// tag

AI / LLM tooling

LLM gateways, agent builders and ML platforms. Newest first.

incidents: 14
live: 4
patched: 12

rss json llms.txt all tags

## 14 AI / LLM tooling incidents in the last year

through Oct 22, 2026

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

mediumlivepartial fixsince Oct 22, 2026updated Oct 22, 2026, 16:53 UTC
Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
› Online banking accounts at major U.S. banks (Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, Citi)
Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.
criticallivepatchedsince Oct 21, 2026updated Oct 22, 2026, 16:00 UTC
LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
› LiteLLM (PyPI + official Docker/GHCR images)
On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.
MAL-2026-2144
criticallivepatchedsince Oct 19, 2026updated Oct 22, 2026, 16:00 UTC
OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)
› OpenCode AI coding agent (Anomaly) on Windows and WSL
A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.
highlivepartial fixsince Oct 17, 2026updated Oct 22, 2026, 16:32 UTC
OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys
› OpenCode Console (hosted service by Anomaly)
On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.

show 10 older incidents

September 2026 1

Sep 2highBerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerabilitypatched
› BerriAI LiteLLM patched
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.
open incident →CVE-2026-59822

August 2026 3

Aug 19highMLflow MLflow: MLflow Server-Side Request Forgery Vulnerabilitypatched
› MLflow MLflow patched
MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19.
open incident →CVE-2026-64849
Aug 17highRay-Project Ray: Ray-Project Ray Code Injection Vulnerabilitypatched
› Ray-Project Ray patched
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.
open incident →CVE-2025-62593
Aug 4highIBM Langflow: IBM Langflow Code Injection Vulnerabilitypatched
› IBM Langflow patched
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.
open incident →CVE-2026-9198

July 2026 2

Jul 21highLangflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21.
open incident →CVE-2026-0770
Jul 7highLangflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07.
open incident →CVE-2026-55255

June 2026 1

Jun 8highBerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerabilitypatched
› BerriAI LiteLLM patched
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.
open incident →CVE-2026-42271 · CVE-2026-48710

May 2026 2

May 21highLangflow Langflow: Langflow Origin Validation Error Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Added to CISA KEV on 2026-05-21.
open incident →CVE-2025-34291
May 8highBerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerabilitypatched
› BerriAI LiteLLM patched
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.
open incident →CVE-2026-42208

March 2026 1

Mar 25highLangflow Langflow: Langflow Code Injection Vulnerabilitypatched
› Langflow Langflow patched
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.
open incident →CVE-2026-33017

## posts 12

› Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
*Walter Bloomberg
@DeItaone
MAJOR U.S. BANKS DETECT UNAUTHORIZED AI AGENTS ACCESSING CUSTOMER ACCOUNTS — AXIOS Major banks, including $JPM, $BAC, $MS and $WFC, are confronting security risks from third-party AI agents accessing customer accounts, according to Axios. Some agents have reportedly attempted actions beyond user instructions, raising concerns about unauthorized transactions and fund transfers. Morgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting access. Banks warn they cannot reliably distinguish legitimate user activity from autonomous AI agents, even when customers have voluntarily shared their credentials.
Oct 22, 2026view on x
› Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
Axios
@axios
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. t.co/QGmAmvmtEK
Oct 22, 2026view on x
› LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
Help Net Security
@helpnetsecurity
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - t.co/7iolIMAKe8 - @GossiTheDog @RockHudsonRock @cloudsek @wiz_io @AikidoSecurity @SocketSecurity - #LiteLLM #SupplyChainAttack #OpenSource #malware #Cybersecurity #CyberSecurityNews t.co/ZLPywonXYC
Oct 22, 2026view on x
› Major U.S. banks detect unauthorized third-party AI agents inside customer accounts
Madison Mills
@MadisonMills22
SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: t.co/Q3bda5In8q
Oct 22, 2026view on x
› OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)
The Hacker News
@TheHackersNews
🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in. Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions. What developers need to know: t.co/l6N4LCjhWt
Oct 22, 2026view on x
› LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
The Hacker News
@TheHackersNews
🚨 LiteLLM 1.107.0 compromised in a supply chain attack. Malicious PyPI packages and Docker images delivered a credential stealer and backdoor. ⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials. 🔗 Full story: t.co/ANqBuYaGx5
Oct 21, 2026view on x

+6 more on the incident pages above.

Get notified

AI / LLM tooling

## 14 AI / LLM tooling incidents in the last year

Major U.S. banks detect unauthorized third-party AI agents inside customer accounts

LiteLLM 1.107.0 PyPI/Docker supply-chain compromise

OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)

OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys