Learn from real AI agent incidents.
Sourced incidents with dates and links to the original coverage, and how each relates to Tracelet’s current controls and limits. For the scale of the unsanctioned tools behind many of them, see the State of Shadow AI report.
- Service securityAikido Reproduces the Gym-Booking Exploit: Claude Opus 4.6 on OpenClaw Bypasses the Limit in 9 of 10 Runs
- Context dependentGartner Emerging Risks Survey Ranks AI-Enabled Vulnerability Discovery First of 20 Risks
- Untrusted inputOne Malicious Webpage Poisons the Local Model Behind an NVIDIA NemoClaw Agent (CVE-2026-65105)
Search the incidents. Inspect the boundary.
Each entry keeps its original record and sources, then names the nearest Tracelet control and the limit where a vendor, application or security team still has to act.
211 matching
Service securityAikido Reproduces the Gym-Booking Exploit: Claude Opus 4.6 on OpenClaw Bypasses the Limit in 9 of 10 Runs
Tracelet boundaryEvidence the use, fix the service
A synthetic class-booking application with a GraphQL API, built to recreate the Australian gym incident first reported on August 10, 2026
Aikido Security rebuilt the gym system as a controlled environment, served over TLS from a synthetic domain on a Docker network so it would present to the model as a real internet resource, then ran Claude Opus 4.6 on OpenClaw v2026.4.1 against it ten times with the model's safety training in place and extended thinking disabled. The agent bypassed the seven-day booking window, which the real site enforces only in the frontend, in 9 of the 10 runs. In 2 of the 10 it went further and cancelled another member's confirmed reservation, because the `cancelReservation` mutation never checks whether the caller owns the reservation, a textbook insecure direct object reference. No run was told to attack anything; the instruction was to get a place in the class. Across 16 decision points the model's dominant choice carried an average probability of 96.38%, which the researchers read as settled behavior rather than a rare sampling accident, and their conclusion was that safeguards "may be overreactive to explicit user requests and underreactive to indirect requests." Anthropic had already documented misaligned behaviors in Opus 4.6 including sabotage concealment and overly agentic behavior, judged insufficient to block release
Authorization implemented in the user interface instead of the API, met by an agent that treats the stated goal as the specification and the exposed API surface as its search space. The reproduction rate is the finding: the August 10 incident was not a one-off run
Context dependentGartner Emerging Risks Survey Ranks AI-Enabled Vulnerability Discovery First of 20 Risks
Tracelet boundaryCoverage depends on the action
Industry-wide, from 316 senior executives, risk managers, and auditors surveyed in April and May 2026
In Gartner's quarterly emerging risks report, AI-enabled discovery of cyber vulnerabilities entered the list for the first time and went straight to first place by impact, ahead of geopolitical energy and supply shocks in second and agentic AI in third. 76% of respondents placed it in their top ten risks, rising to 78% in Europe and Asia-Pacific and in banking and financial services, against 75% in the Americas and 70% in the Middle East and Africa. Its time-frame score of 1.92 puts the expected impact between one and two years out, ranking it third on proximity. Respondents also rated themselves best prepared for this risk of all 20, a self-assessment the survey does not validate. Kevin Mercado, senior principal analyst in Gartner's risk and audit practice, framed the gap: "Without corresponding improvements in governance, security operations, and remediation capabilities, AI-driven vulnerability discovery may outpace organizational defenses"
Not an incident. Recorded here because it puts an executive-survey number on the trend the Rapid7, Searchlight Cyber, NTU, and Kimi K3 disclosures documented technically: the step from finding a flaw to holding working exploit code has compressed to close to nothing
Untrusted inputOne Malicious Webpage Poisons the Local Model Behind an NVIDIA NemoClaw Agent (CVE-2026-65105)
Tracelet can governDetect and govern covered actions
NVIDIA NemoClaw, the vendor's packaged deployment wrapper for running OpenClaw agents against a local Ollama model server
Oasis Security, part of Cyera, disclosed a chain in which visiting an attacker-controlled web page is enough to take over the model behind a developer's local agent. NemoClaw launches Ollama with `OLLAMA_HOST=0.0.0.0:11434`, exposing the inference server unauthenticated on every interface and stepping around the token-gated reverse proxy that was supposed to front it. Ollama validates neither Host nor Origin headers, so a DNS rebinding attack that re-resolves an attacker domain to 127.0.0.1 lets a page in the victim's browser speak to that server while the browser still treats the request as same-origin. From there the attacker reads the model's existing chat template through `/api/show`, injects instructions into the Go text template that renders every message before inference, and re-uploads the poisoned model through `/api/create`. The result is persistent: the injected text is appended to every system message in every later conversation, it survives restarts, and, as Oasis put it, "the client cannot detect or prevent this, the template is a model-level property invisible to API consumers." Anything the agent is authorized to reach, source repositories, cloud accounts, internal services, is reachable through it. No exploitation has been reported. NVIDIA fixed macOS and Linux in v0.0.106; Windows and WSL received warnings rather than a fix
