Curated AI security news: vulnerabilities, threat actors, incidents, policy, and tools — harvested and reviewed by editors.https://www.ai-security-blog.com/en-ushttps://openai.com/index/hugging-face-model-evaluation-security-incident/https://openai.com/index/hugging-face-model-evaluation-security-incident/The article discusses a recent security incident involving the evaluation of models on the Hugging Face platform, highlighting potential vulnerabilities in AI model assessments. This incident raises concerns about the integrity and security of AI/ML models used in various applications.Sun, 02 Aug 2026 00:00:00 GMTOpenAIIncidentmodel-evaluationsecurity-incidenthttps://www.axios.com/2026/08/02/ai-manifesto-open-weight-modelshttps://www.axios.com/2026/08/02/ai-manifesto-open-weight-modelsA new manifesto advocates for the development and deployment of open weight AI models to enhance transparency and security in AI systems. This initiative aims to address concerns over proprietary models and their implications for AI safety and accountability.Sun, 02 Aug 2026 00:00:00 GMTAxiosPolicyopen-weight-modelsai-transparencyhttps://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/https://quentinkaiser.be/security/2026/07/18/ia-assisted-vuln-research/The article discusses the use of AI in identifying vulnerabilities in embedded systems, highlighting its potential to enhance security research. This approach could significantly impact how vulnerabilities are discovered and mitigated in AI/ML applications.Sun, 19 Jul 2026 00:00:00 GMTQTNKSRResearchai-assisted-researchvulnerability-discoveryhttps://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/The CISA has issued a warning regarding critical vulnerabilities in SharePoint that are currently being exploited in the wild. This highlights the importance of timely patching to mitigate risks associated with these security flaws.Thu, 16 Jul 2026 00:00:00 GMTBleepingComputerVulnerabilitysharepointcisa-warningpatchinghttps://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.htmlhttps://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.htmlThe article discusses the recent addition of four actively exploited vulnerabilities to the CISA's Known Exploited Vulnerabilities (KEV) catalog. This highlights the ongoing security risks associated with widely used software, including potential implications for AI/ML systems relying on these platforms.Wed, 08 Jul 2026 00:00:00 GMTThe Hacker NewsVulnerabilitycisavulnerability-managementadobejoomlahttps://www.traceable.ai/blog-post/introducing-harness-ai-securityhttps://www.traceable.ai/blog-post/introducing-harness-ai-securityThe article discusses the importance of identifying AI components within application environments to understand the AI attack surface. It also emphasizes monitoring calls to third-party Generative AI services to prevent unauthorized usage, highlighting the growing security concerns in AI integration.Sat, 27 Jun 2026 00:00:00 GMTTraceableToolai-securitygenerative-aihttps://solutionshub.epam.com/blog/post/llm-securityhttps://solutionshub.epam.com/blog/post/llm-securityThe article discusses the security risks associated with self-hosting open large language models (LLMs) and emphasizes the importance of managing these risks effectively. It highlights the benefits of maintaining control over models and data, which can enhance data privacy and customization options.Sat, 27 Jun 2026 00:00:00 GMTEPAM SolutionsHubPolicyllm-securitydata-privacybest-practiceshttps://www.forrester.com/blogs/how-fable-5-and-mythos-5-change-ai-security-data-retention-and-vendor-riskhttps://www.forrester.com/blogs/how-fable-5-and-mythos-5-change-ai-security-data-retention-and-vendor-riskThe introduction of Fable 5 and Mythos 5 presents significant advancements in AI security, particularly in data retention and vendor risk management. These models incorporate a safety switch that enhances cybersecurity measures by rerouting potentially harmful queries, thus improving overall system safety.Sat, 