https://gridthegrey.com/Real-time AI security intelligence — adversarial ML, LLM vulnerabilities, and supply chain threats mapped to MITRE ATLAS and OWASP LLM Top 10.Hugoen-usTue, 07 Jul 2026 13:20:48 +0530https://gridthegrey.com/posts/first-look-tencent-releases-hy3-295b-moe-open-source-model-with-256k-context/Tue, 07 Jul 2026 07:50:28 +0000https://gridthegrey.com/posts/first-look-tencent-releases-hy3-295b-moe-open-source-model-with-256k-context/Threat Level: MEDIUMFirst LookLLM SecuritySupply ChainJailbreaksIndustry NewsAML.T0044 - Full ML Model AccessAML.T0054 - LLM JailbreakAML.T0051 - LLM Prompt InjectionAML.T0018 - Backdoor ML ModelAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceTencent has released Hy3, a 295B-parameter Mixture-of-Experts open-source model under Apache 2.0, featuring 256K context length and temporarily available for free inference via OpenRouter. The model's large context window, open weights, and Chinese provenance expand the attack surface for defenders managing LLM supply chains, jailbreak campaigns, and influence operations. Security teams should treat this as another high-capability open-weight model requiring the same scrutiny applied to comparable releases from Mistral or Meta.https://gridthegrey.com/posts/first-look-nvidia-and-hugging-face-integrate-gr00t-1-7-into-lerobot-open/Tue, 07 Jul 2026 07:49:34 +0000https://gridthegrey.com/posts/first-look-nvidia-and-hugging-face-integrate-gr00t-1-7-into-lerobot-open/Threat Level: HIGHFirst LookSupply ChainData PoisoningAdversarial MLAgentic AIAML.T0019 - Publish Poisoned DatasetsAML.T0020 - Poison Training DataAML.T0018 - Backdoor ML ModelAML.T0010 - ML Supply Chain CompromiseAML.T0043 - Craft Adversarial DataAML.T0044 - Full ML Model AccessAML.T0031 - Erode ML Model IntegrityAML.T0047 - ML-Enabled Product or ServiceNVIDIA and Hugging Face have integrated the Isaac GR00T 1.7 vision-language-action model, Isaac Teleop framework, and a 350,000-trajectory open dataset into the LeRobot open-source robotics library, creating an end-to-end open pipeline for training and deploying physical AI systems. This dramatically lowers the barrier to fine-tuning and deploying robot foundation models, expanding the attack surface across the full ML supply chain — from poisoned community datasets to adversarially crafted demonstrations used in teleop data collection. Defenders responsible for robotics deployments must now contend with a large, loosely governed open-source ecosystem where compromised models or datasets can directly translate to unsafe physical-world behaviour.https://gridthegrey.com/posts/first-look-aws-launches-multi-turn-rl-infrastructure-for-amazon-nova-on-hyperpod/Tue, 07 Jul 2026 07:48:45 +0000https://gridthegrey.com/posts/first-look-aws-launches-multi-turn-rl-infrastructure-for-amazon-nova-on-hyperpod/Threat Level: HIGHFirst LookAgentic AIData PoisoningSupply ChainAdversarial MLLLM SecurityAML.T0020 - Poison Training DataAML.T0018 - Backdoor ML ModelAML.T0031 - Erode ML Model IntegrityAML.T0019 - Publish Poisoned DatasetsAML.T0010 - ML Supply Chain CompromiseAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0044 - Full ML Model AccessAWS has released a production-grade, event-driven multi-turn reinforcement learning training infrastructure for Amazon Nova models on SageMaker HyperPod, enabling enterprises to train agents that learn tool orchestration, error recovery, and sequential decision-making at scale. This materially expands the attack surface by introducing complex reward-routing pipelines, ephemeral compute provisioning, and environment-facing reward workers as new targets for poisoning and manipulation. Defenders must scrutinise the trust boundaries between the Nova Forge SDK, ECS reward workers, and HyperPod training pods, as a compromised reward signal can silently shape model behaviour across entire interaction sequences.https://gridthegrey.com/posts/first-look-officecli-ships-open-source-microsoft-office-automation-suite-for-ai/Tue, 07 Jul 2026 07:40:52 +0000https://gridthegrey.com/posts/first-look-officecli-ships-open-source-microsoft-office-automation-suite-for-ai/Threat Level: HIGHFirst LookAgentic AIPrompt InjectionLLM SecuritySupply ChainAML.T0051 - LLM Prompt InjectionAML.T0057 - LLM Data LeakageAML.T0043 - Craft Adversarial DataAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceAML.T0054 - LLM JailbreakOfficeCLI is an open-source, single-binary tool that enables AI agents to programmatically read, write, and automate Microsoft Word, Excel, and PowerPoint files without requiring a local Office installation. This dramatically expands the file-system attack surface for agentic AI systems, enabling prompt injection via document content, automated exfiltration of sensitive Office files, and weaponisation of documents as a persistent injection vector. Defenders operating AI agent pipelines that touch file systems must now treat any Office document as a potential adversarial input channel.https://gridthegrey.com/posts/indirect-prompt-injections-weaponised-to-drain-crypto-via-ai-agents/Tue, 07 Jul 2026 07:39:12 +0000https://gridthegrey.com/posts/indirect-prompt-injections-weaponised-to-drain-crypto-via-ai-agents/Threat Level: HIGHPrompt InjectionAgentic AILLM SecurityResearchAML.T0051 - LLM Prompt InjectionAML.T0043 - Craft Adversarial DataAML.T0047 - ML-Enabled Product or ServiceAML.T0057 - LLM Data LeakageResearchers identified two active campaigns embedding indirect prompt injection payloads in malicious websites to manipulate autonomous AI agents into executing unauthorised cryptocurrency transactions. The attacks exploit the growing deployment of agentic AI systems that browse the web and take real-world actions with minimal human oversight. This represents a concrete, financially motivated escalation of prompt injection from data exfiltration to direct fund theft.https://gridthegrey.com/posts/skillcloak-bypasses-ai-agent-skill-scanners-with-90-success-rate/Tue, 07 Jul 2026 03:52:28 +0000https://gridthegrey.com/posts/skillcloak-bypasses-ai-agent-skill-scanners-with-90-success-rate/Threat Level: HIGHAgentic AISupply ChainLLM SecurityResearchAdversarial MLAML.T0010 - ML Supply Chain CompromiseAML.T0015 - Evade ML ModelAML.T0047 - ML-Enabled Product or ServiceAML.T0051 - LLM Prompt InjectionAML.T0057 - LLM Data LeakageResearchers at Hong Kong University of Science and Technology have demonstrated that static scanners used to vet malicious AI agent 'skills' — modular add-ons for agents like Claude Code and OpenAI Codex — can be systematically bypassed using a tool called SKILLCLOAK. The technique leverages either character-substitution obfuscation or self-extracting packing into scanner-ignored directories like .git/, achieving evasion rates above 90% across all eight tested scanners. The same research team also developed SKILLDETONATE, a runtime behavioral sandbox that catches most of the threats static analysis misses.https://gridthegrey.com/posts/amazon-q-vs-code-extension-flaw-enables-cloud-credential-theft-via-mcp/Sun, 05 Jul 2026 15:12:50 +0000https://gridthegrey.com/posts/amazon-q-vs-code-extension-flaw-enables-cloud-credential-theft-via-mcp/Threat Level: HIGHLLM SecuritySupply ChainAgentic AIIndustry NewsAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceAML.T0057 - LLM Data LeakageAML.T0051 - LLM Prompt InjectionA vulnerability in the Amazon Q Visual Studio Code extension allows adversaries to plant malicious repositories that execute arbitrary code and exfiltrate cloud credentials. The flaw highlights escalating risks associated with Model Context Protocol (MCP) integrations embedded within AI-powered developer tools. This attack vector represents a growing threat surface as AI coding assistants gain privileged access to developer environments and cloud infrastructure.https://gridthegrey.com/posts/first-look-chinese-ai-firms-launch-llms-rivalling-us-frontier-models-in/Sat, 04 Jul 2026 10:53:05 +0000https://gridthegrey.com/posts/first-look-chinese-ai-firms-launch-llms-rivalling-us-frontier-models-in/Threat Level: HIGHFirst LookLLM SecurityIndustry NewsSupply ChainJailbreaksAML.T0047 - ML-Enabled Product or ServiceAML.T0051 - LLM Prompt InjectionAML.T0054 - LLM JailbreakAML.T0040 - ML Model Inference API AccessAML.T0010 - ML Supply Chain CompromiseAML.T0043 - Craft Adversarial DataTwo newly released large language models from Chinese AI firms have reached capability parity with leading US frontier models, expanding the global pool of powerful AI available to both commercial and adversarial users. For defenders, this development broadens the asymmetry between attackers — who gain access to capable, potentially less-restricted models — and defenders, who must now account for