AI Security News

2026-03-14 | CodeWall / The Register

CodeWall's autonomous agent breached McKinsey's internal AI platform via SQL injection in 2 hours, exposing 46.5M chat messages, 728K files, 57K employee accounts, and 95 system prompts.

2026-03-03 | Palo Alto Networks

Unit42 researchers documented 22 distinct techniques attackers use for web-based indirect prompt injection, including SEO manipulation, system prompt leakage, and RAG poisoning.

2025-10-03 | MITRE NVD / Check Point

Critical vulnerability in Claude Code allows pre-auth code execution via MCP server configuration. CVSS 8.7. Users opening untrusted repositories execute arbitrary code.

2025-08-12 | Microsoft MSRC

Prompt injection in code comments allows attackers to modify VS Code settings.json and execute arbitrary commands on developer machines.

2025-12-10 | OWASP GenAI

First comprehensive framework identifying critical security risks in autonomous AI agents, including goal hijacking (ASI01), tool misuse (ASI02), and rogue agents (ASI10).

2026-02-28 | Security Research

Rapid escalation of Model Context Protocol vulnerabilities including SSRF, RCE, and authentication bypass across multiple implementations.

2026-08-01 | EU Commission

European Union begins enforcing AI Act requirements for high-risk AI systems with strict penalties for non-compliance.

2026-01-15 | Invariant Labs

Security scans reveal massive exposure of unprotected MCP servers, with 36% lacking any authentication mechanisms.

2025-09-18 | NVD

Remote code execution via malicious serialized objects in LangChain serialization pipeline.

2025-07-22 | NVD

Malicious code comments in files can trigger code execution through Cursor IDE's AI assistance.