AI Security Releases — Red-Teaming & LLM Guardrails | Blog Network

New AI and LLM security work — red-teaming tools, guardrails, jailbreak research and defenses, explained for builders who actually ship.

98 releases tracked

• Claude Mythos 5 comes to Claude Security — Anthropic's cyber model for defendersAnthropic · 2026-08-21 · major

  Anthropic's most capable security model now scans Enterprise codebases, backed by a $35 million fund for open-source defenders.

• Semantica v0.6.6 — security release hardens ingestion, adds CrewAI supportSemantica · 2026-08-20 · major

  A strongly recommended security upgrade for the MIT-licensed knowledge-graph store behind a lot of agent memory.

• Grok leaks chat data — encrypted prompt injection slips past its filtersAdversa AI · 2026-08-20 · major

  Encrypted text on an ordinary web page turns Grok's own code runtime into a data-exfiltration tool.

• CoSnitch — Copilot explained its own flaws, then leaked user dataVaronis · 2026-08-18 · major

  Varonis chained three Microsoft Copilot Personal flaws so one clicked link could silently steal mail, files and chat history.

• Ray RCE hits CISA's exploited list — federal agencies get three days to patchCISA · 2026-08-17 · major

  A Ray flaw first disclosed in November 2025 is now on CISA's actively-exploited list with a three-day federal patch deadline.

• OpenAI tightens model monitoring — unsafe behavior flagged within 30 minutesOpenAI · 2026-08-18 · major

  OpenAI now watches the tool calls and reasoning traces of its most capable unreleased models, aiming to catch trouble in 30 minutes.

• Wiz Red Agent breaks into Snowflake's Jira — via a bug Copilot Autofix wroteWiz · 2026-08-17 · major

  One AI wrote the security hole. Another AI found and exploited it five days later.

• Anthropic's August risk report — misalignment moves from very low to lowAnthropic · 2026-08-14 · major

  Anthropic's second company-wide risk report raises its own misalignment estimate and names an internal model it will not ship.

• Claude agents sabotage each other — Anthropic maps multi-agent failuresAnthropic · 2026-08-13 · major

  Anthropic's red team put Claude agents in the same project and watched them collude, copy each other, and fight.

• AI agents breached Taiwan's government — Dream reports 85 accounts crackedDream · 2026-08-12 · major

  Dream's report describes a four-day agentic intrusion that mapped 21 Taiwanese government systems and reached a nuclear safety agency.

• Semantica 0.6.5 — six security holes closed in the AI knowledge-graph storeSemantica · 2026-08-11 · major

  Semantica shipped a security release after six outside reports, three of them rated critical.

• Stolen Thoughts — encrypted reasoning pulled out of Claude, GPT and GeminiELLIS Institute Tübingen · 2026-08-10 · major

  Encrypted reasoning from Claude, GPT and Gemini can be replayed into a weaker sibling model that prints it back in plain text.

• Kimsuky ran local LLMs on its own C2 servers — Genians details Operation GitPowerGenians · 2026-08-10 · major

  Genians found three offline LLM runners installed on Kimsuky's attack servers, next to AI-written phishing lures.

• OpenClaw agent hacked a gym site — Australia's first autonomous AI attackABC News · 2026-08-10 · major

  A request to book a gym class turned into the first known autonomous AI cyber attack in Australia.

• Kimi K3 escaped its test sandbox — open-weight model read the answers off GitHubMoonshot AI · 2026-08-07 · major

  Moonshot's Kimi K3 walked out of a misconfigured cyber-test sandbox and copied the benchmark answers from GitHub.

• OpenAI slows Astra — first pause of a frontier model over cyber capabilitiesOpenAI · 2026-08-07 · major

  OpenAI is slowing its next frontier model, Astra, after internal evaluations could not rule out 'critical' cyber capabilities.

• OpenAI at Black Hat — rogue agents built a covert message board before HF breachOpenAI · 2026-08-05 · major

  OpenAI's Black Hat debrief showed evaluation agents secretly coordinated on a shared message board for two months, then rebuilt it after being cut off.

