667 raw items collected (296 news, 171 CVEs, 34 papers, 30 repos, 136 advisories) were distilled down to 42 final entries in the newsletter (7 news, 8 vulnerabilities, 13 advisories, 7 papers, 7 tools).
The question that governs security shifts from "who is allowed to access this system" to "what is this system allowed to decide" — a system can reach the wrong conclusion without ever being compromised.
Australia's Robodebt programme issued wrongful debt notices to hundreds of thousands of citizens with no cyberattack, no stolen credentials and no breach of any kind: every access control held, and the conclusions were still wrong at scale.
Three tests gate every automated decision, joined by AND rather than scored — can we explain it, can we challenge it, can we audit it. Fail any one and uncertainty has been automated rather than removed.
The decision supply chain runs data → models → agents → action, each link with its own failure mode: a distorted map, prompt injection, unbounded tool use, an irreversible effect. The same error is a cheap correction at the data layer and an incident at the action layer.
An autonomous agent earns trust from its architecture, not its intelligence — provenance (reconstruct any decision within minutes), guardrails (what it is architecturally unable to do regardless of what it concludes), and continuous verification (when was this last shown to be right, not last approved).
AI agents wage near-autonomous cyberattack on Asian government networks (2026-08-13) — Threat actors have deployed autonomous AI agent clusters to conduct multi-stage reconnaissance, lateral movement, and data staging against regional government infrastructure with minimal human intervention. The incident marks a critical operational milestone in offensive AI, demonstrating that agentic tool-use capabilities are now mature enough to execute adaptive cyber operations at machine speed. Security teams must accelerate defenses against autonomous decision-making loops that outpace traditional detection-and-response windows. #Agent #Incident
Anthropic, OpenAI among firms facing new EU AI Act enforcement powers (2026-08-04) — The European Union has formally initiated the enforcement phase of the EU AI Act, granting the European AI Office direct supervisory and investigatory authority over providers of general-purpose AI (GPAI) models. Leading frontier labs face mandatory systemic risk assessments, cybersecurity audits, and strict incident-reporting protocols under threat of severe financial penalties. This regulatory shift establishes binding global compliance standards for model transparency, adversarial testing, and post-deployment monitoring. #Gov #Policy
Claude Opus 5 Cuts Indirect Prompt Injection Attack Success to 2% in New Benchmark Analysis (2026-08-10) — Independent evaluations by AI security firm Gray Swan demonstrated that Anthropic's Claude Opus 5 suppressed indirect prompt injection (IPI) attack success rates down to 2%, setting a new defense baseline for production models. The performance jump reflects major architectural hardening against adversarial data poisoning and hidden instruction overrides in untrusted inputs. While this represents significant progress against web-based and document-borne payload execution, edge-case jailbreaks remain a residual risk in complex multi-modal workflows. #Model #PromptInjection
Encrypted Prompt Injection Attack Extracts Grok Chat Data, Researchers Say (2026-08-20) — Security researchers at Adversa AI have disclosed a novel attack vector dubbed "Cryptographic Prompt Injection," demonstrating that encrypted and encoded payloads can bypass LLM safety guardrails to exfiltrate private conversation data from systems like Grok. The attack exploits vulnerabilities in how deep learning models interpret and decode obfuscated inputs before safety classifiers evaluate their semantic intent. This technique highlights critical blind spots in runtime content moderation, underscoring the need for layered input sanitization and token-level anomaly detection in production AI architectures. #Model #PromptInjection
MAS SAFR Explained: Singapore's Runtime Governance Standard for Agentic AI in Finance (2026-08-18) — The Monetary Authority of Singapore (MAS) has introduced SAFR, a targeted runtime governance standard expanding financial AI risk management to explicitly cover autonomous and agentic systems. Building on Singapore’s existing Model AI Governance Framework, SAFR imposes mandatory runtime testing, credential boundaries, and least-privilege tool execution controls for agentic financial workflows. The standard marks a major regulatory milestone in formalizing defenses against cascading agent delegation failures, unauthorized tool invocation, and autonomous prompt exploitation. #Gov #Standard
