Researcher

149 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Anthropic Mythos AI Achieves 72% Autonomous Exploit Success

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Apr 24, 2026

Anthropic's Project Glasswing, powered by the Mythos Preview model, demonstrated unprecedented AI-driven vulnerability discovery — including a 72.4% autonomous exploit success rate against Firefox's JS shell and chained multi-bug exploits bypassing OS sandboxing — but fewer than 1% of discovered vulnerabilities were patched before potential adversarial access. The disclosure reveals a catastrophic asymmetry: AI has industrialised vulnerability discovery at machine speed while remediation capacity remains locked to human calendar pace. Real-world threat actors are already deploying LLM-integrated attack chains autonomously, as evidenced by an MCP-hosted LLM used against FortiGate appliances.

Amazon Bedrock Prompt Injection Traverses Agent Hierarchies

ATLAS OWASP HIGH ▲ 8.5 Palo Alto Unit 42 Apr 23, 2026

Unit 42 researchers conducted red-team analysis of Amazon Bedrock's multi-agent collaboration framework, demonstrating how attackers can systematically exploit prompt injection to traverse agent hierarchies, extract system instructions, and invoke tools with attacker-controlled inputs. The research reveals that multi-agent architectures introduce compounded attack surfaces through inter-agent communication channels, though no underlying Bedrock vulnerabilities were identified. Properly configured Guardrails and pre-processing stages effectively mitigate the demonstrated attack chains.

Brex CrabTrap: LLM Proxy Blocks Agentic AI Prompt Injection

ATLAS OWASP MEDIUM ▲ 7.2 HN AI Security Apr 22, 2026

Brex has open-sourced CrabTrap, an HTTP proxy that uses an LLM-as-a-judge architecture to intercept, evaluate, and block or allow requests made by AI agents in real time against configurable policies. The tool targets a critical gap in agentic AI deployments — the lack of runtime guardrails for autonomous agent actions — and represents a practical defensive control against excessive agency and prompt injection exploitation. Its production-oriented design positions it as a notable contribution to the emerging agentic AI security toolchain.

Firefox: 271 Vulnerabilities Found via AI-Assisted Discovery

ATLAS OWASP MEDIUM ▲ 7.2 Simon Willison Apr 22, 2026

Firefox CTO Bobby Holley reports that a collaboration with Anthropic using an early version of Claude Mythos Preview identified 271 vulnerabilities in Firefox, resulting in fixes shipped in Firefox 150. This represents a significant real-world demonstration of AI-assisted vulnerability discovery at scale, signalling a shift in the defender-attacker dynamic. The findings suggest LLMs are becoming operationally viable tools for large-scale code security auditing.

Claude System Prompts Exposed via Git-Based Extraction

ATLAS OWASP MEDIUM ▲ 6.2 Simon Willison Apr 22, 2026

Simon Willison has created a git-based tool to track the evolution of Anthropic's publicly published Claude system prompts across model versions, enabling structured diff analysis of prompt changes over time. While the underlying prompts are intentionally public, the tooling lowers the barrier for adversarial reconnaissance — making it easier for threat actors to identify shifts in safety constraints, refusal heuristics, or behavioral guardrails between model releases. This kind of systematic prompt archaeology directly supports meta-prompt extraction and jailbreak development workflows.

Google Patches Prompt Injection RCE in Agentic AI

ATLAS OWASP CRITICAL ▲ 8.5 Dark Reading Apr 22, 2026

Google has patched a critical prompt injection vulnerability in an agentic AI tool designed for filesystem operations, where insufficient input sanitisation enabled sandbox escape and arbitrary code execution. The flaw highlights the compounding risk surface of agentic AI systems that interface directly with operating system resources. This is a significant example of how LLM-native vulnerabilities can translate into traditional high-severity RCE outcomes.

CVE-2026: Google Antigravity Sandbox Escape via Prompt Injection

ATLAS OWASP HIGH ▲ 9.0 The Hacker News Apr 21, 2026

A now-patched vulnerability in Google's agentic IDE Antigravity allowed attackers to achieve arbitrary code execution by injecting malicious flags into the find_by_name tool's Pattern parameter, bypassing the platform's Strict Mode sandbox before security constraints were enforced. The attack chain could be triggered entirely via indirect prompt injection—embedding hidden instructions in files pulled from untrusted sources—requiring no account compromise and no additional user interaction. This case exemplifies the systemic risk of insufficient input validation in AI agent tool interfaces, where autonomous execution removes the human oversight layer that traditional security models depend on.

