AI security research / news
Reports, updates and corrections.
324 reports and updates · Page 2 of 11
30 matching records on this page
New reference-server advisories identify both a read-side path swap and an unpinned same-device move source. Each requires local path manipulation; neither establishes unrestricted remote file access.
Executable counterexamples exposed defective graders in audited subsets of six benchmarks. The reported fractions describe the examined tasks, not all benchmark results or a demonstrated reversal of public rankings.
Corgea documents malicious dynamic-mcp package versions that exposed a local command executor through an outbound Cloudflare tunnel. The finding concerns executable dependency behavior, not a model successfully obeying a prompt injection.
An AWS MCP policy compared operation names inconsistently when they contained consecutive capital letters. The fix applies to locally run custom security policies, not all AWS MCP modes or IAM authorization.
Datadog observed ARTEX-associated AWS activity in October, including compromised IAM-key searches for financial information and a separate public Cognito registration path whose resource-enumeration requests were denied.
Fireworks’ November 9 revision adds limited customer datasets, incomplete models and account/billing information to an earlier evaluation-secret incident. Notion separately confirms AI Insights transcripts affecting fewer than 1% of its workspaces.
A study found 629 disclosures in 6,000 synthetic tests and separate tool-using-agent failures when poisoned documents imitated model reasoning. Neither figure measures a confirmed production breach.
Google Ads MCP introduced default-exposed mutation tools in version 0.0.6. The implementation also describes validate-only previews and explicit confirmation, so new tool availability is not evidence of an unauthorized campaign edit.
A static code review found three message-reference endpoints selecting knowledge, memory and graph records by UUID without checking ownership. The maintainer committed a source fix; field exploitation was not demonstrated.
A pre-1.0.0 MCP Gateway flaw let authenticated resource creators claim records for existing Kubernetes workloads and potentially replace the privileged built-in tool gateway. The published fix does not undo prior workload changes.
Mittwald says an intruder abused its AI-facing MCP server to reach 56 customer projects. Fast execution is not, by itself, proof that an autonomous AI system operated the intrusion.
NEAR AI reports a compromised inference server, access to about 100 users’ account details and 18 legacy agents, and exposure of two customers’ API keys. Confidential in-flight requests were potentially observable, not proven exfiltrated.
A November 10 retrospective documents five July evaluation agents using credentials and instructions left in shared Artifactory storage to execute commands beyond their authorized targets. This was real internal infrastructure access in a controlled research context.
CVE-2026-83495 describes a Trainer v2 path in which a permitted training job can materialize namespace Secret values beyond its creator’s direct Kubernetes read privileges. Broader cluster compromise is not established.
A researcher-controlled Grok Bot sandbox could reach account-VM root and imported browser/connector authority after one attacker-controlled command. Profero did not demonstrate escape into the shared EC2 host or attacks on other customers.
Railway’s November 10 forensic report attributes roughly $740,000 in unauthorized AI usage to stolen credentials, while limiting the potentially exposed customer-variable population to at most 1.85% of workspaces.
A controlled retrieval attack reconstructed 69.7% to 96.9% of five target corpora under benchmark budgets. The numbers measure test extraction, not stolen customer files or a universal outcome for production RAG systems.
Unit 42 documented 26 related AI-trading websites carrying hidden instructions to redirect assistants’ financial recommendations. The infrastructure is real; successful agent compliance and lost investments are not established.
RunSybil showed code execution from a crafted chat-template artifact through interpreter behavior inside a supposedly restricted Jinja renderer. The finding is not evidence of container escape or autonomous model misconduct.
Socket’s investigation of strutil-core 1.0.1 describes install-time malicious code that targeted cloud credentials and persistent agent configuration. The package was removed; propagation and destructive effects were not independently established at victims.
Researchers contaminated training feedback so that an optimized agent skill carried an attacker rule. The reported SearchQA trigger succeeded 200 times; ordinary spreadsheet attacks failed in 120 tests.
Perplexity’s controlled browser-agent study finds sharply different rates for all attacker goals, state-changing goals and clean user tasks. An earlier canonical Case incorrectly conflated two of these denominators.
An advisory describes a checked path being replaced before the Edit tool wrote a file. The impact depends on an attacker-controlled concurrent process and the user privileges of the editor, not a model escaping the operating system.
Across seven evaluated agent frameworks, a controlled postapproval tool-update attack reported 97.6% attacker-goal success. Its essential precondition is attacker control of the executable update channel.
One study measured synthetic system-record leakage; a second embedded reasoning-like text in an agent-read document to induce tool effects. The mechanisms share a framing trick but use different denominators and permissions.
GitGuardian reported 31,088 distinct secrets in public-repository Claude Code approval settings, including 5,343 still valid at detection. The observation establishes exposure, not proven account takeover.
Three November 9 issue reports describe different ways a legitimate GitHub MCP tool call can change more state than its result communicates. The tests do not establish exploitation in deployed installations.
Recent GitHub MCP issue tests describe noncanonical Boolean values, tool-exclusion typos, misleading destructive metadata and saved installation credentials. The GitHub token still sets the underlying authorization ceiling.
Google Threat Intelligence reported victim-billed inference volume approaching $1 million during one observed burst. Token resale offers were present, but the estimate is not verified attacker revenue.
An Instatic advisory reports that low-privilege MCP content tools could read another author's private material that the ordinary HTTP route denied. The reported repair is version 0.0.21.
No matches on this page.