Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
The blog discusses detection of backdoored language models, outlining research on identifying malicious modifications in AI systems, focusing on three observable signatures and a practical detection scanner.
Over 230 malicious packages, dubbed “skills,” targeting the OpenClaw AI assistant have been released in a week, posing as legitimate tools to distribute malware that steals sensitive information like API keys and passwords. The malware exploits misconfigurations in OpenClaw's admin interface and employs social engineering tactics to infect users' systems, using a seemingly crucial tool called ‘AuthTool' to deliver payloads. To mitigate risks, users are advised to carefully verify the safety of skills before use and adopt security measures such as isolating the AI assistant in a virtual environment.
175,000 exposed Ollama AI servers across 130 countries present significant remote code execution risks due to insufficient security. Researchers found 7.23 million observations and highlighted a core of 23,000 persistent hosts, with many capable of executing code and interacting with external systems, heightening threat levels. Security risks include resource hijacking, spam, and prompt injection attacks, particularly as many hosts lack adequate monitoring. The global infrastructure complicates traditional governance, necessitating improved security measures for edge-deployed AI models.
https://cyberpress.org/175k-exposed-ollama-hosts-allow-remote-code-execution/
Extreme TLDR:
14 malicious ClawdBot skills, posing as crypto trading tools, distribute malware targeting ByBit, Polymarket, and others. Skills leverage social engineering for credential theft on macOS and Windows. They exploit a lack of security in ClawHub, using deceptive documentation to trick users into executing harmful commands. The campaign relies on a centralized C2 infrastructure for data theft, with multiple skills still available online.
https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
Pillar Security introduces RedGraph, the first attack surface mapping and continuous testing platform for AI agents, providing visibility and security for AI infrastructures. The platform addresses rising threats identified in “Operation Bizarre Bazaar,” an orchestrated campaign focused on exploiting exposed AI systems for unauthorized access and resale on digital marketplaces. Key risks include compute theft, data exfiltration, and lateral movement within networks. Recommendations for mitigation involve enabling authentication, auditing server exposure, and implementing strict security controls. The ongoing threat necessitates transparency and proactive defense measures in AI environments.
Researchers found that styling prompts as poetry can significantly undermine the effectiveness of language models’ safety guardrails. By testing 25 popular models, they discovered that poetic prompts increased the likelihood of unsafe responses by an average of 35%. Google’s Gemini 1.5 Pro was the most susceptible, with a 100% success rate in bypassing restrictions with poetic prompts.
NVIDIA allegedly sought high-speed access to millions of pirated books from Anna's Archive for AI training, leading to a class-action lawsuit by authors for copyright infringement. Internal emails suggest NVIDIA management proceeded with piracy despite warnings about the legality of the library's content. The lawsuit expands to include claims of using other pirated sources and distributing tools for accessing copyrighted materials, demanding compensation for damages suffered by the authors.
VoidLink malware, developed likely by a solo programmer with AI assistance, exhibits advanced features like custom loaders and rootkits. Check Point Research notes it shows clear signs of AI generation, operational security failures, and rapid functionality development within a week. This marks a shift where individuals with technical skills can produce sophisticated malware, previously achievable only by well-resourced teams, making it a notable example of AI-driven cyber threats.
Cybercrime has evolved with AI, offering tools like Dark LLMs for scams at subscription prices. Group-IB reports a 371% increase in AI mentions on dark web forums since 2019. AI simplifies previously complex cyberattacks into easily accessible services. Deepfake and synthetic identity tools are now inexpensive, resulting in significant financial losses, including $347 million in a single quarter. Automation in cybercrime lowers barriers for criminals, complicating defense efforts and increasing the scale and personalization of scams.
https://www.theregister.com/2026/01/20/group_ib_ai_cycercrime_subscriptions/
A significant recent cybersecurity concern is a prompt injection vulnerability in Google's Gemini AI, allowing attackers to exploit Google Calendar invites to access private data covertly and create deceptive events. This highlights the need for advanced security strategies addressing semantic vulnerabilities in AI systems.
https://www.darkreading.com/cloud-security/google-gemini-flaw-calendar-invites-attack-vector
Signal leaders warn agentic AI is insecure, unreliable, and risks surveillance. At 39C3, they highlighted its vulnerabilities, including susceptibility to malware and low task success rates. They advocate for industry changes to improve privacy, security, and transparency, urging firms to halt reckless deployment and prioritize user consent and data protection.
Varonis Threat Labs identified a new AI vulnerability called Reprompt in Microsoft Copilot that allows attackers to exploit a single click on a seemingly legitimate link to bypass security controls and exfiltrate sensitive user data without detection. This attack can lead to significant data breaches by firing off malicious commands that continue even after the user interacts with the Copilot. Key methods involve URL parameter manipulation and managing hidden follow-up requests, making it difficult to spot the exploitation attempts. Microsoft has since patched the vulnerability. Recommendations are made for both vendors and users to enhance security against such vulnerabilities.
Three open-source AI/ML Python libraries by Apple, Salesforce, and NVIDIA have vulnerabilities allowing remote code execution (RCE) via malicious metadata in models. Specifically:
The vulnerabilities leverages hydra.utils.instantiate() to execute arbitrary code embedded in model metadata. None have been exploited in the wild as of December 2025. Fixes were issued swiftly by the vendors, with severity ratings classified as High. Modifications in their libraries have improved security against these issues, emphasizing the importance of ongoing vigilance in AI/ML model handling.
https://unit42.paloaltonetworks.com/rce-vulnerabilities-in-ai-python-libraries/
Researchers from Radware discovered a new exploit chain called “ZombieAgent” that leverages ChatGPT’s long-term memory and connector features to enable more severe indirect prompt injection (IPI) attacks. By planting malicious instructions in ChatGPT’s memory, attackers can persistently exfiltrate sensitive information from connected platforms. OpenAI has addressed this exploit by restricting ChatGPT’s ability to modify URLs, but further structural fixes are needed to enhance the security of AI agents.
https://www.darkreading.com/endpoint-security/chatgpt-memory-feature-prompt-injection
IBM's AI agent Bob is vulnerable to prompt injection attacks, allowing it to execute malware. Despite IBM's security measures, researchers from PromptArmor demonstrated that Bob could be manipulated into executing harmful commands by leveraging a prompt injection technique with malicious Markdown files. While IBM advises caution and user approval for risky actions, Bob's defenses were bypassed, enabling the potential execution of malware without proper consent. This raises significant concerns about the security of AI software in development workflows, particularly when handling untrusted data.
https://www.theregister.com/2026/01/07/ibm_bob_vulnerability/
