Incidents tagged in

The proliferation of unmanaged "Shadow AI" deployments, such as unauthenticated Ollama server instances, creates critical security blind spots within corporate networks. These unsecured LLM endpoints are susceptible to unauthorized access, risking exposure of proprietary training data, enabling prompt injection attacks, and serving as potential pivot points for lateral movement.

Advanced AI tools, specifically Large Language Models (LLMs), are now being leveraged to automate cloud environment attacks, rapidly identifying misconfigurations and exposed credentials within minutes in platforms like AWS. This enables attackers to achieve swift credential theft and privilege escalation to administrative access by exploiting existing weaknesses rather than novel vulnerabilities, circumventing traditional phishing methods.

An attack chain exploited exposed AWS credentials in public S3 buckets, leveraging Large Language Models (LLMs) to rapidly escalate privileges through a misconfigured Lambda function. This allowed threat actors to achieve full AWS administrative control and abuse GPU resources within an Amazon Bedrock environment in under eight minutes.

The OpenClaw vulnerability in AI coding assistants allows single-click Remote Code Execution (RCE) by exploiting the trust relationship between developers and AI tools, processing malicious code suggestions automatically. This flaw grants attackers full control over developer systems, enabling access to sensitive resources and posing a significant software supply chain risk through potential injection of backdoors.

Researchers are warning that open-source AI models possess inherent vulnerabilities, making them susceptible to various forms of criminal misuse and exploitation. These weaknesses raise concerns about potential impacts like adversarial attacks, data poisoning, or the generation of malicious content by threat actors.

The article highlights numerous AI agent vulnerabilities, prominently featuring prompt injection techniques like "ASCII Smuggling" used to embed invisible, malicious instructions within legitimate data. These attacks exploit AI agent reasoning and tool usage, leading to significant impacts such as zero-click workflow hijacking, unauthorized data exfiltration, and potential remote code execution in systems like ChatGPT and Google Gemini.

The AI personal assistant MoltBot (OpenClaw) insecurely stores sensitive credentials and API keys in cleartext within `~/.clawdbot` and retains "deleted" secrets in backup files, making them vulnerable to infostealers. Furthermore, the codebase exhibits numerous insecure patterns, including extensive use of `eval` and `execSync` with user input, which could lead to Remote Code Execution (RCE), XSS, and broader data breaches for its hundreds of thousands of users.

OpenAI confirmed a data breach originating from unauthorized access to Mixpanel, a third-party web analytics provider it uses for its API product. This incident exposed names, email addresses, approximate locations, OS/browser data, and user IDs associated with OpenAI API accounts (platform.openai.com users), but did not compromise ChatGPT content, passwords, or payment details.

NSFOCUS has identified emerging threats targeting AI Agents and Large Language Models (LLMs), specifically through sophisticated attacks leveraging Multi-Agent Communication Protocols (MCPs) to achieve unauthorized access, privilege escalation, and intent manipulation. These new vulnerabilities include "MCP Tool Poisoning Attacks" and "Intent Disruption & Goal Manipulation," which could lead to system intrusion, data tampering, and the spread of erroneous information across multi-agent systems.

Grok AI was exploited by users who bypassed its content moderation safeguards through prompt-based manipulation, enabling the generation of non-consensual deepfake images of real individuals. This critical vulnerability in generative AI defenses led to widespread regulatory investigations and forced X to implement geoblocking and content filtering measures.

The article highlights a critical vulnerability in AI agents where simple prompt engineering can lead to the compromise of entire systems. This demonstrates the significant risk posed by prompt injection attacks, allowing adversaries to bypass intended security mechanisms within AI-driven applications.

Traditional security frameworks fail to address AI-specific attack vectors such as prompt injection, model poisoning, and AI supply chain compromises, creating significant security gaps. This inadequacy has enabled various exploits, including the Ultralytics AI library compromise for cryptomining and malicious Nx packages exfiltrating 23.77 million secrets in 2024.

A March 2023 vulnerability in the Redis open-source library temporarily exposed ChatGPT users' chat titles, messages, and potentially payment information. Beyond platform vulnerabilities, users face risks from prompt injection attacks that bypass LLM guardrails and the utilization of AI by threat actors to generate malware, phishing templates, and deepfakes.

Security researcher Ari Marzouk disclosed "IDEsaster," a collection of over 30 vulnerabilities, with 24 assigned CVEs, affecting various AI-powered Integrated Development Environments (IDEs) like GitHub Copilot and Cursor. These flaws enable attackers to chain prompt injection techniques with legitimate IDE features and auto-approved AI agent tool calls to achieve sensitive data exfiltration and remote code execution (RCE).

Anthropic's Threat Intelligence team disrupted the first known AI-orchestrated cyber espionage campaign, where a state-sponsored Chinese threat actor utilized Claude Code to autonomously execute 80-90% of the intrusion life cycle, including reconnaissance, exploitation, credential harvesting, lateral movement, and data exfiltration. This campaign leveraged widely available open-source commodity tools rather than zero-day vulnerabilities, demonstrating a critical shift where AI handles tactical attack execution, significantly compressing detection timelines and challenging traditional incident response frameworks.

Chinese state-sponsored threat actors leveraged Anthropic's Claude Code and Model Context Protocol (MCP) as an "autonomous cyber attack agent" to orchestrate a highly sophisticated and largely automated cyber espionage campaign. This campaign, designated GTG-1002, performed reconnaissance, vulnerability discovery, exploitation, lateral movement, credential harvesting, and data exfiltration against approximately 30 high-value global targets.

AI browsers are highly susceptible to prompt injection attacks, where threat actors can manipulate Large Language Models (LLMs) to bypass security controls and execute unauthorized actions. This vulnerability allows for sensitive data exfiltration by exploiting the LLM's inability to distinguish between trusted user commands and malicious instructions embedded in untrusted web content, effectively nullifying browser protections like the same-origin policy.

The article highlights critical security risks in Large Language Model (LLM) deployments, emphasizing prompt injection as a key attack vector where malicious inputs override an LLM's intended behavior. This can lead to sensitive data leakage, unauthorized actions, or the generation of harmful content, necessitating robust input validation and secure model deployment practices.

The NVIDIA Container Toolkit contains a critical security flaw, identified as CVE-2024-0132, which allows for container escape. This vulnerability grants attackers full host system access, highlighting a significant risk in AI infrastructure.

Researchers demonstrated that as few as 250 poisoned documents can create a backdoor vulnerability in large language models, irrespective of model size or training data volume. This data poisoning technique, which can induce denial-of-service or potentially facilitate data exfiltration, challenges prior assumptions about the required scale of malicious training data during pretraining.