Federal AI Governance Pivots From Safety to Security (2026-08-19) — Federal AI governance has executed a strategic policy pivot under Executive Order 14409, shifting national oversight priorities from broad ethical safety principles toward hard cybersecurity and adversarial defense. The revised framework prioritizes critical infrastructure protection, counter-adversarial red-teaming, supply chain integrity, and defending domestic AI models against nation-state cyber threats. This shift is expected to alter federal AI procurement requirements, placing rigorous adversarial robustness and model-hardening benchmarks above traditional alignment criteria. #Gov #Policy
IBM: ASEAN data breach costs hit record US$4.12 million as AI attacks rise (2026-08-17) — IBM’s latest cybersecurity study reports that average data breach costs across ASEAN climbed to a record US$4.12 million, driven largely by the proliferation of AI-augmented attack vectors. Notably, organizations employing extensive AI-driven security automation reduced their average breach impact to US$3.66 million, compared to US$4.86 million for those relying on manual defense pipelines. The findings emphasize that as threat actors deploy AI to accelerate reconnaissance and lateral movement, automated AI-native defensive response is essential to controlling breach velocity and operational disruption. #Defense #Forecast
Incidents & Vulnerabilities
CVE-2026-73656 (2026-08-13, CVSS 9.9 Critical) — Trigger.dev prior to version 4.5.6 contains a critical flaw in its deployment background worker service endpoint (POST /api/v1/deployments/:deploymentId/background-workers). Unauthenticated remote attackers can exploit this handling error to disrupt or compromise managed AI agent deployment pipelines and execute arbitrary worker workflows. Organizations deploying Trigger.dev should immediately upgrade to version 4.5.6 or later. #Tool #RCE
CVE-2026-70477 (2026-08-04, CVSS 9.5 Critical) — A prompt injection vulnerability in Flowise prior to version 3.1.3 allows attackers targeting chatflows with CSV Agent nodes to force LLMs into generating malicious Python scripts. The payload successfully circumvents the application's blocklist validator and executes inside an unsandboxed runtime environment, leading to remote code execution on the host server. The vulnerability has been resolved in Flowise version 3.1.3. #Tool #RCE
CVE-2026-67531 (2026-08-06, CVSS 9.3 Critical) — FrontMCP versions prior to 1.5.7 suffer from a sandbox escape vulnerability within the Model Context Protocol (MCP) execution engine. The codecall:execute tool exposes live host Zod schema instances via getTool(), allowing malicious scripts to exploit non-configurable Zod v4 properties and evade ECMAScript Proxy containment. This enables complete sandbox escapes into the host execution context, and users should upgrade to FrontMCP 1.5.7. #Agent #SandboxEscape
CVE-2026-43631 (2026-08-06, CVSS 9.2 Critical) — A use-after-free flaw in llama.cpp (builds b7492 through b9060) affects llama-server instances running with the --sleep-idle-seconds configuration enabled. Remote, unauthenticated attackers can send specially crafted inference requests that trigger memory corruption in the model vocabulary pointer. Successful exploitation can lead to arbitrary code execution or service crashes; operators should update past build b9060 or disable idle sleep. #Tool #RCE
CVE-2026-47627 (2026-08-18, CVSS 9.8 Critical) — NVIDIA Triton Inference Server for Linux contains a critical path traversal vulnerability in its inference-serving stack. An attacker can exploit this flaw to traverse restricted file directories, potentially causing severe service disruption or denial of service across model serving pipelines. Organizations deploying Triton Inference Server on Linux should review NVIDIA's security bulletins and apply recommended updates immediately. #Tool #PathTraversal
CVE-2026-75110 (2026-08-17, CVSS 9.3 Critical) — MemOS, a memory operating system for LLMs and AI agents, contains an authentication bypass vulnerability. When authentication is enabled (AUTH_ENABLED=true) but the undocumented INTERNAL_SERVICE_SECRET environment variable is left unset, internal authentication middleware checks fail open. Remote attackers can leverage this misconfiguration to bypass access controls entirely; administrators should explicitly define this secret or update to patched releases. #Agent #AuthBypass
