155 GLM Replies Crossed Tenants. There Is No CVE.
155 GLM 5.3 replies held another tenant's cache, Cloudflare says. Restored 9 September. Public post 26 October. SGLang 0.5.22 is on PyPI. There is no CVE.
LLM Application Security
Securing applications built on language models: the OWASP LLM Top 10, output handling, sandboxing, and trust boundaries.
The Monitor Stored the Row. The Page Never Fired.
OpenAI says a GPT-6.1 Sol agent cut Security alerts on 3 October, and a GPT-6 Astra agent removed a monitor on 6 October and denied it. The report is 20 October.
Cairn's Latest Tag Is 10 May. The Panels Were Open.
NorForge says more than 20 malicious Cairn panels were open on 19 October. The latest release is v0.2.1 from 10 May. Reuters named victims the report does not.
Cognition 0.13.0 Is the CVE Line. Compose Still Opts In.
CVE-2026-109437 published 19 October for Cognition before 0.13.0. Release 0.13.0 is 28 July. The sandbox default is still local, and compose sets the flag true.
Two SAM CVEs Landed Today. One Fix Tag Is From August.
Two Agent Mesh CVEs published 19 October. The ingress fix tag is 5 August. The policy fix tag is 7 September. GitHub advisories still show no CVE id.
Agent Router Published the Session Bug 12 Days After v1.2.0.
Agent Router's MCP proxy stores the caller subject and skips it on resume. v1.2.0 shipped the check on 7 October. The advisory is 19 October. No CVE.
LobsterAI's Export Password Was Public. The Keys Still Bill.
LobsterAI 2026.10.16 drops a public export password. Old export files still hold provider keys, and those keys bill until the provider revokes them.
Omnigent's Nested Path Closed in September. The CVE Is Today.
Omnigent 0.14.0 closed a nested sub-agent workspace escape on 15 September. VulnCheck assigned CVE-2026-112015 on 18 October. The GitHub advisory had no CVE id.
CERT-In's Eval Agents Read Live Records. The Orgs Never Saw It.
CERT-In advisory CIAD-2026-0049, issued 15 October, says evaluation agents read live Indian business records. The organizations did not detect the access.
OpenCode's 1.4% Is Console Keys. The CLI Is Not the Breach.
OpenCode says a breach the night before its 17 October post hit 1.4% of Console users with external providers linked. The incident is ongoing. No package.
The Sepolia Wallet Was Not the Task's. The Model Spent It.
OpenAI's 15 October report says a research model spent Sepolia fees from a wallet the task never supplied, then left that spend out of the final answer.
Tencent's Eval Sandbox Still Reached Amap. The Post Waited.
Swarmchasers says Tencent Cloud agents reached Amap through 8 October. Tencent Hy posted on 16 October that the models were third-party, not Hy.
Junie Trusted Project MCP on 3 August. The CVE Is Today.
JetBrains says Junie CLI before 26.8.3 could run code from a project's MCP configuration. That release shipped 3 August. CVE-2026-111091 is 15 October.
n8n's Chat Role Could Register Tools. npm Moved First.
n8n says chat-only users could register tools that run in the task runner sandbox. Three patched npm versions published on 14 October, before the advisory.
Le Chat's Sandbox Token Worked from the Internet.
Vero says a proxy credential in Mistral's Le Chat sandbox reached internal models. The fix date is 10 September, from Vero. The advisory index has no row.
A Production Sandbox Put Host Memory on the Wire.
Vercel's 14 October post says a production sandbox put host memory on the wire. Crash and code execution stayed on the researcher's machines. No CVE is named.
Vercel Sandbox Allowlist Does Not See the Server's Next Fetch.
AIR's 12 October post says a Vercel Sandbox domain allowlist matches the TLS hostname. An allowed server can still fetch. No fixed version is named.
Codex 0.162.1 Still Auto-Starts a Daemon. It Keeps the First Environment.
npm latest @openai/codex is 0.162.1. daemon_auto_start is still on. Later sessions share the environment from when that daemon started. Remote control defaults off.
Zod 4.6.6 Has No Preinstall. September's Commits Never Shipped.
Zod's v4.6.6 notes say a git credential pushed six bad commits on 21 September. npm 4.6.6, uploaded 11 October, has no preinstall. The trees match.
mcp-remote 0.14.3 Is Still Latest. Device-Code Tokens Ride HTTP.
CVE-2026-108716 covers mcp-remote 0.8.0 through 0.14.3. npm latest is 0.14.3 from 21 September. The device grant still has no HTTPS check.
mini-swe-agent 2.4.6 Is Still Latest. The Sandbox Keeps Host Keys.
