The Hacker News

Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command ...
InfoWorld

GitHub’s public APIs are becoming an enterprise reconnaissance tool

Researchers have uncovered a sustained campaign using GitHub's public APIs and ghost accounts to profile enterprise software ...
SecurityWeek

Accenture Confirms Data Breach After Hacker Claims Source Code Theft

Accenture confirmed a data breach after a hacker claimed to steal 35GB of internal data, including source code and ...
SecurityWeek

Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

A critical prompt injection vulnerability in GitHub Agentic Workflows could allow unauthenticated attackers to leak private repository data, ...

Hackers can use 9 of the most popular AI tools to assemble massive botnets

In the brief history of AI security, the prompt injection has quickly become the top threat. Large language models are ...
techtimes

GitHub Copilot CLI Adds Pre-Commit Security Scanner: LLM Inference at the Detection Layer

GitHub shipped /security-review — a dedicated slash command for GitHub Copilot CLI — on Wednesday, putting AI-driven vulnerability scanning inside the terminal for the first time as an experimental ...
decrypt

What Is an AI Prompt Injection Attack? The Hidden Threat Hijacking Your Chatbots

Add Decrypt as your preferred source to see more of our stories on Google. Prompt injection is the number one security risk for AI applications. The attack works by tricking a chatbot into following ...
techtimes

Ghost CMS SQL Injection Hits 700 Sites: Harvard, DuckDuckGo Serve Fake Cloudflare Malware

An unpatched SQL injection vulnerability in the Ghost content management system has been weaponized in an active, large-scale cyberattack that has compromised more than 700 websites worldwide — ...
The Hacker News

Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based ...
Microsoft

When prompts become shells: RCE vulnerabilities in AI agent frameworks

AI agents have fundamentally changed the threat model of AI model-based applications. By equipping these models with plugins (also called tools), your agents no longer just generate text; they now ...
Dark Reading

AI Finds 38 Security Flaws in Electronic Health Record Platform

An AI-powered analysis of the OpenEMR codebase uncovered 38 previously undisclosed vulnerabilities in the open source electronic health record (EHR) platform used by more than 100,000 healthcare ...
InfoQ

CodeGuardian: a Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...