Affected Technology
Google incidents
Google AI and Gemini security developments
AI Data Exposure
Why U.S. breach costs averaged $11.5 million despite record AI investments Spiceworks
Adobe Commerce Backdoor Vulnerability
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is
Claude Security Incident
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Google API Keys Data Exposure
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
Claude Data Exposure
AI startup OpenCode faces security breach; may have exposed Claude, ChatGPT's data | Google potentially affected as well by incident | Inshorts Inshorts
AI Security Vulnerability
Frontier AI Broke the Vulnerability Math Security Boulevard
Anthropic Remote Code Execution Vulnerability
Warning Over High-Risk Security Vulnerabilities in Widely Used LLM Gat Infosecurity Magazine
Chrome Security Incident
Xbow earned a $250K bug bounty and all the AI model got was a lousy t-shirt
PyTorch Remote Code Execution Vulnerability
A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line 3059 calls `torch.load()` without the `weights_only=True` parameter. This issue affects all versions of the library supporting `torch>=2.2` when used with PyTorch versions below 2.6, as the `safe_globals()` context manager provides no protection in these versions. An attacker can exploit this vulnerability by supplying a malicious checkpoint file, such as `rng_state.pth`, which can execute arbitrary code when loaded. The issue is resolved in version v5.0.0rc3.
OpenAI AI Security Breach Triggers 14-State Legal Reckoning
OpenAI's new GPT-5.5-Cyber tops Claude Mythos 5 in vulnerability benchmark Neowin
FBI Arrests Another Data Exposure
The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public. The
Gemini Credential Compromise
Credential-stealing malware detected within minutes of npm release, but impact remains unknown
PoeLLM Supply-Chain Compromise
Quoth the LLM, 'More and more'
OpenAI Security Breach
OpenAI Fires Workers Over Data Security Breach techbuzz.ai
Chinese AI Penetration Tool Traces Found on Hacking Server in South Korea's Shinhan Bank Breach
Chinese AI Penetration Tool Traces Found on Hacking Server in South Korea's Shinhan Bank Breach finance.biggo.com
Agent Just Breached Remote Code Execution Vulnerability
An Autonomous AI Agent Just Breached a Vulnerability Disclosure Nonprofit by Chaining Two Zammad Zero-Days forkast.news
Gemini Security Incident
The company says its new frontier AI model found a critical vulnerability in software used by hospitals worldwide. The post Google Launches Gemini 4 Argon With Guardrail-Free Access for Vetted Defenders appeared first on SecurityWeek.
AI Is Changing Remote Code Execution Vulnerability
Google’s analysis found that AI-discovered vulnerabilities are more likely to enable remote code execution. The post Google: AI Is Changing the Pace and Profile of Vulnerability Discovery appeared first on SecurityWeek.
OpenAI Data Exposure
OpenAI apologizes to Australia after its AI agents breached government sites TechCrunch
GitHub Copilot Security Vulnerability
How we found 24 Android vulnerabilities using our open source AI security agent github.blog
Claude Security Vulnerability
Anthropic's Claude Opus 4.6 LLM has identified over 500 previously unknown, high-severity security vulnerabilities, including memory corruption and buffer overflow issues, in critical open-source libraries like Ghostscript, OpenSC, and CGIF. This demonstrates AI's emerging capability for sophisticated vulnerability discovery and code analysis, even for complex flaws requiring conceptual understanding of algorithms.
ChatGPT Security Breach
Out-of-control AI breaches UN's security defences: ChatGPT bots scan data 16,000 times creating fake email ... bhaskarenglish.in
OpenAI Security Vulnerability
OpenAI’s Agent Hacked Australia’s Medicare Portal. It Found the Vulnerability Itself. forkast.news
EXCLUSIVE Data Exposure
EXCLUSIVE: OpenAI works to understand full scope of agent activity as user data leak emerges Reuters
Claude Security Breach
Three Open-Source AI Agents Ran 27+ Breaches for $25 a Target. 600,000+ Cards Followed. forkast.news
ChatGPT Security Incident
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned. Old bugs find new jobs. AI tools leak more than expected. Fake prompts look real enough. And some attacks barely need an exploit at all — just
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
Claude Credential Exposure
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.
Adobe Commerce Zero-day Vulnerability
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical
CAIRN Security Incident
'first' publicly documented Windows implant to use LLMs for C2
Gemini Security Breach
A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. [...]
Amazon AWS Security Incident
Muse Mac App Security Flaw Allows Hackers to Exploit the AI Agent iPhone in Canada
Google Security Breach
Google is the latest AI giant to confirm that its models escaped a testing environment and hacked real companies. The post Google Confirms Gemini AI Breached Three Firms appeared first on SecurityWeek.
Data Breach Investigations Report application-local accounts not in centralized access reviews Vulnerability
Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach research, including Verizon's annual Data Breach Investigations Report. This article explains what identity visibility means in IAM, why cloud and multicloud environments complicate it, which capabilities matter in
Three-Person Team Uses Claude to Breach OpenAI's Core Codebase; $6,500 Bounty Triggers AI Security Alarm
Three-Person Team Uses Claude to Breach OpenAI's Core Codebase; $6,500 Bounty Triggers AI Security Alarm finance.biggo.com
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"
Astra hidden vulnerability
The AI Security Problem Is Bigger Than the Hugging Face Breach HackerNoon
Claude Remote Code Execution Vulnerability
A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still validate risk on weekly or quarterly cycles. The dangerous gap is no longer just technical. It is
ChatGPT Remote Code Execution Vulnerability
AI agents, including Claude Sonnet 4.5, GPT-5, and Gemini 2.5 Pro, demonstrated high proficiency by solving 9 out of 10 lab challenges that simulated real-world web application vulnerabilities with minimal cost. These successes encompassed exploits like authentication bypass, IDOR, stored XSS, S3 bucket takeover, and AWS IMDS SSRF, highlighting AI's capability for multi-step reasoning and rapid pattern recognition.
ChatGPT Data Exposure
Autonomous AI agent hit Spanish firm with vulnerability scans before accessing files and data TechRadar
Spain reports first data breach involving autonomous AI agent
Spain reports first data breach involving autonomous AI agent Help Net Security