AI Threat Watch: AI-Targeted

Prompt injection still drives most agentic AI security failures in production

Thu, 11 Jun 2026 06:00:00 GMT

Coverage of OWASP's 2026 findings on agentic AI. Most production failures still begin with prompt injection, and attackers increasingly poison what agents trust: MCP servers, packages and coding-tool configuration.

AI-Targeted (Attacks on AI) | Source: Help Net Security | Vulnerabilities: CVE-2025-6514, CVE-2026-22708

Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

Mon, 21 Sep 2026 08:43:23 GMT

Trend Micro's MDR team correlated attacker server infrastructure with victim telemetry to map Banana RAT, a banking trojan targeting 16 Brazilian financial institutions via phishing and fileless PowerShell delivery. The malware provides remote control, keylogging, overlay injection, and PIX QR code interception, using a polymorphic crypter service to evade detection.

AI-Targeted (Attacks on AI) | Source: Trend Micro | Actors: SHADOW-WATER-063 | Malware: Banana RAT, Backdoor.PS1.BANANARAT.A | Attribution: Brazil, per TrendAI (high confidence)

When prompts become shells: RCE vulnerabilities in AI agent frameworks

Thu, 07 May 2026 06:00:00 GMT

Microsoft researchers show how a single injected prompt reached host-level code execution in agents built on Semantic Kernel. Model-controlled parameters flowed unsanitized into a search plugin. Both flaws are fixed.

AI-Targeted (Attacks on AI) | Source: Microsoft Security | Vulnerabilities: CVE-2026-25592, CVE-2026-26030

OWASP GenAI Exploit Round-up Report Q1 2026

Tue, 14 Apr 2026 06:00:00 GMT

Quarterly review of eight AI-related incidents mapped to the OWASP LLM and agentic risk lists. It includes active exploitation of a maximum-severity Flowise flaw and GrafanaGhost, a prompt injection path that exfiltrates data from Grafana's AI features.

AI-Targeted (Attacks on AI) | Source: OWASP GenAI Security Project | Vulnerabilities: CVE-2025-59528

LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign

Fri, 27 Mar 2026 06:00:00 GMT

Two backdoored releases of LiteLLM, a widely used LLM gateway library, were published to PyPI on March 24, 2026 with a credential stealer. Datadog traces the campaign from a poisoned Trivy scanner through npm and into PyPI.

AI-Targeted (Attacks on AI) | Source: Datadog Security Labs | Actors: TeamPCP

Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer

Mon, 21 Sep 2026 08:40:00 GMT

TrendAI Research documented a campaign where malicious OpenClaw agent skills trick AI agents like GPT-4o into installing a new variant of Atomic macOS Stealer (AMOS), which then deceives users into entering their password. The malware exfiltrates browser data, crypto wallets, Apple and KeePass keychains, and documents, with hundreds of malicious skills found across ClawHub, SkillsMP, and GitHub repositories.

AI-Targeted (Attacks on AI) | Source: TrendAI Research | Malware: Atomic (AMOS) Stealer, AMOS

Moonlock Lab thread on ClickFix malware abusing Claude.ai and Medium

Mon, 21 Sep 2026 08:38:42 GMT

Moonlock Lab reports that a Google Sponsored ad for a macOS search led users to malware via ClickFix delivery, seen over 15,000 times. One variant abused a public artifact hosted on claude.ai, while another used a Medium post impersonating Apple support, both attributed to the same threat actor.

AI-Targeted (Attacks on AI) | Source: Moonlock Lab | Malware: ClickFix

The Lethal Trifecta Strikes: Four Major AI Agent Vulnerabilities in Five Days

Mon, 21 Sep 2026 08:41:18 GMT

Between January 7-15, 2026, researchers including PromptArmor disclosed indirect prompt injection vulnerabilities in four production AI tools: IBM Bob, Superhuman AI, Notion AI, and Anthropic's Claude Cowork, each allowing data exfiltration via the 'lethal trifecta' of private data access, untrusted content exposure, and external communication channels. Vendor responses varied widely, from Superhuman's rapid remediat

AI-Targeted (Attacks on AI) | Source: Breached.company | Malware: Claude Cowork, IBM Bob, Notion AI, Superhuman AI, Superhuman Go

New Prompt Injection Attack Vectors Through MCP Sampling

Mon, 21 Sep 2026 08:38:25 GMT

Unit 42 researchers show that the Model Context Protocol sampling feature, which lets MCP servers request LLM completions from the client, lacks security controls and trusts servers implicitly. They built a proof-of-concept malicious MCP server against an unnamed coding copilot demonstrating resource theft via hidden prompts, conversation hijacking, and covert tool invocation. No in-the-wild exploitation is claimed;

AI-Targeted (Attacks on AI) | Source: Unit 42 (Palo Alto Networks)

Claude Desktop Extensions Vulnerable to Web-Based Prompt Injection

Wed, 05 Nov 2025 06:00:00 GMT

Researchers reported that extensions for the Claude desktop app could be driven by instructions planted in web content, turning an ordinary browsing request into a path to actions on the user's machine.

AI-Targeted (Attacks on AI) | Source: Infosecurity Magazine

First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails

Thu, 25 Sep 2025 06:00:00 GMT

An npm package posing as the Postmark MCP server behaved normally for fifteen versions, then added one line that copied every email sent through it to the author's server. Koi calls it the first malicious MCP server seen in the wild.

AI-Targeted (Attacks on AI) | Source: Koi Security

Cursor AI Code Editor Fixed Flaw Allowing Attackers to Run Commands via Prompt Injection

Fri, 01 Aug 2025 06:00:00 GMT

An indirect prompt injection could make Cursor's agent write a malicious MCP configuration file without user approval, giving the attacker remote code execution on the developer's machine.

AI-Targeted (Attacks on AI) | Source: The Hacker News | Vulnerabilities: CVE-2025-54135

'EchoLeak' AI Attack Enabled Theft of Sensitive Data via Microsoft 365 Copilot

Wed, 11 Jun 2025 06:00:00 GMT

Aim Security showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no user interaction. Microsoft patched it server-side and reported no exploitation in the wild.

AI-Targeted (Attacks on AI) | Source: SecurityWeek | Vulnerabilities: CVE-2025-32711

How we estimate the risk from prompt injection attacks on AI systems

Mon, 21 Sep 2026 08:37:15 GMT

Google DeepMind describes an automated red-teaming framework using optimization-based attacks (Actor Critic, Beam Search, Tree of Attacks with Pruning) to test AI agents' susceptibility to indirect prompt injection that could exfiltrate sensitive user data. This is a defensive research methodology, not a report of real-world exploitation, and no specific incidents are disclosed.

AI-Targeted (Attacks on AI) | Source: Google DeepMind

Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History

Wed, 29 Jan 2025 06:00:00 GMT

An unauthenticated ClickHouse database belonging to DeepSeek exposed over a million log lines, including chat history, API secrets and backend details, and allowed full control of the database. DeepSeek secured it after disclosure.

AI-Targeted (Attacks on AI) | Source: Wiz Research