Source library

Practitioner critique of the OpenAI evaluation containment

A practitioner reaction arguing that the incident should be read primarily as a containment and operational-security failure rather than as proof of exotic exploit capability.

Jake Gold / Bluesky

RCE via malformed HEIF file

Maintainer-side advisory and remediation context for malformed HEIF processing. Narrow software-maintainer scope; does not independently establish the full OpenAI SSO/Codex chain.

Discourse

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident

Hugging Face's detailed forensic reconstruction of the autonomous intrusion, including the launchpad, dataset processor compromise, lateral movement and recovered action log.

Hugging Face

Hacker News discussion: Anatomy of a Frontier Lab Agent Intrusion

Developer discussion of Hugging Face's technical post-mortem. Used only as community context, not as authority for incident facts.

Hacker News

Arbitrary command execution in goose CLI via goose review via git core.fsmonitor

Goose maintainer advisory for CVE-2026-72718 confirming unsandboxed pre-model command execution from repository-local core.fsmonitor and the fix in Goose 1.44.0.

aaif-goose/goose

Verify Git plugin SHA checkouts

OpenAI Codex pull request documenting the root cause and fix: Git can interpret a requested SHA as a branch name, so Codex now resolves HEAD after checkout and rejects plugin materialization unless it exactly matches the requested commit.

OpenAI / GitHub

Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts

KASS paper describing a multi-agent exploit-synthesis and simulation framework for smart contracts, with SmartBugs-Curated and real CVE-tagged evaluations.

Xianhao Zhang et al. / arXiv

MCP Python SDK deprecated WebSocket transport lacked Host and Origin validation

GitHub security advisory for CVE-2026-59950, affecting the deprecated MCP Python SDK WebSocket server transport before 1.28.1.

Model Context Protocol Python SDK / GitHub Security Advisory

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

Check Point Research investigation of a browser-only ransomware technique developed from an LLM-suggested concept and implemented as a practical proof of concept.

Alexey Bukhteyev / Check Point Research

Unauthenticated RCE in ruflo MCP bridge default docker-compose deployment

Ruflo GitHub security advisory describing unauthenticated MCP tool invocation, terminal execution, exposed provider keys, AgentDB poisoning and the patched version.

ruflo

ADR-166: MCP bridge unauthenticated RCE remediation

Ruflo maintainer remediation document stating that the project statically verified the coordinated-disclosure claims against the shipping default deployment and describing the security redesign.

ruflo

AutoJack: How a single page can RCE the host running your AI agent

Microsoft technical disclosure of AutoJack, a development-branch AutoGen Studio chain from hostile web content through a local MCP WebSocket to host process execution.

Microsoft Defender Security Research Team

Microsoft AutoJack end-to-end exploitation figure

Original Microsoft figure showing the AutoJack end-to-end chain.

Microsoft Defender Security Research Team

MCP Python SDK experimental task handlers allowed cross-client task access

GitHub security advisory for CVE-2026-52870, affecting opt-in experimental tasks in mcp 1.23.0 through 1.27.1 and fixed in 1.27.2.

Model Context Protocol Python SDK / GitHub Security Advisory

HTTP transports expose unauthenticated PowerShell control with wildcard CORS

Maintainer advisory for the Windows-MCP HTTP transport vulnerability later assigned CVE-2026-48989.

CursorTouch / GitHub Security Advisory

Windows-MCP v0.7.5 security patch: CORS and DNS rebinding

Windows-MCP release notes describing the fix for GHSA-vrxg-gm77-7q5g.

CursorTouch

Microsoft Semantic Kernel CVE-2026-26030 exploitation figure

Original Microsoft figure from the Semantic Kernel CVE-2026-26030 research article.

Microsoft Defender Security Research Team

When prompts become shells: RCE vulnerabilities in AI agent frameworks

Microsoft's technical write-up of Semantic Kernel vulnerabilities, including the CVE-2026-26030 prompt-injection-to-RCE path and affected configuration.

Microsoft Defender Security Research Team

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

GitHub-reviewed advisory for CVE-2026-26030, identifying affected Semantic Kernel Python versions and the patched release.

GitHub Advisory Database

AiR-ViBeR: Exfiltrating Data from Air-Gapped Computers via Covert Surface ViBrAtIoNs

Research paper demonstrating a vibration-based covert channel where fan-speed modulation produces surface vibrations decoded by smartphone accelerometers.

LED-it-GO: Leaking (a lot of) Data from Air-Gapped Computers via the (small) Hard Drive LED

Research paper demonstrating optical exfiltration through rapid modulation of a computer HDD activity LED.

DiskFiltration: Data Exfiltration from Speakerless Air-Gapped Computers via Covert Hard Drive Noise

Research paper demonstrating acoustic exfiltration by controlling HDD actuator movement and decoding the resulting sound with a nearby receiver.

Fansmitter: Acoustic Data Exfiltration from (Speakerless) Air-Gapped Computers

Research paper showing software-controlled cooling-fan noise as an acoustic covert channel when speakers and audio hardware are absent.

AirHopper: Bridging the Air-Gap between Isolated Networks and Mobile Phones using Radio Frequencies

Research paper demonstrating FM-band exfiltration from an air-gapped computer to nearby mobile phones through electromagnetic emissions associated with display hardware.

'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

Independent BleepingComputer report published July 11, 2026. It reconstructs the split-image attack, CodeRabbit/Bugbot blind spot, fake provenance cover, 311-integer synthetic .env output, harness-dependent results and ASSET's multimodal defensive reviewer, and notes that the researchers disclosed findings to affected vendors.

A Survey on Air-Gap Attacks: Fundamentals, Transport Means, Attack Scenarios and Challenges

Review article organizing air-gap attack research across electromagnetic, magnetic, electrical, acoustic, optical, thermal and vibrational transport mechanisms.

AEPD: Primera notificación de una brecha de datos personales causada por un ataque ejecutado mediante un agente de IA

Primary Spanish data-protection authority publication stating that AEPD received its first notification of a personal-data breach in which the incident was allegedly executed through an AI agent using a known large language model.

AIR-FI: Generating Covert Wi-Fi Signals from Air-Gapped Computers

ASSET Research Group: We put the exploit in a picture. The AI code reviewer never opened it.

Primary ASSET Research Group disclosure dated June 2026. It documents the failed plaintext precursor, the split AGENTS.md + PNG attack, CodeRabbit/Bugbot review behavior, a 6,480-PR review survey, a fabricated validator/postmortem cover story, end-to-end synthetic .env recovery, ten-session model/harness comparisons, a 49/50 attack and 0/30 benign multimodal-reviewer trial, controlled-test limitations and vendor disclosure.

asset-group/ghostcommit public proof of concept

Public GhostCommit PoC repository with the evolved attack fixture, decoder, threat-model document, safe reproduction procedure, retained desktop recording and verified result matrices. Its current Codex results cover 60 CLI trials across GPT-5.6 Luna/Sol/Terra plus six separate App observations, with explicit EXFIL, REFUSED and RETRACT definitions and a warning not to generalize fixture-specific counts.