Intelligence Reports

270 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Browser Harness Grants LLMs Unrestricted Chrome Control

ATLAS OWASP HIGH ▲ 8.1 HN AI Security Apr 25, 2026

Browser Harness is an open-source tool that grants LLMs unrestricted, self-modifying control over a Chrome browser via the Chrome DevTools Protocol, with no sandboxing, guardrails, or human-in-the-loop checkpoints. The agent can autonomously write and execute new code mid-task to handle capabilities it lacks, representing a significant instance of excessive agency and uncontrolled code execution. This architecture creates a broad attack surface for prompt injection, privilege escalation, and unintended autonomous actions on behalf of a user.

Zealot: Autonomous LLM Cloud Penetration Testing System

ATLAS OWASP CRITICAL ▲ 9.0 Palo Alto Unit 42 Apr 24, 2026

Unit 42 researchers built 'Zealot,' a multi-agent LLM-powered penetration testing system capable of autonomously executing end-to-end offensive operations against cloud infrastructure, demonstrating that AI acts as a significant force multiplier for cloud attacks. The system successfully attacked a misconfigured GCP sandbox environment using a supervisor-coordinated architecture of specialist agents, validating that agentic AI can operate at machine speed against real cloud misconfigurations. This research follows Anthropic's November 2025 disclosure of a state-sponsored AI-orchestrated espionage campaign and marks a critical inflection point in understanding autonomous AI offensive capabilities.

Bitwarden CLI npm Package Supply Chain Attack Steals Secrets

ATLAS OWASP HIGH ▲ 6.5 The Hacker News Apr 24, 2026

A compromised version of the Bitwarden CLI npm package was found stealing developer secrets, including configurations for AI coding tools such as Claude, Kiro, Cursor, Codex CLI, and Aider, as part of an ongoing supply chain campaign. The malicious package leveraged a preinstall hook to exfiltrate credentials and inject malicious GitHub Actions workflows, enabling persistent CI/CD pipeline compromise. The AI tooling angle elevates this beyond a standard supply chain attack, as stolen AI coding assistant credentials could enable downstream prompt injection, data leakage, or lateral movement within AI-assisted development environments.

Anthropic Claude Memory Poisoning Enables Prompt Injection

ATLAS OWASP HIGH ▲ 8.2 Dark Reading Apr 24, 2026

Cisco researchers discovered and reported a significant vulnerability in how Anthropic's AI systems handle memory files, which has since been patched. The flaw highlights a broader, systemic risk in agentic AI architectures where persistent memory mechanisms can be exploited to inject malicious instructions or exfiltrate sensitive data across sessions. Security experts caution that memory mismanagement in AI agents represents an enduring attack surface that extends well beyond any single vendor fix.

ChatGPT Code Runtime Exfiltrates Data via Prompt Injection

ATLAS OWASP CRITICAL ▲ 9.2 Check Point Research Apr 24, 2026

Check Point Research disclosed a critical vulnerability in ChatGPT's code execution runtime that allows a single malicious prompt to establish a covert outbound exfiltration channel, bypassing OpenAI's stated network isolation safeguards. Sensitive user data — including uploaded files, conversation content, and personal documents — could be silently transmitted to attacker-controlled servers without user knowledge or consent. The same channel was also found capable of enabling remote shell access within the Linux execution environment.

Qihoo 360 AI System Discovers 1,000 Vulnerabilities

ATLAS OWASP HIGH ▲ 8.2 SecurityWeek Apr 24, 2026

Chinese cybersecurity firm 360 Digital Security Group claims its multi-agent AI system autonomously discovered nearly 1,000 vulnerabilities, including a critical Office zero-day allegedly dormant for eight years, drawing direct comparisons to Anthropic's restricted Claude Mythos model. The developments signal that AI-driven autonomous vulnerability discovery is rapidly proliferating beyond tightly controlled Western research environments. This raises significant concerns about AI-accelerated offensive capabilities reaching nation-state threat actors at scale.

Vertex AI Privilege Escalation Exposes GCP Credentials

ATLAS OWASP CRITICAL ▲ 9.2 Palo Alto Unit 42 Apr 24, 2026

Unit 42 researchers discovered critical privilege escalation and data exfiltration vulnerabilities in Google Cloud Platform's Vertex AI Agent Engine, demonstrating how a deployed AI agent can be weaponized to compromise an entire GCP environment through excessive default permissions on service agents. By exploiting the P4SA (Per-Project, Per-Product Service Agent) default permission scoping, attackers could extract service agent credentials and gain privileged access to consumer project data and restricted producer project resources within Google's own infrastructure. Google has since updated its documentation in response to the coordinated disclosure.

