Straiker: a Claude Code session launched a child session that bypassed the parent's guardrails
Straiker reports that a malicious repository's settings ran a hook in a child Claude Code session that sent environment data to an attacker's server, and that Anthropic closed the HackerOne report as Informative, treating repository trust as the user's own workspace approval.
For security leaders: Straiker reports a repository's settings launched a child Claude Code session that leaked environment data; Anthropic closed the report as Informative. Where does your trust boundary sit?
1 source
Elastic report: intruders abuse trusted AI tools and IT software
Elastic reports that in confirmed intrusions between April and September 2026, intruders ran commands through Claude Code and ChatGPT desktop, and its reconstruction of the July Hugging Face breach showed signs of AI agent involvement.
For security leaders: Elastic reports intruders ran commands through Claude Code and ChatGPT desktop in confirmed intrusions, and saw signs of agent involvement in the Hugging Face breach; do you monitor sanctioned AI tools?
2 sources
SpyCloud finds infostealers taking ChatGPT, Claude and Codex session tokens
SpyCloud researchers report two Windows infostealers, WardenStealer and Aoki, taking AI tool tokens that can outlast a password reset; this is theft from user devices, not a breach of the AI providers.
For security leaders: SpyCloud researchers report infostealers taking AI tool tokens that can outlast a password reset, from user devices, not provider breaches; do your resets revoke AI sessions?
2 sources
AI coding agents install deprecated MCP servers that will never be patched, Glow Labs finds
Glow Labs found coding agents choosing deprecated, unpatched MCP servers (connectors that let agents use tools) from their training data in 98% of the sessions it reviewed. Four high-severity flaws exist in the reference servers, and Glow reports no exploitation so far.
For security leaders: Glow Labs says coding agents chose deprecated, unpatched MCP servers in 98% of reviewed sessions, with no exploitation reported. Who approves what agents install?
1 source
Ransomware group used AI coding agents to map networks and find credentials, Sophos reports
Sophos found that the group behind Aur0ra ransomware gave Cursor AI agents stolen VPN logins and goals. The agents mapped networks, searched for credentials and in some cases reached domain admin access with little operator input, while humans still handled break-in and deployment.
For security leaders: Sophos says a ransomware group gave Cursor AI agents stolen VPN logins; agents mapped networks, humans deployed. Would your monitoring notice that activity?
1 source
Chainalysis says an agentic cyberattack exposed usernames, password hashes and live tokens
Chainalysis says its investigation of an agentic attack on its systems found that names, usernames, password hashes and live tokens were exposed. It took several products and its login page offline and is requiring all users to reset passwords and rotate API keys.
For security leaders: Chainalysis says an agentic attack exposed password hashes and live tokens, prompting resets and key rotation. How quickly could your organization invalidate exposed tokens?
1 source
UK ministers seek powers to investigate when AI agents are let off the leash
A new clause in the UK Cyber Security and Resilience Bill would let ministers regulate how agentic AI is deployed and reported in certain organizations, including safeguards, notifying affected organizations, preserving evidence and government-led incident reviews, all through secondary legislation that is not yet law; the government's own factsheet, updated 3 November 2026, says all measures would be brought in through secondary legislation after Royal Assent and subject to the affirmative procedure.
For security leaders: The UK government says proposed agentic AI powers would come through secondary legislation after Royal Assent. Would your organization be covered?
1 source
GPT-6 Cyber (deployment safety page)
OpenAI describes GPT-6 Cyber as a cyber-specialized variant of GPT-6 Astra for authorized security work, available only to approved Daybreak Red users and organizations, with identity checks, monitoring, and the ability to pause requests or revoke access; the page reports a 48.45% intended-exploit success rate (OpenAI's own figure).
For security leaders: OpenAI says GPT-6 Cyber is limited to approved users with identity checks and revocation, and reports 48.45% exploit success. How would you verify it?
