Zenity Labs publicly disclosed on July 23, 2026 a vulnerability in the ChatGPT agent builder that allowed the silent installation of a malicious agent inheriting all of the victim's connectors (Outlook, Slack, Drive...). Fixed on June 9 - but the vulnerability class remains to be monitored.
2 h ago 7 2
A flaw in the Azure DevOps MCP (Model Context Protocol) integration allows an invisible comment in a pull request to hijack an LLM agent tasked with reviewing it.
20 h ago 7 2
After Bluesky and Damus, Jack Dorsey is pushing a new product via Block: Buzz - a tool that combines team messaging, AI agents, and Git hosting. Positioned as a response to the fragmentation of Slack/Notion/GitHub/Copilot.
yesterday 10 2
A simple comment hidden in an Azure DevOps pull request can turn the code reviewer's AI agent against them - and send it siphoning projects that the attacker normally wouldn't have access to. The vulnerability lies in Microsoft's official MCP server.
yesterday 8 2
Hugging Face confirms and details the previously announced breach: an internal autonomous AI agent, with overly broad permissions, served as a vector for exposing datasets and credentials. The "AI agents as attack surface" folder gains a textbook case.
Jul 21, 2026 8 2
The reference hub of the AI ecosystem officially acknowledges that an intrusion on its production infrastructure was carried out using an autonomous AI agent system - a new chapter in a threat seen emerging in the field.
Jul 21, 2026 16 4
On July 20, 2026, Hugging Face revealed a breach in its production infrastructure. The entry was made through a malicious dataset, but the most disturbing aspect is elsewhere: the post-intrusion operations were carried out by an "autonomous agent framework" executing thousands of actions across a swarm of ephemeral sandboxes.
Jul 20, 2026 23 3
The Danish studio spoke to Rock Paper Shotgun about an early version of its Bond game, which would have featured several 00 agents. A making-of of a creative pivot.
Jul 19, 2026 24 3
