Vulnerabilities
Source reports covering Vulnerabilities. Stories will appear when analysis and community reactions are ready.
6 reports · page 1 of 1
Connected topics are temporarily unavailable. You can still browse stories below.
Source reports
METR, Redwood Research find exploit in OpenAI agent monitoring that could hide hundreds of actions
research
2 min read
METR and Redwood Research reported on October 22, 2026 that a three-week embedded pilot at OpenAI identified previously unknown weaknesses in the company’s internal monitoring of AI agents. The groups said one exploit could have enabled agents to stop hundreds of recent actions from being recorded by the monitoring system. OpenAI said it has patched the identified vulnerabilities affecting its production safeguards. The pilot ran from July 21 through August 11, 2026. One employee from each nonprofit received high-level access to OpenAI’s internal codebase, monitoring prompts and configurations, documentation, and interviews with roughly a dozen staff members from monitoring, safety, and security teams. Their work included estimating monitoring coverage for agentic inference traffic through the Responses API and OpenAI’s internal use of Codex. The evaluators estimated that monitors covered about 75% to 94% of Responses API traffic during the period, leaving some traffic unmonitored. They delivered a 61-page internal report to OpenAI researchers and security staff; OpenAI-redacted a 38-page version for the leadership of METR and Redwood Research. The organizations said the pilot was not designed to provide robust public transparency, so they agreed to publish only high-level findings. The exercise followed CEO Sam Altman’s pledge to give independent evaluators employee-like access and occurred while OpenAI was finalizing contracts with third-party safety assessors.
Document-borne AI worms can self-propagate through Copilot for Word
research
17 min read
Microsoft product teams and the Microsoft Security Response Center (MSRC) collaborated on a technical analysis of vulnerabilities related to AI in Microsoft Word. The findings reveal potential security risks associated with AI integration in word processing software.
Cursor 0day: When Full Disclosure Becomes the Only Protection Left
opinion
8 min read
Cursor IDE executes malicious git.exe files from the root of a project repository without user interaction or prompts. This vulnerability allows repeated execution of the planted malicious file, posing a significant security risk.
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
research
7 min read
Wiz Research identified a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure that allows authenticated users to execute arbitrary commands on backend servers with a single git push command. This vulnerability is notable as one of the first critical flaws found in closed-source binaries using AI.
AISLE Discovers 38 CVEs in OpenEMR Healthcare Software
news
9 min read
AISLE has identified 38 critical vulnerabilities (CVEs) in healthcare software utilized by 100,000 medical providers. The rapid digitization of healthcare is outpacing the implementation of adequate security measures.
Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
news
4 min read
A Lovable-hosted app reportedly exposed the data of 18,000 users due to 16 identified vulnerabilities, including six deemed critical. Lovable asserts that users are responsible for addressing security issues flagged prior to app publication.