All Articles

A three-flaw chain in Microsoft AutoGen Studio's MCP WebSocket surface lets a malicious webpage execute arbitrary commands on the host via an AI browsing agent. Microsoft patched in June 2026.

A sandbox bypass in Cursor's agentic mode lets attackers poison shell environment variables through implicitly trusted built-ins, converting approved commands like git branch or python3 into arbitrary code execution.

Georgia Tech's Vibe Security Radar tracked 35 CVEs in March 2026 alone attributable to AI-generated code, more than all of 2025 combined. The Cloud Security Alliance's research series documents credential sprawl, governance gaps, and a structural security debt building inside the open-source ecosystem.

Six intelligence agencies from five nations jointly warn that frontier AI will transform offensive cyber capabilities within months, urging board-level action on foundational security controls now.

Google's Mandiant M-Trends 2026 report documents the first confirmed AI-generated zero-day exploit blocked in production, adversaries achieving exploitation seven days before patches ship, and industrial-scale LLM use in offensive operations.