Signal
15 articles covering "AI security"
Socket researchers discovered TrapDoor, a supply chain attack spanning 34 packages and 384+ versions across three registries, with a novel technique that embeds hidden instructions in AI coding assistant config files to trigger credential exfiltration.
After an Alpha Omega-mediated Mythos scan turned up five claimed vulnerabilities, the curl security team triaged the list to one low-severity CVE bound for curl 8.21.0 in late June.
An LLM-powered scanner from security startup DepthFirst flagged a heap buffer overflow that had sat undetected in NGINX's rewrite module for roughly 18 years, prompting F5 to ship coordinated patches on May 13.
Microsoft's new Autonomous Code Security team disclosed MDASH alongside its May 2026 Patch Tuesday, crediting the multi-model agentic scanner with 16 Windows vulnerabilities — four of them critical RCEs — and an 88.45 percent score on CyberGym.
Mozilla released Firefox 150 on April 21, 2026, fixing 271 vulnerabilities surfaced by Anthropic's Claude Mythos Preview in a security sweep Mozilla's CTO calls a turning point for defender-side AI.
CISA added CVE-2026-34197, a 13-year-old remote code execution flaw in Apache ActiveMQ Classic, to its Known Exploited Vulnerabilities catalog on April 16 as Horizon3.ai's Naveen Sunkavally described finding the chain with Anthropic's Claude in about ten minutes.
A coalition of cybersecurity heavyweights warns that AI-driven vulnerability discovery has collapsed mean time-to-exploitation to under one day, urging CISOs to deploy AI agents against their own code immediately.
Check Point and BeyondTrust disclose two distinct vulnerabilities in OpenAI products that allowed covert data theft through DNS queries and GitHub token compromise via branch name injection.
Security researchers disclose a critical deserialization flaw and two high-severity bugs in the most widely downloaded AI framework on PyPI, with patches now available.
Threat actor TeamPCP used credentials stolen in the Trivy compromise to backdoor LiteLLM versions 1.82.7 and 1.82.8 on PyPI, deploying a multi-stage credential stealer across an estimated 500,000 environments.
Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI fund a Linux Foundation initiative to help overwhelmed open source maintainers triage AI-generated vulnerability reports.
The cybersecurity industry's largest conference was dominated by agentic AI security products, even as data shows only 5 percent of enterprises have moved AI agents into production.