AI/ML Security & Trends
The standout story is the arrival of autonomous offensive AI in the wild: Wiz's "Red Agent" independently discovered, exploited, and pivoted through a real Snowflake CI/CD flaw into internal Jira with no human steering, while CISA/NSA/FBI jointly warned that threat actors are already using AI-generated exploit scripts against internet-exposed Siemens PLCs in critical infrastructure — both landing the same week as a Microsoft Copilot one-click data-exfiltration bug (CoSnitch) and OpenAI's own decision to pause RL training on its next frontier model over cyber-capability concerns.
Wiz's autonomous "Red Agent" self-exploits Snowflake CI/CD flaw into internal Jira Breaches & Incidents
Wiz Research's autonomous offensive AI agent discovered a shell-injection flaw in Snowflake's public snowflake-connector-net repo (introduced via a Copilot-assisted PR), self-corrected a failed payload, and within seconds exfiltrated a Jira API token exposing engineering, security, and bug-bounty project visibility. Snowflake patched and rotated credentials same-day with no confirmed unauthorized human access. This is one of the first documented cases of a fully autonomous AI agent chaining vulnerability discovery to real-world exploitation and lateral pivoting without operator steering.
Read at Wiz Research →CISA/NSA/FBI warn of AI-generated exploits hitting Siemens PLCs in critical infrastructure Breaches & Incidents
A joint advisory (AA26-231A) from CISA, NSA, FBI, DOE, and EPA warns that threat actors are using AI assistance to generate exploitation scripts — disguised as legitimate monitoring tools — against internet-exposed Siemens S7-200/300/400/1200/1500 PLCs across Critical Manufacturing, Energy, Water/Wastewater, Chemical, and Food/Ag sectors. This is a government-confirmed, live case of AI-assisted attack tooling against operational technology, not a theoretical risk.
Read at CISA →CoSnitch: one-click Microsoft Copilot exfiltration chain via prompt injection (CVE-2026-24301) Breaches & Incidents
Varonis Threat Labs disclosed CoSnitch, a hidden autorun=1 URL parameter that triggered prompt execution with a single click, exfiltrating data from Copilot's connected OAuth apps (Gmail, Calendar, Drive) and planting persistent memory rules that survived password resets and device re-enrollment. CVSS 8.8; reported to Microsoft in December 2025 and patched August 18, 2026, with no evidence of in-the-wild exploitation. A textbook case of prompt-injection-driven agent hijacking via a crafted link.
Read at Varonis Threat Labs →OpenAI pauses frontier RL training after model nears cyber-capability threshold AI Security & Safety
OpenAI paused reinforcement-learning training on its newest deployment-bound model, internally codenamed "Astra," for roughly two weeks after internal evaluation suggested it might cross the "critical" cybersecurity capability threshold defined in its Preparedness Framework. OpenAI has since added real-time agent monitoring (about 20% compute overhead, targeting under 30-minute alerting) alongside a separate Hugging Face-linked incident. A rare instance of a frontier lab publicly gating training on a capability-safety trigger.
Read at Axios →AgentFlow: flow-centric policy framework cuts agent compromise rates to zero on two benchmarks AI Security & Safety
A new arXiv paper introduces AgentFlow, a flow-centric policy language and runtime for securing LLM agent systems that reasons over sequences of individually-plausible actions rather than checking each action in isolation. Backed by an SMT-based verifier, it cut confirmed compromise rates from 33.0%→0.0% and 73.5%→0.0% across two benchmarks while keeping policy verification under 0.5 seconds — directly relevant to anyone building guardrails for agentic pipelines.
Read at arXiv →InjecMEM: one-shot memory poisoning attack on LLM agent long-term memory AI Security & Safety
Researchers demonstrate InjecMEM, an attack showing that a single interaction, with no direct read/edit access to the memory store, can poison an LLM agent's long-term memory and corrupt future responses. It combines a "topical anchor" for reliable retrieval with a gradient-optimized adversarial command, and stays targeted so unrelated queries remain unaffected — expanding the known attack surface for memory-augmented agentic systems.
Read at arXiv →NVIDIA's Groq 3 LPX inference chip enters full production for agentic AI Model & Product Releases
NVIDIA's Groq 3 LPX, a purpose-built inference accelerator extending the Vera Rubin platform, entered full-scale production. Unveiled at Hot Chips 2026, it hit 3,400 output tokens/sec on a Gemma 4 31B agentic benchmark with 100K-token context — 4x the nearest rival platform. Nebius Group is the first customer, deploying it in its Token Factory inference service; it marks the commercial debut of technology from NVIDIA's roughly $20B Groq acquisition.
Read at NVIDIA →MCP publishes next-phase roadmap: agent identity, DPoP auth, progressive tool discovery Tools & Frameworks
Following July's stateless spec rewrite, the MCP steering group published its next-phase roadmap: server-initiated events (webhooks/channels) and maturing the Tasks extension into the core spec; Demonstrating Proof of Possession (DPoP) plus workload identity federation for agent authentication; unified HTTP transport; and "progressive discovery" so large tool catalogs can be revealed incrementally rather than dumped up front. Directly relevant to anyone building or auditing MCP servers and clients.