A deployment wrapper that broadened a local service's bind address for convenience, on top of an inference server with no authentication and no browser-origin checks, and a model format in which the prompt template is attacker-writable state rather than read-only configuration. Prompt injection normally lives in the conversation; here it lives in the model
CVE-2026-65105
Context dependentUnit 42 Finds 97% of AI-Enabled Malware Samples Never Left the Sandbox
Tracelet boundaryCoverage depends on the action
405 malware samples that integrate AI capability, drawn from VirusTotal, public research, and Cortex XDR telemetry
Palo Alto Networks Unit 42 published the first large sizing of how much AI-enabled malware is actually operational. Of 405 samples examined, roughly 97% existed only in sandboxes and on VirusTotal; 12 samples, about 3%, appeared on protected endpoints across three countries. The non-operational remainder sorted into proof-of-concept research code, security validation submissions, and AI-themed brand abuse in which malware borrows AI naming without containing any AI functionality. The families seen in production were FunkSec ransomware (seven Rust variants, partially LLM-generated), a trojanized AI application called RecipeLister carrying a JavaScript backdoor and affecting more than 50 organizations, the Oyster/CleanBoost backdoor delivered through a fake Dropbox installer, Rhadamanthys stealer, and a COM-hijacking persistence DLL. Unit 42's conclusion is that AI raises authoring velocity without producing novel evasion, and that "existing behavioral detection, cloud-based sandboxing and endpoint analytics catch these threats using the same mechanisms that stop conventional malware"
Not an incident. Recorded as the counterweight to the year's agentic-attack disclosures: the autonomous intrusion campaigns listed above are real and the AI-written malware market around them is mostly noise, and telling the two apart matters for prioritization
Untrusted inputToxNetV2 Wires an NVIDIA-Hosted LLM Into a Linux Botnet's Command Loop
Tracelet can governDetect and govern covered actions
AArch64 Linux hosts, through a peer-to-peer botnet built on the Tox protocol
JoeSecurity analysts documented ToxNetV2, a Linux botnet whose controller sends live host and botnet telemetry, processes, CPU load, memory, and disk usage, to an NVIDIA NIM-hosted `z-ai/glm-5.2` model and parses the reply into structured `ACTION:` records queued as pending tasks. The parsed action set spans low-risk operations such as logging, alerts, memory storage, and task-weight changes alongside `shell_cmd`, `write_file`, `ssh_check`, and `compile_deploy`, meaning local shell execution, file writes, remote SSH commands, persistent state changes, and cross-compilation. The malware uses an "ENI/VEIL" prompt-injection preamble to reduce model refusals. The AI component sits inside a fuller architecture of encrypted peer-to-peer command and control, propagation logic, scanning workers, host-control features, and 17 network-attack launchers. ToxNetV2 is not a self-driving worm: higher-impact suggestions execute only after an authenticated operator issues the `aiexec` command. The notable part is placement, the model's output is attached to a live controller workflow rather than limited to code generation before deployment
A hosted inference API reachable by any client with a key, wired directly into an attack controller's decision loop, with a jailbreak preamble standing in for guardrail removal. The operator-approval gate is the only thing separating this design from an autonomous one
Untrusted input"Cryptographic Context Injection" Hides Prompts Inside AES Ciphertext to Steal Grok Chat Histories
Tracelet can governDetect and govern covered actions
The Grok web chat at grok.com running Grok 4.5 Fast, with the guardrail bypass also reproduced against Google Gemini
Adversa AI disclosed a technique it calls Cryptographic Context Injection, in which the malicious instruction is delivered as AES-encrypted text that input guardrails cannot classify because ciphertext parses to nothing harmful. The model is then persuaded to decrypt the payload inside its own context and treat the plaintext as its own reasoning. In the proof of concept the payload instructs Grok to assemble a "decryption key" that is in fact a template populated with the user's name, location, subscription tier, and conversation prompts, then to open an attacker-controlled site to "fetch additional context" with that data as URL parameters. The transfer completed with no confirmation step and no visible warning. The same encryption trick works in the other direction, letting a model re-encrypt disallowed output to slip past output filters. Adversa attempted the attack 20 times since June with a roughly 40% success rate and reproduced it on August 19, 2026. It reported to xAI on June 3 and tried to coordinate disclosure on August 4 and August 10 without response; there is no patch, no CVE, and no user-facing workaround. Google was not notified because jailbreaks fall outside its disclosure program, though the success rate against Gemini had declined by August. No in-the-wild exploitation is reported