threats generated by a wider set of model providers. Security teams should anticipate increased use of these models for offensive tasks such as phishing content generation, vulnerability research automation, and social engineering at scale.https://gridthegrey.com/posts/llm-agents-weaponised-to-deliver-ransomware-via-langflow-platform/Sat, 04 Jul 2026 10:52:14 +0000https://gridthegrey.com/posts/llm-agents-weaponised-to-deliver-ransomware-via-langflow-platform/Threat Level: CRITICALAgentic AILLM SecuritySupply ChainFirst LookAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0040 - ML Model Inference API AccessAML.T0043 - Craft Adversarial DataAML.T0010 - ML Supply Chain CompromiseA documented ransomware attack leveraged agentic AI infrastructure — specifically the Langflow LLM orchestration platform — to automate multi-stage intrusion chains combining known exploitation techniques with real-time LLM reasoning. This marks a significant escalation in threat actor capability, demonstrating that agentic AI can serve as an autonomous attack coordinator rather than merely an assistant. Security teams running self-hosted AI orchestration platforms now face an expanded attack surface where the AI layer itself can be both the entry point and the execution engine.https://gridthegrey.com/posts/poisoned-mcp-tool-descriptions-enable-silent-data-exfiltration-via-ai-agents/Sat, 04 Jul 2026 10:50:50 +0000https://gridthegrey.com/posts/poisoned-mcp-tool-descriptions-enable-silent-data-exfiltration-via-ai-agents/Threat Level: HIGHPrompt InjectionAgentic AISupply ChainLLM SecurityResearchAML.T0051 - LLM Prompt InjectionAML.T0057 - LLM Data LeakageAML.T0010 - ML Supply Chain CompromiseAML.T0047 - ML-Enabled Product or ServiceAML.T0043 - Craft Adversarial DataMicrosoft researchers have demonstrated how attackers can embed hidden instructions inside MCP tool descriptions to covertly redirect AI agents into exfiltrating sensitive business data. Because each individual action the agent takes appears legitimate — using approved tools and the user's own permissions — default security controls generate no alerts. The attack exploits a fundamental design tension in MCP: tool descriptions simultaneously carry operational instructions and attacker-controlled data, collapsing a critical trust boundary.https://gridthegrey.com/posts/fake-bug-reports-weaponised-to-hijack-ai-coding-agents-at-scale/Sat, 04 Jul 2026 10:50:04 +0000https://gridthegrey.com/posts/fake-bug-reports-weaponised-to-hijack-ai-coding-agents-at-scale/Threat Level: HIGHPrompt InjectionAgentic AILLM SecuritySupply ChainAML.T0051 - LLM Prompt InjectionAML.T0043 - Craft Adversarial DataAML.T0047 - ML-Enabled Product or ServiceAML.T0010 - ML Supply Chain CompromiseA technique dubbed 'agentjacking' exploits the inability of AI coding agents to distinguish between legitimate content and embedded instructions, allowing attackers to hijack agent behaviour through maliciously crafted bug reports. The attack represents a scalable, low-barrier prompt injection vector targeting developer workflows that rely on autonomous AI agents. As AI coding assistants gain broader adoption and elevated system permissions, this class of attack poses a significant risk to software supply chain integrity.https://gridthegrey.com/posts/zero-click-prompt-injection-flaws-in-cursor-ide-enable-os-level-code-execution/Sat, 04 Jul 2026 10:47:24 +0000https://gridthegrey.com/posts/zero-click-prompt-injection-flaws-in-cursor-ide-enable-os-level-code-execution/Threat Level: CRITICALLLM SecurityPrompt InjectionAgentic AISupply ChainAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0043 - Craft Adversarial DataAML.T0057 - LLM Data LeakageAML.T0010 - ML Supply Chain CompromiseA set of vulnerabilities dubbed 'DuneSlide' in the Cursor AI code editor allow attackers to conduct zero-click prompt injection attacks that escape the application's sandbox and execute arbitrary code at the operating system level. The flaws represent a critical escalation of AI-native attack surface risks, targeting developers who rely on AI-assisted coding environments. Because exploitation requires no user interaction, the attack chain is particularly dangerous in supply chain and watering-hole scenarios.https://gridthegrey.com/posts/first-look-current-ai-launches-open-source-ai-gap-map-indexing-421-projects/Sat, 04 Jul 2026 