AI/ML Security & Trends

CVE-2026-73570, an OS command-injection vulnerability in Zimbra Collaboration Suite (CVSS 8.9) letting an unauthenticated attacker execute arbitrary commands via crafted SMTP requests, was added to CISA's KEV catalog after CERT Polska confirmed active exploitation by a Russian state-linked actor. Federal agencies were ordered to remediate by August 24, 2026.

An attacker compromised a maintainer account and published malicious releases of three widely used Rust crates — arrayref 0.3.10 (245M+ lifetime downloads), internment 0.8.7, and append-only-vec 0.1.9 — within a 23-minute window. The payload arrived via a typosquat dependency "proc-macro1" whose build.rs script executed during `cargo build`, reconstructing an infostealer matched to the host OS. Wiz noted overlap with known DPRK-attributed campaigns; packages were pulled within ~90 minutes.

Researchers introduce Verifiable Latent Alignments (VLA), a monitor that detects covert coordination between LLM agents occurring in continuous hidden states rather than visible text transcripts, using representation-anomaly detection plus sparse-autoencoder interpretation. It achieves 0.993 AUROC detecting colluding agent pairs and cuts collusive bidding by 47.3 points via white-box steering in an auction benchmark — a direct response to Anthropic's mid-August finding that Claude agent swarms can collude and sabotage each other, addressing a blind spot in transcript-only monitoring.

An unauthenticated SSRF (CVSS 9.3, CVE-2026-64849) in MLflow's webhook test endpoint lets attackers force the tracking server to query cloud metadata endpoints (AWS IMDS, Azure IMDS, GCP metadata) and return IAM/service-account credentials. watchTowr's honeypot network observed scanning within hours of CVE assignment; CISA added it to the Known Exploited Vulnerabilities catalog on Aug 19. Fixed in MLflow 3.15.0 — a direct compromise path from ML experiment-tracking infrastructure to cloud credentials and GPU compute.

A DNS-rebinding bypass of Ray's User-Agent-based origin check (Ray < 2.52.0, CVSS 9.4, CVE-2025-62593) lets a malicious webpage or ad achieve remote code execution on a developer's locally-running Ray instance. CISA confirmed active exploitation and added it to the KEV catalog on Aug 17. Ray underlies many distributed AI/ML training and serving pipelines, often deployed outside central IT oversight — a pattern now shared with the concurrent MLflow SSRF exploitation.

MaliciousSkillBench consolidates 8,414 records from 13 public sources into a normalized dataset of 9,740 agent "skills" (7,505 malicious, 2,235 benign) for the emerging agent-skill/plugin ecosystem. Learned detectors hit 0.88–0.93 F1 in-distribution but drop to 0.65–0.67 under source-disjoint evaluation, exposing poor generalization of current scanners. Relevant as agent skill marketplaces (Claude Skills and similar) become a fast-growing supply-chain attack surface.

An anonymous stealth model called Ox Alpha appeared on OpenRouter and OpenCode on Aug 20 — the fifth such stealth release in six months — built for coding and sustained agentic work with a 1M-token context window and free preview access. On Aug 22, researchers found serving-layer forensic evidence (Java stack traces, matching error codes, tokenizer probe matches) pointing to Zhipu AI/Z.ai as the operator, likely an unreleased GLM variant. By Aug 23 it had processed ~12 trillion tokens across 180,000 users on OpenCode.

OpenAI cut developer/API pricing for its frontier GPT-5.6 Sol model from $5/$30 to $4/$20 per million input/output tokens, a cut of more than 20%, promotional through at least November 21. The cut flows through to ChatGPT Work and Codex credits and is widely read as a competitive response to Anthropic and fast-moving Chinese labs (DeepSeek, Alibaba, Z.ai), following a July 30 cut to cheaper tiers.

GitHub's Copilot desktop app v1.1.12 patches a security bug where tool-approval prompts requested by a hook could be silently skipped instead of always requiring explicit user approval, meaning a malicious or misconfigured hook could get tool execution approved without genuine consent. The release also adds `/ask` and `/btw` commands and PR-status sync fixes — directly relevant to agentic-coding-tool security since it closes an approval-bypass path in an agent-native desktop app.

Claude Code v2.1.238 tightens MCP/plugin trust boundaries: a plugin marketplace's `headersHelper` (which mints HTTP headers/tokens for fetches) now requires the folder's trust dialog to have been accepted even under `claude -p`, and helper scripts now run without inherited credential environment variables to prevent credential leakage into helper processes. Also fixes MCP elicitation dialogs failing for URLs over 4,096 characters and adds egress-proxy authentication flags for self-hosted runners.

Firecrawl launched a specialized semantic-search index of 70M+ developer artifacts (READMEs, docs, issues, PRs, OpenAPI specs), refreshed daily and purpose-built for coding agents to look up current API/library info instead of relying on stale training data. Alongside it they open-sourced DevDex, a benchmark of 1,179 real developer-search queries; the Developer Index scored 0.63 Recall@10 versus 0.45 for general web search and 0.57/0.54 for competitors Parallel and Exa.

Nvidia struck a non-exclusive $6B licensing deal for Poolside's "Model Factory" platform (used to build its Laguna coding models), plus a separate $1B investment at a $12B pre-money valuation. Nvidia will extend job offers to roughly 109 Poolside employees, though Poolside's three co-founders remain and the company continues operating independently — not a formal acquisition.