Research

Claude Mythos Generates Working Exploits for Firefox, Windows

ATLAS OWASP CRITICAL ▲ 9.2 SecurityWeek Jun 10, 2026

Anthropic's Claude Mythos Preview model demonstrated the ability to generate functional proof-of-concept exploits targeting known Firefox and Windows vulnerabilities within minutes to hours, compressing the traditional patch gap window dramatically. Testing also revealed that public Anthropic models with safety guardrails disabled could produce working exploits, though at a lower success rate than Mythos. The findings underscore how frontier LLMs are shifting the threat landscape for unpatched N-day vulnerabilities by automating and accelerating exploit development previously bottlenecked by scarce reverse engineering expertise.

Microsoft 365 Copilot Prompt Injection Threats in Enterprise

ATLAS OWASP MEDIUM ▲ 6.5 Microsoft Security Blog Jun 10, 2026

Microsoft has released a structured investigator playbook for reconstructing AI-related activity across Microsoft 365 Copilot and Azure AI services, addressing the challenge of converting raw telemetry into coherent incident timelines. The playbook targets threats already observed in enterprise deployments, including prompt injection attempts and unauthorized data access, and operationalizes a scope–context–signal methodology across Purview, Defender, and Sentinel. This guidance directly supports security teams responding to AI-specific incidents where unstructured telemetry has previously hindered attribution and impact assessment.

AI Worm Autonomously Generates Exploits at Runtime

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jun 10, 2026

University of Toronto researchers demonstrated a proof-of-concept AI worm that leverages a locally hosted open-weight LLM to autonomously reason through network targets, generate novel exploit chains at runtime, and self-replicate — achieving 62% network penetration across a 33-host testbed with no human intervention. Unlike traditional worms with fixed payloads, this system bypasses conventional patch-based defences by dynamically adapting attack logic to whatever vulnerabilities it discovers. The use of offline open-weight models eliminates dependency on commercial AI APIs, making it resilient to rate-limiting or platform-level safety controls.

Anthropic Claude Code Prompt Injection Leaks Secrets

ATLAS OWASP HIGH ▲ 9.1 Microsoft Security Blog Jun 08, 2026

Microsoft Threat Intelligence disclosed a vulnerability in Anthropic's Claude Code GitHub Action whereby prompt injection via untrusted GitHub content — issue bodies, PR descriptions, and comments — could cause the AI agent to read sensitive environment variables, including the ANTHROPIC_API_KEY, from /proc/self/environ. The flaw stemmed from inconsistent sandboxing: while subprocess execution paths like Bash were scrubbed of environment variables, the Read tool had no equivalent restriction. Anthropic patched the issue in Claude Code version 2.1.128 by blocking access to sensitive /proc filesystem paths.

AI Worm With Embedded LLM Enables Self-Propagation

ATLAS OWASP HIGH ▲ 7.5 Schneier on Security Jun 08, 2026

Researchers have prototyped an internet worm that bundles its own large language model, executing it on compromised hosts to enable fully decentralised propagation with no single point of control. The design mirrors John Brunner's 1975 fictional conception of a worm and echoes the destructive potential of WannaCry and NotPetya, but with the added capability of dynamically generating novel attacks by ingesting recent public vulnerability disclosures. The absence of a command-and-control chokepoint makes traditional takedown strategies ineffective, significantly raising the threat posed by AI-augmented malware.

Google Gemini Android Hijacked by Indirect Prompt Injection

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jun 04, 2026

SafeBreach researcher Or Yair demonstrated that malicious text embedded in WhatsApp, Slack, SMS, or Signal notifications could trigger indirect prompt injection against Google Gemini's Android Utilities feature, causing the assistant to execute real device actions without user awareness. A novel bypass technique called 'Fake Context Alignment' defeated Google's post-patch authorization checks by exploiting multilingual obfuscation and muted hyperlinks to trick victims into authorising sensitive actions. Google has patched the issue, but the research exposes a fundamentally large attack surface where any app capable of pushing a notification becomes a potential injection vector.

Adversa AI: 89% of AI Agents Fail Security Tests

ATLAS OWASP HIGH ▲ 8.2 SecurityWeek Jun 04, 2026

Adversa AI's AI Risk Quadrant report evaluated 100 AI agents across ten categories, finding that only 11 qualify as both capable and well-defended. The research identifies a structural 'power-protection inversion' where the most capable agents also present the widest attack surface, driven by a 'lethal trifecta' of private data access, exposure to untrusted content, and outbound action capability. Computer and coding agents showed the most severe exposure, raising urgent concerns about autonomous agent deployment in enterprise environments.

