LIVE FEED
CRITICAL CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x // HIGH Muse AI Agent Exposed as Covert Commercial Surveillance Tool // CRITICAL VOLTA Infostealer Uses Claude and Gemini to Triage Victims // HIGH AI Tools Accelerate Software Vulnerability Discovery at Record Pace // CRITICAL VOLTA Infostealer Uses LLM Chain to Rank Victim Assets // FIRST LOOK Northstar Security Launches AI Agents to Surface Toxic Risk Combos // HIGH Prompt Injection in Court Filing Triggers Brazil Lawyer Sanctions // HIGH ChatGPT HTML Preview XSS Enables Account Takeover // HIGH Cathedral AI Agents Breach Anthropic Systems in Under 12 Hours // FIRST LOOK OpenAI Updates Model Spec to Sharpen AI Judgment and Safety //
DISCOURSE

Discourse

2 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
Claude Used to Breach OpenAI Employee Account via Forum Flaw

Claude Used to Breach OpenAI Employee Account via Forum Flaw

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.2 Ars Technica Security

Security researchers from Hacktron AI leveraged Anthropic's Claude to compromise an OpenAI employee's ChatGPT account through a vulnerability in OpenAI's Discourse-hosted community forum, gaining access to internal GitHub repositories. The attack chain — forum misconfiguration to internal SSO to privileged account — demonstrates how AI tooling can accelerate offensive security work against AI infrastructure. The incident also coincides with Anthropic disclosing that AI now leads 26% of its own R&D, raising broader concerns about recursive capability growth outpacing security controls.

Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos

Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 8.5 OpenAI (via HN)

Researchers from HacktronAI chained a heap buffer overflow in libheif (via ImageMagick on Discourse) with an OpenAI SSO misconfiguration to achieve RCE on community.openai.com, ultimately gaining access to employee ChatGPT and Codex accounts. With those compromised accounts, attackers could pivot to OpenAI's internal GitHub monorepo and connected services including Slack and email. The full exploit chain was discovered and disclosed responsibly within 72 hours, earning a $6,500 bug bounty.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.