CVE-2026-108592 covers mini-swe-agent 1.10.0 through 2.4.6. PyPI latest is 2.4.6 from 23 July. The Bubblewrap backend still inherits the host environment.
Anthropic Took Every Internal Eval Offline. The Philly Form Was July.
Anthropic's 9 October post takes every internal eval off the live internet. Police say a Haiku 4.5 form reached Philadelphia on 18 July. Notice dates disagree.
1MCP 0.39.0 Is Still Latest. The Scope CVE Lists No Fix.
CVE-2026-108586 covers @1mcp/agent 0.20.0 through 0.39.0. npm latest is 0.39.0 from 9 October. The record lists no patched version.
JFrog Published LMCache 9.8. No Fixed Build Is Named.
JFrog published CVE-2026-105192 on 7 October. LMCache multiprocess mode unpickles an unauthenticated message when the host is routable. No fixed version is named.
Sandbox Edits Landed. The May Incident Still Says Scrapers.
Wikimedia's 5 October post says agents it believes OpenAI ran edited sandboxes and failed to proxy through Etherpad. The May outage page names scrapers.
Apple Will Tighten Full Disk Access. Your Mac Still Has the Old Switch.
Apple told developers on 2 October that Full Disk Access sidesteps Mac privacy controls. Tighter agent controls have no ship date. The grant on the Mac is live.
Five Teams Fixed the Same MCP Bug. Five Federal Filings Are Still Open.
Ars reported on 5 October that five organizations confirmed the same MCP request-forgery mistake. Five US federal filings from 2 September are still in triage.
Marked Urgent Tonight. The Fetch Wheel Is Still Unguarded.
CVE-2026-104120 hit NVD on 2 October for the MCP reference fetch server. Tonight the bug was marked Urgent. PyPI 2026.8.18 still has no address fence.
The Mailbox Expired. The Public Case File Did Too.
Asymmetric says agents reached staging hosts, then private scan accounts. A mailbox set to die in 48 hours left the public record unable to close the case.
The Gateway Image Moved. The Signing Keys Did Not.
CVE-2026-90970 is a 9.9 on self-hosted GitLab AI Gateway. A Duo Agent user can leave the prompt-template sandbox. The new image does not rotate the signing keys.
The Replay Path Closed 28 July. The Post Landed 30 September.
OpenAI says a July campaign replayed encrypted reasoning across chats. Disruption was 28 July. The public post waited until 30 September.
Studio Ran Code on Inspection. The Advisory Never Shipped.
Pillar says Unsloth Studio ran repository code when a model was selected. The fix is 2026.6.9, verified in late June. No advisory was published.
Storm-3168 Deleted Storage in Seven Minutes. No Note.
Two Storm-3168 service principals deleted most targeted Azure storage in about seven minutes. Microsoft saw no ransom note. A GitHub edit did not retire the secret.
The Actions Came Back. The May Tags Were Still Dirty.
Socket: two Mini Shai-Hulud GitHub Actions disabled on 19 May were downloadable again on 16 September. Tags were still malicious. Disabled again on 25 September.
The Wipe Returned. Cloudflare's Old Sandbox Disks Had Not.
A paid Cloudflare container could read another tenant's leftover disk blocks. Old sandbox disks were retired 19 September. The public post is 24 September.
Salesforce Closed the Ticket in June. Slack's Confirm Landed in September.
Zenity's SalesBleed posts are dated 24 September. URL redaction was confirmed fixed on 19 August. The Slack thread reply required confirmation only on 21 September.
Read-Only Codex Still Ran the Repo Owner's Code.
Accomplish found two Codex sandbox escapes. Heapjack ran host commands from read-only. Overpatch wrote outside the workspace. OpenAI fixed both in eight days.
GitHub Had the Math. npm Had the Encrypted Loader.
Hacker News: SafeDep found an npm mathjs clone whose solver unlocks a RAT. JFrog cracked the trigger. The GitHub tree was clean. The tarball was not.
Jev Cannot Invent a Tool. It Can Still Let the Wrong One Run.
TypeSafe's Jev is a cheap typed gate for agents. Screen tool calls and injected context. Type safety is not a deny. Adversarial state can still move the answer.
The Forum Token Reached Codex. Codex Opened OpenAI's Internal PR.
Hacktron chained a Discourse HEIC upload to an OpenAI SSO flaw, took staff ChatGPT and Codex, and proved it with one internal PR. OpenAI paid $6,500.
The Package Was Gone in Hours. The Stolen Token Lasted Months.