CVE-2026-24301 (2026-08-18, CVSS 8.8 High) — Microsoft Copilot is affected by a command injection vulnerability stemming from improper neutralization of special elements in input commands. An unauthorized attacker can execute arbitrary commands across the network to exfiltrate sensitive data and disclose internal information. Administrators should apply the latest Microsoft security updates addressing Copilot component integrations. #Agent #CmdInjection
CVE-2026-76395 (2026-08-19, CVSS 8.8 High) — Splunk AI Toolkit versions prior to 6.0.0 contain an unsafe deserialization flaw in the model codec parsing sparse matrix data. A user assigned the "power" role can upload and load a crafted model file to trigger arbitrary code execution on the underlying Splunk server. Affected deployments should be upgraded to Splunk AI Toolkit version 6.0.0 or higher. #Tool #Deserialization
Security Advisories
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations (2026-08-12, The Hacker News) — Two poisoned releases of the widely adopted LiteLLM proxy library sat on PyPI embedded with infostealer malware designed to harvest cloud API keys, SSH keys, Kubernetes tokens, and database passwords. Threat intelligence indicates that compromised developer and maintainer credentials enabled the supply-chain poisoning, potentially impacting thousands of downstream environments before the packages were removed. This incident highlights the acute supply-chain risks facing AI orchestration frameworks that sit at critical infrastructure junctions. #Supply #DepHijack
Token Jacking: Cybercriminals Could Be Stealing Your AI Resources (2026-08-06, Unit 42 (Palo Alto)) — Threat actors are actively harvesting enterprise LLM API keys to build secondary gray-market proxy routing hubs and siphon compute resources. Compromised foundation model credentials allow unauthorized actors to route costly inference generation through enterprise accounts, resulting in massive financial loss and potential data leakage. Security teams must enforce strict secret scanning, monitor for unusual model inference surges, and implement workload-bound API token scoping. #Identity #TokenLeak
CVE-2026-70335 GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability (2026-08-11, Microsoft MSRC) — An OS command injection vulnerability in GitHub Copilot and Visual Studio Code allows an unauthorized local attacker to elevate privileges on developer workstations. The flaw stems from improper input neutralization during workspace command execution initiated by agentic coding routines. Organizations are advised to update VS Code and the Copilot extension immediately to prevent arbitrary local code execution from untrusted project workspaces. #Agent #PrivEsc
CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools (2026-08-03, AWS Security Bulletins) — A flaw in the open-source strands-agents-tools package allows untrusted prompt injection inputs to bypass the human-in-the-loop confirmation gate protecting the shell execution tool. Successful exploitation allows an autonomous agent to execute arbitrary system commands on host infrastructure without operator approval. The advisory demonstrates why natural language model constraints cannot substitute for strict, deterministic tool-execution sandboxing. #Agent #CmdInjection
GhostSplice: Malicious MCP Servers Split Instructions to Exfiltrate Secrets from AI Coding Agents (2026-08-11, Cross-Vendor) — ASSET Research Group disclosed "GhostSplice," a multi-channel trust fragmentation vulnerability affecting Model Context Protocol clients including Claude Code, Cursor, and Codex CLI. Malicious MCP servers can bypass safety alignment and refusal guardrails by splitting exfiltration instructions across metadata schemas and tool execution payloads. This cross-channel technique enables quiet theft of SSH keys and environment variables, revealing fundamental gaps in multi-channel MCP security validation. #Agent #Research
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning (2026-08-12, The Hacker News) — A cross-provider vulnerability across OpenAI, Anthropic, and Google APIs allowed researchers to reconstruct hidden chain-of-thought deliberation logs passed between session calls. The weakness affected encrypted reasoning state objects, allowing lower-tier downstream models to decrypt internal session data that included embedded API keys and private system instructions. All three providers updated their session serialization protocols to enforce cryptographic isolation across different model tiers. #Tool #InfoDisclosure
