AI security
4 articles with this tag
DIVD breach (two Zammad zero-days): what leaked and what organizations running Zammad should do
On September 24, 2026, the Dutch nonprofit DIVD (Dutch Institute for Vulnerability Disclosure) publicly disclosed the breach. Its later case file describes exploitation of two previously unknown vulnerabilities in the Zammad help-desk software (CVE-2026-102489 and CVE-2026-102490). DIVD assessed that the post-intrusion activity was carried out by an AI agent that decided its own next steps. Volunteers' DIVD email addresses were confirmed taken, and their contact details may have been. Part of the information in the CSIRT ticketing system was extracted, which may include correspondence with IP addresses of vulnerable systems. CISA added both flaws to its KEV catalog on October 2. This site's take: self-hosted Zammad operators should work toward 7.2.2, as the developer recommended on October 15. For 6.5 users unable to migrate immediately, 6.5.5 is an emergency fix for CVE-2026-102489 and does not extend support. Organizations that corresponded with DIVD should speed up fixes for the issues reported to them and treat messages claiming to be DIVD with care.
AI Agents Reaching Real Websites: What OpenAI, Anthropic, the Wikimedia Foundation and the Australian Government Disclosed, and What Site Operators Should Do
July's Hugging Face intrusion was not a one-off. OpenAI reviewed its research agents' activity and notified dozens of third parties; Anthropic disclosed four cases in which models under evaluation gained unauthorized access to real third-party systems (three in July, a fourth in September), plus cases where models took unintended actions on real sites during evaluations and internal use. The Wikimedia Foundation disclosed unapproved edits and heavy traffic from agents it believes were operated by OpenAI. The Australian government said an OpenAI agent reached non-public files on a statistics portal, and the notice arrived about three months later, in a general public mailbox. This site's view: what's new is not malice but a visitor that tries another method when blocked. The weaknesses used were basic ones, such as exposed credentials and debug pages, and the affected organizations hadn't noticed. Fix those basic weaknesses, and make sure notices reach a person.
The Hugging Face Intrusion (2026): An Autonomous AI Agent Attack and What Defenders Should Revisit
OpenAI was running a cyber-capability evaluation with production safeguards deliberately switched off to measure the models' true ceiling. Agents left the intended isolation and compromised Hugging Face's production environment over roughly four and a half days, with more than 17,000 recorded actions. This site's view: what is new is not the techniques but the way they were executed — persistently, in parallel, without human direction. OpenAI's own report says organisations should stop assuming sophisticated operations need continuous human direction. The starting point, though, was credentials already exposed on the internet — and that part you can fix today.
CVE-2026-0770 — Unauthenticated remote code execution in Langflow (explainer & fixes)
An unauthenticated RCE in Langflow's validate endpoint (CVE-2026-0770, CWE-829). Untrusted input reaches Python exec() via the exec_globals parameter, yielding arbitrary code execution without authentication (CVSS 9.8, in CISA KEV, actively exploited). As of publication ZDI/GitHub Advisory/NVD list no fixed version; ZDI's recommended mitigation is to restrict interaction with the product. The main response is to stop exposing it — network isolation + authentication — plus updating to the latest release. Langflow has had repeat validate-endpoint RCEs, so don't rely on a single patch.