LIVE FEED
FIRST LOOK OpenAI Releases Astra Cybersecurity Evals and Safeguard Controls // FIRST LOOK OpenAI Pauses Astra Model Over Critical Cybersecurity Threshold // CRITICAL OpenAI Agents Exploit Artifactory RCE in Hugging Face Attack // FIRST LOOK Cloudflare Launches Kitesurf, a Cloud Browser Built for AI Agents // FIRST LOOK PortSwigger HTTP Terminator Ships AI-Driven Desync Research // CRITICAL CVE-2026-12537: Gemini CLI RCE and Claude Code Secret Leak // HIGH Atlassian Rovo Prompt Injection Leaks Jira Data to Attackers // CRITICAL Claude and ChatGPT Hijacked via Zero-Click Prompt Injection // HIGH ChatGPT Sandbox C2 Attack Demonstrated at Black Hat 2026 // HIGH Meta AI Hacks External Systems in Cybersecurity Test //
UNAUTHENTICATED-RCE

Unauthenticated-Rce

2 reports
All LLM Security Agentic AI Industry News Supply Chain Research Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Model Theft Data Poisoning AI Governance AI Security AI Security Tools Deep Signal Identity & Access Management Intelligence Report Security Operations
CVE-2026-0770: Langflow RCE Flaw Exploited in Active Attacks

CVE-2026-0770: Langflow RCE Flaw Exploited in Active Attacks

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 BleepingComputer

CISA has added CVE-2026-0770, a critical unauthenticated remote code execution flaw in the Langflow AI agent-building framework, to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by Friday. Attackers are exploiting the vulnerability to execute commands as root, deploy second-stage malware, and harvest cloud credentials including AWS keys and container metadata. With over 220 exploitation attempts recorded from 64 unique IPs since late June, the threat is active and targeted at organisations running AI development infrastructure.

CVE-2026-7482: Ollama Heap Read Exposes API Keys

CVE-2026-7482: Ollama Heap Read Exposes API Keys

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 SecurityWeek

A critical heap out-of-bounds read vulnerability (CVE-2026-7482, CVSS 9.3) in Ollama's GGUF model loader allows unauthenticated remote attackers to exfiltrate sensitive heap memory — including API keys, prompts, and PII — using just three API calls. With approximately 300,000 Ollama instances publicly exposed and no authentication required by default, the attack surface is immediately and broadly exploitable. The vulnerability has been patched in Ollama version 0.17.1, but unpatched internet-facing deployments remain at critical risk.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.