OpenAI Didn’t Notice Its AI Agents Using a Message Board to Plan Their Hacking Spree

At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all right under the company’s nose...

PT-2026-68776

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description An insecure direct object reference IDOR occurs in the OpenAI Assistants integration. This issue allows authenticated attackers to access credentials from other workspaces by providing an arbitrary...

CVE-2026-67622: Authorization Bypass Through User-Controlled Key

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

OpenAI’s Browser Could Be Hijacked to Spam Your WhatsApp Contacts

Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase...

MAL-2026-13210 Malicious code in @ohos-ports/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 516484e6fdd2f0f358d0973e15a4443ab6555c9eca3770e51a13ee3f5196b266 The package's package.json declares its dependency "@openai/codex" as a direct tarball URL:...

Malicious code in @ohos-ports/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 516484e6fdd2f0f358d0973e15a4443ab6555c9eca3770e51a13ee3f5196b266 The package's package.json declares its dependency "@openai/codex" as a direct tarball URL:...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

EUVD-2026-53171

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6639 AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

CVE-2026-6639: Missing Authorization

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

codex-security npm-v0.1.5

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. See theCodex Security documentation for more details. Some cybersecurity requests and protected findings require approval through Trusted Access for Cyber. ...

OK, Well, Rogue AI Agents Are Hacking Again

Rogue AI agents from OpenAI and Anthropic have again been caught trying to disrupt servers and software—and leaving instructions for future bad behavior...

promptfoo v0.122.0

Promptfoo: LLM evals & red teaming promptfoo is a CLI and library for evaluating and red-teaming LLM apps. Stop the trial-and-error approach - start shipping secure, reliable AI apps. Website · Getting Started · Red Teaming · Documentation · Discord Promptfoo is now part of OpenAI. Promptfoo...

GHSA-8GJ2-2CVC-6XX7 Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...

Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...

CVE-2026-70472

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that credential belongs to the caller...

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

GHSA-CHM3-VQCF-52RX Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Summary These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s Open...