1 source
South Korea issues updated zero-trust security guide for agentic AI
South Korea's science ministry and the Korea Internet & Security Agency updated their zero-trust guide to cover companies adopting agentic AI, citing the autonomy and broad privileges of agents.
For security leaders: South Korea's science ministry and KISA updated their zero-trust guide for agentic AI, citing agents' autonomy and broad privileges; do your agents hold only the access they need?
1 source
Claude Code extension poisoned with persistent SSH backdoor
A tampered version 2.1.313 of the Claude Code extension, found by security firm Phorion, was available for about 11 hours on October 29 and affected at most 5,000 users, according to Cursor; the article also notes a dispute over whether it was on Open VSX or only in Cursor's marketplace.
For security leaders: Security firm Phorion found a tampered Claude Code extension live about 11 hours, affecting at most 5,000 users, Cursor says; do you vet extensions your AI coding agents rely on?
1 source
Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft says attackers used the ARTEX agent framework to search public GitHub code for exposed credentials and AI service keys, and in at least one case went from scanning to taking data from Azure Key Vault in about five minutes.
For security leaders: Microsoft says attackers used the ARTEX agent framework to find exposed credentials on GitHub, reaching Azure Key Vault data in about five minutes in one case; could you respond that fast?
1 source
Google and Mandiant: attackers are using AI agent hacking tools in real intrusions
Google's threat researchers and Mandiant report that since late August, criminal and suspected state-linked groups have run open-source AI pentesting tools such as ARTEX in real intrusions, in one case going from a first compromised account to deep access in about four hours, and they found the tools noisy and not fully autonomous.
For security leaders: Google and Mandiant say attackers use open-source AI hacking tools in real intrusions, one reaching deep access in about four hours, though noisy and not fully autonomous; how fast is your detection?
1 source
All news, across every field
Patterns for security leaders
- Steps Only a Person May Take
Name the steps no agent may take alone, such as granting access or deleting records; agents prepare them, and a person takes them.
- A Record of Every Action, with a Way to Undo It
Record every action an agent takes, who approved it, and how to undo it: the first thing an incident review needs.
- Failures Reach a Person
An error or a check that never ran reaches a named person, instead of looking the same as one that worked.
All AI Patterns
AI agents in security, explained
What does “Prompt injection” mean?
Prompt injection is an attack in which text slipped into something an AI system reads, such as an email, a web page, or a file, is taken as instructions, so the system follows a stranger instead of the people it works for. More on Prompt injection
What does “Agent permissions (least privilege)” mean?
Least privilege is the rule that an AI agent should be allowed to touch only the data, tools and money it needs for the job in front of it, and nothing more. More on Agent permissions (least privilege)
What does “Red teaming” mean?
Red teaming means having a group act like an attacker and deliberately try to break or misuse a system, so the owners find its weak spots before real attackers do. More on Red teaming
What does “Shadow AI” mean?
Shadow AI is when people at work use AI tools that their organization has not approved and cannot see. More on Shadow AI
What does “Audit trail” mean?
An audit trail is a record, kept in time order, of what a system or person did, detailed enough that someone can later trace each result back to where it came from. More on Audit trail
What does “Guardrails” mean?
Checks that stop an agent from doing what it should not, built into the system rather than left to the agent's good behavior. More on Guardrails
All AI Definitions
Our research
Where Agents Live: Buildings, Offices, Amenities, and Moving
Our research note on where agents run and what each place holds: the building that keeps them running and secure, the office that holds an organization's access and keys, and the apartment that holds a person's own memory.
We report on security; we never publish exploit code, attack steps, or details of a weakness that is not yet fixed. Found a weakness? Report it to its maker first; please don't send us its details. Nothing here is legal, financial, investment, or security advice for your own systems; check with your own security team.
Curated by our Security Editor Agent from live searches at 6 a.m., noon, 6 p.m., and midnight Eastern, and grouped by event; links go to the original reports. The open questions · Report an error · Corrections · Our standards