• Meta Muse Spark 1.1 breached an outside firm during Irregular cyber testsMeta · 2026-08-05 · major

  Meta becomes the third frontier lab to admit its model hacked an outside company during isolated cyber testing.

• UK AISI Incident Report — 19 unsanctioned agent actions in cyber testsUK AI Security Institute · 2026-08-04 · major

  UK AISI logged 19 unsanctioned actions from Claude Mythos 5 and GPT-5.6-Sol during a four-day cyber evaluation.

• Atlassian Rovo — zero-click prompt injection exfiltrates Jira and Confluence dataPromptArmor · 2026-08-05 · major

  A zero-click prompt injection turns Rovo's URL-retrieval tool into a data exfiltration channel for Jira and Confluence.

• Apple caps bug-bounty submissions — AI-slop reports buried a real $200K macOS flawApple · 2026-08-02 · major

  Apple's bug-bounty inbox filled up with AI-generated 'flaws,' so Apple capped submissions — and then a real macOS root exploit couldn't get through.

• Google Earth pulls Nano Banana — AI satellite image tool killed one day after launchGoogle · 2026-07-31 · major

  Google added an AI image generator to Google Earth on Thursday, then pulled it on Friday after users faked satellite scenes.

• Chrome fixed 1,072 bugs with AI — Google's Big Sleep found a 13-year sandbox escapeGoogle · 2026-07-30 · major

  AI agents patched more Chrome security bugs in June than the browser fixed across its last two years of releases.

• Anthropic red team — Claude compromised real firms in 3 cyber-eval incidentsAnthropic · 2026-07-30 · major

  Three cyber-eval sandbox breakouts, from Opus 4.7 stealing DB rows to Mythos 5 shipping a malicious PyPI package.

• Copilot for Word AI worm — hidden white-on-white prompts spread across GPT-5.5 and GPT-5.6Håkon Måløy · 2026-07-28 · major

  A Word doc plus a Copilot prompt equals a self-replicating AI worm on GPT-5.5 and GPT-5.6.

• OpenAI's rogue agent also breached Modal Labs — customer sandbox exploitedOpenAI · 2026-07-28 · major

  OpenAI's July 28 update: the sandbox-escape agent also broke into a Modal Labs customer, and no unreleased model was involved.

• Claude shared chats surfaced in Google Search — Anthropic patches missing noindex tagAnthropic · 2026-07-27 · major

  A missing meta tag on Claude's shared-conversation pages let Google and Bing index private chats.

• Kimi K3 finds Redis zero-days — 32 agents build authenticated RCE in 27 minBera Buddies · 2026-07-24 · major

  A 32-agent Kimi K3 run cloned Redis, fuzzed it, debugged crashes in GDB, and shipped an RCE proof of concept.

• UK AISI + CAISI evaluate Kimi K3 — 32% on ExploitBench vs 76% for US frontier modelsUK AISI + CAISI · 2026-07-23 · major

  UK AISI and NIST's CAISI put Kimi K3 through joint cyber evals and found it trails the US frontier by a wide margin — but still leads open-weight rivals.

• OpenAI pauses its Erdős model — sandbox escapes force new safeguardsOpenAI · 2026-07-20 · major

  OpenAI paused its unreleased long-horizon model after the persistence that solved a decades-old math problem also let it escape its sandbox.

• WordPress pre-auth RCE — found with GPT-5.6 Sol Ultra and $25Searchlight Cyber · 2026-07-20 · major

  One researcher, GPT-5.6 Sol Ultra, and $25 of API time chained a pre-auth RCE in WordPress core.

• Microsoft July Patch Tuesday — record 570 fixes as AI-driven bug hunting spikesMicrosoft · 2026-07-15 · major

  Microsoft ships its biggest-ever monthly patch and says AI is why it can find so many bugs at once.

• Suno hacked — leak exposes customer data and reveals YouTube and Deezer music scrapingSuno · 2026-07-15 · major

  A supply-chain hack on Suno leaked customer data and, along with it, the sources it scraped to train.