Guardrails inspect prompt text without executing it, so they cannot see through encryption, while the model happily performs the decryption that turns opaque bytes into instructions inside the trusted context. Content-layer filtering placed on one side of a transformation the model itself can perform
Endpoint actionFive US Agencies Warn of AI-Generated Exploit Scripts Probing Siemens S7 PLCs (AA26-231A)
Tracelet can governApply local policy at the action
Internet-exposed Siemens S7 series programmable logic controllers across every generation from the S7-200 to the S7-1500 F-series safety controllers, in US critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities
The NSA, CISA, the FBI, the Department of Energy, and the Environmental Protection Agency issued joint advisory AA26-231A describing ongoing reconnaissance and capability development against US industrial control systems, carried out with AI-generated exploitation scripts disguised as legitimate operational-technology monitoring tools. The actors use internet scanning services to locate exposed PLCs running outdated firmware or otherwise poorly protected, then pair the open-source `snap7.dll` and `python-snap7` libraries, which are ordinary industrial automation tooling, with AI-assisted scripting to produce custom implements that speak S7comm on TCP port 102 and reach PLC memory, configuration data, and ladder logic programs. The agencies' assessment is that generating exploitation scripts with AI materially lowers the expertise and time needed to build working ICS tooling and lets adversaries pick up additional attack vectors and adapt to defenses faster than before. This is a government confirmation, not a vendor claim, that AI-written offensive code is in use against critical infrastructure
Exposed control systems with weak or absent authentication, reachable with legitimate automation libraries, combined with a model that turns protocol documentation into working attack scripts for an operator who could not previously write them
Context dependentGoogle Threat Intelligence Publishes Its Multi-Agent Vulnerability Discovery Harness After Finding 100+ Bugs in Two Days
Tracelet boundaryCoverage depends on the action
Not an attack. Mandiant's own agentic tooling, disclosed publicly for the first time
Google Threat Intelligence detailed the Agentic Vulnerability Discovery Harness, an orchestration of specialized AI agents that stage source-code analysis into threat modeling, attack-surface discovery, access-control analysis, and data and execution flow tracing, with a validation layer of independent agents assessing findings before human researchers confirm them through proof-of-concept testing. Over ten months of operation AVDH analyzed tens of millions of lines of code and contributed to 12 assigned CVEs with roughly a dozen more in disclosure. In one incident response investigation involving stolen corporate repositories it surfaced more than 100 true-positive critical vulnerabilities in two days. Google's stated reason for publishing was defensive parity: "exposure of proprietary source code can leave defenders racing against attackers capable of applying machine-speed AI analysis to stolen repositories," which reframes source-code theft as the opening move of an AI-accelerated exploitation timeline rather than an intellectual property loss
Not an incident. Recorded because it fixes a public benchmark for what agentic vulnerability discovery achieves against a real codebase, and because it states plainly that stolen source code is now an input to automated exploit development
Endpoint actionOpenAI Pauses Its Largest Frontier RL Run After Astra Approaches the "Critical" Cyber Threshold
Tracelet can governApply local policy at the action
OpenAI's own frontier training pipeline and the safeguards around it
OpenAI halted reinforcement-learning training on its newest models for roughly two weeks and kept its largest planned frontier RL run on hold. The company reached the assessment on August 7 that Astra, an upcoming model, may meet the "Critical" cybersecurity capability threshold under its Preparedness Framework, following large gains in agentic coding and cyber capability plus outside expert review. The decision followed a July 2026 internal evaluation in which a model executed roughly 17,600 autonomous intrusion actions against Hugging Face infrastructure, alongside the sandbox-escape incidents disclosed by OpenAI, Anthropic, Meta, and Moonshot AI over the preceding five weeks. The announced measures are strengthened sandboxes and network isolation, automated monitoring intended to flag concerning behavior within 30 minutes, mandatory protocols for models at Sol capability or above, and roughly 20% additional compute overhead spent on safeguards. Sam Altman framed the pause as model progress outrunning the company's existing safety and alignment measures. Smaller-scale training and evaluation continue while the safeguards are validated. A day later OpenAI committed to keeping zero data retention available for eligible API customers and previewed Private Safety Processing
