Independent reporting on AI vulnerabilities, agent security, prompt injection, and the software supply chain — distilled for defenders and engineering teams.
BadByte (4 November 2026) exposes a trojanized ARTEX Docker image with a pre-auth root shell, pulled 9,000+ times and served by 62 consoles — as CERT-In flags AI-driven Crafty Falcon attacks on banks.
Read the briefingAcronis TRU (4 November 2026) exposes BOSSAI: a single Taiwan-based operator running a 12-agent AI attack mesh against hundreds of organizations in 11 countries, with confirmed exfiltration of emergency-services medical data, dispatch records, and university student data.
OpenAI report A Thousand Fewer Paths to Root (4 November 2026): an agent pipeline built on an upcoming cyber model produced 948 unique Linux local privilege escalation exploits in a mid-October run costing 1.21 million dollars, with patches flowing upstream.
arXiv:2611.03754 (NeurIPS 2026) introduces CREO, a framework that evolves search-agent poisoning strategies against an adapting defense: 64 to 75 percent total interference across three rounds, collapsing MuSiQue accuracy by up to 65 points while keyword and perplexity filters barely register it.
CVE-2026-110732 lets unauthenticated users register OAuth clients against AI Engine MCP up to 3.8.6 toward admin-bound tokens, and CVE-2026-62264 leaves PDF Reader MCP HTTP endpoints open despite a configured API key. Both scored 7.5, both published 30 October 2026.
Binance attributes its 29 October 2026 theft of approximately 6.34 billion dollars to a campaign that began with a tampered Homebrew installer for an AI coding tool, continued through a fake interview code assignment, and pivoted through an internal AI tool to the wallet signing service.
CNAS report Sovereign Agents (Ben Hayum, 3 November 2026) separates persistent agents from sovereign ones pursuing open-ended survival, lists seven capabilities and seven failing barriers, and makes eight policy recommendations.
Check Point Research found the Haiou jailbreak bundle for OpenAI Codex persistently rewriting global agent instructions so that greetings trigger an ad for a paid LLM gateway. The bundle ships encrypted payloads and six offensive security skills.
NVD published CVE-2026-121458 and CVE-2026-121419 on 3 November 2026: Instatic MCP read tools bypass object-level authorization, and SurrealDB MCP sessions can be hijacked across users of the same access method. Both fixed.
German researchers at Crissy Field scanned 159041 Lovable projects from Common Crawl and found 7403 Supabase-backed sites returning email-bearing rows with no login, plus passport records, payment data and 200000 exposed chat messages.
CVE-2026-116635, published 2 November 2026 and scored CVSS 3.1 6.1, is a path traversal in the deployment status component of the AWS Serverless MCP Server before 0.2.1: traversal sequences or an absolute path in the project name input let an actor influencing the MCP agent read, and with write access create or overwrite, JSON files outside the intended directory. Fixed in 0.2.1.
CVE-2026-120492 lets unauthenticated attackers bypass path-scoped MCP allowed_urls in Chainlit 2.12.0 with semicolon path segments. The current PyPI release is affected, so MCP teams should check their grants now.
CVE-2026-88968, published 3 November 2026 and scored CVSS 4.0 7.7, is a time-of-check to time-of-use race in Claude Code before 2.1.251: the Edit tool validated its target with point-in-time symlink resolution not bound to directory inodes, so attacker code in the Bash sandbox could swap a parent directory for a symlink and redirect the unsandboxed write outside the workspace. Fixed in 2.1.251.
On 2 November 2026 at 19:00 CET, an attacker using AI agents gained unauthorized access to GitBook infrastructure credentials. GitBook blocked the attacker, revoked all personal API tokens, and told customers to rotate integration tokens, Git Sync secrets and re-authenticate the GitBook MCP server. No content modification found; a full postmortem is pending.
Glow Labs found AI coding agents installing deprecated MCP servers from training data in 98 percent of observed sessions. Four high-severity flaws ride along, including a Puppeteer RCE, with no patch coming and no CVE to scan for.
A new paper (arXiv:2611.01953) shows coding agents are harmed by the first processing call on unknown archives, URLs and images: 32 of 42 harness-model pairs blew a 4 MiB disk budget, mostly before the model saw anything. The fix belongs in the tool, not the prompt.
A new paper introduces ETUDE, an attack hiding malicious behavior in updates to initially benign agent tools, with 97.6 percent success across seven frameworks. Defenses watching only the model context do not see it.
Trigger.dev disclosed on 1 November 2026 that an attacker gained unauthorized access to environment variables for a subset of customer organizations. The exploit is blocked and impacted owners were emailed, but the company has not detailed the vector. For a durable AI agent platform, exposed env vars mean exposed connected-service credentials.
WorkOS disclosed on 2 November 2026 that an AI-assisted offensive security framework was used to gain unauthorized access on 30 October to an internal sales application holding CRM contacts, call summaries and customer Slack excerpts. Production services were not impacted. CEO disclosure names ARTEX as the framework involved.