#nvidia · kyber.today

July 28, 2026

Agentic AI Muscles Into the Offensive Toolkit

PortSwigger released Burp AT, an agentic-AI testing tool, while researchers demonstrated the first fully AI-written iOS jailbreak (Relaxin) for Apple devices with SPTM protection. Microsoft launched MAI-Cyber-1-Flash, a security model scoring 96% on CyberGym benchmarks for autonomous attack/defense simulation. Multiple zero-day exploits surfaced including a pre-auth vBulletin RCE (CVE-2026-61511), an exploited Arista VeloCloud zero-day, an n8n sandbox escape, and active FastJSON2 exploitation against US firms, while Hugging Face published a CISO post-mortem of autonomous-AI intrusion revealing 17,000+ logged actions and lateral movement.

June 27, 2026

Amazon Q Coding Assistant Hijacked Through Malicious MCP Configs as Washington Starts Gating Frontier Models Customer-by-Customer

Amazon Q Developer suffered a critical vulnerability (CVE-2026-12957, CVSS 8.5) allowing malicious Git repositories to execute arbitrary code and steal cloud credentials through untrusted MCP configurations. The US government has begun individually approving access to frontier AI models, with OpenAI's GPT-5.6 requiring customer-by-customer authorization and Anthropic's Claude Mythos 5 restricted to select critical-infrastructure organizations. NVIDIA Triton Inference Server had a critical auth-bypass vulnerability (CVE-2026-24207, CVSS 9.8) with public exploits enabling pre-auth RCE. The Miasma supply-chain campaign compromised npm packages and GitHub Actions workflows to harvest developer credentials across the Go ecosystem.