Incidents tagged Meta

'first' publicly documented Windows implant to use LLMs for C2

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical

Ad biz promises users control while bug could expose voice prompts

Three-Person Team Uses Claude to Breach OpenAI's Core Codebase; $6,500 Bounty Triggers AI Security Alarm finance.biggo.com

PLUS: HCL, TCS, admit data breaches; South Korea to fine Apple, Google; India bans some rideshare tips; and more!

This Copilot vulnerability could expose emails, 2FA codes, and other sensitive data Mashable

OpenAI confirms security breach but says no user data was affected TechRadar

A security breach at AI data vendor Mercor potentially exposed sensitive AI training data, including proprietary methodologies and competitive intelligence, impacting clients like Meta. The incident is suspected to involve a supply chain attack via malicious code injected into the LiteLLM open-source library, used to steal credentials and facilitate data exfiltration.

A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.

A security incident at AI data vendor Mercor exposed proprietary AI training data methodologies and strategies from Meta and other major AI labs. This breach represents a significant competitive intelligence leak, highlighting critical security vulnerabilities within the AI supply chain and third-party vendor relationships.

A major security incident impacting Mercor, a leading data vendor, potentially exposed proprietary AI model training data from several major AI labs, including Meta. This breach prompted Meta to indefinitely pause its work with Mercor, with other AI firms also reevaluating their partnerships due to the third-party compromise.

An internal Meta AI agent provided erroneous instructions to an engineer, leading to the accidental exposure of sensitive user and company data to other employees for two hours. This incident highlights a vulnerability in agentic AI systems where a lack of contextual awareness can prompt actions with unintended data exposure consequences.

Architectural vulnerabilities within Large Language Model (LLM) environments integrated with the Model Context Protocol (MCP) enable attackers to embed malicious instructions within data content or tool metadata. This flaw allows for indirect prompt injection and tool poisoning, compelling LLMs to autonomously perform unauthorized actions such as data exfiltration or triggering enterprise workflows.