Skip to content

33 results for “Flue”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types33Articles14Advisories8Papers6Repos3Write-ups2
“Flue”
securityweek.comarticle🛡️ Security

How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI

SecurityWeek article examining US election security through a cybersecurity lens. It covers voting machines certified by the Election Assistance Commission but unpatched for up to two years, machines hacked at DEF CON's Voting Village, and QR-code ballots voters cannot verify. Sequent's Shai Bargil proposes open-source software and encrypted vote records. It also covers AI-enabled influence campaigns such as the 2024 Biden deepfake robocall.

Microsoft ElectionGuard
Election Assistance CommissionVoting VillageDEF CON+9

Threat Intel, AI Security· Published and added 29 Oct 2026

decrypt.coarticle🧠 AI

AI Can Quietly Influence Experts’ Decisions, Anthropic Study Finds

Decrypt reports an Anthropic Alignment team experiment in which 50 professional analysts used Claude Code to advise a fictional farming cooperative. Analysts adopted the agent's hidden, coin-flip-assigned lean on 86% of four analytical decisions (about 50% expected by chance), 77% repeated its arguments, and 15% credited it. Anthropic notes the lean was amplified and tested on one task, field and model, and suggests agents that argue both sides or ask the expert first.

Claude Code
AnthropicDecryptOpenAI+1

ai-safety, agents· Published and added 28 Oct 2026

securityweek.comarticle🛡️ Security

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian's October 2026 security bulletin lists 162 high and 14 critical third-party vulnerabilities across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software and Jira Service Management. SecurityWeek counts 75 unique CVEs, six critical, in Tomcat, Bouncy Castle, Netty and Apache SSHD. Atlassian rates them non-critical for its use, reports no exploitation, and the critical CVE-2026-65905 appears on the portal but not in the bulletin.

ConfluenceJiraBitbucket+3
CVE-2026-65637CVE-2026-65182CVE-2026-68525+6

AppSec, Supply Chain· Published and added 23 Oct 2026

openai.comarticle🧠 AI

How we built ChatGPT’s novel ad stack for user trust and relevance

OpenAI's ChatGPT ad stack uses a custom post-trained LLM, the orchestrator, that makes tool calls for retrieval, filtering, scoring and auction nomination across stateful ad sessions. Ad selection runs in a separate service from answer generation, so ads cannot influence responses or delay them. The post covers ANN retrieval, a model-generated preamble, delivery versus impression, logging, and model-based evaluation.

ChatGPTCodexLLM
OpenAIRitendra DattaKarthik Gopalratnam+1

agents, llm-apps, ai-infra· Published and added 21 Oct 2026

x.comarticle🛡️ Security

Huda (@AlAssaf_H) on X

Source-level review of x64dbg-MCP, GhidraMCP and IDA Pro MCP security, dated October 2026. It covers GHSA-4478-h5jv-647m (missing authentication, 0.0.0.0 bind) and GHSA-jgj3-97w2-9v9r (Content-Length integer overflow before the token check, causing a DoS panic), and compares tags 1.0, v1.1 and v1.2. It separates network reachability, tool authority and semantic influence from hostile binaries. No new exploit is claimed.

Model Context ProtocolGhidrax64dbg+2
GHSA-4478-h5jv-647mGHSA-jgj3-97w2-9v9rprompt injection+5

AI Security, Malware & RE· Added 21 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🛡️ Security

Stealthy Poisoning Attacks via Reused KV Cache of Reasoning

R^2ECAP (Reused Reasoning-Cache Poisoning) is a black-box attack that plants poisoned reasoning traces through a chat interface, exploiting LLM systems that reuse KV caches of reasoning. A preceding trace steers the model, and the retained trace keeps residual adversarial influence in its cache after the preceding trace is discarded. On three open-weight LLMs and three datasets it reaches up to 79% ASR, beats the white-box HijackKV in 8 of 9 settings, and reaches 46% ASR in a reasoning-trace retrieval system. Only 1% of retained responses are flagged by a popular prompt injection detector.

