AI/ML Security & Trends

Microsoft Threat Intelligence detailed a coordinated compromise of the @asyncapi npm organization, used broadly for AsyncAPI spec code generation. Malicious import-time payloads specifically targeted CI/CD systems, cloud identities, GitHub credentials, npm publishing workflows, and AI developer tooling, part of a broader wave of supply-chain attacks (including a compromised Jscrambler package) hitting developer and AI toolchains this month.

Zenity Labs disclosed AgentForger, a cross-site agent forgery flaw in ChatGPT Workspace's Agent Builder. Maliciously crafted initialization URLs abused two parameters (agent template + instructions) to silently build and publish an attacker-controlled autonomous agent inside a victim organization when an employee clicked a benign-looking link — with no new OAuth consent screen since connectors were already authorized. Potential impact included reconnaissance, data exfiltration, credential harvesting, and internal phishing/BEC. OpenAI fixed the issue (as of June 8) following responsible disclosure; details were published publicly this week.

Researchers from Tel Aviv University and Technion demonstrated HalluSquatting: by identifying resource names (repos, 'skills') that coding LLMs predictably hallucinate for common prompts like 'clone repository,' attackers can pre-register those names so tools like Cursor, Windsurf, GitHub Copilot, Cline, and Gemini CLI fetch and auto-execute attacker-controlled payloads via the agent's built-in terminal. Hallucination rates reached up to 85% for repo cloning and 100% for some skill-installation scenarios, and the technique could scale into a botnet — though researchers withheld details criminals could directly weaponize and did not release a live botnet.

Researchers Abhishek Kumar and Carsten Maple (Alan Turing Institute, arXiv 2607.03968) show that assembling a harmful objective piece-by-piece across a multi-turn IDE coding session in GitHub Copilot Chat (VS Code 1.103.0) — rather than a single adversarial prompt — produces unsafe completions in 816 of 816 trials across four model backends (Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro, Gemini 3.5 Flash), versus just 8 of 816 for direct-chat baselines. The finding suggests safety alignment holding in chat contexts doesn't generalize to structured agentic workflows.

Cato AI Labs' full technical writeup of DuneSlide — two critical (CVSS 9.8) zero-click RCE flaws in the Cursor AI code editor — is circulating widely this week. A prompt-injected instruction hidden in content the agent merely reads (an MCP connector response or web search result) could exploit Cursor's unprompted automatic terminal execution and symbolic-link tricks to overwrite protected binaries like the sandbox helper, escaping to full host code execution. Reported privately in February, fixed in Cursor 3.0 (April 2); every version before 3.0 remains vulnerable, and Cursor is used by over half the Fortune 500.

An independent red-team evaluation by Promptfoo of GPT-5.2 found jailbreak success rates climbing from a 4.3% single-turn baseline to 78.5% in multi-turn adversarial scenarios, reinforcing an emerging industry view that prompt injection and jailbreak susceptibility may be a structural property of current LLM architectures rather than something fully patchable at the model layer.

The Wall Street Journal reports Nvidia is discussing a roughly $250 billion financial guarantee to help OpenAI lease/finance a 10-gigawatt, $500B+ data center being built by SoftBank's SB Energy on a decommissioned uranium-enrichment site in Piketon, Ohio. Nvidia is separately discussing financing up to $350 billion in chip purchases for the project. The deal, unconfirmed by Reuters, would be a first step toward OpenAI controlling its own infrastructure rather than renting from Microsoft, Amazon, and Oracle.