A poisoned security scanner backdoored LiteLLM
Snyk researchers discovered that a malicious package was distributed via a popular AI security scanning tool, introducing a backdoor into LiteLLM - a widely used open source library for connecting applications to LLMs. Any organisation using LiteLLM in production was potentially exposed without knowing it. This is a textbook supply chain attack, and the AI ecosystem is particularly vulnerable because the tooling is moving faster than anyone's ability to audit it.
Read the Snyk report ->Claude and ChatGPT used to breach Mexico's government networks
A hacker reportedly used jailbroken versions of Claude and ChatGPT to breach Mexican government systems, stealing 150GB of data including 195 million taxpayer records, voting records, and government employee credentials. The incident is one of the most significant documented cases of AI being used as an active attack tool rather than a passive risk.
Read on Security Boulevard ->300 million AI chat messages exposed in a single database leak
A popular AI chat wrapper app with over 50 million users left its database exposed, leaking 300 million messages from 25 million users. The app sat on top of ChatGPT, Claude and Gemini - meaning users who thought they were talking to a major AI provider were actually routing conversations through an unsecured third party. This is a risk that applies to any AI wrapper or integration layer, not just the model providers themselves.
Read on Malwarebytes ->Malicious Chrome extensions stole AI conversations from 900,000 users
Two Chrome extensions masquerading as AI assistant tools were found to be silently harvesting full ChatGPT and DeepSeek conversations - including session tokens and browsing data - from over 900,000 users. One of the extensions was marked as a Google "Featured" extension. A separate incident earlier in the year found free VPN extensions with 8 million downloads doing the same thing across Gemini, Copilot, and Grok.
Read on Cyber Insider ->An AI agent hacked McKinsey's chatbot in two hours
Security researchers used an AI agent to autonomously target and breach McKinsey's internal AI chatbot, Lilli, gaining full read-write database access. Because the SQL injection flaw was read-write, an attacker could have silently rewritten the chatbot's responses, changed its guardrails, and altered how it cited sources - all without any code deployment. The researchers noted the AI selected its own target without human input.
Read on The Register ->Two AI coding assistants escalated each other's privileges
A researcher demonstrated that GitHub Copilot and Claude could be manipulated into rewriting each other's configuration files and escalating their own privileges - each assuming that instructions from the other AI were legitimate. This highlights a fundamental problem with multi-agent AI systems: they are often far too trusting of each other, creating attack surfaces that do not exist in traditional software.
Read the full analysis ->EchoLeak: Microsoft Copilot leaked corporate data from a single email
Researchers demonstrated a zero-click attack on Microsoft 365's Copilot AI, dubbed EchoLeak, in which a specially crafted email caused Copilot to autonomously exfiltrate corporate data without any user action. No malware, no clicking, no interaction required - just a hidden prompt injection embedded in an incoming message. It is a stark illustration of what happens when AI is given access to sensitive data without sufficient safeguards.
Read more on LLM security risks ->Anthropic's Claude found over 500 high-severity vulnerabilities in open source software
This one cuts both ways. Anthropic published research showing Claude had discovered and responsibly disclosed more than 500 high-severity vulnerabilities in open source software - including critical flaws in OpenSSL. The same capability that makes AI useful for finding and fixing security bugs can, in the wrong hands, be used to find and exploit them at a scale no human team could match. The researchers noted that industry-standard 90-day disclosure windows may not survive AI-speed vulnerability discovery.
Read Anthropic's research ->AI-generated passwords are not random - and are crackable within hours
Security researchers tested Claude, ChatGPT, and Gemini and found that passwords generated by all three appeared complex but were actually highly predictable and crackable within hours. None of the 50 passwords tested contained repeating characters - a statistical impossibility in genuinely random strings - revealing that LLMs produce outputs that look random but are not. Using AI to generate security credentials is not a safe practice.
Read Bruce Schneier's analysis ->OWASP publishes the definitive LLM Top 10 for 2026
OWASP - the gold standard for web application security - has published its Top 10 vulnerabilities for LLM applications, developed by over 600 security experts across 18 countries. The list covers prompt injection, sensitive information disclosure, supply chain attacks, training data poisoning, and excessive agency - the risks that arise when AI systems are given too much autonomy to act. If your organisation is building on or integrating AI, this is the foundational reference document.
Read the OWASP LLM Top 10 ->
What this means for your business
- Treat AI tools like any other external data processor - assume your inputs may be stored, logged, or exposed
- Never paste proprietary code, client data, financial information, or credentials into a public AI tool
- Audit any AI wrapper apps or integrations - the risk is often in the layer between you and the model, not the model itself
- Review browser extensions regularly - several major attacks in 2026 have used extensions to intercept AI conversations
- If you are building AI into your products or workflows, the OWASP LLM Top 10 is the place to start
The pace of AI adoption has significantly outrun the pace of AI security awareness. That gap is where most of the risk currently lives - not in the models themselves, but in the infrastructure, integrations, and habits around them.
If you are thinking about how AI fits into your marketing or analytics stack and want to do it in a way that does not create unnecessary exposure, get in touch.