Vulnerabilities

CVEs, exploits, and security flaws in AI frameworks, models, and infrastructure.

Jun 4, 2026 4 min read

Claude Code Action Prompt Injection Flaw

A flawed permission check in Anthropic's Claude Code GitHub Action allowed attackers to use prompt injection via a crafted issue to steal CI/CD secrets. Patched in v1.0.94.

img of Malicious AI Models: Supply Chain Threat

Jun 4, 2026 7 min read

Vulnerabilities

Malicious AI Models: Supply Chain Threat

Hundreds of backdoored and malware-laced models have been found in public AI registries. Covers pickle RCE, activation-trigger backdoors, and enterprise controls for model intake.

img of Gemini Hijacked via Android Notifications

Jun 3, 2026 3 min read

Vulnerabilities

Gemini Hijacked via Android Notifications

SafeBreach Labs documented a prompt injection attack hiding malicious commands inside WhatsApp, Slack, or SMS notifications. Gemini treats hostile text as trusted. Patched Nov 2025.

img of RAG Security: Attack Surface for AI Teams

May 27, 2026 7 min read

Vulnerabilities

RAG Security: Attack Surface for AI Teams

RAG pipelines introduce document poisoning, indirect prompt injection via retrieved content, and semantic access control gaps that most security teams have not assessed.

img of LLM Plugin Prompt Injection Risks

May 23, 2026 4 min read

Vulnerabilities

LLM Plugin Prompt Injection Risks

Threat actors embed prompt injection payloads in third-party LLM plugins and data sources to hijack AI agent actions, exfiltrate data, and pivot within enterprise environments.