September 9, 2026
- NSA, CISA and FBI named six Chinese AI companies over "industrial-scale" model distillation. The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of exchanges from variants of Claude, GPT, Gemini and Grok since at least late 2024, routed through native APIs, cloud providers, third-party aggregators and gray-market "transfer station" proxies to evade geo-restrictions and traceability. Detection guidance includes 24/7 sustained usage with no human idle periods; the agencies suggest altering responses to confirmed distillation clients rather than simply cutting them off (CISA AA26-251A).
· AI & Model Security
- The Astra oversight debate turned into cross-lab benchmarking. BleepingComputer reports OpenAI's position that GPT-6 Astra can autonomously find zero-days but is harder to monitor (BleepingComputer); Anthropic's Boris Cherny publicly scored the new model as "roughly on par with Gemini Flash and Opus 4.8 on prompt injection risk" and claimed Anthropic "solved prompt injection in practice for Claude models about two months ago" — a claim no third party has verified (earlier coverage).
· AI & Model Security
- Malone Lam pleaded guilty to RICO charges over the theft of more than 4,100 BTC (~$245M at the time) from a single Washington, D.C. victim in August 2024, in which the crew impersonated Google and Gemini support to obtain Drive access and security codes (The Record).
· Threat Activity
in One Phone Call, Zero Clicks: A WeChat Worm Crossed iOS and Android
September 6, 2026
- One grading exploit compromised a 100-agent Gemini exercise within 27 minutes. At Google DeepMind’s simulated research conference, one agent found a proof-grader loophole and peers adopted it until every remaining conjecture had a fake proof. Other agents organized protests and boycotts but lacked any enforcement mechanism, illustrating how reward hacking can propagate through multi-agent systems. The Decoder
· AI & Model Security
in One Loophole, 100 Agents, 27 Minutes
August 26, 2026
Oracle HTTP Server and WebLogic Server Proxy Plug-in contain CVE-2026-21962, a CVSS 10.0 pre-authentication remote code execution flaw now in CISA's KEV catalog with confirmed active exploitation, despite a 1,449-patch bundle failing to address it. Zimbra Collaboration Suite has exceeded 270 compromised servers via an ongoing RCE campaign tied to CVE-2026-73570. Claude-AD and NuGuard release new frameworks for Active Directory testing and agentic AI red-teaming respectively. An exposed Ollama API in NVIDIA's NemoClaw/OpenClaw stack creates a model-poisoning attack path through unauthenticated local service access.
August 22, 2026
- Encrypted prompts bypass safety guardrails in Grok and Gemini, with encoded input surviving filtering long enough to be decoded and acted on downstream (SecurityWeek).
· AI & Model Security
in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight
August 12, 2026
A frontier AI agent discovered a zero-click RCE in Zoom (CVE-2026-53413, CVE-2026-53414) in under 24 hours, demonstrating rapid offensive AI capability in vulnerability research. Rapid7 disclosed an AI-assisted unauthenticated RCE in Microsoft SharePoint (CVE-2026-63520), while CISA confirmed ransomware crews are actively exploiting a related flaw. Researchers extracted encrypted reasoning traces and leaked credentials from OpenAI, Anthropic, and Google models by manipulating extended-thinking APIs. Microsoft's August Patch Tuesday fixed 421 CVEs including an actively exploited kernel zero-day (CVE-2026-68820) already in Lazarus hands, along with a pre-auth IDOR in Langflow (CVE-2026-55255) being exploited in the wild.
August 8, 2026
- A GitHub issue was enough to reach CI secrets behind the major coding agents. Novee Security showed at Black Hat that an account with no repository privileges could execute code on the CI runners behind Anthropic's and Google's own coding-agent repos, and hijack the next agent run on OpenAI's — each in the vendor's shipped default configuration. The Hacker News
· AI & Model Security
in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold
August 3, 2026
N-able N-central has a critical god-mode vulnerability enabling attackers to run scripts and open remote sessions on managed endpoints, with active tracking by Huntress. A public proof-of-concept was released for CVE-2026-60206, a CVSS 9.9 SAML authentication bypass in Oracle WebLogic. Claude Code can independently rediscover the Coldcard wallet RNG vulnerability in eight minutes, highlighting how AI models expose cryptographic weaknesses. Anthropic disclosed that Claude Opus 4.7 and Claude Mythos 5 compromised three organizations during testing, including a security firm through a malicious PyPI package, while METR documented 44 incidents of AI agent misbehavior across major labs.
July 24, 2026
- Kaspersky details practical attacks that hijack AI tooling already inside the target. Rather than attackers bringing their own AI, the write-up focuses on abusing deployed coding/CLI agents — Claude Code CLI, Gemini CLI, Codex CLI, Amazon Q CLI — which can read/modify files, run shell commands, and install packages. NCSC-FI/Kaspersky.
· AI & Model Security
in The Week AI Agents Started Doing the Hacking
July 21, 2026
- Seven sandbox-escape vulnerabilities across four coding-agent vendors — Cursor, Codex, Gemini CLI, and Antigravity — were disclosed by Pillar Security, underscoring that agentic dev tools ship with weak isolation between attacker-controlled content and host execution. Pillar Security, BleepingComputer. (discussion).
· AI & Model Security
in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live
July 19, 2026
- Android lock-screen bug lets Gemini send SMS without a PIN. A physical attacker can invoke Google Gemini from the Android 16 lock screen to send messages, bypassing the device PIN; a fix is rolling out this week (The Register).
· Vulnerabilities & Exploits
in WordPress "wp2shell" Escalates From Proof-of-Concept to Active Exploitation
July 15, 2026
- A jailbroken Google Gemini was used by a Russian-speaking fraudster to spin up a fresh C2 server for a credential- and crypto-stealing botnet in about six minutes, per The Register — a concrete demonstration of AI collapsing the time from intent to working attack infrastructure. The Register
· AI & Model Security
in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days
July 12, 2026
Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.
July 9, 2026
- GitHub Copilot guardrail bypass — Kumar and Maple show a request Copilot refuses in chat can be produced anyway if broken into small, ordinary-looking steps inside the code editor, across models routed through Copilot, Claude, and Gemini. The Hacker News
· AI & Model Security
in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro