LIVE FEED
HIGH Claude Code Auto Mode Bypassed via Zip Payload at 80% Rate // CRITICAL AI Agents Install Unowned Packages via Poisoned llms.txt Files // HIGH ChatGPT Abused by Cambodia Scam Network for Social Engineering // CRITICAL OpenAI AI Agents Escape Sandbox and Hack Hugging Face // HIGH AI Gateways Targeted: LiteLLM, RAGFlow, Kestra Compromised // FIRST LOOK GitHub Releases LLM Pre-Production Evaluation Guide for Developers // HIGH CVE-2026-75149: Marimo Notebook MCP Code Injection Flaw // FIRST LOOK AWS Adds Agentic Observability via OpenSearch Service MCP Apps // HIGH NVIDIA NemoClaw Flaw Lets Malicious Page Poison Local AI Model // HIGH AnonyMousKIT PhaaS Deploys Voice AI Agents to Steal iPhone Passcodes //
LLM-WEAPONISATION

Llm-Weaponisation

4 reports
All LLM Security Agentic AI Industry News Research Supply Chain First Look: Security Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
DeepSeek AI Agent Weaponised in Proxyjacking Attack on Security Firm

DeepSeek AI Agent Weaponised in Proxyjacking Attack on Security Firm

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 8.5 Dark Reading

A Chinese threat actor was caught deploying a weaponised DeepSeek AI agent to compromise over 1,200 hosts belonging to a security firm, with the goal of establishing a proxy network for further attacks. The incident marks a significant escalation in adversarial AI usage, demonstrating that state-aligned actors are now operationalising large language model agents as autonomous attack tools. The interception highlights the acute risks posed by agentic AI systems granted excessive agency within network environments.

Threat Actor Trim Weaponises AI Jailbreaks for Offensive Ops

Threat Actor Trim Weaponises AI Jailbreaks for Offensive Ops

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 Dark Reading

A Russian-speaking threat actor known as 'Trim' has reportedly operationalised frontier AI model jailbreaks, integrating them with offensive security tooling to create an attack platform. This marks a significant escalation from opportunistic jailbreaking to deliberate, weaponised misuse of large language models in adversarial operations. The development signals a maturing threat landscape where AI safety bypasses are no longer merely a research curiosity but a functional component of offensive cyber capability.

GreyVibe Deploys ChatGPT and Gemini in LLM Attack Chain

GreyVibe Deploys ChatGPT and Gemini in LLM Attack Chain

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.5 SecurityWeek

WithSecure has documented GreyVibe, a Russia-nexus threat actor systematically deploying ChatGPT, Google Gemini, and Ideogram AI across every phase of its attack chain — from phishing lure creation to custom malware development — against Ukrainian targets since August 2025. The group's LLM-assisted malware, LegionRelay, contained design flaws introduced during AI-generated development, which paradoxically allowed researchers to track the group over an extended period. The case illustrates both the operational leverage AI provides to moderately skilled threat actors and the novel forensic signatures that AI-assisted development can inadvertently introduce.

GreyVibe Uses ChatGPT and Gemini for Ukraine Cyberespionage

GreyVibe Uses ChatGPT and Gemini for Ukraine Cyberespionage

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.5 BleepingComputer

A likely Russian threat group dubbed GreyVibe has been actively using commercial LLMs — including ChatGPT and Google Gemini — to generate high-quality phishing lures, malware tooling, and social-engineering content targeting Ukrainian military, government, and civilian organisations. WithSecure researchers identified LLM artefact markers embedded in campaign imagery, confirming AI-assisted content generation at scale. The case represents a concrete, documented example of adversarial LLM weaponisation in an active nation-state-adjacent cyberespionage campaign.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.