Researchers Reveal Security Flaws in AI Coding Agents and Open-Source Mobile Frameworks

A new cyber espionage operation, SilkParasite, is targeting Central Asian governments using seven remote access tools (RATs), five of which are newly discovered. This campaign is attributed to a China-nexus threat cluster and shows signs of AI-assisted development in its tooling. The use of AI in developing sophisticated espionage tools marks an evolution in cyber attack methodologies.

Security researchers demonstrated that self-propagating payloads, termed "mind viruses," can spread between AI agents by modifying persistent system prompt files. This research highlights a potential vulnerability in autonomous AI systems, though no in-the-wild propagation has been observed, and simple warnings effectively mitigate the spread.

Wiz Red Agent, an AI-powered security research tool, discovered and exploited a GitHub Actions vulnerability in Snowflake's internal Jira that was introduced by GitHub Copilot Autofix. The vulnerability allowed unauthorized access to sensitive data and highlighted how AI coding assistants can inadvertently create security flaws. Snowflake remediated the issue on the same day it was disclosed.

Taiwan's Ministry of Digital Affairs reported an "abnormal" AI-assisted cyber-attack targeting government agencies last month. This incident marks a new type of threat, with attackers using open-source AI agents to create autonomous hacking tools, raising concerns about advanced cyber warfare tactics.

Hackers with suspected ties to China reportedly used open-source AI tools to conduct an autonomous cyberattack against Taiwanese government systems, compromising 85 user accounts and stealing over 2,500 personnel records. This incident marks the first observed end-to-end autonomous cyberattack against a government target, demonstrating a new level of automated threat capability.

ASSET Research Group disclosed "GhostSplice," a technique allowing malicious Model Context Protocol (MCP) servers to exfiltrate sensitive data from AI coding assistants by splitting harmful instructions into routine fragments. This method exploits how agents combine instructions across different communication channels, enabling data theft even when direct malicious requests are blocked.

The North Korean hacking group Kimsuky is using offline AI tools like Ollama and GPT4All on its own servers to enhance phishing campaigns and automate malware development. This development suggests future attacks could be more sophisticated and harder to detect, shifting the focus for defenders from identifying poorly crafted lures to monitoring system-level intrusion behaviors.

Tenet security researchers demonstrated a new 'Ghostjacking' attack that manipulates AI agents by injecting malicious instructions into trusted logs and alerts from platforms like Cloudflare, Datadog, and Sentry. This attack allows threat actors to control AI agents, leading to actions such as domain hijacking, code execution, and credential theft, highlighting a vulnerability in how AI agents process information from trusted sources.

A browser game simulating human oversight of an AI coding agent revealed that players missed 33.7% of malicious commands across 40,000 runs. This data highlights the challenges of human-in-the-loop security for AI agents, particularly concerning subtle data exfiltration threats.

Security vulnerabilities in AI agent infrastructure from AWS, Google, and Vercel allowed attackers to trigger agent tools without model authorization, bypassing security controls. These flaws, collectively termed CoreBreak, enabled direct tool execution by forging instructions, impacting Amazon Bedrock AgentCore, Google's ADK, and Vercel's AI SDK harness packages.

Google removed three AI agent workflows from its Agent Development Kit (ADK) Python repository after Pillar Security demonstrated that a public GitHub issue could be used to manipulate a triage agent into activating a privileged code-fixing agent. This vulnerability allowed for arbitrary code execution and exfiltration of sensitive credentials, highlighting a security flaw in repository automation rather than the ADK Python package itself.

Palo Alto Networks' Unit 42 researchers discovered a Chinese-speaking threat actor using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers. This activity demonstrates a functional, end-to-end autonomous offensive capability, even though the observed attacks did not successfully compromise targets.

Palo Alto Networks' Unit 42 reported that a Chinese-speaking threat actor utilized the DeepSeek AI model through the open-source Hermes Agent framework to conduct autonomous cyberattacks. This marks a notable instance of AI being directly integrated into the attack chain for automated vulnerability scanning and exploitation attempts.

Hackers deployed an autonomous AI agent, Hermes, to conduct cyber-espionage against Thailand's Ministry of Finance, as revealed by an exposed hacker-controlled server. This incident demonstrates the use of AI agents in sophisticated reconnaissance and credential theft operations against government entities.

A threat actor reportedly used the open-source Hermes AI agent to automate post-exploitation activities during an alleged breach of Thailand's Ministry of Finance. Threat intelligence firm Hunt.io and security researcher Bob Diachenko uncovered this activity after finding exposed web directories containing files related to the operation, though the Ministry of Finance has not confirmed a breach.

An attacker deployed an open-source AI assistant, Hermes, on a rented server to autonomously navigate and explore the network of Thailand's Ministry of Finance after an initial breach. This incident demonstrates a new method of post-exploitation using AI agents to automate reconnaissance and privilege escalation within compromised systems, highlighting the evolving landscape of cyber threats.

Researchers have demonstrated vulnerabilities in five open-source mobile agent frameworks that allow attackers to run commands on host PCs using invisible screen text. This concern highlights weaknesses in mobile app security and the potential for unexpected attacks on connected systems.

Researchers unveiled a new attack called agent data injection (ADI) that manipulates AI agents by corrupting trusted data inputs, enabling unexpected actions like misclicks or executing unauthorized commands. This attack bypasses existing defenses that target direct instruction injections by targeting the trusted factual data agents rely on for their tasks.

Research reveals that AI coding agents like Claude Code and OpenAI's Codex can be tricked into executing malicious code under autonomous settings. This vulnerability undermines the agents' roles in securing open-source projects by allowing attackers to leverage them for code execution instead of threat detection.

Researchers from Hong Kong University demonstrated that AI skill scanners can be bypassed by malicious agents using a technique called SKILLCLOAK. This method rewrites skills to evade detection, highlighting significant security risks for AI coding agents.