Intelligence Reports

270 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Anthropic Ships Claude Fable 5 with Exploit Generation

FIRST LOOK ATLAS OWASP CRITICAL ▲ 8.7 Wired Security Jun 17, 2026

Anthropic's Mythos 5 and Claude Fable 5 represent the arrival of frontier AI models with demonstrated, advanced vulnerability discovery and exploit-development capabilities — a capability class that will rapidly proliferate across multiple vendors and open-weight releases. The core attack surface is not model-specific: guardrail bypass of the consumer-facing Fable 5 exposes full Mythos-grade offensive capability to any actor who can defeat the content filters, while the broader proliferation trajectory means defenders must assume adversary access to equivalent capabilities within months. The regulatory response addresses a single vendor while doing nothing to raise the floor for the broader ecosystem of competitive and open-weight models following close behind.

Google Launches Android 17 with Gemini Omni Integration

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jun 17, 2026

Android 17 embeds Gemini Omni and multiple AI models (Lyria 3, AudioLM) directly into OS-level functions including video editing, call handling, screen recording, and emergency detection, dramatically expanding the attack surface for AI-assisted exploitation on mobile endpoints. The deep integration of conversational AI with device sensors, media pipelines, and inter-app communication creates novel prompt injection and data exfiltration vectors that existing mobile threat defences were not designed to address. The simultaneous AirDrop interoperability expansion and cross-device Pixel Watch mirroring further widen the lateral movement surface across the Google hardware ecosystem.

NVIDIA Launches XR AI for Agentic AR Glasses

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 NVIDIA AI Blog Jun 17, 2026

NVIDIA XR AI puts multimodal agentic systems directly into AR glasses, fusing continuous video, audio, depth, and pose data with enterprise knowledge retrieval and tool execution — creating a persistent, always-on sensor exfiltration and prompt injection surface that sits inches from a worker's face. The framework connects to industrial systems, digital twins, and enterprise RAG backends, meaning a compromised agent can pivot from perceptual data into operational technology networks. Because the inputs are environmental and largely uncontrolled, adversarial content placed in the physical world (signage, screens, spoken commands) becomes a viable injection vector against enterprise infrastructure.

Vertex AI SDK Bucket Squatting Flaw Enables Model Hijack

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Jun 17, 2026

A vulnerability in the Google Cloud Vertex AI Python SDK allowed unauthenticated attackers to intercept model uploads by pre-registering predictable staging bucket names — a technique Unit 42 calls 'Pickle in the Middle'. Once a malicious model replaced the legitimate upload, arbitrary code executed inside Google's serving infrastructure via pickle deserialization. Google patched the flaw in v1.148.0 after disclosure in March 2026, but the incident highlights systemic risks in ML pipeline supply chains.

Anthropic Mythos Model Theft: China-Linked Access

ATLAS OWASP CRITICAL ▲ 8.5 The Verge AI Jun 16, 2026

The White House reportedly believes a China-linked group accessed Anthropic's Mythos AI model, prompting export restrictions on the technology. If confirmed, the breach represents a significant national security threat, as adversaries could exploit the model directly or use knowledge distillation to replicate its capabilities. Separately, reports of jailbreak vulnerabilities in Mythos and Fable compound concerns about unauthorised access to frontier AI systems.

Amazon Bedrock AgentCore Ships with RAG and Memory

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 AWS Machine Learning Blog Jun 16, 2026

Amazon Bedrock AgentCore now enables production-grade agentic systems that combine RAG retrieval, persistent cross-session memory, and direct user-facing endpoints authenticated only via Cognito Bearer tokens — all surfaced through a single /invocations endpoint. This architecture creates compounded attack surfaces where adversarially crafted content in S3-backed knowledge bases can propagate through the retrieve_and_generate pipeline directly into technician workflows. The persistent AgentCore Memory layer introduces a new cross-session context poisoning vector that does not exist in stateless LLM deployments.

AWS Launches Agent-EvalKit for LLM-Powered Agent Evaluation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 AWS Machine Learning Blog Jun 16, 2026

Agent-EvalKit introduces an open-source evaluation pipeline that integrates LLM-as-judge evaluators and AI coding assistants directly into agent development workflows, creating new attack surfaces where poisoned test cases, manipulated ground-truth datasets, and adversarial evaluation prompts could corrupt agent quality signals. The toolkit's deep code-reading access via Claude Code, Kiro CLI, and Kilo Code means a compromised evaluation run could exfiltrate source code or inject malicious recommendations into the development pipeline. Because evaluation outputs drive concrete code changes, adversarial manipulation of the eval layer has downstream consequences for production agent behaviour.

