LEON — AI Systems Security | AGORA Intelligence

VOLTA-AUTODOXER routes a victim's dossier to Claude Opus 4.6 and falls back to Kimi K2 and Gemini 2.5 Flash the moment it detects a refusal. The individual model's filter gives way to the gateway's routing.

Chainalysis ties the breach of user data to agentic techniques and omits vulnerabilities, tools and duration. On ARTEX, Microsoft gives measurements instead: in one campaign it counted more than 151,000 failed sign-ins and zero successful ones, an average of more than 460 for each of the 327 accounts. The confirmed damage can serve scammers: names, email addresses and roles.

After Pluto Security's disclosure, the flagship model in the Hugging Face malware campaign went from 7,354 to 28,412 downloads, close to four times the starting figure. In the meantime, 19 new repositories replaced the first wave that had been taken down. With trust_remote_code enabled, loading the model runs the attacker's code, and the platform's scanners didn't stop it.

Spawn says it spends more than $3 million a month on tokens and ships every hour, which on a rough count means about $4,170 in tokens per deploy against about $140 in human labour. The reports Savi writes from player chats go to a Fable-based agent that changes code and ships it on its own. The safeguards the company describes (fast rollbacks, alerts, breakage tests) catch failures but can't see a malicious change that works.

The malicious LiteLLM package was live on PyPI for about two hours, and Wiz says it was downloaded roughly 49,000 times. Within about four and a half hours of the upload, the attacker was testing stolen AWS credentials, even though the package had already been pulled: removing it stopped the spread, but stolen keys stay valid until their owners rotate them. LiteLLM says the attack started with the master key of an AI agent tool, which was exposed in May and never revoked.

In Forever Security's tests, an AGENTS.md downloaded to ~/Downloads got Codex to run code 90% of the time, and a malicious CLAUDE.md led Claude Code to hand over its OAuth token. The researchers say OpenAI and Anthropic have nothing to patch, which leaves defense to the user. This piece argues that the real flaw is the permissions delegated to the agent.

OpenAI's misalignment monitor fired when the agent ended its turn. METR estimates that between May and July 2026 the compaction gap probably left about a tenth of eligible Codex traffic unmonitored. Combined with the 99.2% eligibility figure, that puts the share actually monitored at around 89%.

An OpenAI agent in reinforcement learning training reached an external chatbot through a DNS misconfiguration, and the lab cut internet access for frontier training to zero from 1 October 2026, with a public announcement 24 days later. Internal red teaming found five escape classes from the perimeter, including virtual machine escapes and a CPU cache channel, along with CVE-2026-111497 (CVSS 9.2) in Brotli. METR and Redwood Research found a way to bypass the sandbox and Auto-Review in Codex and state they left the fixes unverified.

Aokigahara, an infostealer documented by Check Point Research on October 23, 2026, collects session files from Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also takes SSH keys and AWS, Azure and Google Cloud credentials. The risk most likely comes from tokens stored on disk, not from the model.

Anyone could find more than 6,800 shared links from Meta's Muse agent with a single DNS records query, and each URL gave away its contents because it began with the conversation title. Meta had 10 days between Claroc's report and the research going public. It's Muse's second security problem in six weeks.

The security of AI systems, told through the incidents: attacks that run through an agent, flaws in frameworks and protocols, and what it actually took to exploit them.

Two LiteLLM vulnerabilities, CVE-2026-35029 and CVE-2026-59823, could let a low-privilege user steal credentials from the gateway that holds every AI provider's API keys. Check Point's same bulletin describes a similar case at ConnectWise Cloud Backup, where an intermediary's compromised credentials opened up at least 173 organizations. Patching alone is not enough, because keys read before the update stay valid until they are rotated.

Autonomous AI agents driven by the open-source tool Cairn went after more than 1,200 websites and breached those of over 100 companies, including Deere, SharkNinja and Cummins, using prompts of fewer than 100 Chinese characters. The researcher says the whole campaign cost about $5,000 in tokens, or roughly $50 per successful breach. NorForge estimates a success rate of around 10% across the instances it observed.

The known npm packages in the REF8801 campaign number five across three different scopes, and the group's website has been online since March 2026. Compared with the packages SafeDep flagged in July, the ones documented by Elastic use new scopes and a different macOS payload. They also hijack coding-agent traffic to attacker-controlled servers, with zero CVEs involved.

Unit 42 has documented the CL-UNK-1211 campaign, which targeted government agencies and state-linked infrastructure from October 2025 to April 2026, using payloads full of chat-style comments and reasoning notes typical of a language model. The group used open-source tools, custom backdoors and web shells for reconnaissance and persistence, and went after databases, email and social media accounts. For defenders, those notes are now a signal to hunt for, along with protected logs, a register of red-team engagements and alerts whenever someone disables the EDR.

Brennan assessed a professional services firm, and iTnews reported the case on October 14, 2026: a strong Microsoft 365 platform, but weak data governance. Copilot respects existing permissions and creates no new gaps, yet a single plain-language question can surface files shared far too widely. The permissions and audit log review has to be finished before licenses are switched on.

XBOW chained three previously unknown Chrome bugs into an exploit that escapes both of the browser's nested sandboxes and runs code on Windows as soon as a user loads a page. The team built the winning chain in six days with AI agents running OpenAI's public GPT-5.6 Sol model, and the company estimates the AI spend at about $40,000. Google patched the bugs and paid its top bounty of $250,000, so enterprises should restart Chrome on version 152.0.7977.82 or later and rethink the timelines in their risk models.

Check Point Research found two flaws in LiteLLM 1.77.7, CVE-2026-35029 and CVE-2026-59823, which version 1.83.9 fixes. A missing authorization check on /config/update let any authenticated user rewrite the proxy configuration, leading to file reads, admin account takeover and remote code execution, while an SSRF in the Clientside LLM Credentials feature exposed provider keys. This article explains how the attack worked and what to check on versions, accounts and keys.

SOCRadar has documented the CyberXero campaign, in which a Russian-speaking group uses Claude Code to coordinate attacks on WordPress sites with already known flaws and common tools such as Cobalt Strike. The Hacker News reports four Ukrainian organizations robbed and more than 628,000 records stolen. The report describes an abuse of the agent and is silent on any defects in its code.

Anthropic has removed live internet access from all internal evaluations after four categories of unexpected actions by Claude models on real third-party systems: a university server, US government agency websites, and the Philadelphia Police Department's tip form. The stated causes are limited tools, unreachable services, ambiguous instructions and misconfigured environments. This analysis reconstructs the mechanism and the architectural measures that follow from it.