https://gridthegrey.com/Real-time AI security intelligence — adversarial ML, LLM vulnerabilities, and supply chain threats mapped to MITRE ATLAS and OWASP LLM Top 10.Hugoen-usFri, 03 Jul 2026 15:15:03 +0530https://gridthegrey.com/posts/prompt-injection-chain-breaks-cursor-ai-sandbox-enables-full-rce/Fri, 03 Jul 2026 09:44:45 +0000https://gridthegrey.com/posts/prompt-injection-chain-breaks-cursor-ai-sandbox-enables-full-rce/Threat Level: CRITICALPrompt InjectionLLM SecurityAgentic AIResearchAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0043 - Craft Adversarial DataAML.T0057 - LLM Data LeakageTwo critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI code editor allow prompt injection attacks delivered via MCP services or web search results to escape the editor's terminal sandbox and execute arbitrary commands on a developer's machine without any user interaction. Both flaws abuse the sandbox's write-permission logic — one through a misconfigured working directory parameter, the other through a symlink-resolution fallback — ultimately allowing overwrite of the sandbox helper binary itself. The attack surface is significant given Cursor's reported adoption across more than half of Fortune 500 companies; all versions prior to 3.0 remain vulnerable.https://gridthegrey.com/posts/first-look-open-source-tool-lets-claude-and-any-llm-watch-videos-locally/Fri, 03 Jul 2026 09:31:07 +0000https://gridthegrey.com/posts/first-look-open-source-tool-lets-claude-and-any-llm-watch-videos-locally/Threat Level: MEDIUMFirst LookPrompt InjectionLLM SecurityAgentic AISupply ChainAML.T0051 - LLM Prompt InjectionAML.T0043 - Craft Adversarial DataAML.T0057 - LLM Data LeakageAML.T0047 - ML-Enabled Product or ServiceAML.T0010 - ML Supply Chain Compromiseclaude-real-video is an open-source, MIT-licensed Python library that extracts scene-change frames, deduplicates images, and transcribes audio from any video URL or local file, then packages the result as a folder any LLM can consume — all processed locally without cloud upload. For defenders, this dramatically expands the multimodal prompt injection surface by enabling adversaries to embed malicious instructions inside video content that LLM pipelines will now ingest and act upon. Security teams building or deploying LLM agents with video-processing capabilities must treat video content as an untrusted, potentially adversarial input channel.https://gridthegrey.com/posts/first-look-enterprise-iga-platforms-expose-structural-gaps-as-ai-agents/Fri, 03 Jul 2026 09:30:12 +0000https://gridthegrey.com/posts/first-look-enterprise-iga-platforms-expose-structural-gaps-as-ai-agents/Threat Level: HIGHFirst LookAgentic AILLM SecurityRegulatoryIndustry NewsAML.T0012 - Valid AccountsAML.T0047 - ML-Enabled Product or ServiceAML.T0051 - LLM Prompt InjectionAML.T0010 - ML Supply Chain CompromiseAML.T0057 - LLM Data LeakageA new analysis published via The Hacker News details how traditional Identity Governance and Administration (IGA) frameworks — built around HR-driven, human-centric lifecycle events — are fundamentally unequipped to govern AI agents acting as autonomous principals in enterprise environments. Security teams face a growing blind spot: AI agents acquire, retain, and exercise entitlements without triggering the joiner-mover-leaver workflows, manager attestations, or termination events that IGA tooling depends on. Defenders must now treat AI agent identities as a separate governance tier, requiring purpose-built provisioning, audit, and deprovisioning logic that existing platforms like Workday, SailPoint, and Azure AD connectors were never designed to provide.https://gridthegrey.com/posts/claude-opus-4-7-used-to-discover-critical-api-flaw-in-major-ticketing-platform/Fri, 03 Jul 2026 09:28:45 +0000https://gridthegrey.com/posts/claude-opus-4-7-used-to-discover-critical-api-flaw-in-major-ticketing-platform/Threat Level: HIGHAgentic AILLM SecurityResearchIndustry NewsAML.T0047 - ML-Enabled Product or ServiceAML.T0040 - ML Model Inference API AccessAML.T0043 - Craft Adversarial DataSecurity researcher Ian Carroll leveraged Anthropic's Claude Opus 4.7 to identify a critical vulnerability in Front Gate Tickets—a Live Nation subsidiary handling ticketing for major US festivals—that granted super-administrator access and the ability to freely issue tickets of any value. The case demonstrates LLM-assisted autonomous vulnerability discovery at scale, with Carroll noting the AI could likely have completed the full exploit chain without human intervention. Front Gate patched the