LIVE FEED
FIRST LOOK Axiom Math Launches Formally Verified AI Math Foundation in Lean // HIGH ChatGPT Lockdown Mode Bypassed to Exfiltrate Chats Silently // FIRST LOOK Microsoft Ships Dynamic Permissions and Execution Containers for AI Agents // CRITICAL ARTEX Agentic Hacking Platform Drives Autonomous RCE Attacks // FIRST LOOK OpenAI Partners with Hacktron to Find Vulnerabilities in AI Systems // FIRST LOOK Anthropic Accelerates AI Development Using Automated Research Tools // HIGH LLMJacking Bills Reach $1M as AI Phishing Targets Work Accounts // FIRST LOOK OpenAI Launches GPT-6 Cyber with AI-Driven Vuln Discovery // CRITICAL AI Agents Used in Chainalysis Breach Exposing All User Tokens // HIGH Claude Code Leaks Secrets in Settings File Across 1,122 Repos //
METASPLOIT

Metasploit

2 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x

CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 The Hacker News

Two critical vulnerabilities in Langflow, the widely-used open-source AI agent and workflow builder, allow unauthenticated remote attackers to bypass authentication and execute arbitrary code on affected servers running versions 1.0.0 through 1.12.8. A Metasploit module already targets the authentication bypass flaw (CVE-2026-93680) via Langflow's Model Context Protocol endpoint, lowering the bar for exploitation. The only remediation is upgrading to version 1.13.0, with no available workaround for systems that cannot immediately patch.

CVE-2026-41679: Paperclip AI RCE via Malicious Agent Import

CVE-2026-41679: Paperclip AI RCE via Malicious Agent Import

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 The Hacker News

Two critical vulnerabilities in Paperclip, an open-source AI agent control plane, allow attackers to execute arbitrary host commands by importing malicious agent configurations — one requiring no authentication whatsoever. A third flaw exposes sensitive data through unenforced API access controls, and Rapid7 has already published a public Metasploit module for the CVSS 10.0 server-side path. The findings underscore a systemic risk in agentic AI platforms: agent configuration is functionally executable code and must be treated as such.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.