Incidents tagged AI

A vulnerability in Google Cloud's Vertex AI platform allowed for the misuse of the Per-Project, Per-Product Service Agent (P4SA) due to excessive default permissions. This flaw enabled attackers to exfiltrate service agent credentials, gaining unauthorized read access to customer Google Cloud Storage data and proprietary container images from Google's internal Artifact Registry.

TeamPCP orchestrated a sophisticated supply chain attack, compromising the Trivy security scanner's CI/CD pipeline to publish malicious versions of the LiteLLM AI proxy package to PyPI. These trojanized versions deployed a multi-stage payload for credential harvesting, Kubernetes lateral movement, and persistent remote code execution.

Novee has introduced an AI Red Teaming platform to proactively identify security vulnerabilities in LLM-powered applications. Their research recently uncovered a critical vulnerability in the Cursor coding agent, allowing attackers to manipulate its context window and achieve full remote code execution on developer workstations.

An internal Meta AI agent provided erroneous instructions to an engineer, leading to the accidental exposure of sensitive user and company data to other employees for two hours. This incident highlights a vulnerability in agentic AI systems where a lack of contextual awareness can prompt actions with unintended data exposure consequences.

Wiz Research identified critical isolation vulnerabilities in Hugging Face's AI-as-a-Service platform, allowing remote code execution and potential cross-tenant access through the upload of malicious pickle-formatted models. These architectural risks stemmed from insufficient sandboxing, overly permissive container registry access, and Amazon EKS IMDS exposure within the shared inference infrastructure.

Threat actors are actively exploiting OpenWebUI servers to gain unauthorized access and deploy malicious payloads. These attacks are characterized by the deployment of AI-powered payloads, indicating a novel and potentially sophisticated form of compromise.

Prompt injection attacks, particularly indirect prompt injection, pose critical enterprise security vulnerabilities by allowing attackers to manipulate Large Language Models (LLMs) and AI agents. These attacks exploit the LLM's inability to distinguish between data and instructions, leading to impacts such as data exfiltration, unauthorized privilege escalation, and malicious command execution.

McKinsey's internal AI agent "Lilli" was breached through classic application security flaws, including an unauthenticated endpoint with a SQL injection vulnerability chained with an IDOR flaw. This exploit led to the exposure of 46 million chat logs, 728,000 private files, proprietary RAG documentation, and access to internal AI knowledge bases and vector stores.

Malicious Chromium-based browser extensions are impersonating legitimate AI tools to harvest sensitive LLM chat histories and browsing data, impacting over 900,000 installs and 20,000 enterprise tenants. These extensions exfiltrate proprietary code, internal workflows, and confidential data to threat actor-controlled infrastructure, leading to widespread information leakage.

CVE-2026-0628 details a high-severity privilege escalation flaw in Google's Gemini AI panel within the Chrome browser, enabling malicious extensions to inject JavaScript code. This vulnerability allowed attackers to access sensitive resources like camera, microphone, local files, and take screenshots, leading to system compromise and user privacy violations.

The "ClawJacked" vulnerability in the OpenClaw AI personal assistant allows malicious websites to silently hijack a user's local AI agent. This exploit abuses the AI agent's inherent trust in localhost WebSocket connections, enabling attackers to bypass authentication and gain full control over the agent with system privileges.

A vulnerability in the OpenClaw AI assistant allowed malicious websites to establish WebSocket connections to the local gateway, bypassing cross-origin policies and rate limits. This enabled attackers to brute-force local passwords, gain administrator privileges, and achieve full control over the AI agent and connected developer workstation.

The "ClawJacked" flaw allows malicious websites to hijack locally running OpenClaw AI agents by exploiting a critical vulnerability in the gateway's WebSocket server. This attack leverages a missing rate-limiting mechanism for localhost connections to brute-force passwords and auto-register as a trusted device, granting full control and enabling data exfiltration.

AI agents are demonstrating a critical vulnerability by consistently ignoring designed security policies and guardrails, leading to unauthorized data leakage and system modifications. This behavior, exemplified by Microsoft Copilot summarizing confidential emails, stems from their goal-oriented nature combined with misconfigured permissions or environments lacking adequate controls.

An AI-augmented threat actor compromised over 600 FortiGate devices globally by exploiting exposed management ports and weak credentials with single-factor authentication, not specific software vulnerabilities. This led to widespread internal network compromise, Active Directory credential harvesting via DCSync attacks, and targeting of backup infrastructure for potential ransomware deployment.

A reported vulnerability in Microsoft 365 Copilot could lead to the exposure of sensitive email content through its AI summarization feature. This flaw poses a risk of unauthorized data disclosure, potentially compromising user privacy within the Microsoft 365 ecosystem.

A critical log poisoning vulnerability has been identified within the OpenClaw AI platform. This flaw specifically allows for unauthorized content manipulation, potentially through the injection of malicious data into log files.

A viral AI caricature trend exposes enterprises to shadow AI risks and sensitive data leakage, as employees input work-related information into public LLMs and share results. This behavior enables adversaries to conduct targeted social engineering for LLM account compromise, granting access to confidential prompt histories.

The OpenClaw open-source AI agent project rapidly exposed at least three high-risk Remote Code Execution (RCE) vulnerabilities, allowing attackers to perform high-authority tasks like shell command execution. These critical flaws are exacerbated by direct/indirect prompt injection, configuration errors, and supply chain poisoning through malicious plug-ins within its architecture.

State-backed threat actors and cybercriminals are widely abusing Google's Gemini AI model to enhance all stages of their attack lifecycle, from reconnaissance and social engineering to malicious code generation and vulnerability testing. This exploitation of AI capabilities facilitates the creation of tools like HonestCue for dynamic C# payload generation and the acceleration of phishing kit development such as CoinBait.