Incidents tagged Data Leakage

A critical vulnerability, CVE-2025-12420 (CVSS 9.3), was patched in ServiceNow's AI platform, allowing unauthenticated user impersonation and unauthorized actions. Furthermore, researchers identified that default configurations in Now Assist AI Agents could facilitate "second-order prompt injection" attacks, enabling low-privileged users to exploit inter-agent communication for data access and privilege escalation.

New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis The Hacker News

Millions of AI agents imperiled by critical vulnerability in open source package Ars Technica

One AI and two trained eyes delved into the heavily padded leaks

Fortinet Buys Virtue AI to Hunt Vulnerabilities in AI Agents Before Hackers Do Startup Fortune

PLUS: HCL, TCS, admit data breaches; South Korea to fine Apple, Google; India bans some rideshare tips; and more!

A data theft campaign has targeted Fortune 500 companies, specifically exploiting Azure cloud environments for sensitive information exfiltration. This incident underscores critical vulnerabilities in cloud infrastructure and the ongoing risk associated with insecure cloud deployments.

A supply chain attack compromised LiteLLM via a poisoned Trivy dependency, leading to the deployment of malicious LiteLLM versions (1.82.7/1.82.8) that exfiltrated 153GB of corporate credentials. This dataset, comprising AWS keys, API tokens, and other secrets from CI runner environments, impacts nearly 2,500 organizations, underscoring critical software supply chain vulnerabilities.

A significant data breach has resulted in the exposure of terabytes of user credentials. This compromise was identified as a large-scale supply-chain attack, impacting a multitude of dependent organizations.

Data breach costs surged to a record average of $4.99 million, notably escalating with AI-driven attacks that exploit vulnerabilities faster and leverage advanced techniques like deepfakes and AI-generated malware. Critical security gaps in AI deployments, including widespread lack of access controls for AI models and pervasive shadow AI, are contributing to increased incidents, data compromise, and operational disruptions.

A security breach reportedly involving OpenAI and the Hugging Face platform indicates potential unauthorized access to, or exfiltration of, AI model data or related resources. This incident underscores critical vulnerabilities within the AI development ecosystem, raising significant concerns about MLOps security and the integrity of AI supply chains.

This Copilot vulnerability could expose emails, 2FA codes, and other sensitive data Mashable

A critical zero-click vulnerability, dubbed "EchoLeak" and identified as CVE-2025-32711, was discovered in Microsoft Copilot. This flaw leveraged an "LLM scope violation" to allow remote attackers to exfiltrate sensitive data from Microsoft 365 services without any user interaction.

The vulnerability crisis: How AI is shrinking the window for defense TechRadar

Claude Code RCE: claude-cli:// Deeplink Vulnerability Allows Arbitrary Command Execution (Patch 2.1.118) Pasquale Pillitteri

OpenAI confirms security breach but says no user data was affected TechRadar

OpenAI says no user data breached after security issue with open-source library Reuters

U.S. CISA adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog Security Affairs

OpenAI User Drops Privacy Class Action Over Mixpanel Data Breach Bloomberg Law News

Vercel experienced a supply chain attack that led to the compromise and exfiltration of user data. The stolen user data is being actively trafficked and sold for $2M on BreachForums.