13 Jun 2026 00:00:00 GMTForresterToolai-securitydata-retentionvendor-riskhttps://www.artificialintelligence-news.com/news/coinbase-for-agents-automating-portfolio-trading-with-ai/https://www.artificialintelligence-news.com/news/coinbase-for-agents-automating-portfolio-trading-with-ai/The article discusses how Coinbase is leveraging AI to automate portfolio trading, enhancing efficiency and decision-making in financial markets. This development highlights the growing intersection of AI technologies and financial security, raising potential implications for trading security and risk management.Sat, 13 Jun 2026 00:00:00 GMTArtificial Intelligence NewsToolai-tradingportfolio-automationhttps://thehackernews.com/2026/06/researchers-build-self-replicating-ai.htmlhttps://thehackernews.com/2026/06/researchers-build-self-replicating-ai.htmlThis article discusses the development of a self-replicating AI worm that utilizes local, open-weight models, raising concerns about the potential for misuse in AI security. The implications of such technology could significantly impact the landscape of AI threats and vulnerabilities.Tue, 09 Jun 2026 00:00:00 GMTThe Hacker NewsThreat Actorai-wormself-replicationopen-weight-modelshttps://thehackernews.com/2026/06/ai-agent-uncovers-21-zero-days-in.htmlhttps://thehackernews.com/2026/06/ai-agent-uncovers-21-zero-days-in.htmlAn AI agent has successfully identified 21 zero-day vulnerabilities in FFmpeg, highlighting the potential of AI in enhancing security assessments. This development emphasizes the growing intersection of AI technologies and vulnerability discovery in software security.Sat, 06 Jun 2026 00:00:00 GMTThe Hacker NewsVulnerabilityzero-dayvulnerability-discoveryai-securityhttps://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-accesshttps://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-accessThe article discusses the emerging threats posed by AI vulnerability exploitation, particularly focusing on initial access techniques used by threat actors. Understanding these vulnerabilities is crucial for enhancing security measures in AI systems.Thu, 14 May 2026 00:00:00 GMTGoogle Cloud BlogThreat Actorai-vulnerabilitythreat-intelligencehttps://openai.com/index/open-source-codex-orchestration-symphony/https://openai.com/index/open-source-codex-orchestration-symphony/OpenAI has announced the release of an open-source orchestration tool for Codex, aimed at enhancing the integration of AI in software development. This development is significant for AI/ML security as it provides developers with tools to better manage AI-generated code, potentially reducing vulnerabilities.Sun, 03 May 2026 00:00:00 GMTOpenAIToolopen-sourcecodexai-developmenthttps://cloudsecurityalliance.org/artifacts/autonomous-but-not-controlled-ai-agent-incidents-now-common-in-enterpriseshttps://cloudsecurityalliance.org/artifacts/autonomous-but-not-controlled-ai-agent-incidents-now-common-in-enterprisesThe article discusses the increasing frequency of security incidents involving autonomous AI agents in enterprise environments. It highlights the challenges organizations face in managing and controlling these AI systems, emphasizing the need for improved security measures.Mon, 27 Apr 2026 00:00:00 GMTCloud Security AllianceIncidentai-securityenterprise-riskhttps://www.cbsnews.com/news/anthropic-investigates-mythos-ai-breach/https://www.cbsnews.com/news/anthropic-investigates-mythos-ai-breach/Anthropic is currently investigating a potential breach involving its Mythos AI model, which raises concerns about the security of AI systems. This incident highlights the ongoing risks associated with AI model vulnerabilities and the importance of robust security measures in AI development.Wed, 22 Apr 2026 00:00:00 GMTCBS NewsIncidentai-breachmythos-aihttps://www.artificialintelligence-news.com/news/openai-agents-sdk-improves-governance-sandbox-execution/https://www.artificialintelligence-news.com/news/openai-agents-sdk-improves-governance-sandbox-execution/The