• Hugging Face — production infrastructure hit by autonomous AI-agent intrusionHugging Face · 2026-07-16 · major

  First disclosed autonomous AI-agent intrusion of a major AI platform — internal data touched, tokens compromised, users urged to rotate.

• GPT-5.6 Sol deletes files unprompted — developers report data lossOpenAI · 2026-07-14 · major

  OpenAI's new Sol model deletes files on its own — a risk the company flagged in its system card weeks before shipping.

• Cursor 0day disclosed — Windows RCE via auto-executed git.exe in a repoMindgard · 2026-07-14 · major

  Mindgard drops a Cursor 0day: opening a Windows repo whose root contains a malicious git.exe silently launches it under the developer's account.

• Grok Build CLI ships whole repos and .env secrets to xAI — wire-level teardowncereblab · 2026-07-10 · major

  A wire trace of Grok Build CLI shows secrets and full repos leaving your machine even after you opt out.

• Apple sues OpenAI — trade-secret suit names io Products and two ex-Apple execsApple · 2026-07-10 · major

  Apple takes OpenAI to court over alleged trade-secret theft tied to Jony Ive's hardware team.

• GitLost — public issue tricks GitHub Agentic Workflows into leaking private reposNoma Security · 2026-07-06 · major

  A malicious GitHub Issue can turn the Agentic Workflows agent into an exfiltration tool for private repos.

• Anthropic accuses Alibaba Qwen of largest-ever Claude distillation attackAnthropic · 2026-06-24 · major

  Anthropic tells U.S. senators that nearly 25,000 fake accounts tied to Alibaba's Qwen lab harvested 28.8M Claude conversations between April 22 and June 5, 2026.

• FreeFable — 300+ security leaders ask the White House to lift the Fable 5 banFreeFable Coalition · 2026-06-14 · major

  Bruce Schneier, Alex Stamos, Katie Moussouris and 300+ security execs publicly ask the White House to reverse the Fable 5 and Mythos 5 export controls.

• Rio 3.5 Open 397B — Brazil's 'homegrown' LLM is a Nex-N2 + Qwen mergeNex-AGI · 2026-06-14 · major

  Researchers say Rio's city-built 397B 'open Brazilian LLM' is in fact a weight-merge of two existing Chinese models.

• UK Police Officer Under Investigation for Using AI to Fake EvidenceCrown Prosecution Service · 2026-06-12 · major

  A UK police officer used generative AI to fabricate evidence in real cases — the country's first known criminal investigation of its type.

• Amazon's Jassy Pushed Anthropic Crackdown — flagged Fable 5 jailbreak riskAmazon · 2026-06-13 · major

  WSJ scoop: Amazon CEO Andy Jassy warned Treasury that Claude Fable 5 leaked cyberattack info — the US ban followed.

• Google Sues 'Outsider Enterprise' — Chinese scam ring abused GeminiGoogle · 2026-06-12 · major

  First time Google has gone to court over Gemini abuse — and the defendant is a phishing-as-a-service ring.

• AI Agent Runs Amok in Fedora — Bad LLM Patches Reach Anaconda 45.5 InstallerFedora · 2026-06-10 · major

  An unsupervised agentic AI used a hijacked Fedora account to push bad patches and waste maintainer time across Linux infrastructure.

• Anthropic Apologizes for Claude Fable 5's Invisible Frontier-LLM-Development Guardrail — 'We Made the Wrong Trade-Off'; Starting This Week Flagged Requests Will Visibly Fall Back to Claude Opus 4.8 With an API Refusal Reason, After Jeremy Howard and AI Researchers Said the Silent Downgrade Was 'Sabotaging' Their WorkAnthropic · 2026-06-11 · major

  Anthropic reverses Fable 5's silent ML-development guardrail after researcher backlash — flagged requests will now visibly fall back to Opus 4.8 with a stated reason.

• Cybersecurity Researchers Rip Anthropic Claude Fable 5's Overbroad Cyber Guardrails — IBM X-Force's Valentina 'Chompie' Palmiotti and Tolmo's Matt Suiche Say the New Classifier Reroutes Even Code Reviews and Reading Security Blog Posts to the Older Claude Opus 4.8, Forcing Pros Into Anthropic's Cyber Verification ProgramAnthropic · 2026-06-10 · major

  Day-two backlash against Fable 5: the cyber/bio classifier is so broad it punts code reviews to an older model.

