CISA flags Apache ActiveMQ flaw as actively exploited in attacks

CISA warned that attackers are now exploiting a high-severity Apache ActiveMQ vulnerability, which was patched earlier this ...
SecurityWeek

Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and GitHub Copilot Agent hacked via prompt injection ...

Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway.

Microsoft assigned CVE-2026-21520 to a Copilot Studio prompt injection vulnerability and patched it in January — but in ...
The Next Web

Anthropic, Google, and Microsoft paid AI agent bug bounties, then kept quiet about the flaws

Researchers hijacked Claude, Gemini, and Copilot AI agents via prompt injection to steal API keys and tokens. All three ...
Dark Reading

Microsoft, Salesforce Patch AI Agent Data Leak Flaws

Two recently fixed prompt injections in Salesforce Agentforce and Microsoft Copilot would have enabled an external attacker ...
InfoWorld

Claude Code is still vulnerable to an attack Anthropic has already fixed

Anthropic’s source code leak revealed a new way to get Claude Code to do things it doesn’t want to. The leak of Claude Code’s source is already having consequences for the tool’s security. Researchers ...
VentureBeat

Hackers slipped a trojan into the code library behind most of the internet. Your team is probably affected

Attackers stole a long-lived npm access token belonging to the lead maintainer of axios, the most popular HTTP client library in JavaScript, and used it to publish two poisoned versions that install a ...
Milwaukee Journal Sentinel

New CIS Report Warns Prompt Injection Attacks Pose Growing Risk to Generative AI

This report makes clear that technical prompt injections aren’t a theoretical problem, they’re a real and immediate risk.” — TJ Sayers, Senior Director of Threat Intelligence at CIS CLIFTON PARK, NY, ...
HHS

How Prompt Injection Attacks Undermine AI Guardrails

Large language models are inherently vulnerable to prompt injection attacks, and no amount of hardening will ever fully close that gap. The imbalance between available attacks and available ...
The New York Times

Iran’s Attacks Force U.S. Troops to Work Remotely

Iran has severely damaged several American military bases in the Middle East, officials say. By Helene Cooper and Eric Schmitt Reporting from Washington Iran has bombed U.S. bases across the Middle ...
TechCrunch

Anthropic hands Claude Code more control, but keeps it on a leash

For developers using AI, “vibe coding” right now comes down to babysitting every action or risking letting the model run unchecked. Anthropic says its latest update to Claude aims to eliminate that ...
InfoWorld

New ‘StoatWaffle’ malware auto‑executes attacks on developers

The newly observed malware abuses VS Code’s “runOn:folderOpen” feature to execute automatically from trusted projects, enabling near-frictionless compromise. A newly disclosed malware strain dubbed ...