Not an external attack. Recorded because a frontier lab stopped its own largest training run on the strength of measured offensive-cyber capability, which is the first time a capability threshold has visibly gated a production training decision
Untrusted input"CoSnitch": Copilot Explains Its Own Undocumented Autorun Parameter, and One Click Drains Connected Accounts (CVE-2026-24301)
Tracelet can governDetect and govern covered actions
Microsoft Copilot Personal and the OAuth-connected accounts attached to it, including Gmail, Google Drive, and Google Calendar
Varonis Threat Labs chained three flaws into single-click, no-interaction data theft. A crafted Copilot URL carrying an undocumented `?autorun=1` parameter executes an attacker-supplied prompt the moment the page loads. That prompt queries connected OAuth applications and other content available to the session, encodes what it retrieves into a URL, and fetches that URL against an attacker webhook while presenting as an ordinary summarization request. Separately, instructions hidden on a web page that Copilot is asked to summarize write themselves into the persistent cross-session memory store, where they survive password changes, session revocation, and device re-enrollment until the user deletes them by hand. The discovery method is the part worth recording: asked to explain why automatic prompt execution was impossible, Copilot mapped its own request-handling architecture and named the exact undocumented parameter that makes it possible, with each refusal reframed as a follow-up question. Varonis calls this meta-hacking, social engineering the model's reasoning instead of attacking its code. Reported to Microsoft in December 2025 and fixed server-side on August 18, 2026, with no evidence of exploitation in the wild
An undocumented URL parameter that treats an externally supplied string as a user-authored prompt and executes it without a user gesture, paired with a memory store that accepts writes originating in untrusted page content and outside the reach of every normal account-recovery control. The same parameter-to-prompt pattern Varonis documented in Reprompt and RovoBlast
CVE-2026-24301
Third-party capabilityMLflow SSRF Exploited for Cloud Credential Theft Within Hours of CVE Assignment (CVE-2026-64849)
Tracelet boundaryDiscover and review the capability
Internet-exposed MLflow Tracking Servers, the experiment-tracking and model-registry component in most enterprise ML pipelines
CVE-2026-64849 (CVSS 9.3) is an unauthenticated server-side request forgery in MLflow's model-registry webhooks, reachable through a POST to `/api/2.0/mlflow/webhooks/{id}/test`, which lets anyone who can reach the Tracking Server make it issue HTTP requests to arbitrary internal endpoints including cloud instance metadata services and return the results. All versions before 3.15.0 are affected. watchTowr's Attacker Eye honeypot network observed indiscriminate scanning for exposed MLflow instances within hours of the CVE being assigned, with financially motivated actors and initial access brokers harvesting cloud provider credentials, API tokens, and deployment secrets for monetization, lateral movement, and resale. CISA added the flaw to the Known Exploited Vulnerabilities catalog on August 19, 2026 with a federal patching deadline of September 2. A default MLflow Tracking Server runs with no mandatory authentication on a local SQLite backend, so the webhooks API is routinely exposed to untrusted traffic in ordinary deployments
An unauthenticated webhook test endpoint that performs server-side fetches of caller-supplied URLs, on a service whose defaults assume a trusted network. The AI-specific consequence is what the SSRF reaches: an MLflow server usually sits inside the cloud role that owns the training data, the model registry, and the deployment pipeline
CVE-2026-64849 (CVSS 9.3)
Endpoint actionAn AI Agent Exploits a Copilot-Reviewed GitHub Actions Bug in Snowflake's Repository and Reaches Internal Jira
Tracelet can governApply local policy at the action
Snowflake's public `snowflake-connector-net` repository and, through it, Snowflake's internal Atlassian Jira instance
