Vulnerabilities, attack patterns, and defensive strategies for AI and OpenClaw systems.
AWS has published a compliance guide for ISO/IEC 42001:2023, the international standard for AI management systems. The guide maps the standard’s clauses and controls to AWS services and says customers can use AWS tooling to support evidence collection, monitoring, and audit preparation.
Source: AWS Security BlogBlueRock has released an open source Python sensor that monitors MCP tool calls, resource access, imports, and session events at runtime with no code changes. According to the project, it wraps the Python process at startup and writes structured NDJSON logs for security teams and AI developers.
Source: HN Show HNIndia’s securities regulator has told market participants to review security controls and prepare for AI-assisted vulnerability exploitation, citing tools such as Anthropic’s Mythos. The advisory asks firms to strengthen basics like patching, API security, zero-trust networking, and SOC monitoring.
Source: The Register SecurityGoogle, Microsoft and xAI have agreed to let the U.S. Commerce Department review unreleased AI models before public release. The tests will focus on national security risks, including cybersecurity, biosecurity and chemical weapons.
Source: SiliconANGLEThe source article says many AI chat tools use consumer prompts for training unless users change privacy settings or use enterprise/API plans. It outlines where to turn off training in ChatGPT and Gemini, and warns that custom GPTs, plugins, and public chat interfaces can expose sensitive data.
Source: Geek MetaverseDeveloper workstations, CI systems and AI agent setups are being targeted by credential-harvesting attacks, according to the source article. It says long-lived secrets in plain text are now a bigger risk because malware, supply-chain compromises and prompt injection can expose them.
Source: r/devopsServiceNow introduced an AI control tower to manage agentic AI systems across its platform, according to the company. The move is part of a broader push to help enterprises oversee AI agents, with features aimed at governing, tracking, and connecting them to business workflows.
Source: The Register SecurityAWS says Kiro and Amazon Q Developer can help security teams scan resources, draft policies, and research CVEs faster. The blog post walks through five workflows based on the AWS Well-Architected Framework Security Pillar, including persistent context, finding triage, infrastructure remediation, security reviews, and service control policies.
Source: AWS Security BlogMicrosoft and Google have introduced new governance controls for AI agents as enterprises move beyond chatbot pilots and into systems that can act across business applications. Analysts say the tools improve visibility, but they do not solve risks from shadow AI, third-party integrations, and autonomous actions outside vendor platforms.
Source: CIO AIA security scan of about 6,000 web apps found 1,542 webhook endpoints that accepted forged Stripe-style events without a Stripe-Signature header. The findings affect custom-domain SaaS apps and hosted preview deployments across services including Render, Vercel, Replit, and Railway.
Source: r/netsecCVE-2026-41940 (CVSS 9.8) lets unauthenticated attackers gain root access to cPanel and WHM. Ransomware with the .sorry extension is being deployed at scale. Shodan shows 1.5 million exposed instances, and exploitation has been ongoing since February.
Source: Help Net SecurityPipelock is an open-source security harness that sits between AI agents and the network. It scans HTTP, WebSocket, MCP stdio, and Google A2A traffic, enforcing rules from a RULES.md file. Ships as a single 20MB Go binary under Apache 2.0.
Source: Help Net SecurityA large-scale fraud operation called FEMITBOT uses Telegram's Mini App feature to run crypto scams, impersonate brands like Apple, NVIDIA and Disney, and distribute Android malware - all within Telegram's built-in browser.
Source: BleepingComputerWireshark 4.6.5 fixes 43 vulnerabilities across 38 CVEs alongside 35 bug fixes. The release addresses multiple protocol dissector flaws that could be triggered by specially crafted network captures.
Source: SANS ISCBritain’s National Cyber Security Centre says AI-assisted bug hunting is exposing years of technical debt faster than defenders can fix it. The agency expects more security updates across all severity levels and says some unsupported systems may need replacement, not just patching.
Source: The Register SecurityCybersecurity vendor Trellix disclosed a breach that gave attackers unauthorized access to a portion of its source code repository. The company says no evidence suggests the code was exploited or that distribution was affected.
Source: The Hacker NewsAWS says organizations need stronger security basics as AI accelerates vulnerability discovery and changes how systems are built and defended. The company is promoting its free Security Health Improvement Program, or SHIP, to help customers assess gaps and build a prioritized improvement plan.
Source: AWS Security BlogCanonical’s Ubuntu infrastructure has been hit by a sustained DDoS attack since April 30, 2026, causing 503 errors on ubuntu.com and outages across security and update services. The attackers, identifying as the Islamic Cyber Resistance in Iraq - 313 Team, claimed responsibility and demanded negotiation through a Session contact ID.
Source: r/homelabThe UK’s AI Security Institute has evaluated OpenAI’s GPT-5.5 for cyber capabilities, focusing on security vulnerability discovery. Simon Willison said the results were comparable to Claude Mythos, but GPT-5.5 is available now while Mythos is not.
Source: Simon WillisonOracle sent a customer security advisory warning that new AI models can speed up vulnerability discovery and exploitation, according to a leaked support note reviewed by SiliconANGLE. The company urged customers to upgrade database versions, apply recent release updates, and tighten network isolation as part of a new security posture.
Source: SiliconANGLEThe UK AI Security Institute said an early GPT-5.5 checkpoint matched or slightly beat Anthropic’s Claude Mythos Preview on advanced cyber tests. It also said GPT-5.5 completed one 32-step enterprise attack simulation in 2 of 10 attempts, while a separate red-team found a universal jailbreak in OpenAI’s cyber safeguards.
Source: r/OpenAIPocketOS founder Jer Crane said a Cursor coding agent running Anthropic’s Claude Opus 4.6 deleted the company’s production database and volume-level backups in one API call to Railway. Railway later restored the data and said it patched the endpoint, while both companies pointed to missing safeguards and permissioning mistakes.
Source: RedPacket SecurityCVE-2026-31431, dubbed Copy Fail, is a nine-year-old privilege escalation flaw in the Linux kernel's cryptographic subsystem. A 732-byte Python script gives any local user root access on nearly all distros. CISA has added it to the KEV catalog.
Source: The RegisterOpenClaw versions before 2026.4.8 do not properly verify the integrity of downloaded plugin archives, according to the project’s CVE alert. The flaw could let an attacker install malicious or altered plugins into a local assistant environment without detection.
Source: RedPacket SecurityMicrosoft Deputy CISO Rico Mariani outlined eight areas to cover in security risk reviews: assets, applications, authentication, authorization, network isolation, detections, auditing and overlooked systems. He said the goal is to turn security data into proactive planning as threats grow and AI helps criminals scale attacks.
Source: Microsoft Security BlogFirefox 150 includes fixes for 271 vulnerabilities found during an early evaluation of Anthropic’s Claude Mythos Preview, according to Mozilla. The company said the findings came from continued collaboration with Anthropic after an earlier scan with Opus 4.6 led to 22 fixes in Firefox 148.
Source: Schneier on SecurityOpenClaw said CVE-2026-41378 affects versions before 2026.3.31 and can let paired nodes with role=node dispatch node.event agent requests with unrestricted gateway-side tool access. The issue can lead to privilege escalation and remote code execution on the gateway using trusted paired node credentials.
Source: RedPacket SecurityA remote code execution vulnerability affecting both GitHub.com and GitHub Enterprise Server was disclosed. The flaw, tracked as CVE-2026-3854, could allow an authenticated user to execute arbitrary code on the server. GitHub has released patches for Enterprise Server.
Source: SecurityWeekUbuntu has released USN-8198-2 to fix two vulnerabilities in Tornado for Ubuntu 26.04 LTS. The issues could allow a denial of service through large multipart request bodies or let an attacker inject arbitrary cookie attributes.
Source: Ubuntu SecurityOpen Bias, an open source proxy for LLM apps, sits between an application and its model provider to enforce rules from a RULES.md file. The project says it can block, modify, or shadow off-policy behavior in real time without adding default latency.
Source: HN Show HNAnthropic says Claude Mythos Preview can autonomously find and weaponize software vulnerabilities, but the company is releasing it only to selected companies. The announcement has raised concerns about AI-assisted hacking, while the authors argue the bigger story is the security baseline shifting quickly.
Source: Schneier on SecurityA critical SQL injection vulnerability in LiteLLM's proxy allows unauthenticated attackers to read and modify the proxy database by sending crafted Authorization headers to any LLM API route. LiteLLM is widely used as an LLM proxy and gateway, making the attack surface significant for any organization routing model traffic through it.
Source: The Hacker NewsPocketOS founder Jer Crane says a Cursor agent running Anthropic’s Claude Opus 4.6 deleted the company’s production database and volume-level backups with a single API call to Railway. Crane says the incident took nine seconds and left customers doing manual recovery work, though a three-month-old backup remained available.