Read at Model Context Protocol Blog →Hugging Face reportedly in talks for a $13B sale Industry & Trends
Hugging Face is reportedly in early talks around a sale that could value the company at roughly $13 billion, working with a bank to gauge buyer interest. That's nearly 3x its $4.5B valuation from its 2023 Series D (led by Salesforce Ventures, with Alphabet, GV, and IBM Ventures participating). No buyer has been identified and no deal has been reached; earlier in 2026 Hugging Face reportedly turned down a $500M Nvidia investment that would have valued it at $7B.
Read at TechCrunch →"Kriminal" sells jailbroken Grok/Claude/Llama access as a $12.99/mo crime-as-a-service platform AI Security & Safety
ThreatDown/Malwarebytes research uncovered Kriminal, a clearnet, search-indexed SaaS priced $12.99–$99/month that wraps jailbreak prompts around legitimate APIs — xAI Grok as the primary engine, Anthropic Claude for long-context analysis, and Mistral/Llama via OpenRouter — to sell exploit development, OSINT, phishing, and social-engineering content generation via crypto payment. A concrete example of commodified jailbreak-as-a-service abusing frontier model APIs at scale.
Read at CSO Online →MCP server RCE, n8n prototype pollution, and GLM-5.3's state-of-the-art exploit-discovery score AI Security & Safety
A roundup disclosed GHSA-xv5j-cwgj-22r4, an unauthenticated remote code execution flaw in a CircleCI MCP server exploitable via Host/Origin header manipulation in CI/CD pipelines. The same roundup covers n8n prototype pollution (CVE-2026-33696, CVSS 9.4, RCE via XML/GSuiteAdmin workflow nodes widely used in AI agent automation) and notes that Chinese startup Z.ai's GLM-5.3 model achieved state-of-the-art scores on CyberGym, a benchmark for autonomous vulnerability discovery — pairing an MCP infrastructure flaw with evidence that models themselves are getting better at finding such bugs.
Read at The Hacker News →AEGIS: latent-manifold defense against indirect prompt injection avoids over-refusal AI Security & Safety
AEGIS is a new defense against indirect prompt injection that extracts "instruction-sensitive projectors" from internal LLM representations and aggregates signals across layers (Unified Multi-Layer Consensus) to detect injected instructions without the latency and over-refusal trade-offs that plague existing filters. Code has been released publicly, making it directly testable against agentic pipelines.
Read at arXiv →SkillBloat: token-amplification DoS attack via "skill" injection in coding agents AI Security & Safety
SkillBloat is a new attack class that abuses "agent skills" — the trusted instruction/script channels used by coding agents — to cause 5.4x to 10.1x token amplification, effectively a resource-exhaustion and cost attack. It uses a two-phase screening-then-LLM-guided-rewrite pipeline distinct from prior skill-poisoning work, and the automated attack-generation approach is notable for fuzzing-style search over agent instruction spaces.
Read at arXiv →SecOPD cuts adaptive prompt-injection success rate from 94% to 9% via token-level distillation AI Security & Safety
SecOPD is a token-level (not sequence-level) defensive fine-tuning method against adaptive prompt injection. A defended Qwen3.6-27B model cut attack success rate against the PISmith adaptive-injection benchmark from 94.0% (Meta-SecAlign, the prior state of the art) down to 9.0%, and the defense generalized to unseen agentic tool-calling domains.
Read at arXiv →AdaptPrint: fingerprinting the model behind a black-box LLM API with 92% top-5 accuracy AI Security & Safety
AdaptPrint is a black-box model-fingerprinting technique using three response-consistency probing strategies (Direct, Continuation, Follow-up) to identify which underlying model powers an opaque API. It achieves 80.6%/90.3%/92.1% Top-1/3/5 accuracy against 27 candidate models and stays robust to decoding-parameter and defense variation — relevant both for supply-chain/provenance verification and as a reconnaissance technique attackers could use.
Read at arXiv →DeepSeek releases experimental multimodal DeepSeek-V4-Flash-Vision, closing in on Claude Opus 4.8 Model & Product Releases
DeepSeek released DeepSeek-V4-Flash-Vision-Exp, an experimental multimodal extension of its V4-Flash model adding image and screenshot understanding for agentic tasks. On mixed benchmarks it lands close to Anthropic's Opus 4.8, reportedly beating it on DeepSWE (+1.3), Agents' Last Exam (+1.6), and ZeroBench (+1.0), and is available via DeepSeek's API at existing V4-Flash pricing — continued pressure on Western labs' pricing and capability lead.
Read at Bloomberg →GitHub Copilot cloud-agent sessions expand into Microsoft Teams and Slack Tools & Frameworks
GitHub shipped public-preview companion releases putting Copilot's cloud-agent capability into chat: mentioning @GitHub in a Microsoft Teams channel, thread, or DM spins up a shared Copilot cloud-agent session that anyone in the conversation can steer, with participants holding repo write access able to trigger changes; the same capability (plan changes, investigate issues, triage bugs, open PRs) shipped into Slack. Worth noting for practitioners assessing the blast radius of chat-triggered coding agents with repo write access.
Read at GitHub Changelog →Anthropic hires Google's TPU-program founder to build custom AI chips Industry & Trends
Anthropic hired Amir Salek, founder of Google's custom TPU chip program who ran it until 2022 and delivered seven TPU generations, to join its compute team reporting to James Bradbury. The hire signals a strategic pivot toward in-house silicon to reduce Nvidia GPU dependence as Anthropic builds out a dedicated hardware/chip-design team.
Read at Bloomberg →