Incidents tagged the

Cybersecurity experts have identified a critical authentication bypass vulnerability in the Clawdbot AI assistant, stemming from improperly configured reverse proxies that lead the system to treat external connections as unauthenticated localhost access. This flaw exposes sensitive user data, including API keys and chat histories, and can facilitate credential theft and remote code execution on compromised systems.

Prompt injection attacks against AI coding tools like Amazon Q were demonstrated to direct the tool to wipe local files and potentially disrupt AWS cloud infrastructure. Additionally, an unauthenticated code injection vulnerability in Langflow AI allowed threat actors to steal credentials and deploy malware.

The incident involved the mass-theft of authentication tokens from Salesloft's Drift application, leading to significant data exfiltration from integrated corporate Salesforce instances and other cloud services. Threat actors, tracked as UNC6395, leveraged these stolen credentials to perform "authorization sprawl," accessing and siphoning sensitive data including AWS keys and VPN credentials.