Incidents tagged AI

An advanced attack chain exploits an LLM chatbot through indirect prompt injection (OWASP LLM01:2025) to achieve system prompt leakage and abuse excessive agency (OWASP LLM06:2025). This leads to sensitive customer data exfiltration and escalates to command injection (OWASP LLM05:2025) in a backend API, ultimately enabling remote code execution and intellectual property theft.

Google DeepMind introduces CodeMender, an AI agent designed to automatically discover and patch software vulnerabilities, including complex root causes and architectural weaknesses. The agent applies proactive fixes, such as `-fbounds-safety` annotations, demonstrated to prevent exploitation of vulnerabilities like the `CVE-2023-4863` heap buffer overflow in `libwebp`.

Salesforce Agentforce was susceptible to a critical indirect prompt injection vulnerability, codenamed ForcedLeak (CVSS 9.4). This flaw allowed attackers to exfiltrate sensitive CRM data by manipulating Web-to-Lead forms, causing AI agents to transmit information to an attacker-controlled domain.

A multi-stage supply chain attack, tracked as UNC6395, originated from the compromise of a Salesloft GitHub repository, leading to the theft of a sensitive OAuth token. This token enabled access to a high-privilege AI chatbot application (Drift) and subsequent exfiltration of customer conversation data and contact information from over 700 integrated Salesforce instances.

The article details critical security challenges associated with cloud-hosted Large Language Models (LLMs), including prompt injection, adversarial exploits, model jailbreaks, sensitive data leakage, and misconfigurations. These vulnerabilities, stemming from lack of visibility and ungoverned AI behavior, necessitate proactive discovery and risk management to safeguard AI workloads.

AI security incidents are rapidly escalating, primarily impacting organizations through significant data breaches and unauthorized access to AI systems. Notable incidents include the exposure of 38 TB of sensitive data by AI researchers and the rapid exploitation of leaked Bedrock credentials for unauthorized Large Language Model (LLM) use.

Researchers discovered a reflected Cross-Site Scripting (XSS) vulnerability in Yellow.ai's chatbot, which could be tricked into generating malicious HTML/JavaScript code. This flaw enabled attackers to steal support agent session cookies, potentially leading to account hijacking and data exfiltration from customer support platforms.

A security flaw in the Cursor AI code editor, a Visual Studio Code fork, allows for silent arbitrary code execution when a maliciously crafted repository is opened. This vulnerability stems from "Workspace Trust" being disabled by default, enabling tasks configured in `.vscode/tasks.json` to auto-execute and posing a significant supply chain risk.

Hexstrike-AI is an AI-powered orchestration framework designed to automate and accelerate zero-day exploitation, leveraging large language models to significantly reduce the time and skill required for complex attacks. Threat actors are actively discussing using Hexstrike-AI to target recently disclosed unauthenticated remote code execution and other critical vulnerabilities (CVE-2025-7775, CVE-2025-7776, CVE-2025-8424) in Citrix NetScaler ADC and Gateway appliances, with observed webshell deployments.

Hackers exploited a vulnerable workflow in the Nx build system to achieve code injection and GITHUB_TOKEN theft, enabling the publication of malicious package versions. These malicious packages deployed a post-install script that exfiltrated thousands of sensitive credentials and notably weaponized AI assistants like Claude and Gemini for reconnaissance and data exfiltration.

Threat actor UNC6395 exploited compromised OAuth and refresh tokens associated with the Drift AI chat agent, accessible via Salesloft, to gain unauthorized access to Salesforce customer instances. This systematic campaign led to the exfiltration of sensitive data, including AWS access keys, passwords, and Snowflake tokens, from over 700 organizations, indicating a potential supply chain attack.

An Insecure Direct Object Reference (IDOR) vulnerability in an exposed API, combined with an unpatched legacy web application and weak credential hygiene, allowed unauthorized access to sensitive applicant personal data. This composite attack vector resulted in a data leak comprising names, emails, and job histories.

AI coding tools like Claude Code integrate security features to identify common vulnerabilities such as SQL injection, XSS, RCE, and SSRF during development workflows. However, these tools are limited by their training data and struggle to detect novel, complex, or architectural vulnerabilities, potentially instilling a dangerous false sense of security among developers.

Lenovo's GPT-4-powered chatbot "Lena" was vulnerable to cross-site scripting (XSS) attacks due to improper input and output sanitization, initiated by a malicious prompt. This allowed attackers to steal session cookies and potentially gain unauthorized access to customer support systems, facilitating further system command execution and lateral movement.

Enterprise AI assistants have been identified as vulnerable to abuse, potentially enabling unauthorized data theft. This exploitation pathway also allows for the manipulation of enterprise data or the behavior of these AI systems.

The healthcare sector faces an average data breach cost of $7.42 million, driven by the compromise of patient personal identification information (PII). A notable 16% of these incidents leverage AI for sophisticated phishing and deepfake campaigns, often exacerbated by the organizational vulnerability of "Shadow AI" and insufficient AI governance.

Rapid AI adoption is creating significant security debt due to neglected foundational cybersecurity, specifically a lack of proper AI access controls and governance policies. This oversight has led to a heightened risk of data compromise, operational disruption of AI-based workloads, and the exposure of intellectual property within AI implementations.

A critical vulnerability in the AI vibe coding platform Base44 allowed unauthorized access to private applications by exploiting unauthenticated registration and email verification endpoints. Attackers could use a publicly available `app_id` to create verified accounts, bypassing authentication controls including SSO and granting full access to sensitive enterprise data.

Evidence indicates that SQLite is affected by a security issue. Reported affected versions include 3.50.2.

A critical security flaw in McDonald's McHire AI hiring tool leveraged default '123456' administrative credentials combined with an Insecure Direct Object Reference (IDOR) vulnerability in an internal API. This exploit allowed researchers to access and potentially expose sensitive Personally Identifiable Information (PII) for millions of job applicants, including chat histories and contact details.