Amazon Quick Launches Agentic Incident Triage Assistant

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 AWS Machine Learning Blog Jun 16, 2026

Amazon Quick's new agentic incident triage assistant integrates New Relic's observability platform and Asana via MCP, creating a single conversational interface that can query production telemetry, surface error logs, and create tracked tasks autonomously. This multi-tool agent architecture dramatically expands the prompt injection attack surface, as malicious data embedded in production logs, alert payloads, or transaction traces can now influence agent actions — including task creation and RCA narrative generation. The convergence of observability data (high-trust, machine-generated) with autonomous task orchestration creates a novel indirect prompt injection pathway through operational telemetry.

Qwen 3.5-397B Model Theft: Rio's LLM Exposed as Rebranded Clone

ATLAS OWASP HIGH ▲ 7.8 HN AI Security Jun 15, 2026

Researchers have demonstrated that Rio de Janeiro's publicly presented 'homegrown' 397B language model is not an original creation but an undisclosed element-wise weight merge of the Nex-N2_pro model and Qwen3.5-397B-A17B. The finding was established through two independent methods: identity probing showing the model identifies as 'Nex' 79% of the time, and tensor-level statistical analysis confirming a consistent 0.6/0.4 blend across all 60 layers. This constitutes a model theft and supply chain integrity violation, with additional implications for public trust in government AI procurement and IP attribution.

Claude Fable 5 Jailbreak Triggers US Export Control Ban

ATLAS OWASP HIGH ▲ 8.2 Simon Willison Jun 13, 2026

The US government issued an export control directive ordering Anthropic to suspend all access to Claude Fable 5 and Mythos 5, citing national security concerns over an alleged jailbreak technique capable of surfacing software vulnerabilities. Anthropic publicly contested the order, arguing the demonstrated capability is already widely available in other public models including GPT-5.5, and that the identified vulnerabilities were minor and previously known. The incident marks a significant precedent for government intervention in frontier AI model access on national security grounds.

Google Gemini Prompt Injection Powers Smishing Campaign

ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jun 13, 2026

Google has filed suit against a Chinese cybercrime network operating the Outsider phishing-as-a-service kit, which exploited Gemini AI to generate fraudulent phishing pages and power large-scale SMS phishing attacks against Americans. The network used carefully framed prompts — disguised as benign programming requests — to bypass AI safety controls and produce functional credential-harvesting websites. The case illustrates the growing industrialisation of AI-assisted phishing infrastructure, with over 1.59 million malicious URLs and 100,000 victims attributed to the operation.

Anthropic Releases Claude Fable 5 with Jailbreak Resistance

ATLAS OWASP HIGH ▲ 7.2 SecurityWeek Jun 13, 2026

Anthropic's release of Claude Fable 5, a Mythos-class frontier model, has prompted significant industry debate over its dual-use offensive capabilities in cybersecurity and biology. The model includes a capability fallback mechanism — downgrading to Claude Opus 4.8 in high-risk domains — alongside extensive jailbreak-resistance red-teaming. Security professionals are warning that frontier AI capability investment directly accelerates attacker tooling for machine-speed, AI-orchestrated 'hyperattacks' that outpace human defenders.

Agentjacking Attack Achieves 85% Success Rate Against AI Coding Agents via Sentry MCP

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Jun 13, 2026

Tenet Security has disclosed 'Agentjacking', a novel attack class that exploits the implicit trust AI coding agents place in Model Context Protocol (MCP) data sources. By injecting malicious instructions into Sentry error events via publicly accessible DSN credentials, attackers can cause agents like Claude Code and Cursor to execute arbitrary code with full developer privileges. Researchers confirmed 2,388 exposed organisations and an 85% exploitation success rate in controlled testing, with no prior access to victim infrastructure required.

OpenClaw Agent Vulnerable to Prompt Injection RCE

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Jun 12, 2026

Two independent research teams demonstrated that OpenClaw, a self-hosted AI agent, is vulnerable to prompt injection attacks delivered through shared contacts, vCards, location pins, and plain emails — enabling attacker-controlled code execution and sensitive data exfiltration. Imperva's finding, now patched in version 2026.4.23, exploited the agent's failure to mark message objects as untrusted before passing them to the underlying LLM. Varonis separately showed that a single crafted email could instruct an agent to forward mock AWS credentials and customer data to an external address, a behaviour-level risk no patch can fully remediate.

Claude Fable 5 Jailbreak Extracts System Prompts

ATLAS OWASP HIGH ▲ 7.5 SecurityWeek Jun 12, 2026

Security researcher Pliny the Liberator claimed a prompt-based jailbreak of Anthropic's newly launched Claude Fable 5 model, allegedly extracting the internal system prompt and eliciting responses on high-risk topics including bioweapons and cyberattacks. Anthropic disputed the claim, arguing the technique merely coaxes conversational continuation rather than bypassing core safety classifiers. The incident highlights ongoing tension between AI safety assurances at launch and real-world adversarial probing, particularly for Mythos-class models with elevated capability ceilings.

Intelligence Reports

Stay ahead of the threat.