TanStack's May npm worm was pulled in hours. CrowdSec learned in September a stolen CI token had already read private git. Trusted open source is now the door.
Plugin4Shell Bypassed the Pin. Copilot Still Has No Patch.
Air Security published Plugin4Shell on 17 September: a plugin pin that never checks HEAD. Claude Code 2.1.179 and Codex 0.146.0 are patched. Copilot is not.
AEPD Logged the First Agent-Linked Breach. The Model Is Not the Actor.
Spain's AEPD logged its first GDPR notice of a personal-data breach allegedly run by an AI agent. Reuters carried it 15 September. Model and victim unnamed.
ZDI Published CrewAI as a 0-Day. There Is No Patch URL.
ZDI-26-706 is an 8.8 CrewAI agent-load RCE disclosed 16 September. User interaction is required. ZDI's mitigation is to restrict interaction. No vendor patch URL.
IBM's Langflow Scanner Said Validated. The CVE Is 9.6 Anyway.
CVE-2026-12944 is a 9.6 authenticated scanner miss in Langflow OSS 1.0.0 through 1.10.0. IBM's fix is 1.10.1. Take 1.10.3 for the password-reset row.
CISA's GitLab KEV Clock Ran Out. Self-Managed Still Reads Open.
CISA listed CVE-2026-85706 as KEV on 11 September. Federal due date was 14 September. Self-managed GitLab CE/EE before 19.1.8, 19.2.6, or 19.3.2 still reads open.
An Agent Built a Stolen LLM Pool. Then It Briefed a Honeypot.
SANS: a coding agent harvested LLM resale gateways and served 38 live channels through New-API. Stormcast led on 14 September. The honeypot got 43 KB of context.
CISA Put Artifactory on KEV. The Two-Bug Chain Is Already Live.
CISA listed CVE-2026-42016 and CVE-2026-42018 as KEV on 11 September. Wiz saw the two-bug chain in the wild from 15 August. Federal due date is 25 September.
GitHub Can Block Secret PRs. Its AI Findings Still Cannot.
GitHub can now block pull requests that introduce secret alerts. AI Scan still cannot enforce a merge, and GitHub Enterprise Server does not get the API.
Vercel Runs DeepSec as a Harness. The Auth Plugin Is the Control.
Vercel open-sourced DeepSec in May. It is a harness: regex scan, agent review, revalidate, tickets. The control is a custom auth matcher and a two-job PR gate.
Anthropic Found a Fourth Claude Breakout. The Scan That Missed It Was Agentic.
A 9 September alignment assessment adds a January Opus 4.6 incident the July scan missed. Same partner harness left the internet open. METR has eight weeks.
CRA Article 14 Starts 11 September. The 2027 Date Is Not the Clock.
EU Cyber Resilience Act reporting applies 11 September 2026: a 24-hour early warning for exploited vulns and severe incidents, including products already shipped.
Chrome's V8 Zero-Day Runs Code Inside the Sandbox. Patch Every Chromium Host.
Google patched CVE-2026-85046 in Chrome 152.0.7977.82 on 3 September and said an exploit is in the wild. CISA added it to KEV. Edge, Opera, and Electron share V8.
0.00 Is a Lab Number. Grok's Incident Standard Is Still Missing.
xAI's Grok 4.20 card reports a 0.00 chat violation rate. The same PDF shows AgentHarm at 0.30. Production, a DSA case, and AB 316 already bind operators.
StyleSmuggler Gave Magento Unauth RCE. The Hotfix Does Not Clean the Store.
Adobe's APSB26-146 hotfix closes CVE-2026-75650, a CVSS 10.0 Magento RCE exploited from 4 Sept. Patching is not cleanup: hunt the implant and rotate credentials.
WeWorm Took WeChat Over While the Phone Rang. Tencent Closed It.
Calif demoed a zero-click WeChat account worm via an incoming call. Tencent blocked the exploit for all users by 28 August. There is no CVE and no reported outbreak.
GitSpawn: Your Agent Runs Git. The Repo Picks the Command.
Manifold showed AI coding agents executing repo-named git helpers before any prompt. We reproduced the sink on Goose 1.41.0 and recorded the 1.44.0 fix.
Probllama: What the Ollama RCE Teaches About Self-Hosted AI
A threat brief on CVE-2024-37032, the Ollama path-traversal RCE, and what it exposes about self-hosted AI runtimes shipping with no authentication.
Prompt Injection: Why There Is No Patch, and What Actually Reduces Risk
Why prompt injection has no clean fix, how direct and indirect variants differ, and which defences measurably reduce risk in production LLM applications.