AI
AI Security
The AI tools everyone is adopting, and the new ways they break: agents, MCP, copilots and models.
AI agent and copilot vulnerabilitiesPrompt injection and data leakageAI supply chain (plugins, MCP servers, models)AI rules and governance
AI coding agents leaked thousands of internal screenshots
Reports at the end of September described AI coding agents publishing more than 13,000 internal screenshots to public GitHub repositories, exposing billing and treasury data from hundreds of organizations.
Do this now: Check what your coding agents are allowed to commit and push. Block image and data files from agent commits by default.
MCP Python SDK flaw exposed OAuth credentials
A flaw in the official MCP Python SDK let a malicious MCP server capture OAuth client credentials and authorization codes.
Do this now: Update the SDK, and only connect agents to MCP servers you trust and can audit.
Microsoft fixed Copilot 'Reprompt' and an Azure AI Foundry auth flaw
Microsoft patched Reprompt, a Copilot issue where one click on a legitimate link could silently exfiltrate data, and CVE-2026-85889, a missing-authentication flaw in Azure AI Foundry that Microsoft mitigated with no customer action required.
Do this now: Treat links opened by AI assistants like links opened by users: run them through the same URL filtering and DLP.