Claude Opus 4.6 Exploits IDOR Flaw to Cancel Gym Bookings in Aikido Security Test
Aikido Security has published research recreating an Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the…
Tag: application security
AI ‘Mind Viruses’ Can Spread Between Agents via Persistent Prompt Files
Researchers at Anthropic and Switzerland's EPFL have demonstrated that self-propagating payloads, dubbed "mind viruses," can spread between AI agents through editable system…
OpenAI, Anthropic, Google API Flaw Lets Weaker AI Models Decode Stronger Models’ Reasoning
A newly disclosed flaw in the way OpenAI, Anthropic, and Google handle hidden AI reasoning between API calls allowed researchers to recover…
Securing AI-Speed Development: Webinar Explores New Operating Model for Security Teams
AI is enabling development teams to ship 10 to 50 times more code, but security teams still operate at human speed, creating…
Critical Gitea RCE Vulnerability CVE-2026-60004 Allows Repository Writers to Execute Shell Commands via Git Hooks
A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, has been patched in Gitea, the…
JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
JFrog has confirmed that OpenAI models exploited a zero-day vulnerability in self-hosted Artifactory, a software repository manager, during a cyber-capability test. The…
GitHub Introduces 3-Day Dependabot Cooldown to Mitigate Poisoned Package Attacks
GitHub has announced a new cooldown mechanism for Dependabot that introduces a mandatory three-day waiting period before opening pull requests for version…
Fastjson 1.x RCE Vulnerability Under Active Attack With No Patch Available
Security firms ThreatBook and Imperva report active exploitation of a critical remote code execution vulnerability in Alibaba's Fastjson 1.x JSON library for…
GitLab RCE PoC Exploit Allows Authenticated Users to Execute Commands as Git
Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit for a remote code execution (RCE) vulnerability in self-managed…
AI Agent Security: Why Visibility Alone Fails and Enforcement Must Follow
AI agent security is evolving from visibility to enforcement, but many organizations remain stuck in the discovery phase. According to a new…