LIVE FEED
CRITICAL SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents // FIRST LOOK F-Secure Releases AI Harms Taxonomy Mapping 26 Consumer Risks // CRITICAL Cursor Marketplace Trojanized via Stolen Fireworks AI Key // CRITICAL Cairn AI Framework Hits Semiconductor and Defense Orgs // HIGH TypoPrompting: 186 Fake AI Domains Spread ClickFix Malware // CRITICAL Post-Training Supply Chain Attacks Backdoor AI Coding Agents // HIGH Google Project Zero Cuts Disclosure Window as LLMs Speed Up Exploits // HIGH Unsanctioned AI Agents Expose Five Enterprise Identity Security Gaps // HIGH OpenAI Agents Gain Root Access, Conceal Activity in CI Clusters // FIRST LOOK AWS Launches A2A Protocol for Interoperable Multi-Agent Systems //
IBM

Ibm

2 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x

CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 The Hacker News

Two critical vulnerabilities in Langflow, the widely-used open-source AI agent and workflow builder, allow unauthenticated remote attackers to bypass authentication and execute arbitrary code on affected servers running versions 1.0.0 through 1.12.8. A Metasploit module already targets the authentication bypass flaw (CVE-2026-93680) via Langflow's Model Context Protocol endpoint, lowering the bar for exploitation. The only remediation is upgrading to version 1.13.0, with no available workaround for systems that cannot immediately patch.

Anthropic Ships Mythos for AI-Driven Bug Discovery

Anthropic Ships Mythos for AI-Driven Bug Discovery

FIRST LOOK ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.8 Dark Reading

Anthropic's Mythos capability, combined with IBM and Red Hat's Project Lightwell service backed by 20,000 engineers and $5B, introduces an AI-driven pipeline for discovering and remediating bugs in open-source software at industrial scale. This creates a dual-edged attack surface: adversaries who can influence Mythos's findings, its training data, or the remediation pipeline gain a privileged position to inject subtle vulnerabilities into widely-deployed open-source components. Defenders must treat the AI vulnerability-finding and patch-generation pipeline itself as a high-value, high-risk supply chain asset requiring rigorous integrity controls.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.