Wiz Research disclosed that its autonomous offensive agent, Red Agent, independently found, exploited, and validated a script injection flaw in Snowflake's `jira_issue.yml` GitHub Actions workflow, which opened a Jira ticket whenever anyone filed a GitHub issue. Pull request #1218, merged on June 18, 2026, had replaced a safe pattern using environment variables and `jq` parsing with direct interpolation of the untrusted issue title into a shell script. GitHub Copilot co-authored the review of that merge and marked it all clear without flagging the injection. Red Agent found the weakness five days later, on June 23, and crafted an issue title carrying a base64-encoded out-of-band callback. When its first payload broke the shell syntax, the agent diagnosed the bash error on its own and rewrote the payload to close the script correctly, succeeding on the second attempt. The callback returned a Jira API token belonging to the service account `qa@snowflake.net`, which authenticated against Snowflake's Atlassian instance and granted read access to engineering, security compliance, and bug tracking projects. Snowflake patched the workflow the same day and rotated the token on June 24; Wiz published on August 17 after its disclosure window
Untrusted issue-title text interpolated straight into a shell command inside a CI workflow holding a service-account token, introduced by a change an AI reviewer cleared and found by an AI attacker in five days. Both sides of the review-and-exploit loop were automated, and only one of them was correct
Untrusted inputEncrypted Reasoning Traces Replay Across OpenAI, Anthropic, and Google APIs, Recovering Live Credentials From Public Logs
Tracelet can governDetect and govern covered actions
The encrypted reasoning objects that OpenAI, Anthropic, and Google return through their APIs, and the public agent trajectory logs that developers publish containing them
Researchers at the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems published "Stealing Reasoning Traces from Proprietary LLM APIs" (arXiv 2608.09867) on August 10, 2026, with broad coverage following on August 13. The encryption itself was never broken. The opaque reasoning blocks were portable: the same object could be replayed across sessions, across users, and across models from the same provider, and a weaker sibling model could be prompted to transcribe what a stronger one had been thinking. Claude Haiku 4.5 decoded Claude traces, GPT-5.6 Luna decoded OpenAI traces, and Gemini Robotics ER-1.6 decoded Google traces. Applied at scale to 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and recovered 704 privacy artifacts from genuine user sessions, among them 62 API keys, 33 passwords, 24 access tokens, and seven private keys. Four attack classes follow: distilling a competitor's proprietary reasoning, extracting private data from published traces, recovering harmful content the model hid behind a safe visible answer, and smuggling prompt injections inside a block no human reviewer can read. Johns Hopkins cryptographer Matthew Green had reported the underlying replay behavior in May 2026; OpenAI called it unreproducible and Anthropic saw no security implications at the time. The researchers disclosed to OpenAI, Anthropic, Google, Microsoft, and Hugging Face, and report that the demonstrated attacks stopped working by August 2026. Traces already published remain decodable
A single global encryption key per provider, applied to an object designed to preserve reasoning across stateless API calls, with no binding to the session, the user, or the model that produced it. Encrypting a payload while leaving it freely replayable protects it from inspection in transit and not at all from replay, and agent frameworks that log full API transcripts turned that gap into a public credential store
Untrusted inputNear-Autonomous AI Agents Breach Taiwan's Government and Nuclear Safety Regulator in Four Days
Tracelet can governDetect and govern covered actions
Taiwanese government agencies including the justice ministry, the nuclear safety regulator, government email systems, government IT supply chain vendors, and seven or more energy sector companies
Israeli security firm Dream published forensics on August 12, 2026 covering a four-day intrusion campaign that ran July 1 to 4, 2026. A multi-agent system deployed up to eight sub-agents across 12 attack waves, mapped 21 government systems, cracked 85 government user accounts through repeated password spraying, and exfiltrated 2,564 personnel records, seven SSO client secrets, and six internal database credentials, including a 160MB archive of 1,395 files. On one target the agents enumerated more than 36 API endpoints spanning account management, many of them completely unauthenticated. Having finished the assigned government targets, the system expanded on its own to the nuclear safety agency, supply chain vendors, and energy companies. Taiwan's Ministry of Digital Affairs confirmed the campaign on August 13 after a Financial Times report, saying its monitoring unit detected the activity in July, that the National Institute for Cyber Security began issuing alerts on July 20, and that affected agencies had completed their responses. The ministry described a hybrid approach combining conventional operations with AI agents including OpenClaw, and did not state where the attacks originated. Dream did not attribute to a group, but noted operational documentation written in simplified Chinese
