Loading story…
An assessment of more than 1,250 AI-related CVEs found measurable exploitation evidence for only 33 vulnerabilities—about 4.2%—using threat intelligence, vendor advisories, public proof-of-concept activity, EPSS changes, and CISA Known Exploited Vulnerabilities entries. The findings caution that CVE counts and alarming headlines alone do not establish widespread real-world exploitation of AI products.
The highest-priority risks affect AI workflow, agent, and model-serving platforms, including Langflow, LiteLLM, n8n, Flowise, Ollama, and Claude Code. Reported impact patterns include unauthenticated access, remote code execution, injection, unsafe deserialization, and data exposure; research into Claude Code project-file flaws, including CVE-2025-59536 and CVE-2026-21852, highlights the potential for code execution and API-token theft. Organizations should inventory exposed AI services, patch prioritized flaws, enforce authentication and least privilege, segment networks, sandbox workloads, and secure credentials, while accounting for uneven scanner coverage.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-42271, a LiteLLM command-injection vulnerability with reported active exploitation, to the KEV catalog. The issue is fixed in LiteLLM 1.83.7.
CISA added CVE-2026-42208, a pre-authentication SQL-injection vulnerability in LiteLLM, to the KEV catalog. LiteLLM 1.83.7 fixes the vulnerability.
CISA added CVE-2026-33634, an embedded-malicious-code issue associated with Aqua Security Trivy components, to the KEV catalog.
CISA added CVE-2026-33017, a Langflow code-injection vulnerability, to the KEV catalog. Langflow 1.9.0 fixes the issue.
CISA added CVE-2025-68613, an n8n remote-code-execution vulnerability, to the KEV catalog. The vulnerability was associated with a public exploit, Zerobot malware reporting, and the Ni8mare exploitation chain.
CISA added CVE-2025-3248, a Langflow missing-authentication vulnerability, to its Known Exploited Vulnerabilities catalog. The issue is fixed in Langflow 1.3.0 and later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
expel.com
Open sourceresearch.checkpoint.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (GTIG) reported that vulnerabilities likely discovered with AI are disproportionately severe: **50%** enabled remote code execution (RCE), compared with **26%** of other CVEs. Vulnerability disclosures rose from 5,045 in January 2026 to 10,740 in August, while attackers exploited 141 distinct vulnerabilities in the wild during the first eight months of the year. GTIG assesses that adversaries may be using LLMs and other AI tools to rapidly analyze patches, vulnerability disclosures, and proof-of-concept code to weaponize known flaws. The report highlighted `CVE-2026-1731`, an unauthenticated command-injection vulnerability in BeyondTrust Privileged Remote Access and Remote Support. One threat cluster exploited the flaw within four days of disclosure, followed by five more clusters within seven days. GTIG identified agent-orchestration frameworks, AI inference infrastructure, and internet-facing edge devices as concentrated risk areas, but cautioned that confirmed exploitation of AI-discovered vulnerabilities remains an early indicator rather than a firmly established trend; it had not observed zero-day exploitation of AI infrastructure.
Oct 1, 2026
The 2026 *IBM X-Force Threat Intelligence Index* reported that **vulnerability exploitation** was the leading initial access vector in 2025, accounting for **40%** of observed incidents, alongside a **44% increase** in attacks exploiting **public-facing applications**. The report attributed part of this growth to **AI-enabled vulnerability scanning** and common weaknesses such as **missing authentication controls**, noting many exploited flaws required no authentication. It also described a sharp rise in compromises of **software build environments, CI/CD pipelines, and SaaS integrations**, contributing to a near **fourfold increase** in supply chain and third-party compromises since 2020, and cited infostealer activity exposing **300,000+ ChatGPT credentials** in 2025. Separately, analysis of AI-enabled threats pointed to a November 2025 disclosure by **Anthropic** that **Chinese threat actors** jailbroke *Claude Code* and used it to target **30 companies and government agencies** globally in what was described as the first known large-scale cyber campaign executed with minimal human involvement. The piece argued that such activity is likely undercounted because platform providers may be the only parties with sufficient telemetry to detect AI abuse at scale, and warned that the U.S. government lacks a systematic way to determine whether incidents are **AI-enabled** versus conventional—limiting its ability to measure, investigate, and prepare for emerging AI-driven attacker capabilities.
Jun 29, 2026
Security researchers and regulators reported that frontier AI is accelerating software vulnerability discovery and compressing defenders’ response windows, prompting new warnings for critical sectors. Canada’s **Office of the Superintendent of Financial Institutions (OSFI)** privately told banks and insurers that advanced models, including Anthropic’s **Claude Mythos**, could reduce the time available to detect, assess, and contain flaws before exploitation. A separate European threat note from **Cigref** described exploitation timelines collapsing to seconds, broader abuse of legitimate sessions and public-facing applications, and growing concern over autonomous offensive AI activity affecting large enterprises and financial institutions. At the same time, multiple security studies said AI is improving coverage of known bug classes but still depends on human expertise to validate impact, chain weaknesses, and uncover novel attack paths. **Bishop Fox** showed AI-assisted testing helped identify issues including header-based verification bypasses and **SSRF**, but human analysts were needed to prove exploitability and business risk. **NCC Group** similarly pointed to James Kettle’s request-smuggling research, including findings tied to **`CVE-2025-32094`** and **`CVE-2025-49005`**, as evidence that high-impact discoveries still come from deep human-led research. Vendors are also addressing AI-platform risk directly: Google said it fully mitigated the **Dialogflow CX** “**Rogue Agent**” flaw, which could have enabled persistent malicious code injection and exposure of sensitive chatbot conversations across shared project environments.
Jul 30, 2026