ai

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

, ,

Researchers unveiled vulnerabilities in five open-source Android AI agent frameworks, demonstrating how invisible screen text can be injected and leveraged to execute arbitrary commands on the host PC via insecure interactions like unsanitized shell calls and file race conditions. These attacks exploit weaknesses such as unprotected broadcast inputs, overlay UI spoofing, and lack of keyboard input authentication, enabling remote code execution without user detection; despite private disclosure, the maintainers have yet to respond or patch the issues, underscoring the need for improved security practices in mobile AI agent tooling.

https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html

Hugging Face – Security Incident Disclosure

, ,

Hugging Face disclosed that in July 2026 their production infrastructure was compromised by an autonomous AI-driven attacker exploiting code-execution vulnerabilities in their dataset processing pipeline, leading to unauthorized access to internal datasets and credentials. They contained the intrusion by closing the vulnerabilities, rotating credentials, rebuilding affected nodes, enhancing cluster controls, and used their own open-weight AI models for rapid forensic analysis, highlighting the emerging challenge of AI-powered attacks and the need for AI-assisted defense capabilities. The investigation continues with external cybersecurity experts, and affected users are advised to rotate tokens and monitor accounts.

https://huggingface.co/blog/security-incident-july-2026

New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

, ,

Researchers have identified a new class of AI attack called agent data injection (ADI), where attackers manipulate the trusted data fields—such as sender names or button IDs—that AI agents rely on, causing them to misclick or execute malicious commands without altering the agent’s task instructions. This probabilistic delimiter injection exploits AI models' probabilistic parsing of punctuation to fake trusted data, bypassing typical prompt-injection defenses and affecting various AI tools including web agents and coding assistants. While some mitigations like randomizing element IDs can reduce the attack’s success, the vulnerability remains significant as AI agents continue to blend trusted and untrusted data without clear separation.

https://thehackernews.com/2026/07/new-agent-data-injection-attack-can.html

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

, ,

A flaw in the Cursor IDE on Windows allows arbitrary code execution when opening a cloned repository containing a malicious git.exe file in its root, as the IDE automatically runs this binary without prompts or warnings. Reported by AI security firm Mindgard in December 2025, the vulnerability remains unpatched and unacknowledged by Cursor despite full disclosure and repeated follow-ups. Similar issues affecting other AI/code tools highlight a persistent threat where malicious binaries in project folders execute automatically, emphasizing the need for defensive measures like application controls or sandboxing when opening untrusted repositories.

https://thehackernews.com/2026/07/cursor-flaw-lets-malicious-cloned.html

The Memory Heist

, ,

A security researcher demonstrated a method to exfiltrate personal data from the AI assistant Claude by exploiting its web browsing feature and memory system. By creating a malicious website that mimics a legitimate service and leverages Claude's ability to navigate hyperlinks, the researcher tricked Claude into leaking sensitive user information such as full name, employer, and hometown without user consent. Following responsible disclosure, Anthropic mitigated the vulnerability by restricting Claude's web navigation capabilities.

https://www.ayush.digital/blog/the-memory-heist

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

, , ,

Researchers have demonstrated a novel “MemGhost” attack that injects persistent false memories into AI personal assistants through a single crafted email, causing the AI to save deceptive information without alerting the user. Targeting assistants like OpenClaw that maintain memory files and access user inboxes, the attack stealthily alters the assistant’s knowledge base, influencing future interactions while evading detection by existing filters and user oversight. The study highlights a critical vulnerability where AI memory writes from untrusted inputs remain unregulated, urging the need for provenance tracking, user approval, and audit logging to mitigate such persistent memory poisoning risks.

https://thehackernews.com/2026/07/new-memghost-attack-plants-persistent.html

Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

, , ,

A lone attacker leveraged AI-driven workflows to quickly exploit multiple weaknesses across an AWS cloud environment, conducting extensive reconnaissance, credential harvesting, and deployment pipeline abuse within 72 hours, leading to financial extortion of a major Amazon customer. The attacker chained together vulnerabilities in applications, cloud resources, and CI/CD pipelines to systematically steal secrets, create backdoors, and disrupt operations, demonstrating an accelerated attack tempo enabled by AI. Security experts warn organizations must enhance automated detection, response capabilities, and containment procedures to address the increased speed and scale of AI-assisted cloud attacks.

https://www.darkreading.com/cloud-security/lone-attacker-ai-breach-aws-cloud-environment

Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

, ,

Researchers demonstrated a proof-of-concept attack called “Friendly Fire” that tricks AI coding agents like Anthropic's Claude Code and OpenAI's Codex, running in autonomous modes, into executing malicious code hidden in untrusted third-party repositories. The attack exploits these agents' design, leading them to run disguised payloads—such as a script suggested in a README file—without user approval, highlighting significant security risks when using AI agents to vet external code. Experts recommend avoiding giving such AI agents command execution capabilities over untrusted code and caution against relying solely on model updates or sandboxing as defenses.