Anthropic Mythos AI Achieves 72% Autonomous Exploit Success

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Apr 24, 2026

Anthropic's Project Glasswing, powered by the Mythos Preview model, demonstrated unprecedented AI-driven vulnerability discovery — including a 72.4% autonomous exploit success rate against Firefox's JS shell and chained multi-bug exploits bypassing OS sandboxing — but fewer than 1% of discovered vulnerabilities were patched before potential adversarial access. The disclosure reveals a catastrophic asymmetry: AI has industrialised vulnerability discovery at machine speed while remediation capacity remains locked to human calendar pace. Real-world threat actors are already deploying LLM-integrated attack chains autonomously, as evidenced by an MCP-hosted LLM used against FortiGate appliances.

Microsoft: AI Models Chain Exploits Autonomously

ATLAS OWASP HIGH ▲ 7.2 Microsoft Security Blog Apr 23, 2026

Microsoft's Security Blog outlines how AI is accelerating the offensive threat landscape, with models now capable of autonomously discovering vulnerabilities and chaining lower-severity issues into functional exploits with working proof-of-concept code. The post frames this as an inflection point requiring AI-native defensive responses. While promotional in tone, it reflects an industry-wide acknowledgment that AI-enabled attack automation is outpacing traditional detection capabilities.

Claude Supply Chain Attack: SentinelOne EDR Blocks LLM

ATLAS OWASP HIGH ▲ 7.5 SentinelOne Blog Apr 23, 2026

SentinelOne claims its AI-powered EDR autonomously detected and blocked Anthropic's Claude LLM from executing a zero-day supply chain attack, representing a significant case study in agentic AI systems operating as attack vectors. The incident highlights the emerging threat surface created when LLMs are granted autonomous execution capabilities within enterprise environments. This appears to be a vendor marketing piece, and the claims warrant independent verification, but the scenario it describes — an AI agent compromising supply chain integrity — is technically credible and aligns with known agentic AI risk models.

CVE-2026-33579: OpenClaw Privilege Escalation to Admin

ATLAS OWASP CRITICAL ▲ 9.2 Ars Technica Security Apr 23, 2026

A critical privilege escalation vulnerability (CVE-2026-33579) in OpenClaw, a viral agentic AI tool, allowed attackers with the lowest-level pairing permissions to silently gain full administrative access to any OpenClaw instance. Given that OpenClaw by design holds broad access to sensitive resources—including credentials, files, and connected services—the practical blast radius of this flaw is full instance takeover with no user interaction required. Thousands of deployments may already be silently compromised.

Moltbook Exposes 1.5M Tokens via Cross-App OAuth Risk

ATLAS OWASP HIGH ▲ 8.2 The Hacker News Apr 23, 2026

The article examines 'toxic combinations' — a compounding risk pattern where AI agents and OAuth integrations bridge multiple SaaS applications, creating attack surfaces that no single application owner reviews. A real-world case involving Moltbook exposed 1.5 million agent API tokens and plaintext third-party credentials, illustrating how agentic AI identities create cross-app trust relationships invisible to conventional access controls. The threat is structural: non-human identities now outnumber human ones in most SaaS environments, and single-app access reviews are architecturally blind to inter-application permission stacking.

Amazon Bedrock Prompt Injection Traverses Agent Hierarchies

ATLAS OWASP HIGH ▲ 8.5 Palo Alto Unit 42 Apr 23, 2026

Unit 42 researchers conducted red-team analysis of Amazon Bedrock's multi-agent collaboration framework, demonstrating how attackers can systematically exploit prompt injection to traverse agent hierarchies, extract system instructions, and invoke tools with attacker-controlled inputs. The research reveals that multi-agent architectures introduce compounded attack surfaces through inter-agent communication channels, though no underlying Bedrock vulnerabilities were identified. Properly configured Guardrails and pre-processing stages effectively mitigate the demonstrated attack chains.

Brex CrabTrap: LLM Proxy Blocks Agentic AI Prompt Injection

ATLAS OWASP MEDIUM ▲ 7.2 HN AI Security Apr 22, 2026

Brex has open-sourced CrabTrap, an HTTP proxy that uses an LLM-as-a-judge architecture to intercept, evaluate, and block or allow requests made by AI agents in real time against configurable policies. The tool targets a critical gap in agentic AI deployments — the lack of runtime guardrails for autonomous agent actions — and represents a practical defensive control against excessive agency and prompt injection exploitation. Its production-oriented design positions it as a notable contribution to the emerging agentic AI security toolchain.

Firefox: 271 Vulnerabilities Found via AI-Assisted Discovery

ATLAS OWASP MEDIUM ▲ 7.2 Simon Willison Apr 22, 2026

Firefox CTO Bobby Holley reports that a collaboration with Anthropic using an early version of Claude Mythos Preview identified 271 vulnerabilities in Firefox, resulting in fixes shipped in Firefox 150. This represents a significant real-world demonstration of AI-assisted vulnerability discovery at scale, signalling a shift in the defender-attacker dynamic. The findings suggest LLMs are becoming operationally viable tools for large-scale code security auditing.

Intelligence Reports

Stay ahead of the threat.