LIVE FEED
MEDIUM OpenAI Lean Proof Mistranslation Exposes AI Verification Risk // HIGH Grok Bot AI Agent Leaks Personal Bank Data to Company Slack // HIGH Iran Used ChatGPT to Plant Fake Articles in US Publications // CRITICAL ARTEX AI and Claude Agents Weaponised in Korean Bank Attacks // HIGH Anthropic AI Agents Bypass Isolation Controls, Access Live Internet // FIRST LOOK Anthropic AI Agents Submit Visa Forms on State Dept Site // HIGH Anthropic AI Agents Exploit Gov Sites via Reward Hacking // HIGH Anthropic AI Agent Submits False Homicide Tip to Police Tipline // MEDIUM OpenAI Fires Safety Researchers Over Sensitive Data Dispute // FIRST LOOK Token Security Adds Enforcement Controls for AI Agent Permissions //
CODING-AGENTS

Coding-Agents

8 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
AWS and Google Cloud Launch Hard Spend Caps for AI Agent Workloads

AWS and Google Cloud Launch Hard Spend Caps for AI Agent Workloads

FIRST LOOK ATLAS OWASP LOW Limited impact · Standard review ▲ 5.5 Simon Willison

AWS and Google Cloud have both introduced hard monthly spending caps for cloud services, enabling developers and organisations to set firm financial ceilings that pause or terminate services rather than allowing runaway billing. For defenders overseeing agentic AI deployments, this closes a meaningful blast-radius gap: coding agents and personal agents that autonomously invoke paid APIs or spin up compute can now be constrained to a pre-approved financial envelope, limiting the operational damage of a misbehaving or compromised agent. The residual gap is significant — coverage remains fragmented across providers, enforcement depends on correct configuration by each team, and hard caps do not yet extend to non-financial resource consumption such as data egress or API call volume.

Anthropic Launches Claude Code Projects for Multi-Agent Cloud Orchestration

Anthropic Launches Claude Code Projects for Multi-Agent Cloud Orchestration

FIRST LOOK ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 6.2 The Verge AI

Anthropic has relaunched Projects in Claude Code, enabling users to orchestrate multiple AI coding agents in the cloud with shared memory, coordinated goals, and parallel task execution across branched repositories. For defenders and security engineering teams, this closes a meaningful operational gap by providing a governed, centralised interface for managing multi-agent workflows — reducing the likelihood of ad hoc, unmonitored agent sprawl across development pipelines. Residual gaps remain around local tool integration, auditability of inter-agent coordination decisions, and the maturity of access controls governing what each agent thread can reach.

AI Coding Agents Exploit Open-Source Bugs Within Minutes of Patch

AI Coding Agents Exploit Open-Source Bugs Within Minutes of Patch

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.2 Simon Willison

AI-powered coding agents are now capable of identifying and probing exploitable vulnerabilities in open-source software within minutes of a patch or advisory being publicly shared, fundamentally breaking traditional embargo-based disclosure practices. Security maintainers for projects including OCaml and rclone are reporting unprecedented surges in automated exploit attempts and vulnerability reports, with rclone seeing over 40 disclosures in a single month compared to 20 across its first decade. This development signals a systemic shift in the threat landscape where AI agents act as force multipliers for attackers, compressing the window between disclosure and active exploitation to near-zero.

AI Agents Install Unowned Packages via Poisoned llms.txt Files

AI Agents Install Unowned Packages via Poisoned llms.txt Files

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 Ars Technica Security

Researchers discovered that over 120 corporate websites contained misconfigured llms.txt files referencing unregistered package names, which AI coding agents including Claude, Codex, and Hermes automatically executed as trusted installation instructions. By registering a handful of the unclaimed package names and hosting beacon payloads, researchers received phone-home responses from dozens of companies including Fortune 500 firms within hours, confirming real-world agent-driven supply chain compromise. The attack exploits the implicit trust AI agents place in vendor documentation files, with at least one site found directing visitors to live malware.

Ghostcommit PoC Embeds Prompt Injection in PNG to Steal Repo Secrets

Ghostcommit PoC Embeds Prompt Injection in PNG to Steal Repo Secrets

FIRST LOOK ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 BleepingComputer

Researchers from UMKC's ASSET Research Group have published a proof-of-concept attack called Ghostcommit that hides malicious prompt injection instructions inside PNG image files referenced by AGENTS.md convention files, causing AI coding agents to silently exfiltrate repository secrets. The technique exploits a blind spot shared by multiple AI code review tools — including CodeRabbit and Bugbot — which exclude or ignore binary image files from analysis, allowing the payload to survive review undetected. Defenders operating AI-assisted development pipelines must treat image files in agentic context paths as a new, uncontrolled input surface and reassess trust boundaries around automatically-ingested project convention files.

Claude Code Prompt Injection via GitHub Supply Chain

Claude Code Prompt Injection via GitHub Supply Chain

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 9.1 BleepingComputer

Mozilla 0DIN researchers demonstrated a novel attack chain in which a seemingly clean GitHub repository tricks AI coding agents like Claude Code into executing a reverse shell payload — with no malicious code ever present in the repo itself. The attack leverages three innocuous components: a Python package that deliberately errors on first run, an error message that instructs the agent to run an init command, and a shell script that fetches and executes a payload stored in an attacker-controlled DNS TXT record. The technique exploits the autonomous error-recovery behaviour of agentic AI tools, effectively turning a safety feature into an attack vector.

Adversa AI: 89% of AI Agents Fail Security Tests

Adversa AI: 89% of AI Agents Fail Security Tests

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.2 SecurityWeek

Adversa AI's AI Risk Quadrant report evaluated 100 AI agents across ten categories, finding that only 11 qualify as both capable and well-defended. The research identifies a structural 'power-protection inversion' where the most capable agents also present the widest attack surface, driven by a 'lethal trifecta' of private data access, exposure to untrusted content, and outbound action capability. Computer and coding agents showed the most severe exposure, raising urgent concerns about autonomous agent deployment in enterprise environments.

SQLite Blocks AI-Generated Code Contributions

SQLite Blocks AI-Generated Code Contributions

ATLAS OWASP MEDIUM Moderate risk · Monitor closely ▲ 6.2 Simon Willison

SQLite has formally prohibited agentic code contributions and strengthened its policy language, reflecting growing concern over AI-generated submissions overwhelming open source maintainers. The project was forced to create a separate bug forum after being flooded with AI-generated reports of inconsistent quality. This represents an emerging operational security challenge for critical infrastructure software projects targeted by autonomous AI coding agents.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.