AutoJack: A Single Malicious Web Page Can Hijack Your AI Agent and Execute Arbitrary Code
A critical three-vulnerability exploit chain called AutoJack allows a single malicious web page to hijack Microsoft AutoGen Studio's browsing agent and execute arbitrary code on the developer's machine,...
OpenAI Launches ChatGPT Lockdown Mode to Block Prompt Injection Data Exfiltration
OpenAI has released ChatGPT Lockdown Mode, a new security feature that disables outbound network capabilities to cut off data exfiltration pathways exploited in prompt injection attacks. Available to...
Critical HuggingFace Transformers Flaw CVE-2026-4372 Enables Silent RCE — 232 Million Installs at Risk
A critical RCE vulnerability in HuggingFace Transformers (CVE-2026-4372) allows attackers to silently execute code by loading a malicious AI model, bypassing the trust_remote_code=False security control. Over 232 million...
Meta AI Flaw Lets Attackers Hijack Instagram Accounts Without Verification — Premium Handles Worth $1M+ Stolen
A critical flaw in Meta's AI account recovery tool allowed attackers to trick the chatbot into sending password reset codes with no identity verification, enabling theft of premium...
AI Discovers 10,000+ Zero-Days: Anthropic’s Claude Mythos Preview Transforms Cybersecurity Defense
Anthropic's Claude Mythos Preview AI model has autonomously discovered over 10,000 critical zero-day vulnerabilities across major software systems as part of Project Glasswing, revealing both the extraordinary potential...
AI Supply Chain Attack: 575+ Malicious Skills on Hugging Face and ClawHub Deliver Trojans, Cryptominers, and AMOS Stealer
Threat actors have uploaded 575+ malicious AI skills to ClawHub's OpenClaw ecosystem and abused Hugging Face repositories to deliver trojans, cryptominers, and AMOS Stealer. The campaign uses indirect...
CVSS 10.0: Critical Flowise AI Vulnerability Is Being Actively Exploited — 15,000+ Instances Still Exposed
A maximum-severity RCE vulnerability (CVE-2025-59528, CVSS 10.0) in the popular Flowise AI agent builder is under active attack. Over 15,000 instances are still exposed online. Here’s what you...
HashJack: weaponizing trust in AI browser assistants
A vulnerability in the way AI browser assistants handle URL fragments opens doors for malicious attacks. For years, we’ve seen AI take center stage across various industries, revolutionizing...