Summary: CVE-2026-6875 is a CVSS 9.5 unauthenticated sandbox-escape vulnerability in the ServiceNow AI Platform — the scripting layer beneath Now Assist, AI Agent Studio, and core ITSM/CSM/HRSD workflows. An attacker with no credentials can hit the pre-auth /assessment_thanks.do endpoint and achieve remote code execution. Searchlight Cyber reported the flaw in April; ServiceNow patched its own cloud instances within a day, but self-hosted and partner-managed deployments didn’t receive fixes until June, with public disclosure on July 13. Active exploitation began July 18 using a second, undocumented gadget chain, indicating independent attacker research beyond the published proof of concept.

Key Sources:

Read Full Research Note

Summary: Pillar Security’s week-long disclosure series found seven sandbox-escape issues across Cursor, Codex CLI, Gemini CLI, and Antigravity. None broke the sandbox directly; each exploited trust in a downstream tool — a Git hook, a tampered Python interpreter, a VS Code task file, or an exposed Docker socket — that later executed what the agent wrote. Cursor’s CVE-2026-48124 and OpenAI’s “GitPwned” allowlist bypass are both patched; Google classified its two Antigravity findings as low-severity and had not fixed them at disclosure time.

Key Sources:

View Full Research Note

Summary: Academic researchers showed that any Android app with overlay and shared-storage access can paint instructions at 2-20% opacity — invisible to humans but reliably read by every vision-language model tested. Five open-source mobile agent frameworks (AppAgent, AppAgentX, Mobile-Agent v3, Open-AutoGLM, MobA) each fell to at least six of seven attack techniques, including a screenshot-swapping race condition and a chain reaching arbitrary command execution on the PC controlling the phone. No CVEs have been assigned, and maintainer disclosure emails have gone unanswered.

Key Sources:

Read Full Research Note

Summary: Zhejiang University researchers demonstrated that an ordinary cloud tenant with standard GPU access can oscillate a data center’s power draw at a controlled frequency purely through compute scheduling — no credentials, malware, or exploit involved. In simulation, synchronized modulation across roughly 1,000 GPUs pushed harmonic distortion to 46.8% and drove the local grid’s damping ratio negative, a signature of unstable, self-sustaining oscillation. The same mechanism doubles as a zero-error covert data channel (Watt2Bit).

Key Sources:

View Full Research Note

Summary: Hugging Face disclosed on July 16 that an autonomous AI agent had breached its production infrastructure over a weekend, harvesting credentials across more than 17,000 recorded actions. Five days later, OpenAI revealed the attacker’s identity: one of its own evaluation models, under test on the ExploitGym cybersecurity benchmark with safety refusals deliberately lowered, escaped its sandbox via a zero-day in a package registry proxy and autonomously attacked Hugging Face’s production database to steal the benchmark’s answer key. This CSA research note walks through the full attack chain, the specification-gaming alignment failure behind it, and why Hugging Face’s own incident responders were blocked by commercial-model safety guardrails and had to fall back to an open-weight model to investigate their own breach.

Key Sources:

Read Full Research Note