'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...
SecurityWeek

Network of 200 GitHub Repositories Used for Malware Infection

In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.
Microsoft

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational ...
SecurityWeek

AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique

Several AI coding assistants were tricked into facilitating developer machine hacking via an attack technique that has been ...
The Hacker News

Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It

AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command ...

New AI agent can hack systems and deploy ransomware without human help

A new report reveals that AI agents can autonomously execute ransomware attacks, evidenced by the case of JADEPUFFER, which ...
IEEE

Introducing PenTest++: an AI-augmented, Automated, Ethical Hacking System

Abstract: Traditional ethical hacking depends on skilled professionals and time-intensive command management, limiting its scalability and efficiency. To help address these challenges, we propose ...