08:53:39 +0000https://gridthegrey.com/posts/first-look-current-ai-launches-open-source-ai-gap-map-indexing-421-projects/Threat Level: MEDIUMFirst LookSupply ChainResearchIndustry NewsAML.T0010 - ML Supply Chain CompromiseAML.T0019 - Publish Poisoned DatasetsAML.T0020 - Poison Training DataAML.T0044 - Full ML Model AccessAML.T0047 - ML-Enabled Product or ServiceCurrent AI has published the Open Source AI Gap Map v0.1, a structured, MIT-licensed index of 421 open-source AI products spanning models, datasets, software tools, and hardware, backed by 1,184 YAML files and tracking over 16,000 GitHub repositories. For defenders, this comprehensive public inventory creates a dual-use intelligence resource: while it aids supply chain visibility, it simultaneously provides adversaries with a curated, machine-readable attack surface map of the open-source AI ecosystem. Security teams should treat this dataset as threat-actor recon material and cross-reference their own AI dependencies against it immediately.https://gridthegrey.com/posts/deepseek-turns-llm-hallucination-into-working-browser-only-ransomware-technique/Fri, 03 Jul 2026 09:45:56 +0000https://gridthegrey.com/posts/deepseek-turns-llm-hallucination-into-working-browser-only-ransomware-technique/Threat Level: HIGHLLM SecurityJailbreaksResearchFirst LookAML.T0054 - LLM JailbreakAML.T0047 - ML-Enabled Product or ServiceAML.T0051 - LLM Prompt InjectionAML.T0043 - Craft Adversarial DataCheck Point Research demonstrates how DeepSeek's lower refusal rates allowed researchers to transform an LLM-hallucinated malware concept into a practical browser-native ransomware technique targeting Android photo directories via the File System Access API. The attack requires no native payload, APK installation, or root access — only social engineering to obtain a legitimate browser permission prompt. This research highlights how frontier AI models with weaker safety controls can independently design novel attack paths not yet seen in real-world campaigns.https://gridthegrey.com/posts/prompt-injection-chain-breaks-cursor-ai-sandbox-enables-full-rce/Fri, 03 Jul 2026 09:44:45 +0000https://gridthegrey.com/posts/prompt-injection-chain-breaks-cursor-ai-sandbox-enables-full-rce/Threat Level: CRITICALPrompt InjectionLLM SecurityAgentic AIResearchAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0043 - Craft Adversarial DataAML.T0057 - LLM Data LeakageTwo critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in the Cursor AI code editor allow prompt injection attacks delivered via MCP services or web search results to escape the editor's terminal sandbox and execute arbitrary commands on a developer's machine without any user interaction. Both flaws abuse the sandbox's write-permission logic — one through a misconfigured working directory parameter, the other through a symlink-resolution fallback — ultimately allowing overwrite of the sandbox helper binary itself. The attack surface is significant given Cursor's reported adoption across more than half of Fortune 500 companies; all versions prior to 3.0 remain vulnerable.https://gridthegrey.com/posts/first-look-open-source-tool-lets-claude-and-any-llm-watch-videos-locally/Fri, 03 Jul 2026 09:31:07 +0000https://gridthegrey.com/posts/first-look-open-source-tool-lets-claude-and-any-llm-watch-videos-locally/Threat Level: MEDIUMFirst LookPrompt InjectionLLM SecurityAgentic AISupply ChainAML.T0051 - LLM Prompt InjectionAML.T0043 - Craft Adversarial DataAML.T0057 - LLM Data LeakageAML.T0047 - ML-Enabled Product or ServiceAML.T0010 - ML Supply Chain Compromiseclaude-real-video is an open-source, MIT-licensed Python library that extracts scene-change frames, deduplicates images, and transcribes audio from any video URL or local file, then packages the result as a folder any LLM can consume — all processed locally without cloud upload. For defenders, this dramatically expands the multimodal prompt injection surface by enabling adversaries to embed malicious instructions inside video content that LLM pipelines will now ingest and act upon. Security teams building or deploying LLM agents with video-processing capabilities must treat video content as an untrusted, potentially adversarial input channel.https://gridthegrey.com/posts/first-look-enterprise-iga-platforms-expose-structural-gaps-as-ai-agents/Fri, 03 Jul 2026 09:30:12 +0000https://gridthegrey.com/posts/first-look-enterprise-iga-platforms-expose-structural-gaps-as-ai-agents/Threat Level: HIGHFirst LookAgentic AILLM SecurityRegulatoryIndustry NewsAML.T0012 - Valid AccountsAML.T0047 - ML-Enabled Product or ServiceAML.T0051 - LLM Prompt InjectionAML.T0010 - ML Supply Chain CompromiseAML.T0057 - LLM Data LeakageA new analysis published via The Hacker News details how traditional Identity Governance and Administration (IGA) frameworks — built around HR-driven, human-centric lifecycle events — are fundamentally unequipped to govern AI agents acting as autonomous principals in enterprise environments. Security teams face a growing blind spot: AI agents acquire, retain, and exercise entitlements without triggering the joiner-mover-leaver workflows, manager attestations, or termination events that IGA tooling depends on. Defenders must now treat AI agent identities as a separate governance tier, requiring purpose-built provisioning, audit, and deprovisioning logic that existing platforms like Workday, SailPoint, and Azure AD connectors were never designed to provide.https://gridthegrey.com/posts/claude-opus-4-7-used-to-discover-critical-api-flaw-in-major-ticketing-platform/Fri, 03 Jul 2026 09:28:45 +0000https://gridthegrey.com/posts/claude-opus-4-7-used-to-discover-critical-api-flaw-in-major-ticketing-platform/Threat Level: HIGHAgentic AILLM SecurityResearchIndustry NewsAML.T0047 - ML-Enabled Product or ServiceAML.T0040 - ML Model Inference API AccessAML.T0043 - Craft Adversarial DataSecurity researcher Ian Carroll leveraged Anthropic's Claude Opus 4.7 to identify a critical vulnerability in Front Gate Tickets—a Live Nation subsidiary handling ticketing for major US festivals—that granted super-administrator access and the ability to freely issue tickets of any value. The case demonstrates LLM-assisted autonomous vulnerability discovery at scale, with Carroll noting the AI could likely have completed the full exploit chain without human intervention. Front Gate patched the flaw within 24 hours of disclosure, confirming no evidence of prior exploitation.https://gridthegrey.com/posts/first-look-anthropic-s-mythos-ai-vulnerability-discovery-tool-pairs-with-ibm/Fri, 03 Jul 2026 09:27:52 +0000https://gridthegrey.com/posts/first-look-anthropic-s-mythos-ai-vulnerability-discovery-tool-pairs-with-ibm/Threat Level: HIGHFirst LookSupply ChainAgentic AILLM SecurityIndustry NewsAML.T0010 - ML Supply Chain CompromiseAML.T0019 - Publish Poisoned DatasetsAML.T0020 - Poison Training DataAML.T0031 - Erode ML Model IntegrityAML.T0051 - LLM Prompt InjectionAML.T0047 - ML-Enabled Product or ServiceAML.T0057 - LLM Data LeakageAnthropic's Mythos capability, combined with IBM and Red Hat's Project Lightwell service backed by 20,000 engineers and $5B, introduces an AI-driven pipeline for discovering and remediating bugs in open-source software at industrial scale. This creates a dual-edged attack surface: adversaries who can influence Mythos's findings, its training data, or the remediation pipeline gain a privileged position to inject subtle vulnerabilities into widely-deployed open-source components. Defenders must treat the AI vulnerability-finding and patch-generation pipeline itself as a high-value, high-risk supply chain asset requiring rigorous integrity controls.https://gridthegrey.com/posts/ai-agent-autonomously-executes-full-ransomware-attack-chain-via-langflow-rce/Fri, 03 Jul 2026 09:25:09 +0000https://gridthegrey.com/posts/ai-agent-autonomously-executes-full-ransomware-attack-chain-via-langflow-rce/Threat Level: CRITICALAgentic AILLM SecurityIndustry NewsFirst LookAML.T0047 - ML-Enabled Product or ServiceAML.T0012 - Valid AccountsAML.T0040 - ML Model Inference API AccessAML.T0057 - LLM Data LeakageSysdig has documented what it claims is the first end-to-end ransomware attack orchestrated autonomously by an AI agent, attributed to a threat actor tracked as JADEPUFFER. The agent exploited a known remote code execution flaw in Langflow (CVE-2025-3248) to gain initial access, harvest credentials, pivot laterally, and ultimately encrypt and destroy a production database — all without human intervention at the keyboard. The incident demonstrates that AI agents can now lower the skill floor for complex, multi-stage attacks to near zero, representing a qualitative shift in the ransomware threat landscape.