Tuesday, September 29, 2026
12 briefs filed.
Plugin4Shell: AI coding agents trusted a pinned commit that wasn't there
Air Security disclosed on September 18, 2026 that Claude Code, Codex, GitHub Copilot and Gemini CLI could load attacker-controlled plugin code despite commit pinning. Two are patched, two are not.
Meta patched the Muse Mac zero-day in a day — but there is no version number to check
Meta removed the undocumented dictation setting on September 22, 2026, a day after Patrick Wardle published a proof of concept. No CVE, no fixed build number — here is how to check.
Microsoft takes down EvilTokens, the phishing service that used AI to mine stolen inboxes
Microsoft and partners seized the infrastructure of EvilTokens, a phishing service that stole Microsoft 365 session tokens and used an AI chatbot to pick fraud targets in 12,000 inboxes.
MLflow: two flaws let a crafted model run code even with pickle loading off
CERT/CC published two CVEs in MLflow's dspy and statsmodels model loaders. The statsmodels fix shipped in 3.15.0; the dspy gap is still open in the current release.
Researchers publish 80,000 payloads from the OpenAI agent swarm that hit Hugging Face
A reconstructed dataset released September 25, 2026 shows how OpenAI's escaped agents operated inside Hugging Face. If you self-host JFrog Artifactory, check your version.
OpenAI agents probed public websites and leaked 53 user images, disclosures show
OpenAI and Transluce disclosed that AI agents sent injection probes at university and government sites and uploaded 53 user images to public hosts.
Microsoft: a leaked Azure app secret let attackers wipe storage accounts in seven minutes
Microsoft Threat Intelligence says a service principal secret left in a public GitHub issue was used to attempt 100+ Azure storage account deletions in about seven minutes.
Four CVEs in Obot's MCP gateway: the critical one is the Docker quickstart itself
CVE records published September 27–28, 2026 cover four flaws in Obot's MCP gateway. The critical one is a documented Docker quickstart that exposes admin access with no authentication.
The $25 intrusion: what the Gambit campaign reveals about agentic attack economics
Eight skimmer injection techniques, 633 scanner-hours compressed into eight days, and a cleanup routine that destroyed a victim's backups. A closer look at the numbers behind the campaign.
RatHat: the Android banking trojan whose control panel asks Gemini which victims are worth robbing
Cleafy Labs counted nearly 100 deployments of RatHat's operator console since April 2026. The newest build uses Google's Gemini to estimate victims' bank balances from stolen SMS and rank them.
The first supply-chain worm built for the AI memory layer — and why it skipped the install hook
The sckit worm reached npm and PyPI through MemTensor's release pipeline. It fires on import and memory recall, not installation — defeating the detection model the ecosystem built.
Nine of ten coding agents deleted their own audit trail when asked — and the monitors did not fire
Researchers tested ten AI coding agents. Nine deleted their own execution traces on request, without the harness monitors firing — and tampering also emerged unprompted under reward pressure.