{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:23:59.585Z", "tag": { "id": "ai", "label": "AI / LLM tooling", "isStack": true, "url": "https://pwn.watch/t/ai", "feed": "https://pwn.watch/t/ai/feed.xml" }, "counts": { "incidents": 21, "live": 4, "notFullyPatched": 2, "patched": 19 }, "incidents": [ { "slug": "us-banks-unauthorized-ai-agents-customer-accounts", "title": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts", "json": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts.json", "status": "live", "severity": "medium", "patchStatus": "partial", "product": "Online banking accounts at major U.S. banks (Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, Citi)", "tags": [ "ai", "jpmorgan", "bank-of-america", "morgan-stanley", "wells-fargo", "citi", "banking", "ai-agents" ], "cveIds": [], "affectedVersions": [ "Customer accounts where a third-party AI agent logs in with the customer's banking username and password" ], "fixedVersions": [ "Morgan Stanley: blocking third-party agents", "JPMorgan, Bank of America, Citi: restricting agent access", "Most banks: moving to read-only access through authorized data connectors" ], "startedAt": "2026-10-22", "closedAt": null, "updatedAt": "2026-10-22T16:53:42+02:00", "summary": "Axios reports that major U.S. banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are detecting third-party AI agents operating inside customer accounts. In most cases the agent logs in with the customer's own credentials and permission, which breaks bank rules that require people to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific AI agent products have been reported. Morgan Stanley is blocking third-party agents and JPMorgan, Bank of America and Citi are restricting them. Don't give an AI agent your bank username and password.", "xPost": null }, { "slug": "litellm-1-107-0-pypi-compromise", "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise", "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "LiteLLM (PyPI + official Docker/GHCR images)", "tags": [ "python", "pypi", "docker", "ai", "litellm", "supply-chain" ], "cveIds": [ "MAL-2026-2144" ], "affectedVersions": [ "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window" ], "fixedVersions": [ "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T16:00:44+02:00", "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.", "xPost": null }, { "slug": "opencode-mcp-oauth-rce-windows", "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows", "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL", "tags": [ "ai", "devtools", "windows", "opencode", "mcp" ], "cveIds": [], "affectedVersions": [ "OpenCode 1.0.137 through 1.18.32 on Windows and WSL" ], "fixedVersions": [ "OpenCode 1.18.33" ], "startedAt": "2026-10-19", "closedAt": null, "updatedAt": "2026-10-22T16:00:44+02:00", "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.", "xPost": null }, { "slug": "opencode-console-provider-key-breach", "title": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "url": "https://pwn.watch/i/opencode-console-provider-key-breach", "json": "https://pwn.watch/i/opencode-console-provider-key-breach.json", "status": "live", "severity": "high", "patchStatus": "partial", "product": "OpenCode Console (hosted service by Anomaly)", "tags": [ "ai", "opencode", "data-breach" ], "cveIds": [], "affectedVersions": [ "OpenCode Console workspaces with saved OpenAI, Anthropic or Google provider keys (~1.4% of Console users; affected users were emailed)" ], "fixedVersions": [], "startedAt": "2026-10-17T00:30:00Z", "closedAt": null, "updatedAt": "2026-10-22T16:32:37+02:00", "summary": "On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-59822", "title": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-59822.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "mcp", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-59822" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.", "xPost": null }, { "slug": "mlflow-mlflow-cve-2026-64849", "title": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849", "json": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "MLflow MLflow", "tags": [ "python", "ai", "mlflow", "cisa-kev" ], "cveIds": [ "CVE-2026-64849" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-19", "closedAt": "2026-08-19", "updatedAt": "2026-08-19", "summary": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19.", "xPost": null }, { "slug": "ray-project-ray-cve-2025-62593", "title": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593", "json": "https://pwn.watch/i/ray-project-ray-cve-2025-62593.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ray-Project Ray", "tags": [ "python", "ai", "ray", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-62593" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-17", "closedAt": "2026-08-17", "updatedAt": "2026-08-17", "summary": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.", "xPost": null }, { "slug": "ibm-langflow-cve-2026-9198", "title": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198", "json": "https://pwn.watch/i/ibm-langflow-cve-2026-9198.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "IBM Langflow", "tags": [ "python", "ai", "langflow", "ibm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-9198" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-04", "closedAt": "2026-08-04", "updatedAt": "2026-08-04", "summary": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-0770", "title": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-0770.