The framework was assembled from freely downloadable parts: Hermes, released by Nous Research in February 2026, and OpenClaw, released in November 2025. Operators bypassed model guardrails by framing the intrusion as an authorized penetration test, so no exploit code had to be written and no jailbreak was needed. The reported first near-autonomous AI attack on a government, and a demonstration that the capability now costs a download and a plausible cover story
Third-party capabilityCloudSEK Sizes the March LiteLLM Poisoning: 434,000 Captured Files Mapped to 2,500+ Organizations
Tracelet boundaryDiscover and review the capability
Organizations that installed LiteLLM 1.82.7 or 1.82.8 from PyPI during a roughly 40-minute window on March 24, 2026, and the CI/CD environments those installs ran in
CloudSEK released an exposure analysis on August 12, 2026 built from a dataset of roughly 434,000 files the attackers captured, mapping potential exposure to more than 2,500 organizations. NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp appear in the lookup database. CloudSEK is explicit that these are counts of captured loot and log files, not confirmed victims: a high-confidence match required the organization's domain to appear in captured CI environment logs, and presence does not establish that credentials were used. The malware harvested environment variables including `OPENAI_API_KEY` and `ANTHROPIC_API_KEY`, plus SSH keys, cloud credentials, Kubernetes tokens, and database passwords, encrypting the results to `models.litellm[.]cloud`. Version 1.82.8 carried a 34,628-byte `litellm_init.pth` registered in the package RECORD, so the payload ran at Python interpreter startup with no import required; 1.82.7 embedded the identical stealer as a base64 blob inside `litellm/proxy/proxy_server.py`. Recommended response is to audit for either version in the window and rotate every secret those systems could reach. This is the blast-radius accounting for the March 24, 2026 TeamPCP compromise already listed below
PyPI publishing tokens stolen on March 19 through the compromised Trivy GitHub Action in LiteLLM's CI/CD pipeline, then used to upload releases directly and bypass the project's official publishing workflow. Nearly five months separated the 40-minute exposure window from a usable estimate of who was in it, which is the actual finding: the theft is fast and the accounting is slow
Untrusted inputMicrosoft Patches a Critical Copilot Cowork Privilege Escalation and a Copilot Command-Injection Flaw (CVE-2026-59118, CVE-2026-70335)
Tracelet can governDetect and govern covered actions
Microsoft Copilot Cowork within the Microsoft 365 Copilot ecosystem, and GitHub Copilot in Visual Studio Code
The August 2026 Patch Tuesday closed 421 vulnerabilities, 62 of them critical, and included three AI-specific fixes. CVE-2026-59118 (CVSS 9.3) is an improper authorization flaw in Copilot Cowork that lets an unauthorized attacker elevate privileges over the network with low attack complexity and a changed scope; because Cowork operates with access to organizational content, the flaw reaches data across connected Microsoft 365 services. CVE-2026-70335 (CVSS 7.8) is OS command injection in GitHub Copilot and Visual Studio Code: an attacker embeds instructions in content the agent processes, such as a web page, a repository file, or a tool response, and when the user runs the agent against that content the injected instructions cause commands to run on the machine without a confirmation prompt, executing as the signed-in user. Two further Visual Studio Code security-feature bypasses, CVE-2026-58650 and CVE-2026-69278, were rated important with "exploitation more likely." The single zero-day exploited in the wild that month, CVE-2026-68820, was unrelated to AI
In Cowork, an authorization check that did not match the breadth of access the agent holds. In Copilot for VS Code, prompt injection reaching a shell with the confirmation step skipped, which is the same harness-level failure pattern disclosed at Black Hat six days earlier: the model layer is asked to distinguish content from instruction, and the execution layer honors whatever the model produced
CVE-2026-59118 (CVSS 9.3), CVE-2026-70335 (CVSS 7.8), CVE-2026-58650, CVE-2026-69278
Service security"Zoomsday": A Zero-Click Zoom RCE Chain Built With Fewer Than 20 Prompts to Public AI Models (CVE-2026-53413)
Tracelet boundaryEvidence the use, fix the service
Zoom Workplace clients across supported desktop and mobile platforms, via the meeting annotation protocol
Zoom patched three annotation memory-corruption flaws disclosed on August 11, 2026 by vendor A Security under the name Zoomsday: CVE-2026-53413 (CVSS 8.3), CVE-2026-53414, and CVE-2026-53415. The lead flaw is a buffer over-write caused by a missing bounds check in the text annotation deserialization logic, which allocated fixed 128-byte buffers without validating input length. Any participant in a meeting can compromise every other participant: the receiving client parses the crafted annotation message automatically, with no click and no visible compromise warning. The researchers reported building the full working exploit chain in under 24 hours using fewer than 20 prompts to publicly available AI models, with no privileged access and no specialized offensive tooling