flaw within 24 hours of disclosure, confirming no evidence of prior exploitation.https://gridthegrey.com/posts/first-look-anthropic-s-mythos-ai-vulnerability-discovery-tool-pairs-with-ibm/Fri, 03 Jul 2026 09:27:52 +0000https://gridthegrey.com/posts/first-look-anthropic-s-mythos-ai-vulnerability-discovery-tool-pairs-with-ibm/Threat Level: HIGHFirst LookSupply ChainAgentic AILLM SecurityIndustry NewsAML.T0010 - ML Supply Chain CompromiseAML.T0019 - Publish Poisoned DatasetsAML.T0020 - Poison Training DataAML.T0031 - Erode ML Model IntegrityAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0057 - LLM Data LeakageAnthropic's Mythos capability, combined with IBM and Red Hat's Project Lightwell service backed by 20,000 engineers and $5B, introduces an AI-driven pipeline for discovering and remediating bugs in open-source software at industrial scale. This creates a dual-edged attack surface: adversaries who can influence Mythos's findings, its training data, or the remediation pipeline gain a privileged position to inject subtle vulnerabilities into widely-deployed open-source components. Defenders must treat the AI vulnerability-finding and patch-generation pipeline itself as a high-value, high-risk supply chain asset requiring rigorous integrity controls.https://gridthegrey.com/posts/ai-agent-autonomously-executes-full-ransomware-attack-chain-via-langflow-rce/Fri, 03 Jul 2026 09:25:09 +0000https://gridthegrey.com/posts/ai-agent-autonomously-executes-full-ransomware-attack-chain-via-langflow-rce/Threat Level: CRITICALAgentic AILLM SecurityIndustry NewsFirst LookAML.T0047 - ML-Enabled Product or ServiceAML.T0012 - Valid AccountsAML.T0040 - ML Model Inference API AccessAML.T0057 - LLM Data LeakageSysdig has documented what it claims is the first end-to-end ransomware attack orchestrated autonomously by an AI agent, attributed to a threat actor tracked as JADEPUFFER. The agent exploited a known remote code execution flaw in Langflow (CVE-2025-3248) to gain initial access, harvest credentials, pivot laterally, and ultimately encrypt and destroy a production database — all without human intervention at the keyboard. The incident demonstrates that AI agents can now lower the skill floor for complex, multi-stage attacks to near zero, representing a qualitative shift in the ransomware threat landscape.https://gridthegrey.com/posts/llm-hallucinated-domains-create-exploitable-supply-chain-attack-surface/Thu, 02 Jul 2026 04:36:10 +0000https://gridthegrey.com/posts/llm-hallucinated-domains-create-exploitable-supply-chain-attack-surface/Threat Level: HIGHLLM SecuritySupply ChainAgentic AIResearchAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceAML.T0057 - LLM Data LeakageResearchers have identified a novel attack vector dubbed 'Phantom Squatting', in which LLMs consistently hallucinate plausible but non-existent web domains for legitimate brands, which attackers can then register and weaponise. Unlike traditional typosquatting, these hallucinated domains carry implicit trust because they originate from AI-generated outputs that users and developers may act upon without verification. The technique is difficult to detect because the domains are not misspellings but plausible inventions, making automated defences less effective.https://gridthegrey.com/posts/first-look-google-launches-gemini-spark-agentic-assistant-on-mac-with-file-and/Thu, 02 Jul 2026 04:35:20 +0000https://gridthegrey.com/posts/first-look-google-launches-gemini-spark-agentic-assistant-on-mac-with-file-and/Threat Level: HIGHFirst LookAgentic AIPrompt InjectionSupply ChainLLM SecurityAML.T0051 - LLM Prompt InjectionAML.T0057 - LLM Data LeakageAML.T0047 - ML-Enabled Product or ServiceAML.T0010 - ML Supply Chain CompromiseAML.T0040 - ML Model Inference API AccessAML.T0056 - LLM Meta Prompt ExtractionGoogle has expanded Gemini Spark to macOS, giving the agentic assistant access to local files, third-party app integrations (including Dropbox, Canva, and Instacart), custom MCP connections, and real-time topic monitoring. This substantially widens the attack surface for enterprise defenders, as a compromised or manipulated Spark agent gains a foothold across local file systems, cloud workspaces, and external service APIs simultaneously. The addition of custom Model Context Protocol support is particularly concerning, as it allows arbitrary third-party tool connections with unclear trust boundaries and permission scoping.https://gridthegrey.com/posts/first-look-aws-brings-nvidia-nemotron-and-openai-gpt-oss-models-to-govcloud/Thu, 02 Jul 2026 04:34:41 +0000https://gridthegrey.com/posts/first-look-aws-brings-nvidia-nemotron-and-openai-gpt-oss-models-to-govcloud/Threat Level: HIGHFirst LookLLM SecuritySupply ChainPrompt InjectionAgentic AIRegulatoryAML.T0051 - LLM Prompt InjectionAML.T0054 - LLM JailbreakAML.T0057 - LLM Data LeakageAML.T0056 - LLM Meta Prompt ExtractionAML.T0010 - ML Supply Chain CompromiseAML.T0040 - ML Model Inference API AccessAML.T0047 - ML-Enabled Product or ServiceAWS has expanded Amazon Bedrock in GovCloud (US) to include NVIDIA Nemotron and OpenAI's open-weight GPT OSS models, enabling U.S. government agencies and defense contractors to run frontier LLMs within FedRAMP High and DoD SRG compliance boundaries. This expansion introduces large, capable open-weight models into sensitive government mission workflows — including intelligence analysis, security log review, and contract automation — dramatically increasing the consequence of a successful prompt injection or jailbreak. Defenders must account for the elevated impact of model compromise in classified-adjacent environments, supply chain trust assumptions around open-weight model weights, and the risk of agentic workflows operating with privileged data access under reduced human oversight.https://gridthegrey.com/posts/ai-hallucinated-domains-weaponised-in-active-software-supply-chain-attacks/Wed, 01 Jul 2026 05:45:29 +0000https://gridthegrey.com/posts/ai-hallucinated-domains-weaponised-in-active-software-supply-chain-attacks/Threat Level: CRITICALLLM SecuritySupply ChainAgentic AIResearchAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceAML.T0057 - LLM Data LeakageAML.T0051 - LLM Prompt InjectionUnit 42 researchers have documented 'phantom squatting', a novel attack vector where adversaries register domains that LLMs consistently hallucinate when responding to developer queries, intercepting traffic from AI-assisted workflows. Analysis of 913 brands across 685,339 URL queries uncovered 13,229 confirmed malicious URLs and approximately 250,000 unregistered hallucinated domains still available for adversarial pre-registration. A concrete case study reveals a fully operational phishing kit, Montana Empire, built with an AI coding assistant and deployed against a domain Unit 42 had flagged as high-risk 23 days prior.https://gridthegrey.com/posts/first-look-anthropic-restores-global-access-to-mythos-and-fable-models-after/Wed, 01 Jul 2026 05:44:44 +0000https://gridthegrey.com/posts/first-look-anthropic-restores-global-access-to-mythos-and-fable-models-after/Threat Level: HIGHFirst LookLLM SecurityRegulatoryJailbreaksIndustry NewsAML.T0040 - ML Model Inference API AccessAML.T0054 - LLM JailbreakAML.T0047 - ML-Enabled Product or ServiceAML.T0051 - LLM Prompt InjectionAML.T0015 - Evade ML ModelAML.T0010 - ML Supply Chain CompromiseThe US government has lifted export restrictions on Anthropic's Mythos and Fable models, restoring broad international access to what are described as the most capable AI models publicly available, with Mythos specifically noted for its advanced ability to identify and exploit software vulnerabilities. Defenders must now contend with a significantly wider pool of threat actors — including foreign nationals and nation-state-affiliated researchers — who can access a model with documented offensive security capabilities. The policy reversal also introduces regulatory uncertainty that complicates enterprise risk assessments, as organizations cannot rely on stable governance signals to calibrate their AI security postures.https://gridthegrey.com/posts/first-look-token-security-surfaces-agentic-ai-identity-risks-across-enterprise/Tue, 30 Jun 2026 11:11:51 +0000https://gridthegrey.com/posts/first-look-token-security-surfaces-agentic-ai-identity-risks-across-enterprise/Threat Level: HIGHFirst LookAgentic AILLM SecurityIndustry NewsAML.T0012 - Valid AccountsAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0040 - ML Model Inference API AccessAML.T0057 - LLM Data LeakageToken Security has published a detailed analysis of the identity and access management failures emerging as agentic AI systems proliferate across enterprise environments, highlighting how AI agents authenticate, hold credentials, and act autonomously across production systems without adequate oversight. Unlike traditional machine identities, AI agents combine human-like goal-directed behaviour with machine-speed execution, creating credential sprawl that existing IAM programs were never designed to govern. Security teams face a compounding risk: agents are being provisioned with