#173: Claude Fable 5 retains data
Plus, 3-day patch window, hijacking of over 20K Instagram accounts, CISA mandates urgent three-day patching deadlines for AI threat era, and more!
Tech Risk Reading Picks
TL;DR: Rapidly accelerating AI threats and sudden vendor policy changes require immediate action to protect corporate infrastructure and private data. Anthropic’s new Claude Fable 5 model now mandates a 30-day data retention period, canceling previous privacy guarantees and could expose sensitive corporate data to external review. Simultaneously, hackers are actively exploiting severe flaws in AI tools like Langflow and LiteLLM to hijack underlying corporate servers, while self-propagating AI malware targets developer credentials. In response to these automated threats, federal guidance (CISA) now mandates a strict 3-day deadline to patch active vulnerabilities.
Security risks emerge as Anthropic mandates data retention for Claude Fable 5: Anthropic recently launched its powerful Claude Fable 5 model alongside a critical compliance shift. It mandates a 30-day data retention period for all user prompts and outputs. This new policy explicitly overrides all existing enterprise Zero Data Retention commitments. The root cause of this risk is a mandatory safety protocol requiring human review for this specific model class. As a result, proprietary corporate data will temporarily leave established secure cloud infrastructure boundaries. Anthropic personnel can access these logs to review flagged conversations. This exposure may introduce severe third-party disclosure risks for sensitive enterprise workflows and result in immediate confidentiality breaches under these terms. [more]
Autonomous AI worm demonstrates adaptive network exploitation: University of Toronto researchers created an AI-driven computer worm that autonomously navigates networks, generates tailored attack strategies, and self-replicates using a locally hosted open-weight large language model. Running entirely on local GPU resources without relying on commercial APIs, the proof-of-concept worm successfully infected 62% of a 33-host test network in seven days without any prior network knowledge or human input. This demostrated AI’s ability to ingest public advisory text at runtime, allowing it to dynamically bypass its own training cutoff and weaponize newly disclosed vulnerabilities within hours of publication. By establishing infected GPU-capable machines as distributed reasoning nodes, the malware eliminates vendor-side API controls and reduces marginal attack costs to zero. To defend against this shift from fixed exploit payloads to runtime strategic reasoning, strict zero-trust segmentation should be considered for corporate GPU infrastructure. [more]
Active exploitation of Langflow vulnerability threatens AI development infrastructure: Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the open-source AI development platform Langflow, to execute unauthorized file writes on exposed servers. This security flaw allows malicious actors to upload files to arbitrary locations on the filesystem by using directory traversal sequences like
../. The root cause of this risk is a failure to sanitize the user-suppliedfilenameparameter within the multipart form data of thePOST /api/v2/filesendpoint, which is further exacerbated by Langflow enabling unauthenticated auto-login by default. This default configuration allows an unauthenticated attacker to obtain a valid session token and proceed with exploitation via a single request. AI engineering teams should immediately upgrade to Langflow version 1.10.0 to secure their development pipelines and prevent potential infrastructure compromise. [more]Critical exploit chain in LiteLLM triggers active infrastructure attacks:
Attackers are exploiting a severe security flaw in LiteLLM, a popular software tool used by companies to connect and manage their various Artificial Intelligence models. The vulnerability allows attackers to break out of the AI application and run unauthorized commands directly on the underlying corporate server. The root cause of this security failure is a lack of permission checks on two specific testing features inside the software. Because the system did not properly verify who was making the request, it blindly accepted external commands and ran them with full administrative privileges on the host computer. [more]
Flaw in Meta AI support tool enables hijacking of over 20K Instagram accounts: Meta revealed that attackers compromised 20,225 Instagram accounts by exploiting a security flaw in its AI-powered High Touch Support account recovery system. The incident allowed unauthorized third parties to obtain functional password reset links and bypass authentication for accounts lacking two-factor verification. The root cause of the breach was a validation bug in a separate code path that failed to verify whether the requester’s provided email address actually matched the email address linked to the targeted Instagram account. In response, Meta disabled the support tool, invalidated the rogue reset links, and forced affected users through a mandatory security re-authentication checkpoint. [more]
CISA mandates urgent three-day patching deadlines for AI threat era: In response to the machine-speed threat landscape driven by AI-powered vulnerability discovery, the Cybersecurity and Infrastructure Security Agency (CISA) updated its federal binding operational directives. All federal civilian executive branch agencies now have a highly accelerated 3-day window to remediate critical flaws under active exploitation to keep pace with automated exploits. [more]
Vulnerability patch secures Anthropic Claude Code against prompt injection: Microsoft researchers discovered a security flaw in Anthropic’s Claude Code GitHub Action that exposed sensitive CI/CD workflow secrets. Attackers could exploit this flaw by hiding malicious instructions inside GitHub issues to manipulate the underlying model. The root cause of the issue was a lack of security restrictions on Claude’s Read tool, which permitted unauthorized file access. During testing, researchers bypassed defensive layers to extract system files containing API keys and credentials. Anthropic resolved the vulnerability in Claude Code version 2.1.128 by blocking access to sensitive system directories. [more]
Record-shattering June 2026 Patch Tuesday sparked by AI bug-hunting: Microsoft fixed an unprecedented 200+ vulnerabilities in a single month (including 33 rated Critical). Security leaders note this massive surge is the "new baseline" because enterprise AI-assisted fuzzing, static analysis, and agentic scanning tools are radically supercharging flaw discovery at an uncontrollable scale. [more]
Miasma worm hits 73 Microsoft GitHub repositories in major supply chain attack: A massive software supply chain campaign known as the Miasma Worm has successfully compromised 73 public Microsoft GitHub repositories across critical developer ecosystems including Azure, Azure-Samples, and MicrosoftDocs. The threat group TeamPCP orchestrated the breach by re-infecting the popular
durabletaskPyPI package and pushing malicious data-stealing code directly into several npm-related repositories, bypassing standard registry checks entirely. Attackers successfully hijacked a trusted contributor account previously implicated in package compromises, leveraging established developer permissions to commit malicious code directly into the source repositories. [more]Open-source software index hit by self-propagating IronWorm malware:
A sophisticated supply-chain attack infected 36 packages on the Node Package Manager registry with a self-propagating Rust-based infostealer named IronWorm. Triggered automatically during installation via standard package scripts, the malware targets 86 distinct environment variables and 20 credential files containing access keys for cloud networks and high-profile artificial intelligence platforms (including OpenAI, AWS, Anthropic, and npm credentials, vault configuration files, SSH keys, and Exodus cryptocurrency wallet files). The root cause of the rapid spread is the abuse of npm’s Trusted Publishing workflow combined with a lack of isolation in developer environments, allowing the worm to automatically exchange local continuous integration tokens for new publishing credentials. Once inside an ecosystem, IronWorm backdates its malicious code modifications by years to evade modern security auditing tools before routing its stolen payloads over the anonymous Tor network. It hides its core processes behind an advanced operating system kernel rootkit to prevent detection by standard host-based antivirus software. [more]
OWASP released State of Agentic AI Security and Governance 2.01: The State of Agentic AI Security and Governance aims to provides a comprehensive and practical guide for developers, security experts, and decision-makers navigating the complexities of Agentic AI. [more]