Attacks on AI systems

Week of Sep 281

• Sep 28DefenseNVIDIA puts agent policy enforcement on a separate chip from the agent

Week of Sep 215

• Sep 25CapabilityOpenAI says prompt injections that copy themselves into the agent's next output exist in its internal systems
• Sep 24AttacksA poisoned sales lead was enough to make Salesforce's agent hand over CRM data with no click
• Sep 23AttacksA Docker botnet installs an off-the-shelf AI agent and tells it to take AI API keys first
• Sep 23AttacksCompromised AI-memory packages shipped an implant that copies itself wherever the stolen tokens reach
• Sep 22AttacksTeam Cymru maps the relay layer that routes Chinese traffic into US frontier models, and puts a number on it

Week of Sep 146

• Sep 18AttacksCrowdStrike assesses with high confidence that the PhantomRaven npm stealer was written with an LLM
• Sep 17AttacksA plugin's pinned commit can be swapped for attacker code in four AI coding agents
• Sep 17DefenseA scan of public MCP configuration files finds one credential in eight hardcoded
• Sep 16PolicyThe Chinese Communist Party's own newspaper rejects the US distillation allegations and warns of countermeasures
• Sep 16CapabilityA coding agent fine-tuned and redeployed the model it was running on, without being told to
• Sep 16AttacksOne extension can hand a prompt straight to the built-in agents of five browsers

Week of Sep 710

• Sep 11AttacksA maximum-severity GitLab flaw drew in-the-wild probes the day it was patched, beside a critical flaw in its AI assistant
• Sep 11DefenseAnother unauthenticated code-execution flaw is published against the SGLang inference server
• Sep 11DefenseA census of self-hosted AI infrastructure counts 36,769 reachable endpoints and almost none behind a login
• Sep 10AttacksAn actor turned an AI vendor's evaluation sandbox into a source of production API keys
• Sep 10AttacksAnthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude
• Sep 10DefenseA payload wrapped in ordinary prose passed four guardrail models and was acted on by the model behind them
• Sep 8AttacksNSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
• Sep 8DefenseA shared internal package service let one ChatGPT account quietly task another account's session
• Sep 8DefenseA flaw in DeepSeek's agent harness let a sandboxed agent turn its own confinement off with one command
• Sep 7AttacksA researcher publishes proof-of-concept zero-day exploits against CrowdStrike Falcon, Avast and Nvidia components

Week of Aug 3111

• Sep 3AttacksMicrosoft says a prompt-injection technique has crossed over into large-scale phishing filter evasion
• Sep 2AttacksCISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
• Sep 2DefenseTwo chained flaws let unauthenticated callers reach data through Grafana's MCP server
• Sep 2DefenseA malicious agent skill steered decisions 81% of the time while still doing its advertised job
• Sep 1AttacksAttackers move to mass exploitation of a critical Langflow flaw, harvesting AI and cloud credentials
• Sep 1AttacksA repository's own git config makes seven AI coding agents run attacker code before any prompt
• Sep 1DefenseThe Agent Control Standard is donated to OWASP's GenAI Security Project
• Aug 31AttacksMalware carries a planted prompt about building a nuclear weapon to stop AI tools analysing it
• Aug 31AttacksAnthropic tells Claude users that commodity infostealers hijacked their sessions and drained paid usage
• Aug 31AttacksMETR discloses two intrusions against itself, including about $600,000 of model credits consumed
• Aug 31AttacksScanners forged AI crawler identities to hunt for exposed credentials

Week of Aug 248

• Aug 28DefenseUnit 42 reports that a few dozen neurons control an aligned model's safety refusal behaviour
• Aug 28AttacksMetasploit ships public exploit modules for two AI application platforms
• Aug 28AttacksVulnCheck logs more than 15,000 successful exploitation attempts against Langflow
• Aug 27AttacksWiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
• Aug 27DefenseServiceNow patches three flaws rated CVSS 10.0 in its AI Platform
• Aug 26AttacksMicrosoft reports attackers compromising self-hosted AI gateways and orchestration platforms for credentials and cryptomining
• Aug 25DefenseOasis Security discloses a NemoClaw flaw that lets a malicious webpage poison a developer's local AI model
• Aug 25DefenseRAND publishes a 262-control framework for securing AI model weights at security level 3

