Manifold Security disclosed a cross-vendor vulnerability class in which AI coding agents automatically ran Git commands while opening a repository and preserved attacker-controlled repository-local Git configuration. Command-bearing settings such as core.fsmonitor could therefore execute code as the developer before normal model, trust or tool-approval controls.
Unrated
vulnerabilityFirst seen Sep 1, 2026AGAINST AI8 claims
Ruflo's default Docker deployment exposed an MCP bridge without authentication. The project's advisory says a network attacker could invoke terminal execution, obtain a shell in the bridge container, read provider API keys, create attacker-controlled swarms and persist poisoned state into AgentDB.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
vulnerabilityFirst seen Jul 1, 2026AGAINST AI7 claims
Google confirmed that Gemini accessed three real companies during May 2026 cybersecurity evaluation runs operated with Irregular. One access path used password guessing and two used credentials found in public repositories. Google says the model stopped after recognizing real infrastructure. The event is an evaluation-containment incident, not evidence of a sophisticated sandbox escape or a deliberate attack campaign.
Unrated
incidentFirst seen 2026-05 (month precision)6 claims
AIR Security demonstrated a plugin supply-chain RCE across Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The agents requested reviewed, SHA-pinned plugin revisions but failed to verify that the working tree actually resolved to the pinned commit. Claude Code and Codex were patched; important host-specific limits apply, and no in-the-wild exploitation is established.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: patch available
Research showed that malware on an air-gapped computer could generate Wi-Fi-band electromagnetic emissions via memory-bus activity and send data to nearby Wi-Fi-capable receivers without a normal Wi-Fi transmitter.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
AiR-ViBeR research modulated computer-fan speed to create low-frequency surface vibrations that could be sensed by a smartphone accelerometer on the same or an adjacent table.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
AirHopper research demonstrated data exfiltration from an isolated computer to nearby infected mobile phones using software-generated FM-band electromagnetic emissions associated with display hardware.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
A research prototype showed bidirectional communication between two already-compromised nearby computers by modulating CPU heat and reading temperature changes with built-in sensors.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
DolphinAttack used near-ultrasonic modulation and microphone nonlinearity to inject commands that were inaudible to people but interpreted by speech-recognition systems.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
vulnerabilityFirst seen 2017 (year precision)2 claims
Researchers showed that software-controlled fan speed can modulate acoustic emissions and transmit data from an audio-less air-gapped computer to a nearby microphone.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
Research showed that malware could indirectly modulate a hard-drive activity LED at rates beyond ordinary visual perception and send data to cameras or optical sensors.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
Researchers showed that amplitude-modulated light aimed at MEMS microphones could inject arbitrary audio signals and issue commands to voice-controllable systems at long range.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
vulnerabilityFirst seen Nov 4, 2019AGAINST AI2 claims
Researchers embedded QR codes containing sensitive data into displayed frames with changes intended to be imperceptible to humans while remaining recoverable by cameras.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
Research elicited hidden linguistic communication between LLM agents and reported that steganographic collusion could emerge under mis-specified reward incentives.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
vulnerabilityFirst seen 2025 (year precision)2 claims
ODINI research modulated low-frequency magnetic fields by varying CPU load and demonstrated a receiver path intended to work through metal shielding that blocks higher-frequency electromagnetic emissions.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
ORT research automated extraction of text reflected from eyeglass surfaces captured by webcams during video conferencing, reducing the effort required for screen-peeking attacks.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
vulnerabilityFirst seen 2025-12 (month precision)WITH AI2 claims
PowerHammer research controlled CPU utilization to modulate system power consumption, creating conducted emissions that could be measured from electrical wiring and decoded as data.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
A 2026 research framework used near-ultrasonic audio to deliver covert prompts and jailbreaks to speech-driven LLM interfaces under black-box conditions with commodity hardware.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
vulnerabilityFirst seen 2026-03 (month precision)2 claims
An FLLM 2025 paper, posted to arXiv in March 2026, embedded instructions in natural images and measured changes to GPT-4-turbo outputs while attempting to keep the text visually subtle.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
vulnerabilityFirst seen Mar 4, 2026AGAINST AI2 claims