Source: r/singularityResearchers at Socket say a new GlassWorm wave is targeting the OpenVSX extension ecosystem through 73 “sleeper” extensions that become malicious after an update. Six of the extensions have already been activated and are delivering malware, while the rest are under suspicion or appear dormant.
Source: BleepingComputernpm said it is investigating an outage affecting the npm website on Apr. 27, 2026. The status page listed the website as a major outage, while package installation, publishing, search, security audit, and replication feed remained operational.
Source: HN Front PageSecurity vendors Socket and StepSecurity say a self-propagating malware strain has hit multiple npm packages tied to Namastex Labs, stealing secrets from developer environments and attempting to spread further. The campaign overlaps with earlier CanisterWorm infections, though Socket stopped short of attributing this latest incident to TeamPCP.
Source: RedPacket SecurityEuropean regulators warned that AI is enabling faster, more complex cyber attacks, with threat actors using AI to automate reconnaissance, craft social engineering attacks, and find vulnerabilities at machine speed. New regulatory proceedings against X under the Digital Services Act were announced alongside.
Source: The News / European regulatorsOpenClaw, a self-hosted AI agent gateway written in TypeScript, has become GitHub’s most-starred non-aggregator software project after reaching 355,000 stars in about five months. According to the source article, the project runs on developer-owned hardware, connects to more than 50 messaging platforms, and can execute shell commands, file operations, and API calls.
Source: AIThinkerLabThe marketplace.ts module failed to restrict redirect destinations during archive downloads, allowing server-side request forgery. Attackers could redirect plugin downloads to malicious payloads.
Source: RedPacket SecuritySecurity researchers disclosed that MCP's StdioServerParameters allow arbitrary command execution on servers, as commands and arguments passed to create local instances are executed in a server-side shell without input sanitization. Anthropic responded that there is no design flaw and that developers are responsible for input sanitization.
Source: HackadayOX Security documented how MCP's StdioServerParameters allow arbitrary command execution on servers. The parameters passed to create local instances can contain any command and arguments, executed in a server-side shell without input sanitization. Anthropic responded that this is not a design flaw and that input sanitization is the developer's responsibility. Researchers warn that thousands of MCP deployments are effectively running RCE-as-a-Service.
Source: HackadayNIST says it will no longer enrich most vulnerabilities in the National Vulnerability Database because the backlog has grown too large. At the same time, the Cloud Security Alliance and the U.K.’s AI Security Institute say Anthropic’s Claude Mythos Preview can autonomously find and exploit vulnerabilities at a level that changes attacker economics.
Source: KiteworksAnthropic published changes to the Claude Opus 4.7 system prompt, continuing its unusual practice of releasing prompt archives for user-facing chat systems. The update adds stronger child-safety rules, new guidance on tool use and ambiguity handling, and shifts the model’s knowledge cutoff language to January 2026.
Source: Simon WillisonSimon Willison describes a Git-based way to explore Anthropic’s published Claude system prompts. The approach breaks the Markdown source into separate files and timestamped commits so researchers can use standard Git tools to track changes over time.
Source: Simon WillisonAnalysis shows n8n's Docker isolation and tool approval system provide "hard architectural boundaries" that prompt injection cannot override, unlike OpenClaw's prompt-instruction-based security model. The comparison highlights a fundamental design gap.
Source: xCloudIndependent adversarial testing found OpenClaw successfully blocks only 17% of prompt injection attempts. The documented vulnerability makes unrestricted enterprise deployment premature without additional guardrails.
Source: AIThinkerLabAI incidents do not behave like traditional security incidents, according to the source article. Because model outputs can change from one prompt to the next, responders need broader classification, faster containment, and telemetry designed for AI behavior.
Source: Microsoft Security BlogThe official OpenClaw Docker image contains over 2,000 known vulnerabilities including several criticals with no fix available. The container holds Telegram tokens and Slack credentials, making the attack surface significant.
Source: Kilo / r/devsecops / r/sysadminAn Anthropic employee accidentally leaked Claude Code source code through a map file published to the npm registry. Security researcher Chaofan Shou posted the discovery on X, where it was viewed more than 30 million times. The leak exposed internal implementation details of one of the most widely used AI coding assistants.
Source: Cyber Security ReviewThe April security batch fixed 13 vulnerabilities averaging CVSS 7.0, with two crossing the critical threshold. The worst: a device pairing flaw letting any token escalate to full operator access.
Source: Blink Security