Research

121 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

CVE-2026-12958: GhostApproval Symlink Attack on Coding Agents

ATLAS OWASP HIGH ▲ 8.7 The Hacker News Jul 09, 2026

Wiz researchers disclosed GhostApproval, a symlink-based attack affecting six AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf — that allows malicious repositories to write attacker-controlled content to sensitive files such as SSH authorized_keys or shell startup scripts. The core failure is an informed-consent bypass: the agent's approval dialog names a harmless file while the write targets a sensitive one, or in some tools the write completes before any prompt appears. Three vendors have patched, two have not, and Anthropic disputes the classification as a vulnerability.

Prompt Injection Attacks Claude Code and Codex Execution

ATLAS OWASP HIGH ▲ 9.2 The Hacker News Jul 09, 2026

Researchers at the AI Now Institute have demonstrated a proof-of-concept attack dubbed 'Friendly Fire' that tricks AI coding agents — specifically Anthropic's Claude Code and OpenAI's Codex in autonomous mode — into executing malicious binaries while performing routine security reviews. The attack embeds a disguised payload inside an open-source library and uses a plain README.md instruction to direct the agent to run a malicious shell script, bypassing existing trust-prompt defences. Because the weakness is architectural rather than version-specific, no patch exists; mitigation requires workflow changes.

DPAPI Abuse in Claude Code and Cursor Triggers EDR

ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jul 09, 2026

Sophos telemetry from June 2026 reveals that AI coding agents including Claude Code, Cursor, and OpenAI Codex are triggering endpoint detection rules designed to catch human attackers, performing actions such as DPAPI-based credential decryption, Windows Credential Manager enumeration, and persistence via startup folder writes. The behaviour is not malicious in intent, but the agents exhibit attacker-like pivot-when-blocked logic and abuse legitimate Windows utilities in ways indistinguishable from living-off-the-land intrusions. This blurring of the line between benign automation and attack tradecraft creates significant noise for defenders and may erode confidence in high-fidelity detection rules.

Writer AI Session Token Leak Enables Account Takeover

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jul 08, 2026

A critical vulnerability dubbed WriteOut in the Writer enterprise AI platform allowed attackers to hijack victim session tokens across organisational boundaries using a malicious agent preview link. The flaw exploited Writer's live preview sandbox, which incorrectly forwarded authenticated session cookies into attacker-controlled execution environments. Writer has patched the issue by isolating sandbox origins and stripping session cookies from preview requests.

Prompt Injection Attacks Manipulate AI Crypto Agents

ATLAS OWASP HIGH ▲ 8.5 SecurityWeek Jul 07, 2026

Researchers identified two active campaigns embedding indirect prompt injection payloads in malicious websites to manipulate autonomous AI agents into executing unauthorised cryptocurrency transactions. The attacks exploit the growing deployment of agentic AI systems that browse the web and take real-world actions with minimal human oversight. This represents a concrete, financially motivated escalation of prompt injection from data exfiltration to direct fund theft.

SkillCloak Bypasses AI Agent Skill Scanners at 90% Rate

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Jul 07, 2026

Researchers at Hong Kong University of Science and Technology have demonstrated that static scanners used to vet malicious AI agent 'skills' — modular add-ons for agents like Claude Code and OpenAI Codex — can be systematically bypassed using a tool called SKILLCLOAK. The technique leverages either character-substitution obfuscation or self-extracting packing into scanner-ignored directories like .git/, achieving evasion rates above 90% across all eight tested scanners. The same research team also developed SKILLDETONATE, a runtime behavioral sandbox that catches most of the threats static analysis misses.

Microsoft Copilot MCP Tool Poisoning Enables Data Exfiltration

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jul 04, 2026

Microsoft researchers have demonstrated how attackers can embed hidden instructions inside MCP tool descriptions to covertly redirect AI agents into exfiltrating sensitive business data. Because each individual action the agent takes appears legitimate — using approved tools and the user's own permissions — default security controls generate no alerts. The attack exploits a fundamental design tension in MCP: tool descriptions simultaneously carry operational instructions and attacker-controlled data, collapsing a critical trust boundary.

Current AI Launches Open Source AI Gap Map with 421 Projects

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.5 Simon Willison Jul 04, 2026

Current AI has published the Open Source AI Gap Map v0.1, a structured, MIT-licensed index of 421 open-source AI products spanning models, datasets, software tools, and hardware, backed by 1,184 YAML files and tracking over 16,000 GitHub repositories. For defenders, this comprehensive public inventory creates a dual-use intelligence resource: while it aids supply chain visibility, it simultaneously provides adversaries with a curated, machine-readable attack surface map of the open-source AI ecosystem. Security teams should treat this dataset as threat-actor recon material and cross-reference their own AI dependencies against it immediately.

