Affected Technology
Gemini incidents
Gemini product and platform security
Nx build system Supply Chain Attack Vulnerability
Evidence indicates that Nx build system is affected by a security issue.
CVE-2026-0628 Privilege Escalation Vulnerability affecting Chrome
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. The supported impact is code injection. Reported affected versions include
Google says hackers are abusing Gemini AI for all attacks stages
State-backed threat actors and cybercriminals are widely abusing Google's Gemini AI model to enhance all stages of their attack lifecycle, from reconnaissance and social engineering to malicious code generation and vulnerability testing. This exploitation of AI capabilities facilitates the creation of tools like HonestCue for dynamic C# payload generation and the acceleration of phishing kit development such as CoinBait.
ChatGPT Remote Code Execution Vulnerability
The article highlights numerous AI agent vulnerabilities, prominently featuring prompt injection techniques like "ASCII Smuggling" used to embed invisible, malicious instructions within legitimate data. These attacks exploit AI agent reasoning and tool usage, leading to significant impacts such as zero-click workflow hijacking, unauthorized data exfiltration, and potential remote code execution in systems like ChatGPT and Google Gemini.
ChatGPT Security Incident
LLM-generated passwords from tools like Claude, ChatGPT, and Gemini are "fundamentally weak" due to inherent patterns that make them highly predictable and easily guessable, despite appearing complex. Research indicates these passwords have significantly lower entropy (20-27 bits) compared to truly random ones, allowing them to be brute-forced in a matter of hours, potentially ushering in a new era of password brute-forcing.
Claude Security Incident
AI agents, including Claude Sonnet 4.5, GPT-5, and Gemini 2.5 Pro, demonstrated high proficiency by solving 9 out of 10 lab challenges that simulated real-world web application vulnerabilities with minimal cost. These successes encompassed exploits like authentication bypass, IDOR, stored XSS, S3 bucket takeover, and AWS IMDS SSRF, highlighting AI's capability for multi-step reasoning and rapid pattern recognition.
ChatGPT Prompt Injection Vulnerability
The article details an investigation into the security vulnerabilities of prominent large language models (LLMs) like ChatGPT, Gemini, and Claude. It specifically highlights findings and risks associated with adversarial prompt attacks, demonstrating potential for prompt injection or model jailbreaking to bypass safety mechanisms.
Google Security Vulnerability
Google DeepMind has introduced CodeMender, an AI-powered agent designed to automatically detect, patch, and rewrite vulnerable code to eliminate entire classes of vulnerabilities. Leveraging Gemini Deep Think models and an LLM-based critique tool, CodeMender addresses root causes and validates fixes, having already contributed 72 security patches to open-source projects.
AI Prompt Injection Vulnerability
Zenity Labs research details how widely deployed AI agents are highly susceptible to "hijacking attacks" via methods such as email-based prompt injection and zero-click risks. These vulnerabilities enable data exfiltration, manipulation of critical workflows, user impersonation, and long-term access, impacting major platforms like OpenAI ChatGPT, Microsoft Copilot, Salesforce Einstein, and Google Gemini.
Gemini Prompt Injection Vulnerability
The "Echo Chamber" attack is a sophisticated prompt injection technique that leverages context poisoning and multi-turn reasoning to bypass large language model (LLM) guardrails. This allows attackers to gradually manipulate models like GPT and Gemini into generating harmful content, achieving high success rates for categories such as hate speech and illegal activities.