Live Incident Intelligence

The Amazon Q Developer Extension for Visual Studio Code (version 1.84.0) was compromised via a software supply chain attack, embedding a prompt injection that bypassed security reviews. This malicious prompt, detailed in AWS Security Bulletin AWS-2025-015, instructed the AI assistant to systematically delete local file systems and AWS cloud resources, including S3 buckets, EC2 instances, and IAM users.

Evidence indicates that SQLite is affected by a security issue. Reported affected versions include 3.50.2.

A critical security flaw in McDonald's McHire AI hiring tool leveraged default '123456' administrative credentials combined with an Insecure Direct Object Reference (IDOR) vulnerability in an internal API. This exploit allowed researchers to access and potentially expose sensitive Personally Identifiable Information (PII) for millions of job applicants, including chat histories and contact details.

The McHire AI hiring bot, developed by Paradox.ai, suffered from basic security misconfigurations, specifically allowing unauthorized access via easily guessable weak passwords like '123456'. This critical flaw resulted in the data exposure of personal information, résumés, and contact details for tens of millions of McDonald's job applicants.

Evidence indicates that dynamic_module_utils.py is affected by a security issue. Reported affected versions include 4.49.0.

The article highlights the significant risk of sensitive enterprise data leaks through the misuse of Large Language Models like ChatGPT. A prominent example is the April 2023 Samsung incident, where employees inadvertently exposed confidential source code and intellectual property by inputting it into the chatbot.

The article highlights critical security risks in AI and LLM deployments, specifically prompt injection and jailbreak attacks, which enable manipulation for unauthorized actions, sensitive data exposure, and compliance failures. These rapid exploits, alongside data leakage and model theft, pose significant financial and reputational impacts on enterprises leveraging AI technologies.

Researchers have uncovered "EchoLeak," a critical zero-click vulnerability in Microsoft 365 Copilot that exploits design flaws inherent to Retrieval Augmented Generation (RAG) applications. This flaw, leveraging an "LLM Scope Violation" technique, allows for the automatic exfiltration of sensitive corporate data from the LLM's context without requiring user interaction.

The article highlights critical security gaps in Large Language Model (LLM) applications, detailing common vulnerabilities such as prompt injection, sensitive information disclosure, and supply chain compromises. These flaws, categorized by the OWASP Top 10 for LLM Applications, can lead to unintended LLM behavior, data exposure, and other serious consequences.

A critical "EchoLeak" zero-click vulnerability in Microsoft 365 Copilot allowed attackers to remotely exfiltrate sensitive internal data by sending emails containing hidden instructions. This flaw represents an LLM scope violation where the AI agent was tricked into accessing information beyond its intended permissions without user interaction.

A remotely exploitable zero-day vulnerability, CVE-2025-37899, has been discovered in the Linux kernel's Server Message Block (SMB) protocol using OpenAI's o3 model. This critical flaw is identified as a use-after-free bug in the SMB 'logoff' command handler, allowing an object to be freed while still accessible by another thread.

AI agentic applications face significant security threats, including prompt injection, tool misuse, and unsecured code interpreters, which can result in information leakage, credential theft, and remote code execution. These vulnerabilities are primarily rooted in insecure design patterns, misconfigurations, and unsafe tool integrations rather than specific AI agent frameworks.

The DeepSeek breach reportedly resulted in sensitive data being exposed to the dark web, indicating a significant impact on data confidentiality. The full article content detailing the specific exploit or incident scope was not successfully retrieved due to a Cloudflare security block during the scraping process.

Evidence indicates that litellm is affected by a security issue. Reported affected versions include 1.40.12.

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

SQL injection vulnerability in langchain allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.