Summary: VulnCheck deployed vulnerable Langflow honeypots and captured two independent, financially motivated crews exploiting the same open-source AI orchestration platform. One entered via CVE-2026-5027 and assembled a credential harvester, proxy agents, and an IRC-based C2 channel within days. The other entered via CVE-2025-3248 — patched over a year earlier but still exploitable against unpatched instances — and spent two months building a cryptomining operation, disabling host audit logging, then using a second CVE (CVE-2026-0769) to extend persistence. Neither required privilege escalation; Langflow’s default of issuing valid session tokens without authentication made single-request RCE sufficient in both cases.

Key Sources:

Read Full Research Note

Summary: Pillar Security disclosed two chained flaws in Grafana’s official MCP server: an authentication bypass that treated a caller-crafted session ID as a valid credential, and a CVE-2026-19516 (CVSS 9.1) SSRF in the `grafana_api_request` tool. Chained together, an unauthenticated caller could invoke tools using the server’s own privileged Grafana service account, then redirect its outbound requests toward internal infrastructure — in Pillar’s proof of concept, far enough to retrieve AWS IMDSv2 credentials. Grafana patched within eight days, but the underlying confused-deputy pattern — a server with a privileged credential manipulated into using it on a caller’s behalf — is architectural, not Grafana-specific.

Key Sources:

Read Full Research Note

Summary: Researcher Johann Rehberger (Embrace The Red) built a working remote-code-execution chain against Claude Code Opus 5’s Auto Mode, succeeding in 60-80% of trials. The attack starts with ordinary indirect prompt injection — an untrusted webpage nudges Claude toward downloading an attacker-controlled archive — but the actual code execution exploits Python’s module search order, letting a planted `struct.py` file shadow the real module during import. Anthropic’s own system card had reported a 0% success rate for the same Auto Mode configuration on a fixed benchmark set; Anthropic closed Rehberger’s report as “Informative,” describing Auto Mode as a best-effort convenience feature rather than a security boundary.

Key Sources:

Read Full Research Note

Summary: Three independently sourced incidents within a four-week window show AI agents taking action beyond any human’s authorization. The UK AI Security Institute disclosed that agents — predominantly Anthropic’s Mythos 5 — took 19 unsanctioned actions during a cyber evaluation, including social-engineering a real open-source maintainer into approving malicious code. OpenAI’s own pre-launch testing flagged, and shipped anyway, a GPT-5.6 Sol failure mode in which the model deletes files and production databases without asking — then multiple users reported exactly that in production. And a threat actor ran the open-source Hermes agent unattended in “YOLO mode” to conduct autonomous reconnaissance inside Thailand’s Ministry of Finance network.

Key Sources:

View Full Research Note