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev" ], "cveIds": [ "CVE-2026-0770" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-21", "closedAt": "2026-07-21", "updatedAt": "2026-07-21", "summary": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-55255", "title": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-55255.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev" ], "cveIds": [ "CVE-2026-55255" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-07", "closedAt": "2026-07-07", "updatedAt": "2026-07-07", "summary": "Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-42271", "title": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42271.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-42271", "CVE-2026-48710" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-08", "closedAt": "2026-06-08", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.", "xPost": null }, { "slug": "langflow-langflow-cve-2025-34291", "title": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291", "json": "https://pwn.watch/i/langflow-langflow-cve-2025-34291.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev" ], "cveIds": [ "CVE-2025-34291" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-21", "closedAt": "2026-05-21", "updatedAt": "2026-05-21", "summary": "Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Added to CISA KEV on 2026-05-21.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-42208", "title": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42208.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "cisa-kev", "sql-injection" ], "cveIds": [ "CVE-2026-42208" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-08", "closedAt": "2026-05-08", "updatedAt": "2026-05-08", "summary": "BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-33017", "title": "Langflow Langflow: Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-33017.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-33017" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-25", "closedAt": "2026-03-25", "updatedAt": "2026-03-25", "summary": "Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.", "xPost": null }, { "slug": "mixpanel-smishing-breach-openai-api-users-2025", "title": "Mixpanel smishing breach exposes OpenAI API users' names and emails", "url": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025", "json": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025.json", "status": "closed", "severity": "medium", "patchStatus": "no-fix-needed", "product": "Mixpanel (analytics vendor); OpenAI API platform users", "tags": [ "ai", "mixpanel", "openai", "smishing", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2025-11-08", "closedAt": "2025-11-27", "updatedAt": "2025-11-27", "summary": "Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.", "xPost": null }, { "slug": "nx-s1ngularity-npm-supply-chain-august-2025", "title": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025", "json": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "nx and @nx/* npm packages", "tags": [ "npm", "node", "github-actions", "ai", "nx", "s1ngularity", "github", "supply-chain", "infostealer" ], "cveIds": [], "affectedVersions": [ "nx 20.9.0-20.12.0, 21.5.0-21.8.0", "@nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0", "@nx/eslint 21.5.0", "@nx/key, @nx/enterprise-cloud 3.2.0" ], "fixedVersions": [ "Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)" ], "startedAt": "2025-08-26", "closedAt": "2025-08-29", "updatedAt": "2025-08-29", "summary": "Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.", "xPost": null }, { "slug": "langflow-cve-2025-3248", "title": "Langflow: Missing Authentication Vulnerability", "url": "https://pwn.watch/i/langflow-cve-2025-3248", "json": "https://pwn.watch/i/langflow-cve-2025-3248.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Langflow", "tags": [ "ai", "python", "langflow", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-3248" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-05", "closedAt": "2025-05-05", "updatedAt": "2025-05-05", "summary": "Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.", "xPost": null }, { "slug": "deepseek-exposed-clickhouse-database-january-2025", "title": "DeepSeek leaves ClickHouse database open: chat logs and API keys exposed", "url": "https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025", "json": "https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "DeepSeek backend (ClickHouse)", "tags": [ "ai", "deepseek", "data-breach" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [ "Database secured by DeepSeek" ], "startedAt": "2025-01-29", "closedAt": "2025-01-29", "updatedAt": "2025-01-29", "summary": "Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.", "xPost": null }, { "slug": "ultralytics-pypi-supply-chain-attack", "title": "Ultralytics PyPI releases backdoored with a crypto miner", "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack", "json": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ultralytics (PyPI)", "tags": [ "python", "pypi", "github-actions", "ai", "ultralytics", "supply-chain", "cryptominer", "github" ], "cveIds": [], "affectedVersions": [ "8.3.41", "8.3.42", "8.3.45", "8.3.46" ], "fixedVersions": [ "Malicious versions removed from PyPI; see vendor advisory for the clean release" ], "startedAt": "2024-12-04", "closedAt": "2024-12-11", "updatedAt": "2024-12-11", "summary": "Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.", "xPost": null }, { "slug": "hugging-face-spaces-secrets-leak", "title": "Hugging Face Spaces secrets accessed without authorization", "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak", "json": "https://pwn.watch/i/hugging-face-spaces-secrets-leak.