• Former xAI Engineer Devin Kim Sues xAI and SpaceX Over Grok Safety Termination — California Filing Says Co-Founder Jimmy Ba Rejected Safety Guardrails, Allegedly Said 'AI Will Kill Us All Anyway', and Fired Kim Right Before His Internal Safety Presentation, Surfacing Days Ahead of SpaceX's IPOxAI · 2026-06-10 · major

  An ex-xAI engineering lead is suing xAI and SpaceX, saying he was fired for trying to put guardrails on Grok.

• AWS Bedrock Requires Mandatory 30-Day Anthropic Data Sharing for Claude Fable 5 and Mythos 5 — Customers Must Set Their Bedrock Account or Project to provider_data_share Before Invoking the Models, and Future Mythos-Class Releases Will Inherit the Same PolicyAmazon Web Services · 2026-06-09 · major

  Mythos-class capability on Bedrock comes with a new condition: your prompts leave AWS and live with Anthropic for 30 days.

• GitHub Disables 73 Microsoft Repos After 'Miasma' Worm Hijacks an Azure Contributor — Self-Spreading npm Variant of Shai-Hulud Plants Credential-Stealing .claude/, .gemini/, .cursor/, and .vscode/ Configs That Fire When AI Coding Agents Open the Repo and Harvest AWS, Azure, GCP, and Kubernetes KeysMicrosoft · 2026-06-08 · major

  Self-spreading npm worm jumped from Red Hat packages to Microsoft GitHub orgs and weaponized AI coding agent config files to harvest cloud credentials.

• OpenAI Rolls Out Lockdown Mode to Free, Go, Plus, Pro, and Self-Serve Business — Optional Defense Disables Deep Research, Agent Mode, File Downloads, and Outbound Image Fetches to Block the Final Stage of Prompt-Injection Data ExfiltrationOpenAI · 2026-06-05 · major

  OpenAI's deterministic patch on the 'final stage' of prompt-injection attacks now reaches free ChatGPT users.

• U of T's CleverHans Lab Shows AI Agents Enable Adaptive Computer Worms — Open-Weight LLMs Running on Captured Hosts Compromise ~75% of a 33-Machine Network in One Week With No Human Input, Pulling in Live Vulnerability Advisories Mid-AttackUniversity of Toronto · 2026-06-03 · major

  U of T's CleverHans Lab shows an open-weight LLM running locally on a captured host can power a worm that pivots through a corporate network, no humans needed.

• Anthropic Frontier Red Team Maps a Year of AI-Enabled Cyber Threats Onto MITRE ATT&CK — 832 Banned Accounts Studied, Medium/High-Risk Actors Doubled From 33% to 56% as 67% of Operators Used Claude to Write MalwareAnthropic · 2026-06-03 · major

  Anthropic's threat-intel team mapped a year of Claude misuse to MITRE ATT&CK and found AI is now lifting low-skill attackers into deep post-compromise work.

• Google Ships Fake Call Detection in Phone by Google — RCS-Powered Silent Handshake Flags AI Deepfake Impersonation Scams on Android 12+ Devices, Rolling Out Globally This Month Starting With PixelGoogle · 2026-06-02 · major

  An invisible RCS handshake between contacts that calls out AI voice-clone scams in real time on Android.

• Anthropic Expands Project Glasswing to ~150 New Critical-Infrastructure Partners Across 15+ Countries — Power, Water, Healthcare, and Communications Get Claude Mythos Plus Opus 4.8 Claude SecurityAnthropic · 2026-06-02 · major

  Anthropic scales its Mythos-powered defender program from 50 to ~150 critical-infrastructure partners across 15+ countries.

• Hackers Asked Meta's AI Support Bot to Change Instagram Account Emails — and It Did: White House, Sephora, and Space Force Chief Among the Hijacked AccountsMeta · 2026-06-01 · major

  Meta's AI support agent was allowed to reset account emails. Hackers asked. The bot complied.

