https://pwn.watch/t/ai Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts us-banks-unauthorized-ai-agents-customer-accounts:2026-10-22:Axios scoop: major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley is blocking agents and JPMorgan, Bank of America and Citi are restricting them. Thu, 22 Oct 2026 00:00:00 GMT medium Source: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access Status: live, partial https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts us-banks-unauthorized-ai-agents-customer-accounts:2026-10-22:Chase tells Axios that customers should not give their usernames and passwords to anyone. Morgan Stanley says it hasn't observed "rogue AI agents accessing our platforms." Thu, 22 Oct 2026 00:00:00 GMT medium Source: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access Status: live, partial https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts us-banks-unauthorized-ai-agents-customer-accounts:2026-10-22:Reuters picks up the Axios report and says it could not immediately verify it. Thu, 22 Oct 2026 00:00:00 GMT medium Source: https://www.thestar.com.my/tech/tech-news/2026/10/22/us-banks-detect-unauthorized-ai-agents-in-customer-accounts-axios-reports Status: live, partial https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-22:LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-22:StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer Status: live, patched https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-10-22:The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T11:39Z:Malicious 1.107.0 wheels appear on PyPI. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T11:39Z:Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://docs.litellm.ai/blog/security-incident-oct-21-2026 Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T13:23Z:PyPI quarantines/pulls the package (~2h window). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T14:20Z:Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T16:20Z:Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html Status: live, patched https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T20:30Z:LiteLLM posts containment update; investigation ongoing. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-20:Anthropic credit restoration still in progress; OpenCode says it will cover them itself if not done this week. Tue, 20 Oct 2026 00:00:00 GMT high Source: https://ctxsec.com/items/opencode-console-provider-key-breach-2026-10 Status: live, partial https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-19:LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports). Mon, 19 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html Status: live, patched https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-10-19:Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary. Mon, 19 Oct 2026 00:00:00 GMT critical Source: https://x.com/Pillar_sec/status/2112166888985722937 Status: live, patched https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-19:BleepingComputer and The Hacker News report unauthorized charges up to ~$1,700 and Google Cloud project suspensions; OpenAI says it refunded affected credits. Mon, 19 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-18:Dax says attackers have been 'non stop' attacking OpenCode's systems for 48 hours; systems being hardened. Sun, 18 Oct 2026 00:00:00 GMT high Source: https://x.com/thdxr/status/2111790511409258796 Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-17T00:30Z:Earliest possible exposure of saved provider keys (per OpenCode's email to affected users). Sat, 17 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/opencode-console-breach-may-have.html Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-17:OpenCode emails affected users, then announces the breach on X, tied to a 'large scale distillation attack' affecting 1.4% of Console users. Sat, 17 Oct 2026 00:00:00 GMT high Source: https://x.com/opencode/status/2111519637049319818 Status: live, partial https://pwn.watch/i/opencode-console-provider-key-breach opencode-console-provider-key-breach:2026-10-17:Dax (OpenCode) clarifies only the hosted Console is affected; keys used locally with the OpenCode app never reach OpenCode. Anthropic and Google revoke/block exposed keys; refunds start. Sat, 17 Oct 2026 00:00:00 GMT high Source: https://x.com/thdxr/status/2111572618340188393 Status: live, partial https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts us-banks-unauthorized-ai-agents-customer-accounts:2026-10-13:JPMorgan says it blocks outside AI agents from operating retail customer accounts. Jamie Dimon warns of "rogue agents" and says customers who use them should understand there's a "liability transfer". Tue, 13 Oct 2026 00:00:00 GMT medium Source: https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html Status: live, partial https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-09-28:OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security. Mon, 28 Sep 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/berriai-litellm-cve-2026-59822 berriai-litellm-cve-2026-59822:2026-09-02:CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-08-29:Pillar Security privately reports the flaw to Anomaly. Sat, 29 Aug 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/mlflow-mlflow-cve-2026-64849 mlflow-mlflow-cve-2026-64849:2026-08-19:CISA added CVE-2026-64849 to the KEV catalog (due 2026-09-02). Wed, 19 