Claude Sandbox Escape Enables Credential Exfiltration

ATLAS OWASP MEDIUM ▲ 7.2 Simon Willison May 31, 2026

Anthropic has published detailed documentation of its sandboxing architecture across Claude.ai, Claude Code, and Claude Cowork, including disclosure of a previously identified credential exfiltration vector via the api.anthropic.com/v1/files endpoint. The writeup covers process-level isolation technologies including gVisor, Seatbelt, Bubblewrap, and full VM approaches, and candidly acknowledges security gaps that were missed. This transparency is notable for the agentic AI space, where sandbox documentation is typically sparse and trust is difficult to calibrate.

ChatGPT Markdown Injection Enables Phishing in Web Summarizer

ATLAS OWASP HIGH ▲ 8.5 The Hacker News May 31, 2026

Permiso Security has disclosed ChatGPhish, a vulnerability in ChatGPT's web summarisation feature that allows attacker-controlled Markdown payloads embedded in third-party pages to render phishing links, spoofed alerts, and QR codes directly within ChatGPT's trusted UI. The attack requires no user interaction beyond asking ChatGPT to summarise a malicious page, and can exfiltrate IP addresses, User-Agent strings, and Referer headers via auto-fetched remote images. The technique significantly expands the phishing attack surface beyond email into everyday AI-assisted browsing workflows, posing a particular risk in enterprise environments.

CogCAPTCHA30 Fingerprints AI Agents via Behavioral Analysis

ATLAS OWASP MEDIUM ▲ 6.5 HN AI Security May 31, 2026

Researchers have developed CogCAPTCHA30, a 30-task cognitive battery demonstrating that AI agents (GPT, Claude, Gemini) solve CAPTCHAs with statistically distinguishable behavioural patterns despite matching human accuracy. The study introduces a 'Process Turing Test' concept, showing output equivalence and process equivalence are uncorrelated — meaning AI agents can be detected not by what they answer, but by how they answer. This has direct implications for bot detection, anti-automation defences, and the arms race between AI-driven agents and human-verification systems.

FuzzingBrain V2 Discovers 29 Zero-Day Vulnerabilities

ATLAS OWASP HIGH ▲ 7.8 HN AI Security May 29, 2026

Researchers have developed FuzzingBrain V2, a multi-agent LLM system capable of autonomously discovering and reproducing software vulnerabilities with a 90% detection rate on a competitive benchmark dataset. The system discovered 29 zero-day vulnerabilities across 12 open-source projects, all confirmed by maintainers, raising both defensive and dual-use concerns for the security community. While positioned as a defensive research tool, the automation of end-to-end vulnerability discovery at this scale represents a meaningful shift in the offensive capability landscape.

GreyVibe Deploys ChatGPT and Gemini in LLM Attack Chain

ATLAS OWASP HIGH ▲ 7.5 SecurityWeek May 29, 2026

WithSecure has documented GreyVibe, a Russia-nexus threat actor systematically deploying ChatGPT, Google Gemini, and Ideogram AI across every phase of its attack chain — from phishing lure creation to custom malware development — against Ukrainian targets since August 2025. The group's LLM-assisted malware, LegionRelay, contained design flaws introduced during AI-generated development, which paradoxically allowed researchers to track the group over an extended period. The case illustrates both the operational leverage AI provides to moderately skilled threat actors and the novel forensic signatures that AI-assisted development can inadvertently introduce.

GreyVibe Uses ChatGPT and Gemini for Ukraine Cyberespionage

ATLAS OWASP HIGH ▲ 7.5 BleepingComputer May 29, 2026

A likely Russian threat group dubbed GreyVibe has been actively using commercial LLMs — including ChatGPT and Google Gemini — to generate high-quality phishing lures, malware tooling, and social-engineering content targeting Ukrainian military, government, and civilian organisations. WithSecure researchers identified LLM artefact markers embedded in campaign imagery, confirming AI-assisted content generation at scale. The case represents a concrete, documented example of adversarial LLM weaponisation in an active nation-state-adjacent cyberespionage campaign.

SQLite Blocks AI-Generated Code Contributions

ATLAS OWASP MEDIUM ▲ 6.2 Simon Willison May 29, 2026

SQLite has formally prohibited agentic code contributions and strengthened its policy language, reflecting growing concern over AI-generated submissions overwhelming open source maintainers. The project was forced to create a separate bug forum after being flooded with AI-generated reports of inconsistent quality. This represents an emerging operational security challenge for critical infrastructure software projects targeted by autonomous AI coding agents.

AI Supply Chain Compromise: Models Lack Bill of Materials

ATLAS OWASP MEDIUM ▲ 6.2 Dark Reading May 25, 2026

As AI systems proliferate across enterprise environments, the lack of standardised AI Bills of Materials (AI BOMs) leaves organisations blind to the components, training data, and dependencies embedded in deployed models. The article examines whether 2026 marks a turning point for AI BOM adoption as a risk management practice. Without visibility into AI supply chains, organisations remain exposed to hidden vulnerabilities including poisoned models, compromised dependencies, and undisclosed third-party components.

Research

Stay ahead of the threat.