Ai-Security
An AI Agent Found 21 Zero-Days in FFmpeg for $1,000 — and Your Container Images Are in Scope
depthfirst's autonomous agent found 21 zero-days in FFmpeg for about $1,000, including a 23-year-old stack overflow. Nine carry CVEs (CVE-2026-39210 through CVE-2026-39218). FFmpeg is bundled everywhere — patch upstream and your embedded copies.
Claude Code's GitHub Action: One Malicious Issue Could Hijack Any Public Repo
A permission bypass chained with prompt injection in Anthropic's Claude Code GitHub Action let a single crafted issue make the agent leak CI secrets and OIDC request tokens — a clean path to poisoning the action's own supply chain. Patched in v1.0.94.
AI at the Wheel: An LLM Agent Ran a Full Cloud Intrusion in Under an Hour
Sysdig's Threat Research Team documented one of the first in-the-wild intrusions where a large language model agent — not a human — drove the entire post-exploitation chain, pivoting from a marimo RCE to a full PostgreSQL dump in four hops.