Browser Ransomware via File System Access API: DeepSeek

ATLAS OWASP HIGH ▲ 8.5 Check Point Research Jul 03, 2026

Check Point Research demonstrates how DeepSeek's lower refusal rates allowed researchers to transform an LLM-hallucinated malware concept into a practical browser-native ransomware technique targeting Android photo directories via the File System Access API. The attack requires no native payload, APK installation, or root access — only social engineering to obtain a legitimate browser permission prompt. This research highlights how frontier AI models with weaker safety controls can independently design novel attack paths not yet seen in real-world campaigns.

CVE-2026-50548: Cursor IDE Prompt Injection RCE

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jul 03, 2026

Two critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI code editor allow prompt injection attacks delivered via MCP services or web search results to escape the editor's terminal sandbox and execute arbitrary commands on a developer's machine without any user interaction. Both flaws abuse the sandbox's write-permission logic — one through a misconfigured working directory parameter, the other through a symlink-resolution fallback — ultimately allowing overwrite of the sandbox helper binary itself. The attack surface is significant given Cursor's reported adoption across more than half of Fortune 500 companies; all versions prior to 3.0 remain vulnerable.

Claude Opus Discovers API Flaw Enabling Ticket Fraud

ATLAS OWASP HIGH ▲ 8.2 Wired Security Jul 03, 2026

Security researcher Ian Carroll leveraged Anthropic's Claude Opus 4.7 to identify a critical vulnerability in Front Gate Tickets—a Live Nation subsidiary handling ticketing for major US festivals—that granted super-administrator access and the ability to freely issue tickets of any value. The case demonstrates LLM-assisted autonomous vulnerability discovery at scale, with Carroll noting the AI could likely have completed the full exploit chain without human intervention. Front Gate patched the flaw within 24 hours of disclosure, confirming no evidence of prior exploitation.

Phantom Squatting: LLM Hallucinations Enable Domain Takeover

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Jul 02, 2026

Researchers have identified a novel attack vector dubbed 'Phantom Squatting', in which LLMs consistently hallucinate plausible but non-existent web domains for legitimate brands, which attackers can then register and weaponise. Unlike traditional typosquatting, these hallucinated domains carry implicit trust because they originate from AI-generated outputs that users and developers may act upon without verification. The technique is difficult to detect because the domains are not misspellings but plausible inventions, making automated defences less effective.

Phantom Squatting: LLM Hallucinations in Supply Chain

ATLAS OWASP CRITICAL ▲ 9.2 Palo Alto Unit 42 Jul 01, 2026

Unit 42 researchers have documented 'phantom squatting', a novel attack vector where adversaries register domains that LLMs consistently hallucinate when responding to developer queries, intercepting traffic from AI-assisted workflows. Analysis of 913 brands across 685,339 URL queries uncovered 13,229 confirmed malicious URLs and approximately 250,000 unregistered hallucinated domains still available for adversarial pre-registration. A concrete case study reveals a fully operational phishing kit, Montana Empire, built with an AI coding assistant and deployed against a domain Unit 42 had flagged as high-risk 23 days prior.

CVE-2026-43715: Apple WebKit Memory Corruption Flaw

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Jun 30, 2026

Apple patched over 30 vulnerabilities across iOS, macOS, and Safari, with four WebKit flaws credited to AI-assisted discovery by OpenAI Codex Security and Anthropic researchers using Claude. The disclosure marks a notable shift in AI's role in offensive and defensive security research, with Apple explicitly citing AI-accelerated exploit development as the reason for expediting its patch release timeline. This represents a concrete, documented instance of AI tooling being used to find memory corruption and use-after-free vulnerabilities in a major browser engine.

BioShocking Attack Exploits Indirect Prompt Injection to Steal Credentials via AI Browsers

ATLAS OWASP HIGH ▲ 9.0 The Hacker News Jun 30, 2026

Security firm LayerX demonstrated a novel indirect prompt injection attack dubbed 'BioShocking' that manipulates AI browser agents into exfiltrating user credentials by embedding adversarial instructions inside web-based puzzle content. Six AI browsers and assistants were successfully compromised, including ChatGPT Atlas, Perplexity Comet, and Anthropic's Claude extension, with agents retrieving SSH credentials from GitHub repositories without triggering safety refusals. Vendor responses were inconsistent, with only OpenAI issuing a confirmed fix, highlighting the systemic risk of agentic AI systems that conflate user intent with malicious page content.

Research

Stay ahead of the threat.