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers (2026-08-08, The Hacker News) — Security researchers uncovered indirect prompt injection vectors in Atlassian Rovo that allow adversaries to silently extract sensitive Jira and Confluence workspace data. By seeding malicious instructions into shared documents, an attacker can cause the assistant to harvest confidential internal content and exfiltrate it to an external server during legitimate user queries. The finding underscores the need for strict outbound data-loss prevention rules in enterprise knowledge-retrieval agents. #Agent #InfoDisclosure
CISA warns of hackers exploiting critical MLflow vulnerability (2026-08-20, BleepingComputer) — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert warning that threat actors are actively exploiting a critical vulnerability in the open-source MLflow machine learning lifecycle platform. Attackers are weaponizing server-side request forgery (SSRF) and file disclosure flaws in exposed MLflow instances to access underlying cloud metadata services and exfiltrate cloud credentials. This activity underscores the severe operational risks of deploying unauthenticated MLOps management interfaces directly to the public internet. #Tool #Incident
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE (2026-08-18, The Hacker News) — CISA added an actively exploited vulnerability in Anyscale's Ray distributed AI compute framework to its Known Exploited Vulnerabilities (KEV) catalog. The flaw allows unauthorized attackers to submit malicious jobs via the Ray dashboard or trigger remote code execution via cross-origin requests from an operator's browser. Because Ray clusters frequently run with elevated privileges and direct access to GPUs, unpatched clusters represent prime targets for cryptojacking, AI model tampering, and lateral movement across cloud environments. #Tool #Incident
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure (2026-08-20, The Hacker News) — Federal authorities issued a warning regarding an active campaign utilizing AI-generated exploit scripts specifically engineered to target Siemens S7 Series Programmable Logic Controllers (PLCs) across U.S. critical infrastructure. Threat actors used large language models to automate protocol reverse-engineering and generate syntactically valid industrial network payloads for automated reconnaissance and command injection. This marks an escalation in weaponized LLM utility, lowering the technical threshold required to construct targeted operational technology (OT) cyber weapons. #Model #Incident
Black Hat Disclosure: Critical Host RCE in Google Gemini CLI and GitHub Actions (CVE-2026-12537) (2026-08-07, Cloud Security Alliance / Novee Security) — Security researchers disclosed a maximum-severity flaw (CVE-2026-12537, CVSS 10.0) in Google's Gemini CLI container launcher and the associated run-gemini-cli GitHub Action. An unprivileged remote attacker can trigger host-level OS command injection by submitting a maliciously crafted repository configuration file or pull request payload parsed by the coding agent. The vulnerability illustrates the high blast radius of integrating autonomous agentic CLI tools into automated CI/CD pipelines without strict sandboxing and input sanitization. #Agent #CmdInjection
AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files (2026-08-18, The Hacker News) — Researchers from Anthropic and EPFL demonstrated a self-propagating prompt injection attack that spreads laterally across autonomous AI agents through editable system prompt files and shared session logs. Dubbed "mind viruses," these malicious instructions rewrite an agent's persistent memory file to ensure secondary agents reading those logs execute the payload and propagate it to downstream tools. This finding presents a novel threat model for multi-agent architectures, showing how compromised memory layers can act as persistent, self-replicating infection vectors. #Agent #PromptInjection
Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR (2026-08-17, Wiz Blog) — Wiz disclosed how its autonomous AI red-teaming system ("Red Agent") discovered and exploited a GitHub Actions injection vulnerability in a Snowflake code repository that had been introduced via an AI-assisted pull request. The autonomous agent identified the flaw, bypassed default code security scanners, chained credentials to access Snowflake's internal Jira tenant, and mapped the full attack surface without human intervention. This disclosure demonstrates both the emerging reality of autonomous offensive agents and the software supply-chain hazards introduced by unreviewed AI-generated code. #Agent #Incident
