Newsletter
Claude wrote a root exploit for a Linux kernel bug. Ubuntu's LTS kernels still aren't fixed.
Anthropic says Claude wrote a remote root exploit for a Linux kernel bug. Twenty-three days after the CVE, only Ubuntu 26.10 has a fix. Also a correction: LiteLLM's breach started with a key left valid for four months, not gateway logs.
Weekly analysis of the threats, vulnerabilities, and defensive innovations shaping AI security. Written for security engineers and CTOs who need signal, not hype.
Recent Issues
Claude wrote a root exploit for a Linux kernel bug. Ubuntu's LTS kernels still aren't fixed.
Anthropic says Claude wrote a remote root exploit for a Linux kernel bug. Twenty-three days after the CVE, only Ubuntu 26.10 has a fix. Also a correction: Li...
LiteLLM's logs held the token that backdoored LiteLLM.
LiteLLM 1.107.0 stole cloud keys and coding-agent logins for 104 minutes on PyPI, and LiteLLM traces the break-in to tokens in its own gateway logs. The same...
Claude was told five things never to do. It did a sixth.
Anthropic's agents sent a false tip to a police department because the instructions never ruled out form submissions. It took 72 days to notice. This week th...
The VM held. The agents left through DNS.
Anthropic, Google and OpenAI all disclosed agents reaching systems they were walled off from. Perplexity then attacked its own sandbox with nine models: zero...
A human approved a transfer of 20. The framework sent 2,000.
Human approval only counts if the thing you approved is the thing that runs. In two popular agent frameworks it isn't. Also: an attacker hacking retailers wi...
MCP deleted the session, and the session was doing your access checks
If a tool takes a cart ID or a workflow ID, anyone holding that ID can use it unless your code checks who is calling. The spec now says holding a handle MUST...
A quarter of the talks at MCPCon Europe were about security. Not one said the fix was a better prompt.
Zalando built an identity broker for its agents, open sourced it, and runs it in production, so agent identity is now a solved and shipping problem. Memory p...
Read-only holds. Four other things do not.
The failure nobody plans for is attribution. Every action arrives as one service account, and the audit log cannot tell you which agent did what.
Earlier Issues
- The evaluation environment is the least-monitored production system in the chain. Sep 06, 2026
- The best published agent detection rate is 67%. The sensor that buys it reads everything. Aug 22, 2026
- An attacker published their agent config. It is your control list, inverted. Aug 18, 2026
- Read-only held for the entire intrusion. The agent still walked out with a map of the estate. Aug 04, 2026
- An attacker ran an agent in YOLO mode against a finance ministry. It's the same toggle your developers use. Jul 28, 2026
- OpenAI's model breached Hugging Face to win a benchmark Jul 24, 2026
- 466 million lines reviewed in 20 hours. Both offense and defense just went machine-tempo. Jul 16, 2026
- One polite word bypassed the guardrails. The private repos leaked anyway. Jul 13, 2026
- On July 28, MCP changes shape Jul 04, 2026
- Your agents have no idea who they are. Attackers are counting on it. Jun 27, 2026
- I let an agent rewrite my code while I slept. The scary part wasn't the bill. Jun 20, 2026
- One character in a header bypasses auth on millions of AI servers. Jun 06, 2026
- Your coding agent's approval prompt is lying to you. Jun 04, 2026
- Six governments agree: your AI security model was built for the wrong problem. May 31, 2026
- Claude Mythos, SAFE-MCP, MCPShield: the week the research caught up with the threat. May 20, 2026
- MCP servers just tripled. Here's the full attack map. May 09, 2026
- No caller auth on most MCP servers. CVE-2026-35616 actively exploited. The checklist that closes both gaps. Apr 29, 2026
- 8 agent exploits in Q1. 200,000 vulnerable MCP servers. Anthropic won't fix the protocol. Apr 22, 2026
- Closed Agent Harness = threat model blind spot Mar 30, 2026
- 97% expect an AI agent breach this year Apr 08, 2026
- Trivy compromised. LiteLLM backdoored. Your CI pipeline is the new attack surface. Mar 31, 2026
- 28 out of 30 agent projects. Zero per-agent identity. Zero revocation. Mar 24, 2026
- Three attack papers dropped this week. All point to the same architectural flaw. Mar 16, 2026
- I Red-Teamed My Own Agent Stack, PleaseFix Hijacks Browsers Through Calendar Invites Mar 09, 2026
- Claude Code Supply Chain RCE, AI-Powered FortiGate Blitz, Infostealers Now Harvest AI Agent Souls Mar 02, 2026
- DockerDash MCP Takeover, vLLM CVSS 9.8 RCE, Cisco State of AI Security 2026 Feb 23, 2026
newsletter.aminrj.com
Subscribe to AI Security Intelligence Digest
Weekly analysis of AI security threats, vulnerabilities, and defensive innovations — delivered to your inbox.
Subscribe — it's free