LLM
R^2ECAPHijackKVprompt injection

AI Security· Added 20 Oct 2026, published 16 Oct 2026

anthropic.comarticle🧠 AI

Preparing for the 2026 US midterms

Anthropic's post on Claude's election safeguards ahead of the 2026 US midterms. An analysis of 250,000 conversations found politics at about 5.75% of US Claude.ai chats and requests for voting advice at 0.01%. It covers 99% scores on its political evenhandedness evaluation, third-party reviews, ISD and McCain Institute red-teaming that found multi-step misuse slipped through, new classifiers, and banned influence-operation accounts.

ClaudeClaude.ai
AnthropicClaude Opus 5.5Claude Sonnet 5.5+10

ai-safety, ai-policy, evals· Added 29 Oct 2026, published 14 Oct 2026

securityweek.comarticle🛡️ Security

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Attackers began exploiting CVE-2026-21589, a critical CVSS 9.3 unauthenticated file-read flaw shared by Atlassian Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center products, within hours of WatchTowr publishing technical analysis and PoC code. WatchTowr showed that when Jira is integrated with Crowd, the flaw can read a config file containing plaintext Crowd credentials, enabling creation of a rogue Jira admin account. Previdian honeypots recorded 190 exploitation attempts from 32 IPs across 10 countries within two days; Atlassian has released patches and interim mitigations.

ConfluenceJiraBitbucket+3
CVE-2026-21589watchTowrPrevidian

Threat Intel, AppSec· Published and added 8 Oct 2026

openai.comarticle🛡️ Security

Disrupting AI-enabled “false front” operations

OpenAI reports banning ChatGPT accounts tied to two covert influence operations using "false front" entities. The Russian "Dark Clark" operation ran a think tank (Social Research Center) staffed by unwitting Latin Americans, planted fake emails, audio and documents targeting Ukraine and Argentine, Bolivian and Ecuadorian leaders, and was rated Breakout Scale Category 5. The Iranian "Bogus Bylines" operation used seven fake journalist personas to place nearly 100 articles in online outlets (Category 4) and generated batches of social media comments (Category 2), while using inflated impact metrics in internal reports.

ChatGPTOpenAIVPN+2
Dark ClarkBogus BylinesSocial Research Center+12

Threat Intel, AI Security, OSINT· Published and added 8 Oct 2026

openai.comarticle🧠 AI

Disrupting AI-enabled “false front” operations

OpenAI's threat report describes two banned ChatGPT-account clusters running "false front" influence operations. The Russian "Dark Clark" operation ran a Latin American think tank, the Social Research Center, through unwitting staff and was rated Breakout Scale Category 5, OpenAI's first. The Iranian "Bogus Bylines" operation placed almost 100 articles under seven fake journalist bylines (Category 4) and inflated its own impact metrics.

ChatGPT
OpenAIMetaDark Clark+9

ai-safety, ai-policy· Published and added 8 Oct 2026

orca.securityadvisory🛡️ Security

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Orca Security details CVE-2026-21589 (CVSS 9.3), a critical unauthenticated path traversal flaw affecting all versions of eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Insufficient path validation lets remote attackers read arbitrary files within the web application root without authentication, and in Crowd SSO deployments this can expose plaintext credentials usable to create administrative accounts and take over the entire Atlassian ecosystem. The advisory lists fixed versions for each product and recommends WAF rules and log review for organizations unable to patch immediately.

JiraConfluenceBitbucket+3
CVE-2026-21589path traversal

AppSec, Identity & Access· Published and added 7 Oct 2026

rapid7.comwriteup🛡️ Security

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Rapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root — including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.

BitbucketConfluenceJira+3
CVE-2026-21589CWE-552watchTowr Labs+1

AppSec· Published and added 7 Oct 2026

securityweek.comadvisory🛡️ Security

Atlassian Patches Critical Vulnerability Affecting 8 Products

Atlassian patched CVE-2026-21589 (CVSS 9.3), an unauthenticated arbitrary file access flaw affecting all versions of Bitbucket, Bamboo, Crowd, Crucible, Confluence, Fisheye, Jira Service Management, and Jira Software Data Center. WatchTowr researcher Yordan Ganchev notes that organizations using Crowd for SSO are especially at risk because authentication details are stored in plaintext at a predictable path, letting attackers mint admin accounts if Crowd endpoints are internet-reachable. Fixed versions are listed for each product; Atlassian recommends immediate patching or disconnecting internet-facing instances, with WAF rules as a stopgap.

BitbucketConfluenceJira+2
CVE-2026-21589watchTowrYordan Ganchev

AppSec, Identity & Access· Published and added 7 Oct 2026

labs.watchtowr.comwriteup🛡️ Security

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

CVE-2026-21589 is a pre-auth arbitrary file read in Atlassian Jira, Confluence and Bitbucket, found by diffing atlassian-plugins-webresource 6.0.7 against 6.0.8. The Router's unescapeSlashes turns "::" into "/", so "..::" traversal reaches WEB-INF files through download/resources routes. Reading crowd.properties leaks Crowd app credentials, which allow creating an admin user.

JiraConfluenceBitbucket+3
CVE-2026-21589watchTowrpath traversal+1

AppSec, Offensive Security· Added 30 Oct 2026, published 6 Oct 2026

watchtowr.comadvisory🛡️ Security

Atlassian Jira, Confluence (and more) Arbitrary File Read Vulnerability (CVE-2026-21589)

CVE-2026-21589 is an unauthenticated arbitrary file read (path traversal) in eight Atlassian Data Center and Server products: Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. Atlassian fixed it on 5 October 2026, and CISA added it to the KEV catalog on 15 October 2026. The page lists patching, WAF regex, Tomcat RewriteValve and urlrewrite.xml mitigations, and a log check for ".." sequences after up to two rounds of URL decoding.

JiraConfluenceBitbucket+3
CVE-2026-21589CISA KEVpath traversal+3

AppSec, Blue Team & Detection· Added 30 Oct 2026, published 6 Oct 2026

watchtowr.comadvisory🛡️ Security

Frequently Asked Questions About the Atlassian Jira & Confluence Arbitrary File Read Vulnerability (CVE-2026-21589)

CVE-2026-21589 is an unauthenticated arbitrary file read in eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye Data Center. Attackers must know the exact file path, and watchTowr Intel observed exploitation by 6 October 2026. The FAQ covers the timeline (Atlassian advisory 5 October 2026), upgrade and WAF mitigations, and log searches for two dots next to a slash, backslash or double colon.

JiraConfluenceBitbucket+2
CVE-2026-21589path traversalCISA KEV+1

AppSec, Blue Team & Detection· Added 30 Oct 2026, published 6 Oct 2026

x.comadvisory🛡️ Security

Dark Web Intelligence (@DailyDarkWeb) on X

Atlassian disclosed CVE-2026-21589, a critical (CVSS 9.3) unauthenticated path traversal flaw allowing remote attackers to read specific files within the web application root across its self-managed Data Center/Server products — Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. Fixed versions are listed for each product (e.g. Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19), and Atlassian Cloud is already patched; WAF/URL-rewrite mitigations are available for those who can't upgrade immediately. The post's analyst note clarifies exploitation requires knowing the exact target file path (no directory listing), and as of Oct 5, 2026 it is not yet in CISA KEV with no public exploit reported.

JiraConfluenceBitbucket+3
CVE-2026-21589path traversal

AppSec· Added 7 Oct 2026, published 6 Oct 2026

arxiv.orgpaper🛡️ Security

Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents

This arXiv paper identifies a new attack surface in proactive personal AI agents: an external content provider who controls only material tied to its own target (e.g. a product or service) can manipulate an otherwise benign agent into recommending that target to the user, without compromising the agent or accessing private user context. The authors formalize the attack via three mechanisms — Target Control, Private Binding, and Prospective Support — and show across three proactive-agent environments and six simulated user models that the full attack raises target authorization rates by up to 77.4 percentage points, with a multi-turn variant that keeps influencing the agent's responses even absent final user authorization.

Target ControlPrivate BindingProspective Support

AI Security· Added 6 Oct 2026, published 4 Oct 2026

fortune.comarticle🧠 AI

LeCun has "zero concerns" about AI wiping out humanity, recent "rogue" incidents

Fortune interview with Yann LeCun, who dismisses AI extinction risk and recent "rogue AI" incidents (e.g. OpenAI agents hacking Hugging Face) as preventable engineering failures rather than existential threats, and sharply criticizes effective altruism's influence on AI safety culture at labs like Anthropic and OpenAI. LeCun also discusses his new startup AMI Labs, which he founded after leaving Meta, building JEPA (Joint Embedding Predictive Architecture)-based world models for industrial applications like anomaly detection and robotics rather than language modeling. He argues Dario Amodei's AI-risk warnings amount to regulatory capture that would entrench incumbents and harm open-source AI.