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ray-project-ray-cve-2025-62593 ray-project-ray-cve-2025-62593:2026-08-17:CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20). Mon, 17 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ibm-langflow-cve-2026-9198 ibm-langflow-cve-2026-9198:2026-08-04:CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07). Tue, 04 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/langflow-langflow-cve-2026-0770 langflow-langflow-cve-2026-0770:2026-07-21:CISA added CVE-2026-0770 to the KEV catalog (due 2026-07-24). Tue, 21 Jul 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/langflow-langflow-cve-2026-55255 langflow-langflow-cve-2026-55255:2026-07-07:CISA added CVE-2026-55255 to the KEV catalog (due 2026-07-10). Tue, 07 Jul 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/berriai-litellm-cve-2026-42271 berriai-litellm-cve-2026-42271:2026-06-08:CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22). Mon, 08 Jun 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/langflow-langflow-cve-2025-34291 langflow-langflow-cve-2025-34291:2026-05-21:CISA added CVE-2025-34291 to the KEV catalog (due 2026-06-04). Thu, 21 May 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/berriai-litellm-cve-2026-42208 berriai-litellm-cve-2026-42208:2026-05-08:CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11). Fri, 08 May 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/langflow-langflow-cve-2026-33017 langflow-langflow-cve-2026-33017:2026-03-25:CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08). Wed, 25 Mar 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025 mixpanel-smishing-breach-openai-api-users-2025:2025-11-26:OpenAI discloses impact on API users and drops Mixpanel Wed, 26 Nov 2025 00:00:00 GMT medium Source: https://openai.com/index/mixpanel-incident/ Status: closed, no-fix-needed https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025 mixpanel-smishing-breach-openai-api-users-2025:2025-11-08:Mixpanel detects the smishing campaign and unauthorized export Sat, 08 Nov 2025 00:00:00 GMT medium Source: https://openai.com/index/mixpanel-incident/ Status: closed, no-fix-needed https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-28/29:Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens Thu, 28 Aug 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/s1ngularity-supply-chain-attack Status: closed, patched https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-27:GitHub disables attacker-created s1ngularity repositories (09:00 UTC) Wed, 27 Aug 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/s1ngularity-supply-chain-attack Status: closed, patched https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-26:Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening Tue, 26 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-24:Attacker exploits the workflow and exfiltrates the npm token Sun, 24 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025 nx-s1ngularity-npm-supply-chain-august-2025:2025-08-21:A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx Thu, 21 Aug 2025 00:00:00 GMT critical Source: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c Status: closed, patched https://pwn.watch/i/langflow-cve-2025-3248 langflow-cve-2025-3248:2025-05-05:CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26). Mon, 05 May 2025 00:00:00 GMT critical Status: closed, patched https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025 deepseek-exposed-clickhouse-database-january-2025:2025-01-29:Wiz finds the exposed database and reports it; DeepSeek secures it within an hour Wed, 29 Jan 2025 00:00:00 GMT high Source: https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak Status: closed, patched https://pwn.watch/i/ultralytics-pypi-supply-chain-attack ultralytics-pypi-supply-chain-attack:2024-12-11:PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed Wed, 11 Dec 2024 00:00:00 GMT high Source: https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/ Status: closed, patched https://pwn.watch/i/ultralytics-pypi-supply-chain-attack ultralytics-pypi-supply-chain-attack:2024-12-05:Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner Thu, 05 Dec 2024 00:00:00 GMT high Source: https://github.com/ultralytics/ultralytics/issues/18027 Status: closed, patched https://pwn.watch/i/hugging-face-spaces-secrets-leak hugging-face-spaces-secrets-leak:2024-05-31:Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens Fri, 31 May 2024 00:00:00 GMT high Source: https://huggingface.co/blog/space-secrets-disclosure Status: closed, no-fix-needed https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 microsoft-ai-research-sas-token-38tb-exposure-2023:2023-09-18:Public disclosure by Wiz and Microsoft Mon, 18 Sep 2023 00:00:00 GMT high Source: https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers Status: closed, patched https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 microsoft-ai-research-sas-token-38tb-exposure-2023:2023-06-24:Microsoft revokes the SAS token Sat, 24 Jun 2023 00:00:00 GMT high Source: https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/ Status: closed, patched https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023 microsoft-ai-research-sas-token-38tb-exposure-2023:2023-06-22:Wiz reports the exposure to Microsoft Thu, 22 Jun 2023 00:00:00 GMT high Source: https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers Status: closed, patched