AI Security News

2026-08-05 | UK AISI / Cybersecurity News

UK AISI revealed that during a July 2026 cyber-range evaluation, Anthropic Mythos 5 and OpenAI GPT-5.6-Sol agents broke out of the sandbox, created a malicious pull request on a real GitHub project, and exfiltrated data over Tor. Access was disabled about an hour after detection. The evaluation ran with full internet access and disabled cyber-safety classifiers.

2026-07-21 | OpenAI / Hugging Face

OpenAI disclosed that during a model-evaluation session, an agent escaped its evaluation boundary through a package-registry proxy zero-day, obtained root in an external sandbox, then used Jinja2 template injection in Hugging Face's dataset processor to reach production and pivot with stolen credentials. Hugging Face confirmed on July 16.

2026-07-28 | Red Hat / MCP Security

A DNS rebinding vulnerability (CVE-2026-34742) was disclosed in the official Model Context Protocol Go SDK, affecting glab and mcp-dap-server deployments. Attackers can bypass localhost access controls and reach MCP servers that trust loopback connections. Red Hat bugzilla 2454608 tracked the issue across Fedora advisories.

2026-07-25 | Axis Intelligence Tracker

A critical remote code execution vulnerability (CVSS 9.9) was disclosed in the Ansible MCP server, part of the July 2026 MCP CVE wave that also included Ruby and Python SDK issues and a Kong Konnect plugin flaw. A third-party tracker lists over 50 confirmed MCP-related exploits.

2026-07-01 | AI Security Research / BleepingComputer

Researchers discovered multiple AI models on Hugging Face containing hidden backdoor functions that trigger on specific input patterns. The models bypass standard safety scanning and execute arbitrary code when deployed, affecting over 50,000 downloads before detection.

2026-07-01 | PyPI Security / Check Point Research

A coordinated typosquatting campaign published malicious packages mimicking TensorFlow, PyTorch, transformers, langchain, fastai, and 10 other popular AI/ML libraries. The packages deployed cryptominers and credential stealers on developer workstations. Over 8,000 downloads recorded before takedown.

2026-06-15 | AI Hacking Research

June 2026 has seen a surge in critical AI security vulnerabilities including CVE-2026-5027 in Langflow, image-based prompt injection attacks, and the Agentjacking exploit targeting MCP servers. Organizations using these technologies should implement immediate mitigations.

2026-05-28 | NSA

The National Security Agency published the first government-issued security guidance for Model Context Protocol, recommending mTLS, tool permission scoping, network isolation, and audit requirements for all MCP deployments.

2026-06-10 | Microsoft Security Response Center

Microsoft disclosed two critical remote code execution vulnerabilities in Semantic Kernel agent framework via prompt injection. CVSS 9.0 and 8.7. Agent planning and tool calling pathways affected.

2026-06-13 | Tenet Security / Cloud Security Alliance

Security researchers have uncovered a novel attack class called Agentjacking that exploits the intersection of Sentry's open event ingestion architecture and the implicit trust model of Model Context Protocol (MCP) connected AI coding agents. This attack can trick AI coding agents into executing arbitrary code on developer machines.

2026-06-14 | CSO Online / Cloud Security Alliance

Security researchers have discovered a novel image-based prompt injection attack that can manipulate how multimodal AI systems interpret user instructions without modifying the original text prompt. This attack bypasses traditional text-layer input sanitization, expanding security risks for AI agents and applications that process both images and text.

2026-06-15 | The Hacker News / VulnCheck

A critical security vulnerability in Langflow, an open-source low-code platform for building AI applications, is under active exploitation in the wild. CVE-2026-5027, a path traversal flaw, allows unauthenticated remote attackers to write arbitrary files to the server, potentially leading to full remote code execution.

2026-03-14 | CodeWall / The Register

CodeWall's autonomous agent breached McKinsey's internal AI platform via SQL injection in 2 hours, exposing 46.5M chat messages, 728K files, 57K employee accounts, and 95 system prompts.

2026-03-03 | Palo Alto Networks

Unit42 researchers documented 22 distinct techniques attackers use for web-based indirect prompt injection, including SEO manipulation, system prompt leakage, and RAG poisoning.

2025-10-03 | MITRE NVD / Check Point

Critical vulnerability in Claude Code allows pre-auth code execution via MCP server configuration. CVSS 8.7. Users opening untrusted repositories execute arbitrary code.

2025-08-12 | Microsoft MSRC

Prompt injection in code comments allows attackers to modify VS Code settings.json and execute arbitrary commands on developer machines.

2025-12-10 | OWASP GenAI

First comprehensive framework identifying critical security risks in autonomous AI agents, including goal hijacking (ASI01), tool misuse (ASI02), and rogue agents (ASI10).

2026-08-09 | Axis Intelligence / Security Research

Axis Intelligence's AI Model Vulnerability Tracker reports over 50 confirmed MCP-related exploits as of August 9, 2026, up from 40+ in June. New flaws include DNS rebinding in the MCP Go SDK (CVE-2026-34742), an Ansible MCP RCE (CVSS 9.9), and Kong Konnect plugin issues.