Security-focused reporting on model operations, incident response, prompt risks, access drift, and governance.
CERT/CC published CVE-2026-93088 on September 22, 2026 for SGLang’s disaggregated-diffusion DiffusionServer—an unauthenticated ZeroMQ ROUTER socket that feeds attacker frames to pickle.loads—documented in Keita Sode’s September 22 technical writeup covering affected 0.5.11+ releases with no patch called out yet.
On September 16, 2026, Trend Micro’s Zero Day Initiative published ZDI-26-706, a CVSS 8.8 remote code execution advisory in the open-source CrewAI framework’s load_agent_from_repository path when a user loads a malicious agent configuration.
On September 15, 2026, Google’s Developers Blog published Part 2 of its Zero-trust Agents series, covering Model Armor, Semantic Governance Policies, and Agent Anomaly Detection, with an open-source companion demo under GoogleCloudPlatform/generative-ai.
On September 15, 2026, NOFire AI released Brig under Apache 2.0 to run AI coding agents inside hardware-enforced microVMs on macOS and Linux, with install via brig.sh and curated profiles for major agent CLIs.
Anthropic’s September 2026 multi-lab threat report details illicit Claude distillation it says it disrupted across seven China-based labs — a broader peg than Writeble’s June 28 Alibaba-only piece — with TechCrunch and The Hacker News relaying Anthropic-reported volumes and caveats.
Wiz Research found 294 of 3,074 internet-facing LiteLLM gateways still accepted the docs example admin key sk-1234, a credential that can expose provider API keys—while related LiteLLM MCP flaws are already on CISA’s KEV list.
OX Security disclosed CVE-2026-82533 (CVSS 9.4) in DeepSeek Harness, where an unauthenticated local control API trusted via Host header lets a sandboxed agent elevate to danger-full-access; fixed in 0.1.2-alpha.1.
VulnCheck reports active exploitation of Langflow CVE-2026-0768 (CVSS 9.8), an unauthenticated root RCE in the custom component editor used for recon and harvesting OpenAI, AWS, and Langflow secrets.
Google released Mantis, an open-source skill suite that helps coding agents discover, triage, sandbox-reproduce, and patch software bugs, targeting hallucinated findings and true-positive rates under 7% in naive AI code scanning.
Manifold Security disclosed GitSpawn, a vulnerability class where AI coding agents that run unsanitized git status or git diff at startup can execute attacker-controlled commands from a repository .git/config, with several agents still unpatched as of early September 2026.
Cloud development platform Coder confirmed an attacker breached its Cloudflare infrastructure to deploy rogue registry servers that served backdoored Terraform modules. The compromised modules contained info-stealing payloads designed to harvest cloud API keys, SSH keys, OIDC tokens, and CI/CD pipeline secrets before exfiltrating them to an external server. Coder released security updates across versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9, urging developers who downloaded modules during the 14-hour incident window on August 31 to rotate all credentials.
OpenAI has kept its largest planned frontier reinforcement learning training run on hold following a recent security incident involving Hugging Face and internal assessments indicating that an upcoming model, codenamed Astra, may cross the critical cybersecurity capability thresh
Hugging Face published its Summer 2026 ecosystem report on August 14, 2026, documenting platform data gathered between January and August. The platform recorded an expansion to 2.96 million public model repositories and 1 million datasets, marked by Chinese releases reaching up t
Cisco and CISA warned that threat actors are actively exploiting a static credentials vulnerability in Cisco Secure Firewall Management Center. The flaw, designated CVE-2026-20316, stems from hardcoded low-privileged credentials in the web interface that allow remote attackers to authenticate without valid user accounts. Cisco released emergency hotfixes across FMC versions 7.0 through 10.0, and CISA ordered US federal agencies to apply patches by August 1, 2026.
The U.S. Department of Defense and the Small Business Administration announced a temporary pause on Phase II of the Cybersecurity Maturity Model Certification program. The program requires defense contractors to undergo third-party assessments to verify compliance with the 110 cybersecurity requirements outlined in NIST SP 800-171 Rev 2. During the pause, the Pentagon will rely on contractor self-assessments to enforce baseline cybersecurity standards while focusing on tangible cyber hygiene over administrative overhead.
GitHub has detailed the underlying security architecture designed to safely run non-deterministic AI agents within its GitHub Actions continuous integration and continuous delivery (CI/CD) environments. In a technical overview published on March 9, 2026, researchers Landon Cox an
Security researchers disclosed a high-severity improper access control vulnerability, tracked as CVE-2026-49049, in the Helix3 template framework extension for Joomla. The flaw allows unauthenticated remote attackers to delete arbitrary files, write arbitrary JSON files, and modify template parameters on exposed websites. The vulnerability affects Helix3 versions 1.0 through 3.1.1, and no official vendor patch is currently available from developer JoomShaper.
CISA has updated its Known Exploited Vulnerabilities catalog to confirm that ransomware groups are actively exploiting a high-severity privilege escalation flaw in Microsoft Defender. The vulnerability, dubbed BlueHammer and tracked as CVE-2026-33825, allows local attackers to bypass access controls and elevate their privileges to SYSTEM level. The flaw was patched by Microsoft on April 14, 2026, but was leaked as a zero-day earlier that month by a disgruntled researcher.
Researchers at the University of Washington evaluated seven popular agentic AI browsers and discovered that four of them expose users to significant cyber risks. The study demonstrated that ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, and Perplexity Comet allow malicious sites to bypass the browser's fundamental same-origin policy. The team successfully executed a proof-of-concept prompt injection attack where a malicious webpage forced an AI agent to exfiltrate sensitive data from an embedded site.