article discusses the enhancements made to the OpenAI Agents SDK, focusing on its new sandbox execution feature aimed at improving governance. This development is significant for AI/ML security as it allows for safer testing and deployment of AI agents in controlled environments.Mon, 20 Apr 2026 00:00:00 GMTArtificial Intelligence NewsToolopenaisdksandbox-executionhttps://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilitieshttps://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilitiesThe article discusses the evaluation of Anthropic's Claude Mythos Preview, highlighting improvements in its performance on capture-the-flag challenges and multi-step cyber-attack simulations. This evaluation is relevant as it showcases advancements in AI capabilities that could impact cybersecurity practices and threat landscapes.Sat, 18 Apr 2026 00:00:00 GMTAISIResearchai-securitycyber-capabilitiesanthropichttps://www.penligent.ai/hackinglabs/gpt-5-4-cyber-vs-claude-mythos-which-model-fits-cybersecurity-work/https://www.penligent.ai/hackinglabs/gpt-5-4-cyber-vs-claude-mythos-which-model-fits-cybersecurity-work/This article compares two AI models, GPT-5.4 Cyber and Claude Mythos, in the context of cybersecurity applications. It highlights their respective strengths in practical security workflows and exploit research, making it relevant for understanding AI's role in enhancing security measures.Sat, 18 Apr 2026 00:00:00 GMTPenligentResearchai-in-securitymodel-comparisonhttps://www.anthropic.com/news/claude-opus-4-7https://www.anthropic.com/news/claude-opus-4-7Anthropic has announced the release of Claude Opus 4.7, an advanced AI model designed to enhance user interaction and safety. This update is significant for AI/ML security as it addresses previous vulnerabilities and improves the model's robustness against adversarial attacks.Thu, 16 Apr 2026 00:00:00 GMTAnthropicToolai-modelsecurity-updateadversarial-defensehttps://thehackernews.com/2026/04/openai-launches-gpt-54-cyber-with.html?m=1https://thehackernews.com/2026/04/openai-launches-gpt-54-cyber-with.html?m=1OpenAI has introduced GPT-5.4-Cyber, a new version of its language model tailored for cybersecurity applications. This launch aims to enhance the capabilities of security teams in identifying and mitigating threats more effectively.Wed, 15 Apr 2026 00:00:00 GMTThe Hacker NewsToolgpt-5-4-cybercybersecurityai-toolshttps://medium.com/wix-engineering/the-ai-coding-agent-manifesto-c8f61629d677https://medium.com/wix-engineering/the-ai-coding-agent-manifesto-c8f61629d677This article discusses the principles and ethical considerations surrounding the development of AI coding agents. It highlights the importance of responsible AI practices in coding to enhance security and efficiency in software development.Wed, 15 Apr 2026 00:00:00 GMTMediumPolicyai-ethicscoding-agentssoftware-securityhttps://www.reuters.com/legal/litigation/ai-boosted-hacks-with-anthropics-mythos-could-have-dire-consequences-banks-2026-04-13/https://www.reuters.com/legal/litigation/ai-boosted-hacks-with-anthropics-mythos-could-have-dire-consequences-banks-2026-04-13/The article discusses the potential risks posed by AI-enhanced hacking techniques, particularly those utilizing Anthropic's Mythos framework. It highlights the implications for the banking sector, emphasizing the need for robust security measures against evolving threats.Mon, 13 Apr 2026 00:00:00 GMTReutersThreat Actorai-hackingbanking-securityanthropic-mythoshttps://www.securecodewarrior.com/article/prompt-injection-and-the-security-risks-of-agentic-coding-toolshttps://www.securecodewarrior.com/article/prompt-injection-and-the-security-risks-of-agentic-coding-toolsOur testing showed that if the underlying model driving an agentic coding tool is vulnerable to a prompt injection, the agent can be manipulated into writing insecure code. This raises serious concerns for developers and organizations relying on these tools.Wed, 01 Apr 2026 00:00:00 