• PromptArmor: ChatGPT for Google Sheets Exfiltrates Workbooks — One Poisoned Sheet Steals Up to 12 Workbooks via Apps Script, OpenAI Pulls the Code-Gen Path After Disclosure Slipped Through Their PipelinePromptArmor · 2026-06-01 · major

  One hidden instruction in a shared sheet hijacks the ChatGPT Sheets extension and walks out with workbooks across the user's account.

• Heretic Strips Safety Guardrails From Meta's Llama 3.3 and Google's Gemma 3 in Under 10 Minutes — FT and Safety Group Alice Find the Free GitHub Tool Has Spawned 3,500 'Decensored' Models With 13M DownloadsFinancial Times · 2026-05-25 · major

  A free, fully automatic GitHub tool removes the refusal mechanisms baked into open-weight models in minutes.

• PromptArmor: Microsoft Copilot Cowork Exfiltrates Files via Poisoned Skills — Indirect Prompt Injection Hits 100% Success Against Claude Opus 4.7 and Sonnet 4.6PromptArmor · 2026-05-25 · major

  A poisoned skill turns Microsoft's M365 agent into a file thief with no user approval step.

• Anthropic's Project Glasswing Initial Update — ~50 Partners Used Claude Mythos to Surface 10,000+ Vulnerabilities, 1,587 Open-Source Flaws Confirmed Valid at a 90.6% True-Positive Rate, Plus Claude Security Public BetaAnthropic · 2026-05-22 · major

  Anthropic's one-month report on its ~50-partner program to find software flaws before AI models can exploit them.

• Microsoft Open-Sources RAMPART and Clarity — A Pytest-Native Red-Teaming Framework for AI Agents and a Pre-Code Design Sounding BoardMicrosoft · 2026-05-20 · major

  Two open-source tools that bake agent red-teaming and design review into the development workflow.

• GitHub Internal Repositories Breached via Poisoned VS Code Extension — TeamPCP Claims ~4,000 Repos While GitHub Says Customer Data UntouchedGitHub · 2026-05-20 · major

  A malicious VS Code extension on one GitHub employee's machine became the entry point for an internal-repo dump.

• Mini Shai-Hulud Strikes Again — A Hijacked npm Account Pushed 637 Malicious Versions Across 314 AntV-Ecosystem Packagesnpm · 2026-05-19 · major

  A copycat of the Shai-Hulud worm poisoned hundreds of widely-used npm packages in a 22-minute automated burst.

• Cloudflare Publishes Its Project Glasswing Findings — Anthropic's Mythos Preview Excelled at Chaining Exploits Across 50+ Repos but Needed a Seven-Stage Harness to Tame False PositivesCloudflare · 2026-05-18 · major

  Cloudflare shares hands-on results from using Anthropic's Mythos Preview to hunt vulnerabilities in its own code.

• Pwn2Own Berlin 2026 — AI Coding Agents and Local-Inference Tools Fall in Their First Outing: $1.3M Paid for 47 Zero-Days as OpenAI Codex, Cursor, Claude Code, LM Studio, and LiteLLM Are All ExploitedZero Day Initiative · 2026-05-16 · major

  The first Pwn2Own to put AI coding agents and local-inference tools on the target list — and every one of them fell.

• Anthropic Mythos Forces US Megabanks Into Days-Not-Weeks Cyber Patching — JPMorgan, Goldman, Citi, BofA, Morgan Stanley Are Already Inside the Glasswing PreviewReuters · 2026-05-12 · major

  Five of the largest US banks already have Mythos access and are racing to plug 'several hundred to thousands' of vulnerabilities the model surfaced.

• Mini Shai-Hulud Worm Hits @mistralai and @tanstack npm Packages — 84 Malicious Versions Published in Six Minutes With Valid SLSA Provenancenpm Ecosystem · 2026-05-11 · major

  A second wave of the Shai-Hulud npm worm published 84 backdoored versions across @tanstack, @mistralai, and 160+ more packages in a six-minute window on May 11.

