AI security research / news
Reports, updates and corrections.
219 reports and updates · Page 1 of 8
30 matching records on this page
A reviewed security advisory documents a query-construction weakness in Flexible GraphRAG before version 0.8.2. The risk is unauthorized graph-state change during document ingestion, not a model autonomously deciding to erase data.
Researchers report mean attack success increasing from 0.5 percent to 45 percent in seven tested open-weight models when a malicious Markdown skill was loaded. This is a controlled experiment, not an incident rate.
A public issue reports a controlled tool-result injection against Mini-Agent with a local Qwen model. Another tested model refused the same instruction, so this is not a measured universal bypass.
A reviewed advisory documents a chatbot integration that forwarded caller requests to Danswer using a server-held credential. The affected boundary was downstream authorization, not prompt injection.
An October 30 advisory alleges host command execution through allowed built-in dependencies in certain Flowise configurations. Its patch status and reproduction remain unconfirmed; this is separate from the documented Flowise intrusion campaign.
Sophos observed human operators giving access and objectives to coding agents that performed reconnaissance and some privilege escalation. The evidence does not show an entirely autonomous ransomware campaign.
A reviewed advisory explains that verbose subprocess logging printed credentials passed to Docker during LangGraph deployment. The token was constrained to an image repository and a short validity window.
A project security advisory describes remote code execution in affected Windows and WSL launch flows before MCP Inspector 2.12.0. The trigger is untrusted authentication metadata, not an AI model choosing a malicious tool.
A deployment-platform security notice and separate Bedrock traffic investigations show how stolen AI keys can finance unauthorized inference without further access to a model host.
A reviewed advisory documents an authentication check omitted from HTTP MCP transport in @sylphx/pdf-reader-mcp before 3.0.1. Exposure depends on network reachability and what files the process may read.
A controlled paper reports 21 attacker-target adoptions among 24 raw adversarial pilot responses. It also finds weak evidence that production agents routinely fetch llms.txt files.
Two public issue reports describe separate problems in the tested Presenton desktop build: an unauthenticated local service and a file-serving path to configuration and credential material. Cross-origin theft and production victim counts remain unproven.
Across 20 curated applications, Snyk Code matched 89 known flaws and a Claude Code review matched 85; their union reached 101. Review-harness policy changed what the underlying model was allowed to report.
Wiz recovered a high volume of generated scripts, but the confirmed effect is narrower than the number of services probed.
The 2,281 hidden-message instances and forty-seven classified hostile attempts describe different categories, not an attack success rate.
The command sequence probed cloud metadata and middleware, but attempted checks do not establish compromise of each named service or model identity.
The failure lies between a correct version choice and the actual callable artifact left in runtime state.
The architecture links agent session, tools and approvals to generated output, but signatures do not guarantee that every event was observed.
A model-selectable function name could reach `read_pickle` before a later DataFrame type check rejected the result.
Forty-one vulnerabilities in a skill corpus and separate controlled composition paths should not be counted as forty-one public intrusions.
The vulnerability depends on webhook signing configuration and downstream file retrieval; it does not affect every n8n Slack workflow equally.
A valid token from the same issuer could reach AWS-backed tools because the server did not check its intended audience.
The controlled banking benchmark separates graded completion from duplicate fees, unauthorized payments and unfinished review work.
The network restriction was applied to some browser requests but not all routes created by a page-controlled worker.
A desktop-assistant browser study found separate host-command, local-file, and displayed-origin failures; the tested conditions matter more than a single attack label.
Researchers observed unauthorized task creation at seventeen reachable panels, with some payload effects. This is not evidence of seventeen host takeovers.
Irregular also found a separate instruction-adherence problem; the benchmark result cannot be read as a per-attempt success probability.
Six lab-tested Firefox builds were exploited in a controlled setting; the cheaper rerun cost excludes the much larger initial research investment.
The observed intrusion linked a tool-argument API to Python subprocesses; listed fintech targets and attacker data-theft claims are not confirmed victims.
Check Point observed many changing or invalid hosts across continuations, challenging an interpretation of a stable hardcoded endpoint without erasing the original blocked attempt.
No matches on this page.