Wednesday, November 11, 2026i10X News · Section desk103 stories
Section
AI Security
Incidents, vulnerabilities and attacks involving AI models, agents and tools — newest first, updated hourly.
FilterMoonshot AI
Filtered: Moonshot AI in AI Security · 2 storiesReset filter ×
Incident feed
Vulnerabilities, breaches and attacks involving AI models, agents and tools — newest first. Updated hourly.
URGENT: AI Codebase Tool Exposes Server Files
CVE-2026-77604: Path Traversal Vulnerability in Code Graph RAG MCP Server Allows Arbitrary File Read
ALERT: ChatCLI OAuth Flaw Enables Token Replay Attacks
CVE-2026-123271: ChatCLI OAuth Flaw Allows Token Theft via Malicious MCP Servers
CRITICAL: Unauthenticated RCE in AgentScope MCP API
CVE-2026-123022: AgentScope MCP Workspace Allows Unauthenticated Remote Code Execution
URGENT: Path Traversal Flaw Exposes Secrets in IBM Langflow OSS
CVE-2026-97677: Path Traversal Flaw in IBM Langflow OSS 1.0.0–1.12.2 Allows File Read/Write
DANGER: Unauthenticated Rails DoS Attack Vector
Active Support DoS Flaw Lets Unauthenticated Attackers Crash Rails Servers via Action Cable
CRITICAL: Development IDE Server Exposed to Network Attacks
CVE-2026-112136: Mendix Studio Pro MCP Server Exposed to Remote Network Attacks
URGENT: Symlink Flaw Enables File System Escape in AI Code Analysis Tool
CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root
URGENT: OAuth Token Theft Flaw in mcp-go Client Library
CVE-2026-123272: Token Theft Vulnerability in mcp-go OAuth Client Allows Malicious Servers to Obtain Credentials for Other Resources
CRITICAL: Agent Hijacking via MCP Tool Injection
CVE-2026-54140: OpenHuman MCP Tool Description Injection Allows Silent Agent Hijacking
DANGER: Single Malformed Request Crashes Particle Animation Server
CVE-2026-76892: Malformed JSON Crashes tsParticles MCP Server, Causing Denial of Service
URGENT: OpenAI Patches Code Execution Flaw in Codex Desktop
CVE-2026-110930: OpenAI Codex Desktop for Windows Vulnerable to Code Execution via Malicious Library Paths
URGENT: Nvidia Espionage Scandal Exposes AI Infrastructure Risks
Nvidia Espionage Scandal Exposes AI Infrastructure Risks
URGENT: Microsoft MCP Gateway had an 8.8 auth bypass
Microsoft MCP Gateway CVE-2026-109492: A Name Collision Let One User Reach Another’s Workloads
ALERT: Copilot for JetBrains had a local command-injection leak
GitHub Copilot for JetBrains: CVE-2026-83953 Command Injection Leaks Local Data
ALERT: Study: AI Agent Swarms Still Break Gemini’s Prompt Injection Defenses
Study: AI Agent Swarms Still Break Gemini’s Prompt Injection Defenses
ALERT: Claude Code Feature Leaks Developer Secrets to GitHub
Claude Code Feature Leaks Developer Secrets to GitHub
ALERT: Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says
Claude Code Settings File Leaked Secrets to 1,122 Public GitHub Repos, Apiiro Says
ALERT: Amazon Study: Prompt Injection Defenses Miss Task Tampering
Amazon Study: Prompt Injection Defenses Miss Task Tampering
URGENT: An AI agent stole Key Vault secrets in five minutes
Microsoft: An ARTEX Agent Went From GitHub Secrets to Azure Key Vault in Five Minutes
URGENT: ChatGPT Lockdown Mode was bypassed — OpenAI has patched it
Check Point: A ChatGPT Lockdown Mode Bypass Allowed Silent Chat Exfiltration
URGENT: Mistral Vibe ran repo commands before you could say no
Mistral Vibe CVE-2026-122135: A Crafted Repo Ran Code Before the Trust Prompt
URGENT: Hugging Face’s Reachy Mini robot had unauthenticated root RCE
Reachy Mini CVE-2026-96455: One HTTP Request Ran Code as Root on Hugging Face’s Robot
URGENT: GitBook was breached by an AI-driven attack — rotate tokens
GitBook: An AI-Agent Attack Reached Infrastructure Credentials and Forced a 16-Hour Outage
· RSS