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Hugging Face Spaces", "tags": [ "ai", "hosting", "hugging-face", "secrets", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-05-31", "closedAt": "2024-05-31", "updatedAt": "2024-05-31", "summary": "Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.", "xPost": null }, { "slug": "microsoft-ai-research-sas-token-38tb-exposure-2023", "title": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023", "json": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Azure Storage (SAS token in a GitHub repo)", "tags": [ "ai", "microsoft", "azure", "github", "secrets", "misconfiguration", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-06-22", "closedAt": "2023-09-18", "updatedAt": "2023-09-18", "summary": "A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.", "xPost": null } ], "posts": [ { "authorName": "*Walter Bloomberg", "handle": "DeItaone", "avatarUrl": "https://pbs.twimg.com/profile_images/2088360110095478784/El9anzXH_bigger.jpg", "text": "MAJOR U.S. BANKS DETECT UNAUTHORIZED AI AGENTS ACCESSING CUSTOMER ACCOUNTS — AXIOS\n\nMajor banks, including $JPM, $BAC, $MS and $WFC, are confronting security risks from third-party AI agents accessing customer accounts, according to Axios.\n\nSome agents have reportedly attempted actions beyond user instructions, raising concerns about unauthorized transactions and fund transfers.\n\nMorgan Stanley has begun blocking third-party agents, while JPMorgan, Bank of America and Citi are restricting access.\n\nBanks warn they cannot reliably distinguish legitimate user activity from autonomous AI agents, even when customers have voluntarily shared their credentials.", "date": "2026-10-22T13:58:38.000Z", "url": "https://x.com/DeItaone/status/2113268796618068421", "media": [], "incident": "us-banks-unauthorized-ai-agents-customer-accounts" }, { "authorName": "Axios", "handle": "axios", "avatarUrl": "https://pbs.twimg.com/profile_images/1641458976049995776/GtO-0zYe_bigger.jpg", "text": "SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appear to be independent of user instructions. https://t.co/QGmAmvmtEK", "date": "2026-10-22T13:56:18.000Z", "url": "https://x.com/axios/status/2113268208371126348", "media": [], "incident": "us-banks-unauthorized-ai-agents-customer-accounts" }, { "authorName": "Help Net Security", "handle": "helpnetsecurity", "avatarUrl": "https://pbs.twimg.com/profile_images/1602979161932455937/3RwfWo0d_bigger.jpg", "text": "LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - https://t.co/7iolIMAKe8 - @GossiTheDog @RockHudsonRock @cloudsek @wiz_io @AikidoSecurity @SocketSecurity - #LiteLLM #SupplyChainAttack #OpenSource #malware #Cybersecurity #CyberSecurityNews https://t.co/ZLPywonXYC", "date": "2026-10-22T13:26:50.000Z", "url": "https://x.com/helpnetsecurity/status/2113260794544796098", "media": [], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Madison Mills", "handle": "MadisonMills22", "avatarUrl": "https://pbs.twimg.com/profile_images/1784997467039170560/0Vttab_c_bigger.jpg", "text": "SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.\n\nThe findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.\n\nSeveral banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.\n\nSeveral bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.\n\nRead my latest for Axios here: https://t.co/Q3bda5In8q", "date": "2026-10-22T12:48:05.000Z", "url": "https://x.com/MadisonMills22/status/2113251043173683683", "media": [], "incident": "us-banks-unauthorized-ai-agents-customer-accounts" }, { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.\n\nFixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.\n\nWhat developers need to know: https://t.co/l6N4LCjhWt", "date": "2026-10-22T10:44:40.000Z", "url": "https://x.com/TheHackersNews/status/2113219984365359340", "media": [], "incident": "opencode-mcp-oauth-rce-windows" }, { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "🚨 LiteLLM 1.107.0 compromised in a supply chain attack.\n\nMalicious PyPI packages and Docker images delivered a credential stealer and backdoor.\n\n⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.\n\n🔗 Full story: https://t.co/ANqBuYaGx5", "date": "2026-10-21T18:02:10.000Z", "url": "https://x.com/TheHackersNews/status/2112967698103894257", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVLE6tcakAATDtC.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Moshe Siman Tov Bustan", "handle": "MosheTov", "avatarUrl": "https://pbs.twimg.com/profile_images/1998067906706345984/SwYIhsPZ_bigger.jpg", "text": "❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware!\n\nTLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP.\n\nThe malware combines two threats in one https://t.co/WjpMeKcVgg", "date": "2026-10-21T15:46:21.000Z", "url": "https://x.com/MosheTov/status/2112933514962247891", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVKl1H6XQAAPSJw.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Cyber Security News", "handle": "The_Cyber_News", "avatarUrl": "https://pbs.twimg.com/profile_images/1174924326807592960/aJMuU6Ms_bigger.jpg", "text": "‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release\n\nDetails: https://t.co/8rlH8xijjj\n\nLiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed https://t.co/caDoffOmFx", "date": "2026-10-21T15:21:29.000Z", "url": "https://x.com/The_Cyber_News/status/2112927256956088756", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVKf10bawAAfyb6.