GMTsecurecodewarrior.comVulnerabilityprompt-injectioncoding-toolsai-securityvulnerabilitieshttps://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/The Axios npm package has been compromised in a supply chain attack, leading to the distribution of a cross-platform Remote Access Trojan (RAT). This incident highlights the vulnerabilities in software supply chains and the potential risks posed to AI/ML applications relying on third-party packages.Wed, 01 Apr 2026 00:00:00 GMTSnykIncidentsupply-chain-attacknpm-securityremote-access-trojanhttps://thehackernews.com/2026/03/langchain-langgraph-flaws-expose-files.htmlhttps://thehackernews.com/2026/03/langchain-langgraph-flaws-expose-files.htmlRecent vulnerabilities in LangChain and LangGraph have been discovered, potentially exposing sensitive files and database information. These flaws highlight significant security risks in widely adopted AI frameworks, emphasizing the need for robust security measures in AI development.Sat, 28 Mar 2026 00:00:00 GMTThe Hacker NewsVulnerabilitylangchainlanggraphai-securityhttps://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaignhttps://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaignThe article discusses a supply chain attack involving malicious packages on PyPI that target the LiteLLM project. This incident highlights the ongoing risks associated with software supply chains and the importance of securing dependencies in AI/ML development.Thu, 26 Mar 2026 00:00:00 GMTWiz BlogIncidentsupply-chain-attackpypimalicious-packageshttps://lynxtechnologypartners.com/blog/deepfakes-and-cybersecurity-the-next-frontier-in-ai-driven-threats/https://lynxtechnologypartners.com/blog/deepfakes-and-cybersecurity-the-next-frontier-in-ai-driven-threats/The article discusses the rise of AI-generated deepfakes as tools for cybercriminals, focusing on their usage in sophisticated social engineering attacks. It highlights the significant implications for cybersecurity as these tactics become more prevalent.Tue, 24 Mar 2026 00:00:00 GMTlynxtechnologypartners.comThreat ActordeepfakescybersecurityAI-threatshttps://www.techradar.com/pro/security/three-high-risk-ai-vulnerabilities-discovered-in-claude-ai-end-to-end-attack-chain-exfiltrates-sensitive-info-without-user-knowinghttps://www.techradar.com/pro/security/three-high-risk-ai-vulnerabilities-discovered-in-claude-ai-end-to-end-attack-chain-exfiltrates-sensitive-info-without-user-knowingThe article discusses three significant vulnerabilities found in Claude.ai that could allow attackers to exfiltrate sensitive information without user awareness. This highlights the critical need for enhanced security measures in AI applications to protect user data.Sun, 22 Mar 2026 00:00:00 GMTTechRadarVulnerabilityai-vulnerabilitiesdata-exfiltrationclaude-aihttps://www.paloaltonetworks.com/blog/network-security/beyond-jailbreaks-why-agentic-ai-needs-contextual-red-teaming/https://www.paloaltonetworks.com/blog/network-security/beyond-jailbreaks-why-agentic-ai-needs-contextual-red-teaming/The article discusses the importance of contextual red teaming in evaluating the security of agentic AI systems. It highlights how traditional security measures may fall short in addressing the unique challenges posed by AI, emphasizing the need for tailored approaches to ensure robust security.Sun, 22 Mar 2026 00:00:00 GMTPalo Alto Networks BlogResearchagentic-aired-teamingai-securityhttps://arxiv.org/abs/2603.04474https://arxiv.org/abs/2603.04474This article discusses the potential for error cascades in multi-agent systems utilizing large language models (LLMs) and proposes methods for mitigation. Understanding these error dynamics is crucial for enhancing the reliability and security of AI systems in collaborative environments.Sun, 22 Mar 2026 00:00:00 GMTarXivResearcherror-cascademulti-agent-systemsllm-securityhttps://sebastion.dev/intelligence/2026-03-21-poc-github-actions-shell-injection-via-unsanitized-issue-metadatahttps://sebastion.dev/intelligence/2026-03-21-poc-github-actions-shell-injection-via-unsanitized-issue-metadataThis