JEPA
Yann LeCunDario AmodeiAnthropic+14

ai-policy· Added 4 Oct 2026, published 3 Oct 2026

github.comrepo🛡️ Security

Sift — Open-Source Secrets/Credential Scanner

Sift is Stratus Security's open-source successor to Snaffler: a Native AOT credential/secrets scanner for pentesters that crawls local drives, SMB shares/subnets, Active Directory, SharePoint/OneDrive/Teams, Slack, and Jira/Confluence for exposed secrets. It supports Kerberos/NTLM/pass-the-hash authentication, resumable checkpointed scans, a JSON rule/ignore-rule system compatible with Snaffler's detection catalogue, and optional local-LLM (Ollama) validation to cut false positives without sending sensitive findings to a cloud API.

.NETActive DirectoryMicrosoft 365+3
Snaffler

Offensive Security· Added 30 Sep 2026

arxiv.orgpaper🛡️ Security

MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI

MemSentry is a proposed pre-commit evaluation framework for agentic AI systems that intercepts proposed writes to persistent memory and issues Accept/Review/Quarantine decisions by jointly scoring source trust, semantic risk, attack radius over a component-dependency graph, access risk, and a signed security-posture delta. The authors evaluate it against 1,000 GPT-4-generated scenarios using four pluggable semantic classifiers (Regex, TF-IDF+SVM, SBERT+LR, SetFit), with SBERT+LR reaching 91.7% accuracy while all methods catch 100% of external quarantine-class threats; the paper also documents a key limitation — surface-similar but oppositely-intentioned insider operations remain hard to distinguish semantically. It targets the persistent-memory-poisoning attack surface distinct from prompt injection, where a single malicious memory write (e.g., "suppress alerts from this IP") can silently persist and influence future agent actions like a SOC assistant's alerting or access decisions.

GPT-4LangChain
SMSRMemAuditMEMSHIELD+2

AI Security· Added 26 Sep 2026

arxiv.orgpaper🧠 AI

When Errors Become Narratives: A Longitudinal Taxonomy of Silent Failures in a Production LLM Agent Runtime

An eight-week longitudinal case study of a production personal-assistant LLM agent runtime (40 scheduled jobs, 8 LLM providers, a tool-governance proxy, and a memory plane) that documented 22 incidents and derived a five-class taxonomy of silent failures: environment/platform quirks, design-assumption mismatches, error swallowing, chained hallucination, and operational blind spots. It introduces "fail-plausible" failures, where an LLM fabricates a fluent, believable narrative to mask an underlying error rather than surfacing it, and finds that audits mostly catch regressions rather than preventing failures, with incident latency tied to failure mechanism rather than code complexity.

agents, ai-infra, research· Added 26 Sep 2026

thehackernews.comarticle🛡️ Security

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

The Hacker News reports on two prompt-injection flaws in Atlassian's Rovo AI assistant: PromptArmor found that a malicious uploaded file could make Rovo silently exfiltrate Jira/Confluence data via a self-constructed URL even with web search disabled, while Varonis Threat Labs disclosed 'RovoBlast,' a one-click attack using the rovoChatPrompt URL parameter to preload attacker instructions and exfiltrate data (including a Confluence API key) through an image-fetch request. Atlassian fixed the URL-parameter flaw server-side on July 8, 2026 per Bugcrowd (P2, $6,000 bounty), but the content-borne file-injection vector's status after PromptArmor's August 5, 2026 disclosure remains unconfirmed, with no CVE assigned to either issue.

Atlassian RovoJiraConfluence
RovoBlastPromptArmorVaronis Threat Labs+1

AI Security· Added 26 Sep 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-65695: Office-Word-MCP-Server through 1

CVE-2026-65695 is a path traversal vulnerability (CWE-22, CVSS 4.0 7.6 HIGH) in Office-Word-MCP-Server through version 1.1.11, an MCP server that exposes Word document manipulation tools to LLM agents. Attackers who can influence the filename argument can supply absolute paths or ../ sequences to document open/save operations, bypassing the check_file_writeable and ensure_docx_extension helpers (which do no base-directory confinement or realpath validation) to read or overwrite arbitrary .docx files outside the intended working directory.