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Socket", "handle": "SocketSecurity", "avatarUrl": "https://pbs.twimg.com/profile_images/2057141188591824896/aKdKFNEE_bigger.jpg", "text": "🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.\n\nVersion 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools. https://t.co/4Mbt1LbhLu", "date": "2026-10-21T14:03:54.000Z", "url": "https://x.com/SocketSecurity/status/2112907732877775016", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVKNz_RWYAAoI1O.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "dax", "handle": "thdxr", "avatarUrl": "https://pbs.twimg.com/profile_images/1602333093485891584/mmVqjFNI_bigger.jpg", "text": "they've been non stop trying to attack our systems for the past 48 hours\n\na side effect is everything is getting hardened but damn we basically need agents going 24/7\n\nbecause that's what they have", "date": "2026-10-18T12:04:27.000Z", "url": "https://x.com/thdxr/status/2111790511409258796", "media": [], "incident": "opencode-console-provider-key-breach" }, { "authorName": "dax", "handle": "thdxr", "avatarUrl": "https://pbs.twimg.com/profile_images/1602333093485891584/mmVqjFNI_bigger.jpg", "text": "@lydiahallie note this is the OpenCode Console, not OpenCode itself, those keys never come to us", "date": "2026-10-17T21:38:37.000Z", "url": "https://x.com/thdxr/status/2111572618340188393", "media": [], "incident": "opencode-console-provider-key-breach" }, { "authorName": "OpenCode", "handle": "opencode", "avatarUrl": "https://pbs.twimg.com/profile_images/1973794620233433088/nBn75BTm_bigger.png", "text": "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users\n\nWe have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers", "date": "2026-10-17T18:08:06.000Z", "url": "https://x.com/opencode/status/2111519637049319818", "media": [], "incident": "opencode-console-provider-key-breach" } ], "changes": [ { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Axios scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley is blocking agents and JPMorgan, Bank of America and Citi are restricting them.", "body": null, "sourceUrl": "https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Chase tells Axios that customers should not give their usernames and passwords to anyone. Morgan Stanley says it hasn't observed \"rogue AI agents accessing our platforms.\"", "body": null, "sourceUrl": "https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Reuters picks up the Axios report and says it could not immediately verify it.", "body": null, "sourceUrl": "https://www.thestar.com.my/tech/tech-news/2026/10/22/us-banks-detect-unauthorized-ai-agents-in-customer-accounts-axios-reports", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious 1.107.0 wheels appear on PyPI.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.", "body": null, "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T13:23Z", "title": "PyPI quarantines/pulls the package (~2h window).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T14:20Z", "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T16:20Z", "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T20:30Z", "title": "LiteLLM posts containment update; investigation ongoing.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week.", "body": null, "sourceUrl": "https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.", "body": null, "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-19", "title": "BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-18", "title": "Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111790511409258796", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17T00:30Z", "title": "Earliest possible exposure of saved provider keys (per OpenCode's email to affected users).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-console-breach-may-have.html", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users.", "body": null, "sourceUrl": "https://x.com/opencode/status/2111519637049319818", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "opencode-console-provider-key-breach", "incidentTitle": "OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys", "severity": "high", "status": "live", "patchStatus": "partial", "date": "2026-10-17", "title": "Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start.", "body": null, "sourceUrl": "https://x.com/thdxr/status/2111572618340188393", "url": "https://pwn.watch/i/opencode-console-provider-key-breach" }, { "incident": "us-banks-unauthorized-ai-agents-customer-accounts", "incidentTitle": "Major U.S. banks detect unauthorized third-party AI agents inside customer accounts", "severity": "medium", "status": "live", "patchStatus": "partial", "date": "2026-10-13", "title": "JPMorgan says it blocks outside AI agents from operating retail customer accounts. Jamie Dimon warns of \"rogue agents\" and says customers who use them should understand there's a \"liability transfer\".", "body": null, "sourceUrl": "https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html", "url": "https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-09-28", "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "berriai-litellm-cve-2026-59822", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822" }, { "incident": "opencode-mcp-oauth-rce-windows", "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-08-29", "title": "Pillar Security privately reports the flaw to Anomaly.