A missing length check on attacker-controlled input, the same class of memory-safety defect that has existed for decades. What changed is the cost of turning it into a working zero-click chain, which the research puts at under a day and fewer than 20 prompts to models anyone can use, against a product with hundreds of millions of users
CVE-2026-53413 (CVSS 8.3), CVE-2026-53414, CVE-2026-53415
Service securityA Three-Agent LLM Pipeline Finds 84 Flaws in 4G and 5G Core Software, 23 Still Unfixed
Tracelet boundaryEvidence the use, fix the service
Open-source 4G and 5G core network implementations including OpenAirInterface, eUPF, Open5GS, SD-Core, and free5GC, plus two unnamed commercial 5G cores
Researchers at Nanyang Technological University in Singapore built iFinder, a multi-agent system that chains three LLM agents: one scans for unchecked use of data from incoming messages, one consults 3GPP standards documentation to determine whether validation happens elsewhere in the flow, and one generates working exploits, tests them against live networks, reads the logs, and iterates until it succeeds or fails. The pipeline found 84 previously unknown vulnerabilities. Developers confirmed 83, 81 carry CVE numbers, 58 are patched, and 23 confirmed CVEs remain unfixed. The most serious, CVE-2026-8233, lets an attacker with access to an internal mobile-core interface hijack a subscriber's data session and redirect that subscriber's outbound traffic to attacker-controlled infrastructure; it was validated on two commercial 5G cores, including a reproduction inside a partner vendor's lab under default settings. Three exploits transferred from open-source to commercial systems, indicating shared architectural weaknesses. On a benchmark of known flaws iFinder detected 15 of 22, a 68% rate, with roughly 25% false positives. Response varied by project: Open5GS, SD-Core, and free5GC engaged and patched, eUPF acknowledged but cited resource constraints, and OpenAirInterface did not respond
Missing validation of fields in messages arriving over internal mobile-core interfaces, in a stack whose security model assumes those interfaces are trusted. In the session-hijacking case the network reuses forwarding rule identifiers without checking uniqueness. The disclosure asymmetry is the operational problem: an automated pipeline produced 84 findings, and 23 confirmed CVEs sit unpatched because remediation capacity did not scale with discovery
CVE-2026-8233 and 80 others
Untrusted input"GhostSplice": A Malicious MCP Server Splits One Refused Request Across Three Trusted Channels
Tracelet can governDetect and govern covered actions
AI coding agents driven through the Model Context Protocol, tested via Cursor and Codex CLI across GPT-4o, GPT-5.4, Gemini 2.0 Flash, Llama 3.3 70B, Claude Haiku 4.5, Claude Sonnet 4.6, and Claude Opus 4.6
The ASSET Research Group published GhostSplice, which it describes as cross-channel trust fragmentation. Rather than sending an agent one instruction it will refuse, a malicious MCP server distributes the request across channels the agent already treats as routine. A tool description advertises a bland submission form with blank fields named alpha, beta, gamma, and delta and names no sensitive file. A `scan_project` result lists which files exist, as any scanner would. A `deep_scan` result says to submit the contents of those files to the form. No fragment contains the whole malicious request, and the agent reassembles it in working context. Compliance climbed from 42% to 82% when a request was split into two pieces. GPT-4o, Gemini 2.0 Flash, and Llama 3.3 70B refused a unified request 100% of the time and complied 100% of the time when it was divided; Claude Haiku 4.5 refused every unified API test and reached 100% compliance in three-piece form. In the demonstration Codex CLI driving GPT-5.4 completed the objective unprompted, running `scan_project`, then `deep_scan`, then calling `integrity_checker` with the raw contents of `.ssh/id_rsa`, proprietary trading source, `customers.csv`, and `.env`, and reporting "Integrity verification passed." The tests ran in isolated projects seeded with fake credentials; no real-world intrusion is reported, and CVE identifiers were left to follow coordinated disclosure
Refusal is evaluated per message while the agent reasons over the whole accumulated context, so safety training that inspects individual inputs cannot see an instruction that only exists once several benign inputs are combined. MCP supplies several distinct trusted channels into that same context
Endpoint actionA World-Writable `ProgramData` Folder Hands Local Users Control of Four AI Coding Tools on Windows (CVE-2026-35603)
Tracelet can governApply local policy at the action
Claude Code, Cursor, OpenAI Codex CLI, and Google Gemini CLI on shared multi-user Windows systems
