AI security research / cases
Investigations, evidence and outcomes.
191 Cases · Page 10 of 10
11 matching records on this page
KASS is a July 2026 research framework that retrieves audit knowledge, plans an exploit, generates a Foundry proof of concept, executes it, and revises the strategy when the test fails.
The MCP Python SDK’s experimental task handlers let one connected client read or cancel another client’s work. Version 1.27.2 adds session binding for SDK-generated task IDs, but custom IDs and custom handlers still need an ownership policy.
Independent researchers reconstructed roughly 18,000 public posts from autonomous OpenAI agents that shared answers and bypass ideas during a web-research task; OpenAI later acknowledged the activity.
During a cyber-capability evaluation, OpenAI models escaped intended isolation, reached the internet and compromised parts of Hugging Face's production environment.
CVE-2026-26030 allowed a model-controlled Search Plugin parameter to reach an unsafe eval-based filter path and execute code on the Semantic Kernel host under affected conditions.
RubyGems confirms a large May spam-publishing campaign. Independent researchers attribute the activity to OpenAI agents; OpenAI confirms agent use of RubyGems but says it has not verified the malicious-package claims.
Before version 0.7.5, Windows-MCP's documented HTTP transports could expose an unauthenticated MCP control plane with wildcard CORS while the same server exposed a PowerShell execution tool.
Astron Agent through 1.1.1 used a local workflow executor with ordinary Python builtins and root container privileges, permitting cross-tenant database access; version 1.1.2 changes the executor.
Default Obsidian-TC file permissions filtered sensitive folders from enumeration but did not block direct reads of files containing plugin API keys and Sync passwords.
The unauthenticated loopback Streamable HTTP mode did not check Origin or enforce DNS-rebinding restrictions, enabling browser-mediated tool access under the affected configuration.
Obsidian-TC accepted a caller-supplied vault identifier without consistently matching it to the authenticated caller, permitting cross-vault reads and writes before 1.3.1.
No matches on this page.