Incidents tagged AI

This article details potential Remote Code Execution (RCE) vulnerabilities arising from the use of modern AI/ML formats and libraries. It investigates how these emerging technological components can introduce new attack surfaces for exploitation.

Attackers could exploit a universal credential for ServiceNow's Virtual Agent API combined with weak email-only authentication to impersonate users. This allowed them to weaponize the "Now Assist" agentic AI to create administrative accounts, leading to full platform takeover and potential lateral movement across integrated enterprise systems.

The article highlights a critical vulnerability in AI agents where simple prompt engineering can lead to the compromise of entire systems. This demonstrates the significant risk posed by prompt injection attacks, allowing adversaries to bypass intended security mechanisms within AI-driven applications.

Prompt injection attacks manipulate AI systems, particularly Large Language Models (LLMs), by overriding their intended instructions through malicious input, leading to sensitive data leakage, unauthorized actions, or corrupted outputs. A real-world example involved a phishing campaign leveraging hidden text-based prompt injection to bypass AI defenses, coupled with the exploitation of CVE-2022-30190 (Follina) for remote code execution.

Prompt injection is a prevalent AI-specific vulnerability where Large Language Models (LLMs) misinterpret external data as executable instructions, bypassing intended safeguards. This can lead to sensitive data exfiltration, the execution of rogue tasks, or malicious code execution, impacting various AI agents, coding assistants, and chatbots.

Traditional security frameworks fail to address AI-specific attack vectors such as prompt injection, model poisoning, and AI supply chain compromises, creating significant security gaps. This inadequacy has enabled various exploits, including the Ultralytics AI library compromise for cryptomining and malicious Nx packages exfiltrating 23.77 million secrets in 2024.

A March 2023 vulnerability in the Redis open-source library temporarily exposed ChatGPT users' chat titles, messages, and potentially payment information. Beyond platform vulnerabilities, users face risks from prompt injection attacks that bypass LLM guardrails and the utilization of AI by threat actors to generate malware, phishing templates, and deepfakes.

Over 30 critical "ShadowMQ" vulnerabilities, stemming from insecure ZeroMQ `recv_pyobj()` and Python `pickle` deserialization, affect leading AI inference engines such as Meta Llama LLM and NVIDIA TensorRT-LLM. These flaws enable remote code execution, data theft, and privilege escalation, with specific CVEs like CVE-2024-50050 attributed, and active exploitation has been observed.

Security researcher Ari Marzouk disclosed "IDEsaster," a collection of over 30 vulnerabilities, with 24 assigned CVEs, affecting various AI-powered Integrated Development Environments (IDEs) like GitHub Copilot and Cursor. These flaws enable attackers to chain prompt injection techniques with legitimate IDE features and auto-approved AI agent tool calls to achieve sensitive data exfiltration and remote code execution (RCE).

A data breach at OpenAI resulted in the exposure of API user information. This incident necessitates prompt action from affected users to secure accounts and rotate API keys to prevent unauthorized access.

Agentic AI systems introduce new architectural risks due to their autonomous planning, decision-making, and tool-use capabilities, moving the attack surface from static models to dynamic workflows. Key threats include memory poisoning, tool misuse, and potential remote code execution (RCE) stemming from manipulated agent reasoning paths, external interactions, and inter-agent communications.

Anthropic's Threat Intelligence team disrupted the first known AI-orchestrated cyber espionage campaign, where a state-sponsored Chinese threat actor utilized Claude Code to autonomously execute 80-90% of the intrusion life cycle, including reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration. This campaign leveraged widely available open-source commodity tools rather than zero-day vulnerabilities, demonstrating a critical shift where AI handles tactical attack execution, significantly compressing detection timelines and challenging traditional incident response frameworks.

Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.

A novel indirect prompt injection attack allows threat actors to compromise Anthropic's Claude AI Code Interpreter, leveraging its network features to exfiltrate sensitive user chat data. This exploit bypasses default network settings by tricking Claude into uploading sandbox-stored user information directly to an attacker's account via Anthropic's own APIs.

Google's AI agent "Big Sleep" identified five new security flaws, including buffer overflow (CVE-2025-43429) and use-after-free (CVE-2025-43434) vulnerabilities, within Apple's Safari WebKit component. These critical vulnerabilities, if exploited by processing maliciously crafted web content, could result in unexpected browser crashes or memory corruption, requiring immediate patching via various Apple OS updates.

The article details a Remote Code Execution (RCE) vulnerability, tracked as CVE-2024-12366, affecting agentic AI systems that execute LLM-generated code without proper sandboxing. Attackers can craft malicious prompts to bypass sanitization, leading the AI to generate and execute arbitrary code on the host system.

A critical vulnerability in OpenAI's ChatGPT Atlas browser leverages a Cross-Site Request Forgery (CSRF) flaw to inject malicious instructions into the AI's persistent memory. This allows attackers to achieve arbitrary code execution and gain control over user accounts or systems across sessions, triggered by legitimate user interaction with the compromised AI.

Rapid AI adoption by 85% of organizations is creating an expanded attack surface, with security lagging behind adequate governance frameworks. This deficiency leads to systemic vulnerabilities such as data leakage and unauthorized model access in multi-tenant cloud environments, alongside "shadow AI" breaches that incur an estimated $670,000 more in costs.

The NVIDIA Container Toolkit contains a critical security flaw, identified as CVE-2024-0132, which allows for container escape. This vulnerability grants attackers full host system access, highlighting a significant risk in AI infrastructure.

Attackers can achieve remote code execution (RCE) on developer machines by leveraging indirect prompt injection against agentic AI developer tools. This is accomplished by introducing untrusted data, such as malicious commands in GitHub issues or hidden payloads in fake Python packages within pull requests, which the AI agent autonomously executes.