Loading story…
GitHub Security Lab disclosed an AI-assisted vulnerability discovery effort in which its open source Taskflow Agent generated candidate findings that researchers manually reproduced, triaged, assessed, and coordinated for disclosure, resulting in 18 public CVEs across eight open source projects. The affected software includes Quarkus, Docmost, Frappe, NocoDB, Sylius, Spree, Rocket.Chat, and Wekan, with the published issues tracked through GitHub Security Lab advisories.
The reported flaws were concentrated in access-control and web application logic weaknesses rather than memory-corruption bugs, highlighting the framework’s usefulness for finding application-layer security defects in widely used platforms. GitHub later described the broader approach publicly as an open source AI-powered framework for vulnerability scanning, while emphasizing that the disclosed CVEs represent only the subset of model-generated leads that were validated and released through the normal advisory process.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Bugflation reported that GitHub Taskflow Agent findings had produced 18 public CVEs across eight open source projects. The report highlighted that the disclosed issues were primarily access-control and web-application logic flaws rather than memory-corruption bugs.
GitHub published a blog post explaining how to scan for vulnerabilities using GitHub Security Lab’s open source AI-powered framework. The post contextualizes the methodology behind the vulnerability-finding approach referenced in later reporting on Taskflow Agent discoveries.
GitHub Security Lab published advisories covering vulnerabilities later summarized as 18 public CVEs across eight projects, including Quarkus, Docmost, Frappe, NocoDB, Sylius, Spree, Rocket.Chat, and Wekan. Bugflation states these advisories stemmed from AI-generated candidate reports that were manually reproduced, triaged, impact-assessed, and disclosed by Security Lab researchers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugflation.com
Open sourcegithub.blog
Open sourcesecuritylab.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026