Loading story…
GitHub Security Lab reported that targeted, AI-assisted taskflows identified and disclosed 24 Android vulnerabilities in open-source applications. The workflows direct an open-source AI security agent to map mobile attack surfaces, locate entry points such as exported components and deep links, and evaluate Android-specific flaw classes; researchers emphasized that analysts must still validate findings and build proof-of-concept exploits because LLM output can overstate impact or produce false positives.
In OsmAnd, an exported MapActivity accepted attacker-controlled intent extras that could silently import and replace application settings. A permissionless malicious app could use the issue to redirect map-tile or routing traffic and potentially infer a victim's location, routes, origin, and destination. In Wikipedia for Android, researchers found two inadequate hostname-suffix checks that could be chained through a wikipedia:// deep link to load attacker-controlled content, expose Wikimedia cookies, and enable account takeover across Wikimedia projects.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers found two hostname-suffix validation flaws in the Wikipedia Android app that could be chained through a wikipedia:// deeplink. The chain could load attacker-controlled WebView content, expose Wikimedia cookies, and enable account takeover across Wikimedia projects.
Researchers found that OsmAnd's exported MapActivity accepted sensitive settings-import intent extras from arbitrary apps rather than only its intended AIDL service. A permissionless malicious app could silently replace map-tile or routing endpoints with attacker-controlled servers, exposing location and route data.
GitHub Security Lab reported finding and disclosing 24 vulnerabilities in Android applications using its open-source Taskflow Agent and Android-focused AI auditing workflows.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed an agent-to-agent exploitation chain in Google’s open-source `adk-python` repository for the Agent Development Kit, showing how a low-privilege public-facing AI agent handling GitHub issues and pull requests could be prompt-injected into triggering a higher-privilege maintainer-only agent. The attack abused trusted handoffs between agents and GitHub workflow visibility to create a plausible malicious review trail, potentially steering maintainers toward merging poisoned pull requests and opening a software supply-chain compromise path. The researchers also reported a second weakness in Antigravity SDK-based automation, where a command allowlist could be bypassed through Git scripting features to achieve remote code execution on the CI runner. Because the runner reportedly exposed a long-lived personal access token and Google Cloud service account credentials, even an unprivileged GitHub issue could have enabled secret exfiltration. Google said it fixed and hardened the repository and credited the report, while declining a bug-bounty payout because successful exploitation still depended on social engineering and maintainer action.
Aug 10, 2026
Security researchers have identified significant risks stemming from both legitimate and malicious Android applications due to insecure or outdated embedded components. One report highlights that thousands of popular Android apps, including those in travel, weather, and airline categories, still contain the deprecated `libmapbox-gl.so` library, which statically links to an outdated and vulnerable version of SQLite (3.24.0). This exposes users and enterprises to threats such as credential theft, data exfiltration, and denial-of-service attacks, especially in BYOD environments where employees may unknowingly install these apps on corporate devices. Separately, advanced malicious Android apps are employing sophisticated evasion techniques to bypass antivirus detection. These apps use strong packing and obfuscation, multi-stage payload delivery, and custom package installers to avoid analysis and facilitate the installation of additional malicious components. The malicious behaviors include information theft and coin mining, with payloads often hidden in encrypted files or triggered only under specific conditions, making detection and remediation more challenging for security teams.
Jun 29, 2026
Novee Security disclosed at Black Hat USA 2026 that AI coding agents tied to GitHub workflows can be manipulated through untrusted issue, pull request, and workflow-generated content to execute malicious actions inside repositories they are meant to maintain. Testing of **Anthropic Claude Code**, **Google Gemini CLI**, and **OpenAI Codex** against the vendors’ own public repositories and default setups showed paths to **remote code execution**, credential theft, repository tampering, and software supply-chain compromise without requiring privileged access. Researchers said the weakness lies primarily in the surrounding agent harnesses—tool permissions, execution controls, and sandboxing—rather than the underlying models. Reported exploitation paths included command-validation bypasses, unenforced shell restrictions, secret exposure through `/proc`, and persistent instruction poisoning across multi-pass workflows. Anthropic remediated **`CVE-2026-54316`** in Claude Code versions `0.2.54` through `2.1.162`; Google patched Gemini CLI versions before `0.39.1`, preview versions before `0.40.0-preview.3`, and `run-gemini-cli` GitHub Action versions before `0.1.22`; OpenAI mitigated Codex workflow risk by isolating agent runs and using read-only environments. The researchers said they found similar insecure patterns in more than 100 public repositories and reported no evidence of malicious exploitation in the wild.
Aug 7, 2026