AI Security Research and Incident Coverage
Tracking AI supply-chain attacks, agent exploits, prompt injection, model leaks, and the real-world incidents shaping AI security today.
Articles Tagged "Vulnerabilities"
Google Catches First AI-Built Zero-Day in Wild
Google's Threat Intelligence Group confirmed criminals used an AI model to discover and weaponize a zero-day 2FA bypass - the first documented case of AI-generated exploitation in a real attack campaign.
Pwn2Own 2026 Capacity Overflow, Hackers Drop 0-Days Solo
Pwn2Own Berlin 2026 hit a hard submission cap for the first time in 19 years. Rejected researchers are now publishing working zero-days directly, breaking the contest's secrecy norms.
LiteLLM Exploited 36 Hours After Vulnerability Disclosure
Attackers hit CVE-2026-42208, a critical pre-auth SQL injection in LiteLLM proxy, within 36 hours of the public advisory - targeting database tables holding API keys for every upstream AI provider.
Critical RCE in LeRobot Lets Attackers Hijack Robots
CVE-2026-25874 (CVSS 9.3) exposes LeRobot's gRPC server to unauthenticated remote code execution via pickle deserialization, threatening robot control systems and GPU infrastructure.
Firefox 150: Claude Found 271 Bugs, 3 Got Credits
Mozilla's blog says Claude Mythos Preview uncovered 271 vulnerabilities patched in Firefox 150. The security advisory lists 36 CVEs, and only three of them credit Anthropic. The gap is the whole story.
The Claw Security Ledger - 10 Products in the Dock
We audited ten AI agent products sold under the Claw name. The ledger shows 11 live CVEs, 130 published advisories, 1,184 malicious marketplace skills, and one leaked SSL private key - concentrated almost entirely in a single vendor.
Lovable Users Report Leak of Chats, Code, Credentials
A fresh warning from developer Morgan Linton says free Lovable accounts can still read other users' AI chat histories, source code, and database credentials on projects created before November 2025. The pattern is the same one that earned the platform CVE-2025-48757 last year.
MCP Marketplace Audit - 32% of Servers Are Stale
We pulled 11,447 MCP servers from four registries, ran the GitHub and OSV APIs against them, and tried to install the top 100. Nearly a third haven't been touched in six months.
MCP's STDIO Flaw Puts 200K AI Servers at Risk
Ox Security found that MCP's STDIO transport executes arbitrary OS commands before validating the server, exposing 200K+ instances across every major AI coding tool.
Claude Mythos Preview Finds Thousands of Zero-Days
Anthropic's restricted Claude Mythos Preview model autonomously discovered thousands of high-severity vulnerabilities across every major OS and browser, including bugs hiding in plain sight for 27 years.
Microsoft Patches 84 Flaws - AI Found the Worst One
Microsoft's March 2026 Patch Tuesday fixes 84 vulnerabilities including a CVSS 9.8 RCE discovered by XBOW's autonomous AI agent, an Azure MCP Server SSRF, and an Excel XSS that hijacks Copilot to exfiltrate data.
