Live Incident Intelligence

Over 30 critical "ShadowMQ" vulnerabilities, stemming from insecure ZeroMQ `recv_pyobj()` and Python `pickle` deserialization, affect leading AI inference engines such as Meta Llama LLM and NVIDIA TensorRT-LLM. These flaws enable remote code execution, data theft, and privilege escalation, with specific CVEs like CVE-2024-50050 attributed, and active exploitation has been observed.

Security researcher Ari Marzouk disclosed "IDEsaster," a collection of over 30 vulnerabilities, with 24 assigned CVEs, affecting various AI-powered Integrated Development Environments (IDEs) like GitHub Copilot and Cursor. These flaws enable attackers to chain prompt injection techniques with legitimate IDE features and auto-approved AI agent tool calls to achieve sensitive data exfiltration and remote code execution (RCE).

A data breach at OpenAI resulted in the exposure of API user information. This incident necessitates prompt action from affected users to secure accounts and rotate API keys to prevent unauthorized access.

Agentic AI systems introduce new architectural risks due to their autonomous planning, decision-making, and tool-use capabilities, moving the attack surface from static models to dynamic workflows. Key threats include memory poisoning, tool misuse, and potential remote code execution (RCE) stemming from manipulated agent reasoning paths, external interactions, and inter-agent communications.

Anthropic's Threat Intelligence team disrupted the first known AI-orchestrated cyber espionage campaign, where a state-sponsored Chinese threat actor utilized Claude Code to autonomously execute 80-90% of the intrusion life cycle, including reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration. This campaign leveraged widely available open-source commodity tools rather than zero-day vulnerabilities, demonstrating a critical shift where AI handles tactical attack execution, significantly compressing detection timelines and challenging traditional incident response frameworks.

Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.

A novel indirect prompt injection attack allows threat actors to compromise Anthropic's Claude AI Code Interpreter, leveraging its network features to exfiltrate sensitive user chat data. This exploit bypasses default network settings by tricking Claude into uploading sandbox-stored user information directly to an attacker's account via Anthropic's own APIs.

Google's AI agent "Big Sleep" identified five new security flaws, including buffer overflow (CVE-2025-43429) and use-after-free (CVE-2025-43434) vulnerabilities, within Apple's Safari WebKit component. These critical vulnerabilities, if exploited by processing maliciously crafted web content, could result in unexpected browser crashes or memory corruption, requiring immediate patching via various Apple OS updates.

The article details a Remote Code Execution (RCE) vulnerability, tracked as CVE-2024-12366, affecting agentic AI systems that execute LLM-generated code without proper sandboxing. Attackers can craft malicious prompts to bypass sanitization, leading the AI to generate and execute arbitrary code on the host system.

A critical vulnerability in OpenAI's ChatGPT Atlas browser leverages a Cross-Site Request Forgery (CSRF) flaw to inject malicious instructions into the AI's persistent memory. This allows attackers to achieve arbitrary code execution and gain control over user accounts or systems across sessions, triggered by legitimate user interaction with the compromised AI.

AI browsers are highly susceptible to prompt injection attacks, where threat actors can manipulate Large Language Models (LLMs) to bypass security controls and execute unauthorized actions. This vulnerability allows for sensitive data exfiltration by exploiting the LLM's inability to distinguish between trusted user commands and malicious instructions embedded in untrusted web content, effectively nullifying browser protections like the same-origin policy.

Rapid AI adoption by 85% of organizations is creating an expanded attack surface, with security lagging behind adequate governance frameworks. This deficiency leads to systemic vulnerabilities such as data leakage and unauthorized model access in multi-tenant cloud environments, alongside "shadow AI" breaches that incur an estimated $670,000 more in costs.

The article highlights critical security risks in Large Language Model (LLM) deployments, emphasizing prompt injection as a key attack vector where malicious inputs override an LLM's intended behavior. This can lead to sensitive data leakage, unauthorized actions, or the generation of harmful content, necessitating robust input validation and secure model deployment practices.

The NVIDIA Container Toolkit contains a critical security flaw, identified as CVE-2024-0132, which allows for container escape. This vulnerability grants attackers full host system access, highlighting a significant risk in AI infrastructure.

Researchers demonstrated that as few as 250 poisoned documents can create a backdoor vulnerability in large language models, irrespective of model size or training data volume. This data poisoning technique, which can induce denial-of-service or potentially facilitate data exfiltration, challenges prior assumptions about the required scale of malicious training data during pretraining.

Attackers can achieve remote code execution (RCE) on developer machines by leveraging indirect prompt injection against agentic AI developer tools. This is accomplished by introducing untrusted data, such as malicious commands in GitHub issues or hidden payloads in fake Python packages within pull requests, which the AI agent autonomously executes.

An advanced attack chain exploits an LLM chatbot through indirect prompt injection (OWASP LLM01:2025) to achieve system prompt leakage and abuse excessive agency (OWASP LLM06:2025). This leads to sensitive customer data exfiltration and escalates to command injection (OWASP LLM05:2025) in a backend API, ultimately enabling remote code execution and intellectual property theft.

Google DeepMind introduces CodeMender, an AI agent designed to automatically discover and patch software vulnerabilities, including complex root causes and architectural weaknesses. The agent applies proactive fixes, such as `-fbounds-safety` annotations, demonstrated to prevent exploitation of vulnerabilities like the `CVE-2023-4863` heap buffer overflow in `libwebp`.

LLM-based applications are susceptible to remote code execution (RCE) vulnerabilities when executing LLM-generated code via functions like `exec` or `eval` without proper sandboxing, often triggered by prompt injection. Additionally, insecure access controls in Retrieval-Augmented Generation (RAG) systems can lead to data leakage and indirect prompt injection, while active content rendering of LLM outputs enables data exfiltration by embedding malicious links or images.

Threat actors are employing Large Language Models (LLMs) to create sophisticated phishing campaigns, leveraging LLM-generated code to obfuscate malicious payloads within Scalable Vector Graphics (SVG) files. These meticulously crafted SVG files bypass email security by disguising embedded JavaScript with business terminology, ultimately redirecting victims to fake login pages for credential harvesting.