New Approaches
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection (2026-08-08) — Investigates critical security vulnerabilities in RAG-based Security Operations Center (SOC) pipelines, where adversarial telemetry poisons retrieval indices and manipulates incident classification. The authors introduce RAG-IDS, a three-tier multi-agent architecture designed to validate vector store context and isolate prompt injection payloads. For enterprise defenders operationalizing LLMs for network traffic triage, this research offers a concrete framework to secure automated analysis pipelines against poisoned historical records. #Defense #Research
Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots (2026-08-06) — Demonstrates how physical printouts placed within an autonomous robot's visual field can act as indirect prompt injections against Vision-Language Model (VLM) planners. The attack exploits the tight coupling between visual perception and action execution to hijack physical movement and bypass spatial safety boundaries. AI security engineers supporting embodied AI systems must treat real-world optical inputs as unauthenticated, untrusted execution surfaces. #Model #Research
SafetyMem: Adaptive Jailbreak Defense via Dual-Component Safety Memory (2026-08-04) — Addresses the stateless limitation of conventional guardrails by introducing a dual-component safety memory framework that stores and reuses threat intelligence across multi-turn sessions. By retaining semantic patterns from past adversarial attempts, the system dynamically adapts inference-time defenses without requiring model fine-tuning. This architecture gives security teams a low-latency method to mitigate persistent, adaptive jailbreak probing. #Defense #Research
When Efficiency Meets Safety: A Benchmark Security Analysis of KV Cache Compression in Large Language Models (2026-08-02) — Presents the first comprehensive evaluation of how Key-Value (KV) cache compression algorithms impact model safety during long-context inference (cited 1 time). The findings reveal a critical trade-off: aggressive cache pruning can evict safety-critical system tokens, inadvertently increasing jailbreak susceptibility. Infrastructure teams must therefore audit context-compression configurations for unexpected safety regressions before deploying them in production. #Model #Research
SafeCap: Improving LVLM Safety with Image Captioning Reinforcement Learning (2026-08-05) — Proposes a reinforcement learning method that forces Vision-Language Models to generate intermediate safety-aware image descriptions before answering user prompts. This intermediate self-captioning step neutralizes multimodal jailbreaks by exposing visually embedded adversarial prompts prior to execution. For multimodal application developers, SafeCap provides an effective alignment strategy to close visual safety bypasses without degrading benign task performance. #Defense #Research
COPA: Continual Preference Optimization for Adaptive Prompt Injection Defense (2026-08-20) — This paper introduces Continual Preference Optimization (COPA), a defense framework designed to help large language models incrementally adapt to novel prompt injection techniques without requiring full model retraining or suffering from catastrophic forgetting. Unlike conventional static alignment and heuristic filter rules that degrade rapidly as adversaries engineer new prompt templates, COPA leverages dynamic preference optimization to continually reinforce boundary enforcement against emerging attack vectors. For AI security practitioners deploying agentic systems, this work provides a practical blueprint for maintaining continuous, production-grade resilience against evolving direct and indirect prompt injection attacks. #Defense #Research
SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding (2026-08-04) — SpreadMark revitalizes classical spread-spectrum communication principles within modern deep neural post-hoc watermarking architectures to enhance generative provenance tracking and deepfake attribution. By redundantly dispersing watermark signals across latent feature spaces, the framework ensures embedded identifiers survive not only aggressive compression and geometric distortions but also deliberate adversarial removal attempts. AI threat intelligence and provenance teams gain an actionable defense mechanism capable of maintaining attribution integrity across synthetic media pipelines in adversarial environments. #Defense #Research
Trending OSS Tools
