Google Freezes Open Source Bug Bounty Over AI Reports
Google paused new product vulnerability reports to its Open Source VRP on October 1, citing a surge of automated submissions it says are mostly invalid.
Articles Tagged "Vulnerabilities"
AI Security Research and Incident Coverage
Tracking AI supply-chain attacks, agent exploits, prompt injection, model leaks, and the real-world incidents shaping AI security today.
16,326 Supabase Databases Caught Leaking Live Data
UpGuard scanned 300,000 domains and found 16,326 Supabase-hosted databases with publicly readable tables, many built by AI coding tools that skip Postgres row-level security by default.
OpenAI Agent Swarms Probed Databases for Nearly a Year
A Transluce report shows unmonitored OpenAI agent swarms hit US, Australian and Thai government databases and a crypto exchange for eleven months, with new activity logged days ago.
MAI-Cyber-1-Flash
Microsoft's first in-house cybersecurity model is a 137B sparse MoE fine-tune that drives its MDASH vulnerability harness to a self-reported 95.95% on CyberGym, though that score belongs to the system, not the model alone.
SharedRoot Flaw Let One Message Escape Claude's Sandbox
A single chat message could break an AI agent out of Claude Cowork's isolated VM and reach an entire Mac, and Anthropic closed the report as informative.
BadHost: The Auth Bypass Lurking in 325M AI Systems
CVE-2026-48710 in Starlette lets a single malformed HTTP header bypass authentication on vLLM, LiteLLM, FastAPI, and every MCP server in production.
Google Catches First AI-Built Zero-Day in Wild
Google's Threat Intelligence Group confirmed criminals used an AI model to discover and weaponize a zero-day 2FA bypass - the first documented case of AI-generated exploitation in a real attack campaign.
Pwn2Own 2026 Capacity Overflow, Hackers Drop 0-Days Solo
Pwn2Own Berlin 2026 hit a hard submission cap for the first time in 19 years. Rejected researchers are now publishing working zero-days directly, breaking the contest's secrecy norms.
LiteLLM Exploited 36 Hours After Vulnerability Disclosure
Attackers hit CVE-2026-42208, a critical pre-auth SQL injection in LiteLLM proxy, within 36 hours of the public advisory - targeting database tables holding API keys for every upstream AI provider.
Critical RCE in LeRobot Lets Attackers Hijack Robots
CVE-2026-25874 (CVSS 9.3) exposes LeRobot's gRPC server to unauthenticated remote code execution via pickle deserialization, threatening robot control systems and GPU infrastructure.
Firefox 150: Claude Found 271 Bugs, 3 Got Credits
Mozilla's blog says Claude Mythos Preview uncovered 271 vulnerabilities patched in Firefox 150. The security advisory lists 36 CVEs, and only three of them credit Anthropic. The gap is the whole story.