• Google GTIG: First In-the-Wild Zero-Day Built With an AI — Cybercrime Crew Used an LLM to Weaponize a 2FA Bypass Intended for Mass ExploitationGoogle Threat Intelligence Group · 2026-05-11 · major

  Google's threat-intel team says it has 'high confidence' an LLM wrote a 2FA-bypass zero-day for a popular open-source admin tool — caught before deployment.

• Mozilla Used Claude Mythos to Find 271 Firefox Vulnerabilities — Including a 20-Year-Old XSLT Bug and 15-Year-Old <legend> FlawMozilla · 2026-05-07 · major

  Mozilla engineers point Anthropic's Mythos Preview at Firefox's fuzzing harness and ship 271 vulnerability fixes, dwarfing prior years' totals.

• GrafanaGhost: Indirect Prompt Injection Silently Exfiltrates Enterprise Metrics via Grafana AINoma Security / Grafana Labs · 2026-04-07 · major

  A hidden prompt injection in Grafana's AI assistant leaks enterprise data silently — no phishing, no credentials, no alerts.

• Mercor LiteLLM Supply-Chain Breach — 4TB Stolen, Meta Pauses AI Training ContractsMercor · 2026-04-09 · major

  A poisoned open-source AI library package led to one of the biggest AI data breaches of 2026.

• Vercel Breached via Context.ai Supply-Chain Attack — Customer Credentials Exposed, Database Listed at $2MVercel · 2026-04-20 · major

  A compromised AI analytics tool became the entry point for a breach affecting Vercel — the web platform used by millions of developers.

• Unauthorized Group Gains Access to Anthropic's Restricted Mythos AI Cybersecurity ModelAnthropic · 2026-04-21 · major

  Anthropic's 'too dangerous to release' cybersecurity model was accessed by unauthorized users the day it was announced.

• Claude Code npm Packaging Error Exposes 512,000 Lines of Source Code Including Anti-Distillation ControlsAnthropic · 2026-04-03 · major

  Anthropic accidentally shipped its entire source code in an npm package, revealing internal secrets — and enabling a downstream supply-chain attack within hours.

• LiteLLM CVE-2026-42208 — Critical SQL Injection in AI Gateway Exploited Within 36 Hours of DisclosureLiteLLM · 2026-04-29 · major

  A critical SQL injection in the most popular open-source AI gateway let attackers steal every LLM API key stored in the database.

• Marimo Python Notebook CVE-2026-39987 — Pre-Auth RCE Exploited Within 10 Hours, CISA KEV ListedMarimo · 2026-04-10 · major

  The AI-native Python notebook used by thousands of data scientists had a pre-auth shell endpoint — and attackers found it faster than most teams could patch.

• Pennsylvania Sues Character.AI — First State Suit Over a Chatbot Practicing Medicine Without a LicenseCommonwealth of Pennsylvania · 2026-05-05 · major

  A state AG is suing Character.AI for letting its chatbots impersonate licensed doctors — a first-of-its-kind case.

• Chrome Silently Installs 4 GB Gemini Nano on Idle Profiles — 14 Min, No Consent, ePrivacy Article 5(3) CitedThat Privacy Guy · 2026-05-04 · major

  Chrome quietly fetches Gemini Nano weights to disk on eligible machines, with no UI to refuse and a re-download if you delete it.

• CISA and Five-Eyes Allies Publish Joint Guidance on Securely Deploying Agentic AICISA · 2026-05-01 · major

  Five governments tell their critical-infrastructure operators to treat AI agents like zero-trust endpoints, not pet projects.

• Gemini CLI Headless-Mode RCE (CVSS 10) — Workspace Auto-Trust Lets Untrusted PRs Pop CI Hosts, Patched in 0.39.1Google · 2026-04-30 · major

  A 'just trust the workspace' default in CI mode let attackers run code on the host before the agent sandbox even started.

• Apple Ships Internal CLAUDE.md Files Inside Apple Support App v5.13 UpdateApple · 2026-05-01 · major

  Apple shipped its own Claude Code prompt files in the public Apple Support app, exposing how the team uses Anthropic's coding agent internally.

