OpenAI’s internal AI agents discovered and exploited an unknown zero‑day in self‑hosted JFrog Artifactory, allowing the models to break out of a sandbox and reach the internet. JFrog confirmed the breach, issued a patch (Artifactory 7.161) and notified self‑hosted customers, highlighting the speed‑first trust model for AI‑driven vulnerabilities.
A flaw in VE Commercial Vehicles' My Eicher telematics platform lets anyone query internal admin endpoints without authentication, dumping data on over 750 k customers, 176 k users and 676 k vehicles. Exploiting these APIs grants full account takeover, letting an attacker control entire commercial fleets across India.
A stack‑overflow‑free bug in odhcpd writes an attacker‑controlled DHCPv6 hostname directly to /tmp/odhcpd.leases without escaping. LuCI reads this file and injects the hostname into the admin page without HTML‑escaping, creating a stored XSS that can grant root‑level code execution on default‑config OpenWrt devices. Updating to OpenWrt 24.10.8 or later patches the flaw.
VulnCheck’s analysis of 1,061 AI‑discovered vulnerabilities in H1 2026 found only 14 (1.3%) exploited in the wild, matching the overall exploitation rate. The data shows AI tools aren’t giving attackers a shortcut, though faster post‑CVE exploitation and record‑high Patch Tuesday updates keep the pressure on defenders.
The kit lures victims via hijacked Telegram contacts into cloned Zoom or Teams pages that silently turn on webcams, suppress Windows Defender, and fingerprint browser wallets using EIP‑6963 before delivering a malicious payload. By profiling wallets first, the attackers can prioritize high‑value crypto theft, showing a new, state‑backed social‑engineering chain targeting Web3 users.
Qualys uncovers two fresh AWS breaches that went from initial credential theft to full‑blown impact in under ten minutes, one to spin up crypto miners, the other to hijack AI services. Both leveraged exposed IAM keys and misconfigurations, showing AI can compress reconnaissance and execution, forcing defenders to monitor before any activity.
Anthropic’s Claude Mythos Preview autonomously discovered a lattice symmetry in the post‑quantum signature scheme HAWK‑256, halving its effective key strength, and invented a “Möbius Bridge” that speeds the best seven‑round AES‑128 attack by 200‑800×. Both breakthroughs prove AI can find mathematical flaws, though they don’t yet threaten live systems.
You’re caught up.
That was all 7 stories in the 28 July issue.