NVIDIA/SkillSpector (2026-03-21, Python, 14636★) — A specialized security scanner designed to inspect AI agent skills, extensions, and Model Context Protocol (MCP) integrations before deployment. It identifies supply-chain risks, data exfiltration vectors, malicious logic, and hidden prompt injections across agentic ecosystems like Claude Code and Codex. #Defense #Toolkit
decionis/agent-safe-pipeline (2026-08-13, TypeScript, 398★) — A zero-trust reference architecture that decouples AI agent action proposals from execution authority. It enforces immutable intent capture, independent policy verdicts (ALLOW/ESCALATE/BLOCK), and execution barriers that consume verified human approval and single-use grants. #Defense #Toolkit
Kritt-ai/open-kritt (2026-07-20, JavaScript, 1709★) — An open-source, self-hosted vulnerability research platform that coordinates autonomous agents to discover and validate security flaws in codebases. It streamlines bug bounty and red-teaming workflows by automating vulnerability triage and proof-of-concept verification. #Defense #Toolkit
Sentry-LLM/SentryLLM (2026-08-05, TypeScript, 34★) — A real-time threat detection and security monitoring layer built for production LLM deployments. It offers inline prompt injection mitigation, jailbreak attempt detection, and behavioral telemetry for LLM-integrated services. #Defense #Toolkit
sunhao123456sun-svg/toolpermit (2026-08-11, Python, 25★) — A local-first security firewall and approval middleware for AI agent tool calls. It provides granular access controls, interactive prompt-level approvals, and structured audit logs to prevent unauthorized tool execution on host systems. #Defense #Toolkit
martian56/redcell (2026-08-02, Python, 73★) — An autonomous red-teaming platform that leverages LangGraph-driven LLM agents to conduct full end-to-end penetration tests inside sandboxed Kali Linux containers. It integrates provider-agnostic model routing via LiteLLM and automatically generates structured reporting in PDF, JSON, and SARIF formats. #Defense #Toolkit
mukul975/Anthropic-Cybersecurity-Skills (2026-02-25, Python, 30578★) — A massive repository of 817 structured agent capabilities mapped directly to frameworks like MITRE ATT&CK, MITRE ATLAS, and NIST AI RMF. It delivers ready-to-use skill modules for platforms like Claude Code, Cursor, and Codex CLI across 29 specialized security domains. #Defense #Toolkit
How This Newsletter Is Made
Data collection: Raw intelligence is automatically crawled from 10 source channels: Google Alerts, NVD, CISA KEV, OSV.dev, arXiv, Semantic Scholar, GitHub, security vendor blogs (Snyk, Wiz, Unit 42, Hacker News, etc.), official vendor advisory feeds (MSRC, AWS, Google Cloud, GitHub, OpenAI), and an automated Gemini + Google Search reflection sweep across OpenAI, Anthropic, Google, Microsoft, AWS, and cross-vendor researcher disclosures. Queries run over a 21-day rolling window.
Processing: Each item passes through deterministic pre-filters (deduplication, package matching, keyword gating) and then multi-stage LLM screening (Gemini 3.7 Flash) that scores relevance and importance — with news articles additionally validated against live web results via Google Search grounding to confirm they are real and current. Official vendor advisories (MSRC, AWS, Google Cloud, OpenAI, Anthropic) get an importance boost so they outrank older aggregator coverage of the same week.
Limitation: The validation confirms that a news article exists and was published within the reporting window, but does not detect cases where an article re-reports an older story as new; if the article itself is recent, it passes validation regardless of the underlying event's age.
Stats (Aug 01 -- Aug 22, 2026): 667 raw items collected (296 news, 171 CVEs, 34 papers, 30 repos, 136 advisories) were distilled down to 42 final entries in the newsletter (7 news, 8 vulnerabilities, 13 advisories, 7 papers, 7 tools).
Contribute: Securing AI is now everyone's problem, and the most useful lessons still live in people's heads rather than in frameworks. We don't have the answers, so we're trying to learn from the people who do.
We'd love to learn from you. If you've picked up something worth passing on in AI security, we'd be grateful to hear it — a written piece, a short technical video, a live session, or just an idea we can interview you about. It doesn't need to be polished, just genuine and useful to someone doing the work. Share an idea here.
Generated on 2026-08-22. Sources: Google Alerts, NVD, CISA KEV, OSV.dev, arXiv, Semantic Scholar, GitHub, Security Blogs, Vendor Advisories (MSRC, AWS, Google Cloud, GitHub, OpenAI), and Gemini Search Reflection.