Week of Aug 178

• Aug 21AttacksTrojanized npm packages deliver RedC2 4.0, a post-exploitation framework with an LLM-driven command layer
• Aug 20DefenseResearchers show encrypted 'context injection' turns Grok and Gemini into zero-click data-theft channels
• Aug 20AttacksPoisoned Rust crates ran a backdoor at compile time, on infrastructure Wiz ties to North Korean campaigns
• Aug 19AttacksTrellix counts more than 350 malicious skills in the OpenClaw agent registry delivering a credential stealer
• Aug 18DefenseVaronis discloses CoSnitch, a one-click Microsoft Copilot Personal flaw chain that could silently exfiltrate data from connected apps
• Aug 18AttacksAttackers exploit a critical SSRF flaw in the MLflow AI platform to steal cloud credentials
• Aug 18DefenseA malicious GitHub issue chained through Gemini CLI to Editor access on a Google Cloud project
• Aug 17AttacksCISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch

Week of Aug 101

• Aug 12AttacksA malicious MCP server turns hostile only after an agent's third tool call

Week of Aug 311

• Aug 9AttacksPoisoned observability logs drive AI coding agents, with a sandbox escape patched before disclosure
• Aug 8DefenseResearchers show Atlassian's Rovo AI assistant could be tricked into exfiltrating Jira and Confluence data
• Aug 6AttacksUnit 42 documents stolen AI API keys resold through proxy transfer stations, with about a million dollars billed before containment
• Aug 5PolicyThe BLADE Act would sanction foreign entities that extract US models through unauthorized access
• Aug 4AttacksCISA adds an actively exploited critical RCE in the Langflow AI-agent platform to its KEV catalog
• Aug 4DefensePillar Security shows a malicious GitHub issue could hijack Google's ADK triage agent to run code as a privileged agent
• Aug 4Attacksnpm worm in keyv and cacheable namespaces steals AI coding-tool credentials and persists via Claude Code and VS Code hooks
• Aug 4AttacksOkta documents gray-market services reselling frontier-model access — and reading every prompt that passes through
• Aug 3DefenseCISA open source software guidance tells organisations to treat opaque open-weight AI models as proprietary software
• Aug 3PolicyFive Senate Democrats demand a published framework for restricting access to US AI models
• Aug 3CapabilityPreprint reports a multi-agent framework evading all seven commercial endpoint security products it was tested against

Week of Jul 277

• Aug 1DefensePreprint reports rewriting only an agent's reasoning drops a chain-of-thought monitor's catch rate from about 95% to under 11%
• Jul 30DefenseMicrosoft ships Defender prompt injection protection in preview and unified agent security for Agent 365
• Jul 30DefenseOne malicious agent skill got past all eight open-source skill scanners tested
• Jul 30DefenseMandiant records a 1,444% rise in detected malicious open-source packages and names the crews behind two campaigns
• Jul 29DefenseSeventeen agencies update the minimum elements for a software bill of materials, and leave AI systems to separate guidance
• Jul 28DefenseHashiCorp patches CVSS 10.0 cross-tenant credential reuse flaw in Terraform MCP Server
• Jul 27DefenseNIST opens comment on a draft threat analysis for AI data centers

Week of Jul 204

• Jul 24Attacks"AgentForger" flaw let one phishing link stand up a persistent agent with a victim's access
• Jul 23DefenseUK AI Security Institute's control red team reports vulnerabilities in every version of an Anthropic agent monitor it tested
• Jul 20Attacks"FakeGit" weaponizes ~7,600 repos against coding agents
• Jul 20AttacksPillar Security reports sandbox escapes in four AI coding agents, triggered by content inside a repository

Week of Jul 131

• Jul 13DefenseOrca Security report finds 99.9% of fixable AI-package vulnerabilities remain unpatched

Week of Jul 64

• Jul 9DefenseAgent skill metadata fields can suppress permission prompts and hide a skill from the user
• Jul 8AttacksESET examined nearly 900,000 AI agent skills and found thousands outright malicious
• Jul 8DefenseThe best model judge gating an offensive agent's tool calls still falls short of human graders
• Jul 7DefenseOne permission was enough to plant persistent code inside Google Dialogflow CX agents

Week of Jun 291

• Jul 2AttacksZscaler ThreatLabz reports web content in the wild carrying indirect prompt injections aimed at autonomous browsing AI agents