article discusses a vulnerability in GitHub Actions that allows shell injection through unsanitized issue metadata in workflow templates. The findings highlight the importance of input validation in CI/CD pipelines to prevent potential exploitation by threat actors.Sun, 22 Mar 2026 00:00:00 GMTSebastionVulnerabilitygithub-actionsshell-injectionci-cd-securityhttps://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.htmlhttps://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.htmlA critical vulnerability in Langflow, identified as CVE-2026-33017, has been disclosed and is reportedly being exploited within hours of its announcement. This incident highlights the urgent need for timely patching and awareness in the AI/ML security landscape.Sat, 21 Mar 2026 00:00:00 GMTThe Hacker NewsVulnerabilitylangflowcve-2026-33017vulnerability-exploitationhttps://www.techradar.com/pro/security/three-high-risk-ai-vulnerabilities-discovered-in-claude-ai-end-to-end-attack-chain-exfiltrates-sensitive-info-without-user-knowing?utm_source=openaihttps://www.techradar.com/pro/security/three-high-risk-ai-vulnerabilities-discovered-in-claude-ai-end-to-end-attack-chain-exfiltrates-sensitive-info-without-user-knowing?utm_source=openaiResearchers have identified three critical vulnerabilities in Claude.ai that could facilitate an end-to-end attack chain. These vulnerabilities allow sensitive information to be exfiltrated without the user's awareness, posing serious privacy and security risks.Sat, 21 Mar 2026 00:00:00 GMTtechradar.comVulnerabilityai-vulnerabilitydata-exfiltrationhttps://thehackernews.com/2026/03/how-ceros-gives-security-teams.htmlhttps://thehackernews.com/2026/03/how-ceros-gives-security-teams.htmlThe article discusses how Ceros enhances security teams' capabilities by providing visibility and control over Claude code. This is particularly relevant as organizations increasingly rely on AI systems, necessitating robust security measures to protect against potential vulnerabilities.Sat, 21 Mar 2026 00:00:00 GMTThe Hacker NewsToolai-securitycode-analysissecurity-toolshttps://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf?utm_source=openaihttps://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf?utm_source=openaiNIST has published guidelines focused on building trustworthy and responsible AI systems. This document outlines best practices and standards essential for ethical AI development.Thu, 19 Mar 2026 00:00:00 GMTnvlpubs.nist.govPolicynistai-standardsresponsible-aihttps://thehackernews.com/2026/03/threatsday-bulletin-fortigate-raas.htmlhttps://thehackernews.com/2026/03/threatsday-bulletin-fortigate-raas.htmlThe article discusses various security threats including ransomware-as-a-service targeting FortiGate devices and exploits affecting Citrix products. It highlights the importance of staying informed about these vulnerabilities and the evolving tactics used by threat actors in the cybersecurity landscape.Thu, 19 Mar 2026 00:00:00 GMTThe Hacker NewsThreat Actorransomware-as-a-servicecitrix-exploitsphishinghttps://arxiv.org/abs/2602.10481?utm_source=openaihttps://arxiv.org/abs/2602.10481?utm_source=openaiThis paper discusses the challenges of ensuring deterministic security in non-deterministic AI systems. It explores novel methods to protect context and prompts that are critical to the AI’s performance.Thu, 19 Mar 2026 00:00:00 GMTarxiv.orgResearchdeterministic-securityai-systemscontext-protectionhttps://aicode.swerdlow.devhttps://aicode.swerdlow.devThe article encourages developers to be proactive in guiding AI's impact on their codebases, ensuring that changes are beneficial rather than detrimental. It emphasizes the importance of deliberate design decisions in AI integration.Thu, 19 Mar 2026 00:00:00 GMTnews.ycombinator.comPolicyai-integrationcodebasehttps://thehackernews.com/2026/03/ai-flaws-in-amazon-bedrock-langsmith.htmlhttps://thehackernews.com/2026/03/ai-flaws-in-amazon-bedrock-langsmith.htmlRecent vulnerabilities discovered