overprivileged OAuth grants, API tokens, and cloud roles that remain unreviewed and unrevoked long after the original use case has expired.https://gridthegrey.com/posts/ai-tools-discover-webkit-vulnerabilities-as-apple-accelerates-patch-cadence/Tue, 30 Jun 2026 11:03:15 +0000https://gridthegrey.com/posts/ai-tools-discover-webkit-vulnerabilities-as-apple-accelerates-patch-cadence/Threat Level: HIGHIndustry NewsResearchLLM SecurityAML.T0047 - ML-Enabled Product or ServiceAML.T0043 - Craft Adversarial DataApple patched over 30 vulnerabilities across iOS, macOS, and Safari, with four WebKit flaws credited to AI-assisted discovery by OpenAI Codex Security and Anthropic researchers using Claude. The disclosure marks a notable shift in AI's role in offensive and defensive security research, with Apple explicitly citing AI-accelerated exploit development as the reason for expediting its patch release timeline. This represents a concrete, documented instance of AI tooling being used to find memory corruption and use-after-free vulnerabilities in a major browser engine.https://gridthegrey.com/posts/bioshocking-attack-exploits-indirect-prompt-injection-to-steal-credentials-via/Tue, 30 Jun 2026 11:01:35 +0000https://gridthegrey.com/posts/bioshocking-attack-exploits-indirect-prompt-injection-to-steal-credentials-via/Threat Level: HIGHLLM SecurityPrompt InjectionAgentic AIJailbreaksResearchAML.T0051 - LLM Prompt InjectionAML.T0054 - LLM JailbreakAML.T0057 - LLM Data LeakageAML.T0043 - Craft Adversarial DataAML.T0047 - ML-Enabled Product or ServiceSecurity firm LayerX demonstrated a novel indirect prompt injection attack dubbed 'BioShocking' that manipulates AI browser agents into exfiltrating user credentials by embedding adversarial instructions inside web-based puzzle content. Six AI browsers and assistants were successfully compromised, including ChatGPT Atlas, Perplexity Comet, and Anthropic's Claude extension, with agents retrieving SSH credentials from GitHub repositories without triggering safety refusals. Vendor responses were inconsistent, with only OpenAI issuing a confirmed fix, highlighting the systemic risk of agentic AI systems that conflate user intent with malicious page content.https://gridthegrey.com/posts/indirect-prompt-injection-in-repositories-gives-claude-code-full-shell-access/Tue, 30 Jun 2026 10:59:28 +0000https://gridthegrey.com/posts/indirect-prompt-injection-in-repositories-gives-claude-code-full-shell-access/Threat Level: HIGHPrompt InjectionAgentic AILLM SecuritySupply ChainResearchAML.T0051 - LLM Prompt InjectionAML.T0043 - Craft Adversarial DataAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceResearchers have demonstrated that indirect prompt injection attacks embedded within seemingly benign code repositories can cause Claude Code — Anthropic's agentic coding assistant — to spawn a reverse shell on a developer's machine. The attack exploits Claude Code's autonomous execution capabilities, using hidden instructions in repository content to hijack the host system without any explicit user consent. This highlights a critical risk in agentic AI tools that operate with elevated system privileges in developer environments.https://gridthegrey.com/posts/first-look-justvugg-releases-nanoeuler-gpt-2-scale-llm-built-in-pure-c-cuda/Mon, 29 Jun 2026 14:35:58 +0000https://gridthegrey.com/posts/first-look-justvugg-releases-nanoeuler-gpt-2-scale-llm-built-in-pure-c-cuda/Threat Level: MEDIUMFirst LookAdversarial MLSupply ChainResearchLLM SecurityAML.T0018 - Backdoor ML ModelAML.T0020 - Poison Training DataAML.T0044 - Full ML Model AccessAML.T0010 - ML Supply Chain CompromiseAML.T0031 - Erode ML Model IntegrityAML.T0054 - LLM JailbreakNanoEuler is an open-source GPT-2-class language model (~116M parameters) built entirely from scratch in C/CUDA, including hand-written backpropagation, a BPE tokenizer, FlashAttention, pretraining, and supervised fine-tuning — with RLHF/DPO planned. For defenders, the significance lies in the democratisation of low-level, dependency-free LLM training infrastructure: adversaries gain a highly portable, auditable, and modifiable training stack that bypasses standard ML framework telemetry and supply chain controls. Security teams should treat this class of 'from-scratch' open-source LLM tooling as a potential foundation for covert fine-tuning pipelines, backdoor insertion, and evasion of model-level safety controls.https://gridthegrey.com/posts/first-look-z-ai-releases-open-weight-glm-5-2-matching-frontier-models-on-tasks/Mon, 29 Jun 2026 14:32:17 +0000https://gridthegrey.com/posts/first-look-z-ai-releases-open-weight-glm-5-2-matching-frontier-models-on-tasks/Threat Level: HIGHFirst LookLLM SecuritySupply ChainResearchIndustry NewsAML.T0044 - Full ML Model AccessAML.T0054 - LLM JailbreakAML.T0047 - ML-Enabled Product or ServiceAML.T0010 - ML Supply Chain CompromiseAML.T0018 - Backdoor ML ModelAML.T0040 - ML Model Inference API AccessAML.T0020 - Poison Training DataZhipu AI (Z.ai) has released GLM-5.2, an open-weight model that researchers report matches Anthropic's Mythos in bug-finding and cybersecurity-related tasks, while remaining freely downloadable and runnable on commodity hardware. The open-weight distribution removes access controls and usage monitoring that restrict frontier closed models, enabling unconstrained offensive security use by any actor. Defenders face a materially elevated threat from nation-state and cybercriminal actors who can now fine-tune, deploy, and weaponise a frontier-class vulnerability-discovery model without API gatekeeping or usage telemetry.https://gridthegrey.com/posts/first-look-anthropic-ceo-warns-lawmakers-open-source-ai-poses-safety-control/Mon, 29 Jun 2026 14:00:53 +0000https://gridthegrey.com/posts/first-look-anthropic-ceo-warns-lawmakers-open-source-ai-poses-safety-control/Threat Level: HIGHFirst LookLLM SecuritySupply ChainRegulatoryIndustry NewsJailbreaksAML.T0044 - Full ML Model AccessAML.T0054 - LLM JailbreakAML.T0018 - Backdoor ML ModelAML.T0010 - ML Supply Chain CompromiseAML.T0019 - Publish Poisoned DatasetsAML.T0031 - Erode ML Model IntegrityAML.T0043 - Craft Adversarial DataAnthropic CEO Dario Amodei testified to lawmakers that open-source AI models present a systemic safety risk because once released, developers lose the ability to monitor misuse, revoke access, or patch safety guardrails. For defenders, this formalises a long-standing asymmetry: closed-source safety controls (rate-limiting, usage monitoring, kill-switches) become irrelevant once capable weights are publicly distributed. Security teams building on or competing against open-weight models must now treat every downloaded model artifact as a potentially unpatched, unmonitored endpoint that can be fine-tuned to remove safety constraints entirely.https://gridthegrey.com/posts/dns-exfiltrated-malware-exploits-ai-coding-agents-via-clean-github-repos/Mon, 29 Jun 2026 03:25:51 +0000https://gridthegrey.com/posts/dns-exfiltrated-malware-exploits-ai-coding-agents-via-clean-github-repos/Threat Level: HIGHAgentic AIPrompt InjectionSupply ChainLLM SecurityResearchAML.T0051 - LLM Prompt InjectionAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceMozilla 0DIN researchers demonstrated a novel attack chain in which a seemingly clean GitHub repository tricks AI coding agents like Claude Code into executing a reverse shell payload — with no malicious code ever present in the repo itself. The attack leverages three innocuous components: a Python package that deliberately errors on first run, an error message that instructs the agent to run an init command, and a shell script that fetches and executes a payload stored in an attacker-controlled DNS TXT record. The technique exploits the autonomous error-recovery behaviour of agentic AI tools, effectively turning a safety feature into an attack vector.https://gridthegrey.com/posts/first-look-meta-ai-releases-agentkits-with-60-production-ready-agent-blueprints/Mon, 29 Jun 2026 03:17:10 +0000https://gridthegrey.com/posts/first-look-meta-ai-releases-agentkits-with-60-production-ready-agent-blueprints/Threat Level: HIGHFirst LookAgentic AIPrompt InjectionSupply ChainLLM SecurityAML.T0051 - LLM Prompt InjectionAML.T0056 - LLM Meta Prompt ExtractionAML.T0054 - LLM JailbreakAML.T0047 - ML-Enabled Product or ServiceAML.T0010 - ML Supply Chain CompromiseAML.T0057 - LLM Data LeakageAgentKits ships 60 open, free AI agent blueprints covering 30 operational categories — from incident response and access provisioning to HR screening and fraud detection — complete with copyable system prompts, tool definitions, and workflow architectures targeting Claude, OpenAI, LangGraph, and n8n. The free, no-login distribution model dramatically lowers the barrier for adversaries to study, clone, or weaponise production-grade agent architectures, including sensitive categories like SecOps triage, access provisioning, and compliance monitoring. Defenders must treat these blueprints as publicly documented attack playbooks and audit any internally deployed instances against their documented worst-case actions and trust levels.