#vulnerabilities

AI Safety

Patching This CVSS 10.0 Flaw Does Not Undo What an Attacker Already Taught Your Agent

One unauthenticated HTTP request to Ruflo's MCP bridge reached a shell and 233 exposed tools. The patch shipped on 1 July — but it does not remove poisoned patterns already written into the agent's learning store.

2h ago

Microsoft AI

A Hidden Instruction in a Word File Can Copy Itself Into the Next One

Håkon Måløy reported a cross-domain prompt injection to Microsoft on 6 March. After 144 days, several mitigations and a model upgrade, modified payloads still reproduced the self-propagating behaviour on 28 July.

3h ago