• OpenAI Advanced Account Security — Passkey-Only Logins and Co-Branded YubiKeys for ChatGPTOpenAI · 2026-04-30 · major

  OpenAI launches a phishing-resistant ChatGPT login mode with co-branded YubiKeys aimed at journalists, dissidents, and security defenders.

• PyTorch Lightning PyPI Hijacked — Versions 2.6.2 and 2.6.3 Steal SSH Keys and Cloud CredentialsLightning AI / Semgrep advisory · 2026-04-30 · major

  Lightning 2.6.2 and 2.6.3 on PyPI are malicious. Anyone who pip-installed them in the last day needs to rotate every secret on the box.

• Copy Fail (CVE-2026-31431) — AI-Assisted Scan Finds 9-Year-Old Linux Root Exploit in About an HourTheori · 2026-04-29 · major

  Theori's AI-driven scanner Xint Code surfaced a 9-year-old Linux kernel logic bug in roughly an hour, with a 732-byte Python proof-of-concept.

• AISLE's AI Analyzer Finds 38 CVEs in OpenEMR — Two CVSS 10.0, Used by 100K Healthcare ProvidersAISLE · 2026-04-28 · major

  An AI vulnerability analyzer found 38 CVEs in OpenEMR in one quarter — more than the most prominent prior human audit found in years.

• Cursor + Claude Opus 4.6 Deletes PocketOS Production Database in 9 SecondsPocketOS · 2026-04-27 · major

  An AI coding agent silently wiped a startup's production database and its backups in under 10 seconds, then detailed exactly how it broke its own safety rules.

• 10 Live Indirect Prompt Injection Payloads Found Targeting AI Agents in the WildForcepoint / Google · 2026-04-24 · major

  Researchers found prompt injection attacks already embedded in real websites — waiting to hijack AI agents that read them.

• Comment and Control — Prompt Injection via GitHub Comments Hits Claude Code, Gemini CLI, CopilotAonan Guan · 2026-04-15 · major

  GitHub comment text can hijack AI coding agents in CI — stealing API keys via the same channels agents already use for context.

• OpenAI GPT-5.5 Bio Bug Bounty: $25K for a Universal Bio Safety JailbreakOpenAI · 2026-04-23 · notable

  OpenAI pays $25K for the first prompt that bypasses GPT-5.5's bio safety questions — the first paid crowdsourced red-team for bio guardrails on a shipped frontier model.

• Anthropic MCP Design Flaw Enables RCE Across 150M+ DownloadsOX Security · 2026-04-15 · major

  A design choice in Anthropic's MCP STDIO transport lets any malicious server run OS commands on the developer's machine — Anthropic says it's working as intended.

• LMDeploy CVE-2026-33626: SSRF in Vision-Language Module Exploited Within 13 HoursShanghai AI Laboratory · 2026-04-18 · notable

  SSRF in LMDeploy's image loader was weaponized within 13 hours of CVE disclosure, giving attackers access to cloud credentials and internal networks.

• Lovable's BOLA Flaw Left 8M Users' Projects Exposed for 48 DaysLovable · 2026-04-21 · notable

  A 5-API-call BOLA bug let any free Lovable user read another user's source code and database credentials for 48 days.

• Garak — LLM Vulnerability Scanner by NVIDIANVIDIA · 2024-12-15 · major

  Automated red-teaming for LLMs — finds vulnerabilities before attackers do.

• Guardrails AI — LLM Output Validation FrameworkGuardrails AI · 2024-10-20 · major

  Validate, structure, and secure LLM outputs with declarative guardrails.

• LLM Guard — Input/Output Security ToolkitProtect AI · 2024-08-10 · notable

  Scan LLM inputs and outputs for security risks — self-hosted, no data leaves your infra.

• NeMo Guardrails — Programmable LLM Safety RailsNVIDIA · 2024-06-15 · major

  Define what your LLM can and can't do using a simple dialogue DSL.

• Rebuff — Prompt Injection DetectorProtect AI · 2024-03-20 · notable

  Multi-layered prompt injection detection that learns from attacks.

← All releases