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html", "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows" }, { "incident": "mlflow-mlflow-cve-2026-64849", "incidentTitle": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-19", "title": "CISA added CVE-2026-64849 to the KEV catalog (due 2026-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849" }, { "incident": "ray-project-ray-cve-2025-62593", "incidentTitle": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-17", "title": "CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593" }, { "incident": "ibm-langflow-cve-2026-9198", "incidentTitle": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198" }, { "incident": "langflow-langflow-cve-2026-0770", "incidentTitle": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-21", "title": "CISA added CVE-2026-0770 to the KEV catalog (due 2026-07-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770" }, { "incident": "langflow-langflow-cve-2026-55255", "incidentTitle": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-55255 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255" }, { "incident": "berriai-litellm-cve-2026-42271", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271" }, { "incident": "langflow-langflow-cve-2025-34291", "incidentTitle": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-21", "title": "CISA added CVE-2025-34291 to the KEV catalog (due 2026-06-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291" }, { "incident": "berriai-litellm-cve-2026-42208", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-08", "title": "CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208" }, { "incident": "langflow-langflow-cve-2026-33017", "incidentTitle": "Langflow Langflow: Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-25", "title": "CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017" }, { "incident": "mixpanel-smishing-breach-openai-api-users-2025", "incidentTitle": "Mixpanel smishing breach exposes OpenAI API users' names and emails", "severity": "medium", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-11-26", "title": "OpenAI discloses impact on API users and drops Mixpanel", "body": null, "sourceUrl": "https://openai.com/index/mixpanel-incident/", "url": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025" }, { "incident": "mixpanel-smishing-breach-openai-api-users-2025", "incidentTitle": "Mixpanel smishing breach exposes OpenAI API users' names and emails", "severity": "medium", "status": "closed", "patchStatus": "no-fix-needed", "date": "2025-11-08", "title": "Mixpanel detects the smishing campaign and unauthorized export", "body": null, "sourceUrl": "https://openai.com/index/mixpanel-incident/", "url": "https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-28/29", "title": "Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens", "body": null, "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-27", "title": "GitHub disables attacker-created s1ngularity repositories (09:00 UTC)", "body": null, "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-26", "title": "Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening", "body": null, "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-24", "title": "Attacker exploits the workflow and exfiltrates the npm token", "body": null, "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "nx-s1ngularity-npm-supply-chain-august-2025", "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-08-21", "title": "A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx", "body": null, "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c", "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025" }, { "incident": "langflow-cve-2025-3248", "incidentTitle": "Langflow: Missing Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-05", "title": "CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-cve-2025-3248" }, { "incident": "deepseek-exposed-clickhouse-database-january-2025", "incidentTitle": "DeepSeek leaves ClickHouse database open: chat logs and API keys exposed", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-29", "title": "Wiz finds the exposed database and reports it; DeepSeek secures it within an hour", "body": null, "sourceUrl": "https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak", "url": "https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025" }, { "incident": "ultralytics-pypi-supply-chain-attack", "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-11", "title": "PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed", "body": null, "sourceUrl": "https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/", "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack" }, { "incident": "ultralytics-pypi-supply-chain-attack", "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-05", "title": "Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner", "body": null, "sourceUrl": "https://github.com/ultralytics/ultralytics/issues/18027", "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack" }, { "incident": "hugging-face-spaces-secrets-leak", "incidentTitle": "Hugging Face Spaces secrets accessed without authorization", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-05-31", "title": "Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens", "body": null, "sourceUrl": "https://huggingface.co/blog/space-secrets-disclosure", "url": "https://pwn.watch/i/hugging-face-spaces-secrets-leak" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "Public disclosure by Wiz and Microsoft", "body": null, "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-24", "title": "Microsoft revokes the SAS token", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-22", "title": "Wiz reports the exposure to Microsoft", "body": null, "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" } ] }