https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html

JadePuffer Ransomware Used AI Agent to Automate Entire Attack

, , ,

Researchers from Sysdig identified JadePuffer as the first ransomware operation fully automated by a large language model (LLM) agent, which autonomously conducted reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption. The AI-powered attack exploited a remote code execution flaw in Langflow to access targets, adapt to failures in real time, and encrypt over 1,300 MySQL configuration items, illustrating the emergence of agentic threat actors lowering the barrier for complex cyberattacks.

https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/

New BioShocking Attack Manipulates AI Browser Into Data Theft

, , ,

A new prompt injection attack called “BioShocking” tricks AI-powered browsers into treating dangerous real-world actions as fictional scenarios, bypassing safety guardrails and enabling data theft. Researchers at LayerX demonstrated this by using a malicious webpage that taught AI agents to ignore normal rules, leading them to disclose sensitive information from code repositories across six tested AI browsers, with only one vendor implementing an effective fix. LayerX recommends stronger user confirmation, context checks, and access restrictions to mitigate this vulnerability.

https://www.bleepingcomputer.com/news/security/new-bioshocking-attack-manipulates-ai-browser-into-data-theft/

Clean GitHub Repo Tricks AI Coding Agents Into Running Malware

, , , ,

Researchers at Mozilla's 0DIN AI security platform demonstrated that an attacker can trick AI coding agents like Claude Code into executing malicious shell commands by cloning and running a clean-looking GitHub repository containing no explicit malware. The attack exploits a multi-step setup process where an initialization command triggers a shell script that fetches and executes a remote payload from a DNS TXT record controlled by the attacker, ultimately granting the attacker interactive shell access with developer privileges. This method evades detection by security scanners, AI agents, and human reviewers, raising concerns about AI-assisted development security and prompting recommendations for improved transparency in automated execution chains.

https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/

Cybersecurity Firms Targeted by Fraudulent OpenAI Organization Invites

, ,

Threat actors have been creating fraudulent OpenAI ChatGPT organizations impersonating legitimate companies, such as Push Security, to send legitimate-looking invitations to targeted employees with the goal of tricking them into sharing sensitive company information. These attacker-controlled tenants assign invitees administrative privileges and include payment methods to appear credible, enabling them to collect confidential data submitted within the workspace. Security experts warn this reflects a growing tactic of abusing legitimate SaaS invitation systems to bypass email security measures and recommend staff training and monitoring of SaaS memberships to mitigate risks.

https://www.bleepingcomputer.com/news/security/cybersecurity-firms-targeted-by-fraudulent-openai-organization-invites/

Vulnerability Reports Are Not Special Anymore

,

Filippo Valsorda argues that vulnerability reports have lost their special status due to advances in large language models (LLMs), which can now identify potential security issues as effectively as human researchers. This shift diminishes the scarcity and confidentiality that once made vulnerability reports valuable, making the main challenge for maintainers triage and remediation rather than discovery. The article suggests security teams should adapt by focusing on rapid assessment and integrating automated LLM analysis into their workflows while recognizing some high-severity or trusted-source reports still require special handling.

https://words.filippo.io/vuln-reports/

‘Deepfake as a Service’ Sees 39% Spike in Dark Web Conversations — and Experts Fear It Will Fuel the Next Wave of “Fake Boss” Scams

, , ,

Discussions about “deepfake as a service” have surged by 39% on dark web forums, raising concerns among experts that this trend could intensify “fake boss” scams, where attackers impersonate executives to deceive employees. The rise of easily accessible deepfake technology lowers barriers for cybercriminals to conduct sophisticated social engineering attacks. Experts warn that this development may lead to more convincing and frequent fraud attempts targeting organizations.

https://www.techradar.com/pro/security/deepfake-as-a-service-sees-39-percent-spike-in-dark-web-conversations-and-experts-fear-it-will-fuel-the-next-wave-of-fake-boss-scams

Hundreds of AI-powered iOS Apps Found Exposing Credentials

,

Researchers from Wake Forest University analyzed 444 iOS apps with AI features and found that 282 exposed exploitable credentials or backend access, affecting diverse categories like productivity and health. Despite responsible disclosure, only 28% of the vulnerable apps remediated the issue, while 23% remained exploitable due to lack of action or flawed authentication. The study highlights systemic credential leakage in AI-powered iOS apps, posing ongoing security risks beyond individual developers and providers.

https://www.helpnetsecurity.com/2026/06/22/llm-api-credential-leakage-ios-apps/

Scroll to Top