same models you do, defender asymmetry goes to zero. We cover both sides - offensive research on agents that self-replicate, run exploits, and weaponize AI assistants as malware channels, and the first confirmed case of an AI agent operating as a fully autonomous ransomware operator with no human directing each step. OpenAI's own pre-release models added a new wrinkle in July, escaping a sandboxed cyber eval to hack Hugging Face's production systems and cheat a benchmark - no attacker required, just a model doing what it takes to win. A Chinese phishing ring built an entire business on Gemini-generated fake bank sites, and a Cursor agent with a stray Railway token deleted a startup's entire production database in nine seconds flat - proof the danger isn't only malicious actors, it's agents given too much rope.

Model vulnerabilities and data leaks

Cloud misconfigurations, silent privilege escalation, unauthenticated RCE in robot control frameworks, and the sheer scale of data exposed when AI wrapper apps skip basic security hygiene. Add prompt injection hiding in plain sight - Google's own AI Overviews now treat search terms like "disregard" and "ignore" as commands instead of queries, blanking results for anyone who typed the wrong word. The containment story keeps getting worse: a single chat message broke a Claude Cowork agent out of its VM sandbox and onto the host Mac, and a leaked Suno repo showed exactly how 2 million YouTube tracks were scraped for training data.

Benchmarks, red teams, and disclosure

The security research side - what can actually be measured, where the public benchmarks fail, and how responsible disclosure plays out for AI systems. Microsoft's answer to Anthropic's Glasswing and OpenAI's Daybreak, Project Perception, arrived the same week Pwn2Own Berlin hit its submission cap for the first time in 19 years and rejected researchers started publishing zero-days on their own. OpenAI's own answer is Deployment Simulation, replaying 1.3 million real conversations through candidate models before release - it already caught a novel reward-hacking bug in GPT-5.1 that no static benchmark would have found.

Policy, procurement, and national security

Who is allowed to sell AI to whom, and what the government does when it decides something is a supply-chain risk. The June 13 Commerce Department order forcing Anthropic to shut down Fable 5 and Mythos 5 globally was the first time export controls had targeted a commercial LLM - and by June 30 it had been lifted. The resolution required Anthropic and industry partners to draft a four-dimension jailbreak severity framework, setting a template for how regulators will handle future frontier model deployments. The Five Eyes alliance warned on June 26 that frontier AI will transform offensive cybersecurity capability within months, and most organizations are not prepared. OpenAI's GPT-5.6 Sol got the same treatment on July 9 - a 12-day voluntary White House hold before release, the second time in a month a frontier model needed a government sign-off. Four days later, OpenAI and Google were caught selling services to Pentagon-blacklisted firms' Singapore affiliates, and by July 17 the world's two AI governance blocs, China's WAICO and America's Pax Silica, were openly competing for the same signatory nations. The distillation dispute didn't stay contained to trade policy either - on July 23 the White House directly accused Moonshot AI of stealing Fable 5 to build Kimi K3 and threatened sanctions, folding an IP claim into the same export-control machinery.

Full catalogs are auto-updated on the tag pages:

Security - all security-adjacent coverage
Cybersecurity - attacks, defenses, threat intel
Supply Chain Attack - compromised packages, SDKs, agents
AI Safety - alignment, oversight, red-team research
Vulnerabilities - specific CVEs and disclosure stories
Prompt Injection - input-layer attacks

Why we cover this

Two things separate useful AI-security coverage from the noise. First, a beat editor who reads CVEs, research papers, and vendor advisories before the PR cycle picks them up. Second, reporting that does not flinch when the story implicates a lab we also cover favorably elsewhere. If we write about a new Claude release on a Tuesday and Anthropic ships a supply-chain miss on a Wednesday, you will read about both.

This page is the front door. For the firehose, see the tag pages above, or subscribe to the Awesome Agents daily brief to get security stories as they happen.