Model Context ProtocolNVDCVSS
CVE-2026-65695CWE-22path traversal+3

AI Security, AppSec· Added 26 Sep 2026

arxiv.orgpaper🛡️ Security

JevOut: Natural Context Can Flip Decision Models

This paper studies "decision models" like Jev, which map unstructured language directly to probability distributions over a fixed set of choices to drive routing, tool selection, and action triggering. The authors use an optimizer guided by the model's own option probabilities to craft short, fluent context additions that preserve the original question and gold answer yet flip the model's decision: 61.4% of initially correct decisions (312/508) are flipped for Jev, with 229 reaching ≥0.7 confidence in the wrong option, and three other decision systems show flip rates of 64.9%-73.2% across seven datasets. The results argue that treating these models' probability outputs as reliable decision interfaces is dangerous, since ordinary contextual phrasing — not adversarial-looking text — is enough to hijack them.

LLM
Jev

AI Security· Added 26 Sep 2026, published 24 Sep 2026

arxiv.orgpaper🧠 AI

JevOut: Natural Context Can Flip Decision Models

This arXiv paper shows that dedicated decision models (e.g., Jev) which map language to probability distributions over finite choices can be "flipped" from a correct answer to a high-confidence wrong one by adding short, fluent, natural-seeming context — without altering the source, question, choices, or gold answer. Using an optimizer that refines context additions based on the model's option probabilities, the authors flip 61.4% of initially correct decisions in Jev within 64 accepted evaluations, and 64.9%-73.2% across three other decision systems on seven datasets. The findings raise concerns about relying on these models' probability outputs as trustworthy decision interfaces for routing, tool selection, or triggering actions.

Jev

research, evals· Added 26 Sep 2026, published 24 Sep 2026

synacktiv.comarticle🛡️ Security

AWS EKS Forensics: Data Sources and Investigation Tooling

Synacktiv's CSIRT breaks down the forensic data sources exposed by Amazon EKS across three layers — Kubernetes control plane (audit logs), data plane (Container Insights/Fluent Bit), and AWS services (GuardDuty EKS Protection, CloudTrail) — and provides concrete CloudWatch Logs Insights queries for RBAC-escalation detection, static pod persistence, node credential theft, and other attack indicators. It also covers node-level acquisition (SSM, kubectl debug), containment pitfalls that destroy evidence, and a full investigation workflow from GuardDuty finding to cross-layer timeline correlation.

AWSKubernetesAmazon EKS+3
PrivilegeEscalation:Kubernetes/PrivilegedContainerPersistence:Kubernetes/ContainerWithSensitiveMountExecution:Runtime/ReverseShell+3

Cloud & Infra, Blue Team & Detection· Added 21 Sep 2026

deepmind.googlearticle🧠 AI

Intelligent transcription with Gemini 3.5 Transcribe

Google DeepMind's Gemini 3.5 Transcribe is a new speech-to-text model offered as two API variants: gemini-3.5-transcribe-live for sub-second-latency real-time streaming via the Live API, and gemini-3.5-transcribe for pre-recorded audio with speaker attribution and word-level timestamps via the Interactions API. It reports Word Error Rates of 4.0% (streaming) and 2.6% (non-streaming) as measured by Artificial Analysis, supports 85+ languages, custom vocabulary, disfluency/filler removal, and function calling to delegate tasks to other Gemini models, and is being rolled into Gboard's Rambler feature, Antigravity, Google AI Studio, and the Gemini macOS app.

GeminiLangChain
Gemini 3.5 TranscribeGoogle DeepMindChirp 3+16

multimodal, models· Added 29 Sep 2026, published 26 Aug 2026

securityweek.comarticle🛡️ Security

Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data

Varonis Threat Labs disclosed RovoBlast, a one-click vulnerability in Atlassian's Rovo enterprise AI assistant where a crafted link using the rovoChatPrompt URL parameter seeded attacker-controlled instructions directly into a victim's live chat session, no jailbreak or permission bypass required. Because Rovo trusted externally supplied parameters and its ResearchAgent tool could autonomously browse and exfiltrate data, a single seeded link let attackers pull sensitive Confluence, Jira, and SharePoint content out to the open web in one automated chain. Atlassian patched the issue before the DEF CON talk and Varonis blog write-up were published; researchers frame the class as "parameter-to-prompt" (P2P) injection, having previously found the same pattern (dubbed Reprompt) in Microsoft Copilot.

