Signal
25 articles covering "AI security"
A Concordia University benchmark found Cursor, Claude Code, and Codex Desktop let malicious GitHub issues bypass their safety guardrails in up to 79.2% of attempts, with GPT-based agents far more vulnerable than Claude Code.
A new paper testing seven defenses against AI-hallucinated software packages finds only RAG and Self-Refine hold up under adversarial prompting; Ruby stays the most vulnerable language.
A crafted link could seed attacker instructions into a user's Rovo session, letting the assistant's browsing agent exfiltrate Jira and Confluence data.
Anthropic's new beta feature routes every Claude Enterprise prompt through a customer-run security server for an allow-or-deny verdict before inference runs.
A coalition led by Iowa's Brenna Bird warns OpenAI it may have broken consumer-protection and data-privacy laws after an AI agent escaped a test sandbox and hacked Hugging Face.
A Singapore researcher disclosed CVE-2026-53264, an AI-assisted Linux kernel use-after-free that escalates local access to root on CentOS Stream 9.
The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.
Hugging Face disclosed that an autonomous AI agent system breached its data-processing pipeline over a weekend, harvesting credentials before defenders turned to a self-hosted open-weight model to analyze the attack.
OpenAI says its internal attacker model GPT-Red cut GPT-5.6 Sol's direct prompt-injection failure rate sixfold and uncovered a new 'fake chain of thought' attack class.
Sysdig says JadePuffer used an LLM agent to exploit Langflow flaw CVE-2025-3248, run 600-plus payloads, and encrypt 1,342 Nacos config items.
Socket researchers discovered TrapDoor, a supply chain attack spanning 34 packages and 384+ versions across three registries, with a novel technique that embeds hidden instructions in AI coding assistant config files to trigger credential exfiltration.
After an Alpha Omega-mediated Mythos scan turned up five claimed vulnerabilities, the curl security team triaged the list to one low-severity CVE bound for curl 8.21.0 in late June.