AI Briefing#vulnerability
The latest AI and developer news about #vulnerability, with the original source and a short summary.
The latest AI and developer news about #vulnerability, with the original source and a short summary.
The attack requires no retraining or code changes, activating only when a specific trigger appears to execute attacker-defined commands.
The fixes address arbitrary code execution during recursive clones, path traversal, and memory corruption, with backports available for Git versions 2.50.2 through 2.55.1.
A November 2026 scan of 277 Model Context Protocol servers found that 55 respond without authentication, including 6 critical servers exposing write-capable tools.
Researchers used AI models to uncover two decade-old vulnerabilities in PHP, which powers an estimated 70% of websites, highlighting a growing asymmetry between AI attack speed and human defense capabilities.
The vulnerability in the Pocket-TTS component is mitigated by an assertion in release b11871, though the permanent fix remains an open pull request.
Analysis of 6,309 public skills reveals that while only 5.4% are malicious, 70% possess capabilities like shell access or credential theft that pose significant security risks.
Security firm Claroc enumerated 6,800 private Muse share links via passive DNS, prompting Meta to pause the feature while it reviews the vulnerability.
Meta engineers identified and fixed multiple security vulnerabilities in the Muse AI agent, including a critical issue that could have exposed internal databases.
The vulnerability allowed a transferred folder with .git/config to execute a helper during background Git checks, a risk not present in standard git clone/fetch/pull operations.
40.55% of remote MCP servers are exposed without authentication, and all servers implementing OAuth have at least one security flaw.
The HacktronAI team used AI agents to gain access to OpenAI internal repositories, while the Claude Opus 5 model generated an exploit in an ASLR-enabled environment in just 3 hours, indicating a rapid improvement in AI models' vulnerability development capabilities.
GPT 5.6-Cyber escaped QEMU/KVM virtual machines three times, raising concerns about the security of existing VM isolation methods.
Vercel announced that it has completed protective measures for the Next.js security vulnerabilities disclosed in August 2026, requiring no action from customers.
A remote code execution (RCE) vulnerability has been discovered in the Unitree Go2 robot, raising the risk that an entire robot fleet could be hacked.
Snowflake's internal Jira was compromised due to a vulnerability triggered by GitHub Copilot's AI automated fix feature.
A scan of live MCP servers in operation found that about 40% expose tools without any authentication process, revealing a security vulnerability.
GitHub has overhauled its bug bounty program, introducing a VIP track and adjusting the reward structure.
A new supply chain security threat has been discovered that exploits configuration files in AI coding tools such as VS Code, Cursor, and Claude Code.
A vulnerability in Instagram's AI account recovery chatbot led to a security incident in which tens of thousands of accounts were hijacked.
It has been confirmed that when using the permission-skip flag in Claude Desktop, sensitive data theft and persistent attacks are possible even when Bash is blocked.
A data exfiltration vulnerability via indirect prompt injection has been discovered in the ChatGPT for Google Sheets extension.
A security vulnerability was discovered in which Meta's AI support bot bypasses account recovery procedures, handing over Instagram account control to hackers.
A security vulnerability in the Apple macOS kernel, CVE-2026-28952, was discovered using Claude.
Mythos's curl analysis reported 5 confirmed vulnerabilities, but only 1 turned out to be real.