GoModel AI Gateway Supply Chain Compromise

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 21, 2026

GoModel is an open-source AI gateway written in Go that provides a unified OpenAI-compatible API across multiple LLM providers including OpenAI, Anthropic, Gemini, Groq, xAI, and Ollama. As an infrastructure layer sitting between applications and AI backends, it introduces a significant supply chain and API security surface that warrants scrutiny. The project advertises built-in guardrails and observability, which are positive security signals, but open-source gateway projects centralising multi-provider API key management represent a meaningful attack vector if misconfigured or compromised.

CVE-2026: Anthropic MCP SDK Remote Code Execution

ATLAS OWASP CRITICAL ▲ 9.4 The Hacker News Apr 20, 2026

A systemic 'by design' vulnerability in Anthropic's Model Context Protocol (MCP) SDK enables arbitrary remote code execution across all supported language implementations via unsafe STDIO transport defaults, affecting over 7,000 publicly accessible servers and 150 million downloads. The flaw has been independently confirmed across 10+ popular AI frameworks including LiteLLM, LangChain, and Flowise, with Anthropic declining to modify the protocol's architecture. This represents a significant AI supply chain risk with cascading exposure to sensitive data, API keys, and internal systems.

Prompt Injection Risk: Claude 4.7 Agentic Tool Expansion

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 20, 2026

Anthropic's published system prompt diff between Claude Opus 4.6 and 4.7 reveals significant expansions in agentic tool access, autonomous browsing capabilities, and child safety guardrails — changes with direct security implications for prompt injection and excessive agency risks. The new `tool_search` mechanism and acting-before-asking posture increase the attack surface for adversarial inputs targeting agentic Claude deployments. Transparency in publishing these changes is notable, but the expanded autonomous capabilities warrant scrutiny from defenders.

Autonomous Exploit Generation: Claude Mythos Risk

ATLAS OWASP HIGH ▲ 8.5 Schneier on Security Apr 20, 2026

Bruce Schneier analyses Anthropic's Claude Mythos Preview and Project Glasswing, a controlled deployment programme aimed at finding and patching software vulnerabilities before the model is publicly released due to its advanced cyberattack capabilities. The piece highlights a growing offensive AI capability gap, noting that newer LLMs can autonomously chain memory corruption bugs and operationalise exploits without human orchestration, while observing that defenders currently retain a marginal advantage because vulnerability discovery is easier than exploitation. Schneier warns that this advantage is narrowing rapidly and that the industry must prepare for a world of commoditised zero-day exploits.

Legacy Vulnerabilities Amplified by AI at Enterprise Scale

ATLAS OWASP HIGH ▲ 6.5 Dark Reading Apr 18, 2026

The article argues that AI's primary security risk lies not in introducing entirely new vulnerability classes, but in dramatically amplifying the impact and exploitability of well-established ones. This framing has significant implications for defenders, suggesting that legacy vulnerability management practices must be re-evaluated through an AI-augmented threat lens. The convergence of classic weaknesses with AI capabilities raises the baseline risk profile for organisations deploying or adjacent to AI systems.

Cursor AI Prompt Injection Chains to Shell Access

ATLAS OWASP CRITICAL ▲ 8.5 SecurityWeek Apr 18, 2026

A chained vulnerability in Cursor AI—a widely-used AI-powered code editor—allowed attackers to combine indirect prompt injection with a sandbox escape and the application's built-in remote tunnel feature to achieve arbitrary shell access on developer machines. The attack chain is particularly significant because it weaponises Cursor's own legitimate remote-access infrastructure, meaning malicious commands could blend into normal developer workflows. Developers using Cursor's AI features against untrusted code or repositories are at elevated risk of full host compromise.

Comment Injection Attacks Hit Claude Code, Gemini, Copilot

ATLAS OWASP HIGH ▲ 8.2 SecurityWeek Apr 17, 2026

A researcher has disclosed a novel prompt injection attack technique dubbed 'Comment and Control,' demonstrating that popular AI coding agents — including Claude Code, Gemini CLI, and GitHub Copilot Agents — can be manipulated through malicious instructions embedded in source code comments. The attack exploits the tendency of agentic coding tools to process and act upon contextual content within files they are tasked to read or modify. This represents a meaningful escalation in the risk surface of AI-assisted software development workflows.

GPT-5.4-Cyber Expansion Raises LLM Jailbreak Dual-Use Risks

ATLAS OWASP MEDIUM ▲ 6.5 SecurityWeek Apr 17, 2026

OpenAI has expanded access to GPT-5.4-Cyber, a fine-tuned model designed for defensive cybersecurity applications, following Anthropic's reveal of its Mythos cybersecurity model. While framed as a defensive tool for legitimate security practitioners, the widened access to a capability-enhanced cybersecurity LLM raises dual-use concerns around potential misuse for offensive operations. The competitive dynamic between major AI labs in the security-focused model space signals a broader industry trend that warrants careful access control and policy scrutiny.

Researcher

Stay ahead of the threat.