Atlassian RovoJiraConfluence+3
RovoBlastVaronis Threat Labsparameter-to-prompt injection+3

AI Security· Added 26 Sep 2026, published 8 Aug 2026

github.comadvisory🛡️ Security

AI Security Briefing

This GHSA advisory documents CVE-2026-27826, a DNS-rebinding TOCTOU bypass of the SSRF fix in the MCP Atlassian server (mcp-atlassian PyPI package). The prior patch (GHSA-7r34-79r5-rcc9) added validate_url_for_ssrf, which resolves the attacker-controlled X-Atlassian-{Jira,Confluence}-Url header host once at middleware time but discards the resolved IP; the actual outbound request later re-resolves the raw hostname at connect time with no IP pinning, so a rebinding DNS name can pass validation with a public IP and then connect to 169.254.169.254 or an internal address, restoring unauthenticated SSRF to cloud metadata/internal services even on the 'patched' build. The advisory includes an executed PoC against the real urls.py, exact code locations (utils/urls.py, servers/main.py, servers/dependencies.py), and remediation via a custom resolver/cached-getaddrinfo adapter to pin the validated IP.

Model Context ProtocolPyPIPython+1
CVE-2026-27826GHSA-489g-7rxv-6c8qGHSA-7r34-79r5-rcc9+3

AppSec, AI Security· Published and added 13 Jul 2026

nvd.nist.govadvisory🛡️ Security

CVE-2026-61447

CVE-2026-61447 describes a critical (CVSS 4.0 score 10.0) remote code execution vulnerability in PraisonAI versions before 1.6.78, rooted in CodeAgent._execute_python(), which runs LLM-generated Python code with no AST validation, import restrictions, or sandbox enforcement. An attacker who can influence the LLM's output via prompt injection can exfiltrate environment secrets and achieve arbitrary code execution on the host, making it a textbook agentic-code-execution flaw (CWE-94).

PraisonAIPythonLLM
CVE-2026-61447GHSA-2xv2-w8cq-5gxwCWE-94

AI Security, AppSec· Published and added 12 Jul 2026

github.comrepo🧠 AI

magnus919/agent-skills

A sprawling open-source collection of 100+ reusable "Agent Skills" (markdown instruction packs with YAML frontmatter following the open Agent Skills format) for agentic systems, compatible with Claude Code and any framework that supports the standard. Skills span multi-agent orchestration frameworks (AutoGen, CrewAI, LangChain, LangGraph, LlamaIndex, DSPy, Haystack, a PydanticAI-based multi-agent debate tool), production agent operations, evals, and AI governance, alongside dozens of narrower domain skills — CLI integrations for Jira, Confluence, Notion, Linear, HubSpot, Ghost, Fireflies, Grafana, PostgreSQL, Kubernetes, Docker Compose, FFmpeg, Ghidra-based binary triage, FPGA/ESP32 hardware design, and more. The page text was truncated at 40,000 of 71,286 characters, so later entries in the catalog are not reflected here.

CrewAILangChainLangGraph+17
PydanticGraphMicrosoftStanford University+5

coding-agents, prompting· Added 1 Oct 2026, published 11 Jul 2026

github.comrepo🧠 AI

loop-js/loop.js

loop.js is a TypeScript framework for "loop engineering": you define a goal and a verification bar, and the engine runs an agent through repeated Rounds (Execute → Handoff → Verify → Persist) with fresh context each round, memory read back from disk, until a separate skeptical judge agent rules the goal met, gives up, or a budget guard (rounds/usd/timeout) fires. It ships a CLI (`loop run`, `loop status`, `loop cron`) for one-off runs or scheduled/recurring loops (local or deployed to Modal), a typed async-iterable event stream for embedding in products, and runs its worker/judge agents on the Claude Agent SDK. It's positioned against bare `while(true)` agent loops and Claude Code's own `/loop` command, aiming at loops that outlive a terminal session — cron-triggered chores, financial-trade auditing, or long-running builds — where "done" must be judged by an agent the worker can't influence.

TypeScriptNode.jsBun+1
ModalClaude Haiku 4.5

agents· Added 30 Sep 2026, published 10 Jul 2026