LIVE FEED
FIRST LOOK Microsoft Uses AI to Ship Record 974-Vulnerability Patch Batch // FIRST LOOK Meta Launches Muse Personal AI Agent with Secure VM Isolation // CRITICAL ChatGPT Cross-Account Data Leakage via Sandbox Channel // HIGH Hidden Prompt Injection Attacks Hijack Autonomous AI Agents // FIRST LOOK Schneier and Raghavan Frame AI Agent Risk as a Genie Problem // HIGH ChatGPT Prompt Injection Exfiltrates Gmail Data via Hidden Channel // FIRST LOOK Capsule Security Launches AI Circuit Breaker for Rogue Agents // MEDIUM Rogue AI Agents Drive Insurers to Rethink Cyber Risk // HIGH LLM-Assisted Intrusions Hit Latin American Orgs via NextChat // HIGH GPT 5.6-Cyber Breaks VM Sandboxes, Exposing Agent Limits //
DEPENDENCY-CONFUSION

Dependency-Confusion

3 reports
All LLM Security Agentic AI Industry News Research Supply Chain First Look: Security Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report AI Governance AI Security AI Security Tools Identity & Access Management Monthly Review Security Operations
AI Agents Install Unowned Packages via Poisoned llms.txt Files

AI Agents Install Unowned Packages via Poisoned llms.txt Files

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 Ars Technica Security

Researchers discovered that over 120 corporate websites contained misconfigured llms.txt files referencing unregistered package names, which AI coding agents including Claude, Codex, and Hermes automatically executed as trusted installation instructions. By registering a handful of the unclaimed package names and hosting beacon payloads, researchers received phone-home responses from dozens of companies including Fortune 500 firms within hours, confirming real-world agent-driven supply chain compromise. The attack exploits the implicit trust AI agents place in vendor documentation files, with at least one site found directing visitors to live malware.

AI Coding Agents Exploited via Hallucinated Package Names

AI Coding Agents Exploited via Hallucinated Package Names

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 BleepingComputer

Researchers from Tel Aviv University, Technion, and Intuit have demonstrated that AI coding agents across tools like Cursor, Copilot, and Gemini CLI predictably hallucinate package, domain, and repository names that attackers can pre-register to deliver malicious code. The attack—variously branded slopsquatting, phantom squatting, and HalluSquatting—requires no phishing, no stolen credentials, and no direct user interaction, only an automated agent with permission to fetch external resources. Because agents handle delivery autonomously and hallucinations are reproducible at up to 100% consistency, the technique scales to botnet-level compromise without traditional malware infrastructure.

HalluSquatting Exploits AI Hallucinations for Botnet RCE

HalluSquatting Exploits AI Hallucinations for Botnet RCE

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 SecurityWeek

Researchers have demonstrated a novel attack technique called 'HalluSquatting', which weaponises AI hallucinations by registering fake package names that LLMs fabricate, turning them into malware delivery vectors. When developers trust AI-recommended dependencies and install the squatted packages, attackers can achieve remote code execution and potentially recruit victim machines into botnets. The technique represents a significant escalation in the practical exploitation of LLM hallucinations beyond misinformation into active infrastructure compromise.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.