Flaws in AI coding assistants, agents and MCP servers, and AI-assisted attacks.
Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.
Anthropic, Sep 2026: “automated exploit foundries”.
mcp-atlassian CVE-2026-27825 / -27826: SSRF plus arbitrary write leads to RCE.
Prompt injection in GitHub issues let attackers reach CI secrets through Claude Code, Gemini CLI and Codex. Upgrade, and keep untrusted input away from secrets.
VulnCheck/Berkeley: 14 of 1,061 (1.3%) AI-model-found vulnerabilities were exploited in the wild (Jul 2026).
CVE-2026-24887: `find` command parsing bypasses the approval prompt.
CVE-2026-22708: shell built-ins bypass the Auto-Run allowlist.
CVE-2026-25253: one-click RCE (CVSS 8.8).
CVE-2026-29783: Copilot CLI shell-expansion RCE.
A writable system-wide configuration folder on Windows gave hook/notify privilege escalation to every user.
A Chinese state-sponsored group used Claude Code through MCP tooling against about 30 targets.
The unauthenticated Ray Jobs API was used to build a self-propagating GPU cryptomining botnet (Oligo).
Legit Security. Hidden PR comments plus a Camo image-proxy alphabet leaked secrets and code.
ESET found it. It turned out to be an NYU research prototype.
Prompt injection got Copilot to write `chat.tools.autoApprove` into `.vscode/settings.json`, enabling RCE.
CurXecute: prompt injection could write `.cursor/mcp.json` and get RCE.
Cymulate “InversePrompt”. Fixed: 0.2.111 and 1.0.20.
Claude Code was used to automate reconnaissance, intrusion and ransom-note writing against 17 organizations.
A malicious MCP server’s OAuth `authorization_endpoint` led to RCE on the client.
A precursor to the Mythos story: an AI agent found a bug that was “known only to threat actors”.
A prompt-injected README plus a weak allowlist check ran hidden commands.
Unauthenticated localhost proxy plus the 0.0.0.0-day browser bug led to RCE from a website.
Aim Labs. A crafted email caused Copilot to leak tenant data through markdown image and link fetches.
