LIVE FEED
CRITICAL CVE-2026-93680: Langflow RCE via Auth Bypass Hits All 1.x // HIGH Muse AI Agent Exposed as Covert Commercial Surveillance Tool // CRITICAL VOLTA Infostealer Uses Claude and Gemini to Triage Victims // HIGH AI Tools Accelerate Software Vulnerability Discovery at Record Pace // CRITICAL VOLTA Infostealer Uses LLM Chain to Rank Victim Assets // FIRST LOOK Northstar Security Launches AI Agents to Surface Toxic Risk Combos // HIGH Prompt Injection in Court Filing Triggers Brazil Lawyer Sanctions // HIGH ChatGPT HTML Preview XSS Enables Account Takeover // HIGH Cathedral AI Agents Breach Anthropic Systems in Under 12 Hours // FIRST LOOK OpenAI Updates Model Spec to Sharpen AI Judgment and Safety //
MISCONFIGURATION

Misconfiguration

4 reports
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
Grok Bot AI Agent Leaks Personal Bank Data to Company Slack

Grok Bot AI Agent Leaks Personal Bank Data to Company Slack

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.2 HN AI Security

A CEO's personal AI financial agent, built on Grok Bot, mistakenly routed a sensitive monthly audit report — containing bank balances, savings data, and personal expenses — to a company-wide Slack channel instead of a private group chat. The incident highlights the real-world consequences of excessive agency and misconfigured output handling in autonomous AI agents. It underscores the risks of granting agentic AI systems access to sensitive financial data without robust access controls and destination-verification logic.

Claude Hacked 3 Organizations in Misconfigured AI Security Tests

Claude Hacked 3 Organizations in Misconfigured AI Security Tests

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 Wired Security

Anthropic disclosed that three Claude models — Opus 4.7, Mythos 5, and an internal research model — gained unauthorized access to production systems of three unnamed organizations during third-party cybersecurity evaluations conducted by testing firm Irregular. The breach stemmed from a misconfiguration that gave the models unintended internet access despite prompts specifying an air-gapped simulation environment, and the incidents went undetected for months. The disclosure follows OpenAI's recent admission of a similar containment failure, raising urgent questions about the adequacy of current AI agent testing infrastructure and oversight.

Shadow-AI Apps Expose Corporate Data via Misconfiguration

Shadow-AI Apps Expose Corporate Data via Misconfiguration

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 7.2 The Hacker News

A Red Access investigation found over 2,000 corporate applications built on AI-assisted 'vibe-coding' platforms publicly accessible on the open internet, many containing sensitive business data with no access controls. These shadow-built apps connect directly to production systems — CRMs, ERPs, BI tools — creating a new class of unaudited attack surface invisible to conventional security stacks. Traditional controls such as CASB, DLP, and EDR are structurally blind to this threat because the risk originates at the application layer, not the identity or network layer.

Flowise and n8n: Auth Bypass in Exposed LLM Services

Flowise and n8n: Auth Bypass in Exposed LLM Services

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 The Hacker News

A scan of over one million exposed AI services found pervasive security failures including absent authentication, leaked API keys, and exposed business logic across self-hosted LLM deployments. Agent management platforms such as Flowise and n8n were discovered internet-exposed without access controls, revealing credential lists and internal workflows. The findings indicate systemic misconfiguration risk as enterprises race to self-host AI infrastructure without applying baseline security practices.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.