Browse public community intelligence reports, source analysis, and threat research.
32 intel reports
Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.
Researchers identified a lethal trifecta where a public AI triage agent was prompt-injected to trigger a privileged code-fixing agent, leading to RCE and credential theft in GitHub Actions.
A maximum-severity RCE vulnerability in the Ruflo AI agent platform allows unauthenticated attackers to execute commands and poison agent memory.
The FakeGit campaign leverages 7,600 malicious GitHub repositories and the 'AgentBaiting' technique to trick AI agents into recommending SmartLoader and StealC malware.
Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.
ShinyHunters compromised the @asyncapi NPM organization via a GitHub Actions CI/CD exploit to deliver the Miasma modular runtime using import-time execution.
A threat actor compromised the jscrambler npm package, delivering cross-platform Rust-based infostealers through malicious preinstall hooks and self-executing functions targeting developers and CI/CD environments.
Amazon Q Developer and several AI coding assistants were found vulnerable to arbitrary code execution and cloud credential theft via the automatic loading of Model Context Protocol (MCP) server configurations.
