Summary: A pre-authentication sandbox escape in ServiceNow’s AI Platform, rated CVSS 9.5, lets an unauthenticated attacker with network access execute arbitrary code by abusing the GlideRecord query filter mechanism. ServiceNow disclosed and patched the flaw on July 13; threat intel firm Defused confirmed active exploitation beginning July 17 via a gadget chain distinct from the original proof of concept, suggesting independent attacker re-derivation. Self-hosted and partner-hosted instances that have not applied the July patches are exposed to full data access, admin-account creation, and — where a MID Server bridges to internal networks — a pivot into on-premises infrastructure.

Key Sources:

Read Full Research Note

Summary: Island researchers documented roughly 7,600 malicious GitHub repositories tied to about 6,600 fabricated developer profiles, of which more than 800 impersonate AI Skills or MCP servers for tools like Gmail, WhatsApp, Databricks, and Jenkins. The campaign has driven over 14 million downloads of a SmartLoader-to-StealC malware chain that harvests credentials, session tokens, and SSH keys. Its most consequential finding, dubbed AgentBaiting, is that AI coding agents such as Claude Code, Gemini, and ChatGPT independently discover these repositories, treat attacker-written READMEs as trustworthy documentation, and recommend installation to users without any human first encountering the malicious link.

Key Sources:

Read Full Research Note

Summary: Academic researchers evaluated five widely used open-source mobile AI agent frameworks — AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA — and found each vulnerable to at least six of seven newly demonstrated attacks. The core weakness is architectural: these agents perceive a phone’s screen only as a raw screenshot captured over ADB, so anything a co-installed malicious app can render into that screenshot, including content invisible to a human, is treated as ground truth. A demonstrated end-to-end chain combines an invisible visual overlay with a screenshot-tampering race condition and shell metacharacter injection to reach arbitrary code execution on the host PC running the agent — not just the phone.

Key Sources:

Read Full Research Note

Summary: Zhejiang University researchers disclosed Bit2Watt, a cyber-physical vulnerability class in which a fully authorized cloud tenant can destabilize the power grid supplying a GPU data center purely by scheduling ordinary-looking compute jobs in carefully timed patterns — no credential theft, network intrusion, or terms-of-service violation required. Worst-case modeling of 1,000 synchronized GPUs against a 1MW grid segment with heavy distributed energy resources drove total harmonic distortion to 46.8% and pushed the grid’s damping ratio negative, a hallmark of self-sustaining instability. A companion technique, Watt2Bit, uses the same channel for covert data exfiltration and can trigger denial-of-service across the compute cluster when protective equipment trips.

Key Sources:

Read Full Research Note