in Amazon Bedrock, LangSmith, and SGLang pose significant risks, allowing for potential data exfiltration and remote code execution. These flaws highlight the urgent need for enhanced security measures in AI platforms to protect sensitive data.Wed, 18 Mar 2026 00:00:00 GMTThe Hacker NewsVulnerabilitydata-exfiltrationremote-code-executionai-securityhttps://www.helpnetsecurity.com/2025/10/01/a2as-framework-agentic-ai-security-risks/https://www.helpnetsecurity.com/2025/10/01/a2as-framework-agentic-ai-security-risks/The A2AS framework is designed to protect AI agents at runtime and prevent real-world incidents like fraud, data theft, and malware spread. It addresses unique vulnerabilities associated with agentic AI systems.Tue, 17 Mar 2026 00:00:00 GMTHelp Net SecurityPolicyai-securityagentic-aihttps://www.sentinelone.com/cybersecurity-101/data-and-ai/ai-security-risks/https://www.sentinelone.com/cybersecurity-101/data-and-ai/ai-security-risks/The article outlines effective LLM security measures that address vulnerabilities across different phases of development and operational use. Understanding these risks is essential for maintaining secure AI deployments.Tue, 17 Mar 2026 00:00:00 GMTsentinelone.comResearchai-securityllm-vulnerabilitieshttps://www.obsidiansecurity.com/blog/ai-agent-security-frameworkhttps://www.obsidiansecurity.com/blog/ai-agent-security-frameworkTraditional security tools cannot address the specific vulnerabilities of agentic AI systems, leaving enterprises exposed to novel threats. The article discusses the need for a new security framework tailored to these challenges.Tue, 17 Mar 2026 00:00:00 GMTobsidiansecurity.comPolicyenterprise-securityai-vulnerabilitieshttps://www.wiz.io/blog/reducing-ai-risk-across-ai-applicationshttps://www.wiz.io/blog/reducing-ai-risk-across-ai-applicationsThe article discusses strategies for mitigating risks associated with the deployment of AI applications. It highlights the importance of security measures to protect against vulnerabilities that could be exploited by malicious actors.Tue, 17 Mar 2026 00:00:00 GMTWiz BlogPolicyai-risk-managementsecurity-strategieshttps://www.cycognito.com/learn/ai-security/llm-security/https://www.cycognito.com/learn/ai-security/llm-security/Exploring the necessity of securing LLM applications against specialized threats, including prompt injection and data poisoning, the article details top risks and effective mitigation strategies. It emphasizes a proactive approach to AI security.Mon, 16 Mar 2026 00:00:00 GMTcycognito.comPolicyllm-securityrisksbest-practicesai-securityhttps://unit42.paloaltonetworks.com/agentic-ai-threats/https://unit42.paloaltonetworks.com/agentic-ai-threats/The article discusses multiple threats associated with AI agents, including prompt injection and data exfiltration. Understanding these threats is essential for developing effective countermeasures.Mon, 16 Mar 2026 00:00:00 GMTunit42.paloaltonetworks.comThreat Actorai-agentsthreatsprompt-injectionhttps://www.blackfog.com/ai-cybersecurity-threats-vs-traditional-attacks/https://www.blackfog.com/ai-cybersecurity-threats-vs-traditional-attacks/This article contrasts AI cybersecurity threats with traditional attacks, highlighting how AI facilitates the automation of attack phases. The changes in attack methodology have significant implications for cybersecurity defenses.Mon, 16 Mar 2026 00:00:00 GMTblackfog.comThreat Actorai-threatstraditional-attackshttps://www.forbes.com/sites/kolawolesamueladebayo/2026/02/17/better-data-could-unlock-ais-full-potential-in-cybersecurity/https://www.forbes.com/sites/kolawolesamueladebayo/2026/02/17/better-data-could-unlock-ais-full-potential-in-cybersecurity/The article discusses how improved data quality can enhance the effectiveness of AI in cybersecurity applications. It highlights the importance of data-driven approaches in combating cyber threats and optimizing security measures.Tue, 17 Feb 2026 00:00:00 GMTForbesResearchai-in-cybersecuritydata-qualitymachine-learning