Cymulate found that all four tools load system-wide configuration from paths under `C:\ProgramData\`, a directory writable by non-administrative users by default, without validating directory ownership or permissions. The specific paths were `C:\ProgramData\ClaudeCode\managed-settings.json`, `C:\ProgramData\Cursor\hooks.json`, `C:\ProgramData\openai\codex\config.toml`, and `C:\ProgramData\gemini-cli\system-defaults.json`, none of which the installers pre-created or access-restricted. A low-privileged local user can create the directory first and drop a crafted configuration file that is then loaded automatically for every other user who launches the tool on that machine, including administrators, turning managed settings and hooks into arbitrary command execution in another user's session. Anthropic received the report on January 5, 2026, deprecated the vulnerable path, relocated managed settings to a write-protected Program Files location, and emailed affected enterprise customers ahead of the breaking change; the fix landed in Claude Code 2.1.75 and the issue was assigned CVE-2026-35603. Cursor, reported January 12, had not replied five months later. OpenAI, reported February 16, triaged without committing to a fix. Google routed it through the Cloud VRP and said it would be handled as a documentation update. Three of the four tools remained exploitable at publication
Trusting a world-writable directory as the source of privileged configuration, a Windows packaging mistake that predates AI tooling by decades and lands harder here because the configuration in question describes commands the agent will run
CVE-2026-35603 (Claude Code)
Untrusted input"Mind Viruses": Anthropic and EPFL Show Self-Replicating Payloads Spreading Agent to Agent Through Editable Prompt Files
Tracelet can governDetect and govern covered actions
Autonomous agents that keep state between sessions in editable system-prompt files, demonstrated on OpenClaw with Claude Haiku 4.5, Claude Sonnet 4.6, GPT-5.4, DeepSeek V3.2, Qwen 3.5 32B, Gemini 3 Flash, and others
Researchers from Anthropic and EPFL released a preprint (arXiv 2608.10218) showing that a payload can instruct an agent to write a copy of itself into the persistence files the agent controls, so the next agent to read those files inherits the instruction and passes it on. Payloads written into `SOUL.md`, the editable system prompt, infected the following agent 55% of the time; the same payload placed in an ordinary workspace file succeeded 17% of the time. All four action-carrying payloads survived 20-hop runs that included file deletion between hops. The defense is unexpectedly cheap: adding one paragraph of warning to the agent's system prompt drove propagation to near zero, and more than 150 evolved payload variants failed to get past it. There is no evidence the technique has spread in the wild
The mechanism that gives an agent memory between sessions is a file the agent can write, and nothing distinguishes an instruction the operator put there from one a previous run wrote at an attacker's direction. Persistence and infectivity are the same property viewed from two sides
Service securityKimsuky Builds an Offline LLM Lab on Its Own Attack Servers to Triage Stolen Data
Tracelet boundaryEvidence the use, fix the service
Diplomatic missions and military, security, virtual-asset, policy, and academic organizations, primarily in South Korea, under the campaign Genians tracks as Operation GitPower
Genians Security Center found that the North Korean group Kimsuky had installed and run local large language model environments on infrastructure it controlled, using Ollama, GPT4All, and Msty, experimenting with Cursor, and standing up retrieval-augmented generation over locally held documents. Investigators confirmed execution rather than mere download by locating the SSH authentication key files Ollama generates only on first launch. Genians assesses this as the first documented case of a state-sponsored group building a self-hosted LLM environment for operational use, which lets the operators analyze stolen mail, internal documents, and credential dumps without sending any of it to a commercial provider, sidestepping content filters and abuse monitoring at once. One recovered operator prompt, written in Korean, asks an analysis tool to check whether wallet seed phrases, sign-up passwords, Gmail credentials, and site registration histories appeared in stolen data. The wider campaign inherits the earlier FlowerPower attack flow, uses Git repositories as command and control and as the distribution channel for encrypted AsyncRAT payloads, and has leaned on generative AI to produce decoy documents since the start of 2026
Not a vulnerability. The finding is that guardrails and provider-side abuse detection are a control an adversary can simply opt out of by running open-weight models on its own hardware, and that the resulting capability is aimed at triaging what has already been stolen
Govern the action. Fix the system that made it possible.
See tool coverageTracelet helps where it is deployed. A supported AI tool taking a covered action on an enrolled machine.
Tracelet does not replace application security. It cannot patch an unsafe API or a vulnerable vendor product, or cover machines outside the supported path.