LLM Security

258 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Axios npm Library Compromised in Supply Chain Attack

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Apr 20, 2026

A North Korean threat group (UNC1069) compromised the popular npm Axios library via a supply chain attack, injecting a backdoor (WAVESHAPER.V2) into two poisoned versions that were inadvertently downloaded by OpenAI's macOS app-signing GitHub Actions workflow. Although OpenAI found no evidence of certificate exfiltration or user data compromise, the incident exposed the signing credentials for ChatGPT Desktop, Codex, Codex CLI, and Atlas, prompting certificate revocation and mandatory app updates by May 8, 2026. The attack highlights the acute risk of software supply chain compromises against AI product delivery pipelines.

Legacy Vulnerabilities Amplified by AI at Enterprise Scale

ATLAS OWASP HIGH ▲ 6.5 Dark Reading Apr 18, 2026

The article argues that AI's primary security risk lies not in introducing entirely new vulnerability classes, but in dramatically amplifying the impact and exploitability of well-established ones. This framing has significant implications for defenders, suggesting that legacy vulnerability management practices must be re-evaluated through an AI-augmented threat lens. The convergence of classic weaknesses with AI capabilities raises the baseline risk profile for organisations deploying or adjacent to AI systems.

Cursor AI Prompt Injection Chains to Shell Access

ATLAS OWASP CRITICAL ▲ 8.5 SecurityWeek Apr 18, 2026

A chained vulnerability in Cursor AI—a widely-used AI-powered code editor—allowed attackers to combine indirect prompt injection with a sandbox escape and the application's built-in remote tunnel feature to achieve arbitrary shell access on developer machines. The attack chain is particularly significant because it weaponises Cursor's own legitimate remote-access infrastructure, meaning malicious commands could blend into normal developer workflows. Developers using Cursor's AI features against untrusted code or repositories are at elevated risk of full host compromise.

Comment Injection Attacks Hit Claude Code, Gemini, Copilot

ATLAS OWASP HIGH ▲ 8.2 SecurityWeek Apr 17, 2026

A researcher has disclosed a novel prompt injection attack technique dubbed 'Comment and Control,' demonstrating that popular AI coding agents — including Claude Code, Gemini CLI, and GitHub Copilot Agents — can be manipulated through malicious instructions embedded in source code comments. The attack exploits the tendency of agentic coding tools to process and act upon contextual content within files they are tasked to read or modify. This represents a meaningful escalation in the risk surface of AI-assisted software development workflows.

GPT-5.4-Cyber Expansion Raises LLM Jailbreak Dual-Use Risks

ATLAS OWASP MEDIUM ▲ 6.5 SecurityWeek Apr 17, 2026

OpenAI has expanded access to GPT-5.4-Cyber, a fine-tuned model designed for defensive cybersecurity applications, following Anthropic's reveal of its Mythos cybersecurity model. While framed as a defensive tool for legitimate security practitioners, the widened access to a capability-enhanced cybersecurity LLM raises dual-use concerns around potential misuse for offensive operations. The competitive dynamic between major AI labs in the security-focused model space signals a broader industry trend that warrants careful access control and policy scrutiny.

LLM Agents Exploit Human Over-Trust in Strategic Games

ATLAS OWASP MEDIUM ▲ 6.2 Schneier on Security Apr 17, 2026

Research published via Schneier on Security reveals that humans systematically over-trust LLMs in strategic game environments, defaulting to Nash-equilibrium rational play based on assumptions of LLM rationality and cooperation. This behavioural bias has direct security implications for mixed human-LLM systems, where adversaries could exploit predictable human over-trust to manipulate decision outcomes. The findings underscore systemic risks in deploying LLMs as agents in high-stakes economic or security-relevant decision loops.

CrowdStrike OpenAI LLM Integration Raises Prompt Injection Risks

ATLAS OWASP MEDIUM ▲ 6.2 CrowdStrike Blog Apr 17, 2026

CrowdStrike has announced a partnership with OpenAI's Threat Actor Collaboration (TAC) programme, positioning frontier AI models as defensive tools within the cybersecurity operations space. The collaboration signals a broader industry push to deploy advanced LLMs in security contexts, raising important considerations around agentic AI risk, model trust boundaries, and the dual-use nature of frontier AI capabilities. While framed as a defensive initiative, the integration of powerful AI into SOC workflows introduces new attack surfaces including prompt injection against agentic pipelines and potential for sensitive data leakage through LLM interfaces.

