Rubrik Zero Labs documents ChatMate, the first publicly known remote prompt execution attack: one malicious document makes Copilot run code, escape its network-isolated sandbox, and open an interactive prompt shell to the attacker. The chain starts with CVE-2026-32193, root access on an AKS node, and ends with an attacker reading M365 data one prompt at a time. Copilot packs a Python interpreter that executes model-generated code across a huge share of enterprises. That interpreter is now a proven beachhead.
Ask Grok to summarize a webpage and the page's encrypted payload can get the bot to hand over your name, location, subscription tier, and conversation history to an attacker's server, no click or warning required. Adversa AI hides the malicious instructions as AES-256 ciphertext, which Grok decrypts inside its own code runtime, so content classifiers never see the plaintext. Reported to xAI in June, the flaw was still reproducible on August 19.
ENUM, the early-2000s scheme that routes phone calls over the internet via e164.arpa DNS, is mostly dead and unguarded. A researcher found three country-code zones delegated to abandoned nameservers, took them over, and accidentally logged hundreds of thousands of calls, including to military bases. Nothing stopped her: a territory's entire call routing can be captured by registering a domain, and one registry still hands these zones out to anyone.
New research dubbed CDN Tsunami shows that when a CDN speaks HTTP/3 to browsers but HTTP/1.1 to origin sites, attackers can amplify a sub-500 Kbps request stream into 100+ Mbps of origin-bound traffic, up to 350x. The two techniques, bandwidth (HBA) and connection (HCA) amplification, hit all six major CDNs tested; Cloudflare dodged only HCA, and 42,330 Tranco Top-1M subdomains look vulnerable. Two vendors have already patched with bounties. No CVEs or in-the-wild exploits yet.