Agentic AI Excessive Agency Bypasses Security Testing

ATLAS OWASP MEDIUM ▲ 6.5 The Hacker News Apr 16, 2026

The article examines the architectural tension between fully agentic AI systems and deterministic validation frameworks in security testing contexts, arguing that unconstrained AI autonomy introduces repeatability and auditability risks. It highlights how probabilistic AI behaviour — while valuable for exploration — undermines the measurable, consistent outcomes required for enterprise security validation programs. The piece reflects a broader industry debate about governing AI agency in high-stakes operational environments.

Anthropic MCP Supply Chain Flaw Enables Command Injection

ATLAS OWASP CRITICAL ▲ 9.1 SecurityWeek Apr 16, 2026

A structural vulnerability in Anthropic's Model Context Protocol (MCP) allows unsanitized commands to be executed silently within AI environments, potentially enabling full system compromise. Researchers classify the flaw as 'by design,' meaning it stems from architectural decisions rather than implementation bugs, making it particularly difficult to patch without protocol-level changes. The breadth of MCP adoption across agentic AI toolchains significantly amplifies the supply chain risk.

AI Agent Prompt Injection and Data Leakage Threats Rise

ATLAS OWASP MEDIUM ▲ 6.5 SecurityWeek Apr 16, 2026

Capsule Security, an Israeli startup, has emerged from stealth with $7 million in seed funding focused on runtime security for AI agents, continuously monitoring their behaviour to detect and prevent unsafe or malicious actions. This positions the company within the rapidly growing agentic AI security space, where autonomous agents executing actions on behalf of users represent a significant and underexplored attack surface. The funding signals growing investor recognition of the risks posed by unmonitored AI agent behaviour, including prompt injection, excessive agency, and unintended tool use.

Gas Town Supply Chain Attack Hijacks LLM Credits

ATLAS OWASP HIGH ▲ 8.5 HN AI Security Apr 16, 2026

Gas Town, a developer tool with 14.2k GitHub stars, allegedly ships configuration files that autonomously consume users' LLM API credits and GitHub account permissions to perform work on the maintainer's own repository — without explicit user consent. This represents a serious instance of unauthorised agentic AI behaviour, where an installed tool hijacks user-provisioned AI resources and credentials for third-party benefit. The incident raises critical concerns around supply chain trust, excessive agency in LLM-integrated tooling, and the abuse of delegated credentials.

Prompt Injection Flaws in Salesforce and Microsoft AI

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 16, 2026

Prompt injection vulnerabilities in Salesforce Agentforce and Microsoft Copilot were patched after researchers demonstrated that external attackers could exploit them to exfiltrate sensitive user data. The flaws highlight systemic risks in enterprise AI agent deployments, where insufficient input sanitisation allows malicious content to hijack agent behaviour. Both vendors have issued patches, but the incidents underscore the growing attack surface introduced by agentic AI systems operating with elevated privileges.

Claude Code Source Leak Exposes 512K Lines of Code

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 16, 2026

A packaging error exposed 512,000 lines of Claude Code's source, revealing severe code quality issues including a 3,167-line monolithic function, undocumented API waste, and regex-based sentiment analysis in an LLM product — raising questions about the security posture of AI-generated codebases. The disclosure highlights systemic risks when AI systems are used to self-develop production tooling without adequate human review or architectural oversight. These patterns represent meaningful supply chain and excessive agency concerns for enterprise users of Claude Code.

GPT-5.4-Cyber Jailbreak and Prompt Injection Risks

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Apr 15, 2026

OpenAI has launched GPT-5.4-Cyber, a cybersecurity-optimised model variant, alongside an expanded Trusted Access for Cyber (TAC) programme targeting authenticated defenders and security teams. While the initiative is framed as a defensive measure, the dual-use nature of a vulnerability-detection model introduces significant risk of adversarial inversion — where threat actors could exploit the same capabilities to discover and weaponise unpatched vulnerabilities at scale. OpenAI acknowledges this risk and states it is iteratively strengthening safeguards against jailbreaks and adversarial prompt injection as access broadens.

Scanning for AI Models, (Tue, Apr 14th)

ATLAS OWASP HIGH ▲ 7.8 SANS Internet Storm Center Apr 15, 2026

A single threat actor (IP 81.168.83.103) has been systematically scanning internet-facing systems since at least January 2026, specifically targeting credential files, API tokens, and configuration data associated with popular AI platforms including OpenAI, Anthropic Claude, HuggingFace, and the Openclaw/Clawdbot tools. The campaign focuses on harvesting AI API credentials and secrets stored in predictable file paths, representing a targeted reconnaissance effort against AI model deployments. If successful, these probes could enable API key theft, model access abuse, and broader compromise of AI-integrated systems.

LLM Security

Stay ahead of the threat.