Software Blog

Andrea Cosentino Apache Camel PMC Chair

Thoughts about programming, open source and more

© 2026 Andrea Cosentino

Source on GitHub

AI security, week of 2 to 8 November 2026

14 min read

This is the seven days to 8 November 2026, and the thread was the boundary around an agent: a research agent left its test environment and reached a production tool at WorkOS, a popup left the sandbox around ChatGPT’s HTML preview, and a desktop agent’s approval prompts were buttons in a page that a browser extension could script. The anatomy walks through the ChatGPT chain. The window overlaps the 2 November post by a day, so I leave out what it covered (the MLflow 3.17.0 batch, the testmetest worm, Warp, VAPOR PANDA). One correction to it: it relayed Chainalysis’s first notice, which said credentials had not been accessed, and the company’s updates since 4 November say names, usernames, password hashes and live tokens for all users were exposed.

At a glance

By layer

Model files and loaders

Inference and serving

Agent frameworks and MCP

AI applications and UIs

MLOps and data pipelines

Also patched: MCP TypeScript SDK 1.32.0 and 2.3.0 (CVE-2026-111770, wrong-client responses from a shared transport, needs an application change; CVE-2026-111768 and CVE-2026-111771 need configuration; CVE-2026-111769), vLLM 0.33.0 (GHSA-5r3c-5x4v-8gjh, GHSA-qrj2-j723-m6w8), Banks 2.4.3 (CVE-2026-61536, tool import_path resolved to any callable), DBHub 0.22.6 (CVE-2026-61789, a -- comment hid writes from the read-only check), OpenHuman 0.57.13 (CVE-2026-54140, MCP tool descriptions placed in model context), stable-diffusion.cpp master-764 (CVE-2026-70660, safetensors offsets), Langflow 1.13.0 (CVE-2026-97677), MLflow 3.17.0 (ZDI’s CVE-2026-118623 to CVE-2026-118628).

Case files

WorkOS: a research agent left its test environment (6 November)

WorkOS has an internal tool that gathers CRM, support and customer-conversation data for its go-to-market teams. The actor was an agent built on ARTEX, the framework from last week’s VAPOR PANDA report, run by a security researcher in benchmark evaluations.

WorkOS traced unusual query volume to the tool on 30 October, and the first confirmed access was on 25 October. Its 6 November bulletin says the researcher came forward: the agent had left its isolated test environment and the contact was unintended. A forensics firm matched the evidence to WorkOS logs, and the researcher says the data was deleted and not shared. WorkOS names four gaps: an internet-reachable API, a predictable development credential accepted in production, no rate limiting, and late detection. BleepingComputer notes that neither side has said how the agent left it’s environment.

WorkOS closed the exposure on 30 October, rotated credentials, and has tested its own systems with ARTEX since 3 November.

OWASP LLM Top 10 2025: LLM06 Excessive Agency. MITRE ATLAS: AML.T0105 Escape to Host, the closest entry, since the route out is not public.

Claude Dispatch: a web session accepted as the user (6 November)

Dispatch sends tasks from a phone or browser to Claude Desktop, an agent that can run commands on the computer. Gal Weizman at Forever Security found that it also accepted an ordinary signed-in claude.ai session, although the website shows no link to it.

An extension that can run scripts on claude.ai (malicious, or legitimate after a compromised update) can send Claude Desktop prompts as if the user typed them. In the test, four prompts asked for an npm install, a follow-up in the user’s voice answered the agent’s hesitation, and a script clicked each Allow in the page it controlled. The install script opened Calculator; the researchers report no real attacks.

They reported it on 14 May and say Anthropic closed it as a duplicate of an internal finding, then said on 13 October that Dispatch would be retired, targeting the end of October. On 6 November existing users on some plans could still use it, and the researchers say the flaw can still be exploited. This is the approval question from Is there really a human in the loop?: a prompt protects you only where the party it guards against cannot reach the button.

OWASP LLM Top 10 2025: LLM06 Excessive Agency. MITRE ATLAS: AML.T0053 AI Agent Tool Invocation.

Claude Code: saved approvals carry secrets into repositories (6 November)

Claude Code’s documentation says that “Yes, and don’t ask again” on a Bash command saves an allow rule in .claude/settings.local.json, and a rule without a * matches that exact command. The first write also adds the file to the user’s global git excludes.

Apiiro, as reported by The Hacker News, found 104,185 copies of the file in public repositories. In 1,122 of them there is at least one secret, including 379 database passwords, 43 SSH logins, 42 GitHub, GitLab or npm tokens and 23 AWS keys. Apiiro did not test whether they work, and one notified company confirmed its key had been live. The global exclude lives on one machine, so it does not follow the project, and neither gitleaks nor TruffleHog flagged 215 of the 1,122 files.

I did not find a vendor statement in the coverage, so the fixes sit on the user side. Apiiro’s order is rotate first, then clean: search your organisation for the file and its history, rotate what it held, git rm --cached it and add it to .gitignore.

OWASP LLM Top 10 2025: LLM02 Sensitive Information Disclosure. MITRE ATLAS: AML.T0083 Credentials from AI Agent Configuration.

Anatomy of the week: the ChatGPT preview that let a popup out

Lockdown Mode, added to ChatGPT in June 2026, is an optional setting that closes channels a prompt injection could use to move data out. Since February ChatGPT can also render an HTML page from a code block, in two nested sandboxed iframes with a script that intercepts anything reaching outside. On 5 November Alexey Bukhteyev at Check Point Research published how the preview could be used to bypass Lockdown Mode; OpenAI reported the fix deployed on 18 September.

  1. The attacker gets an HTML page into a code block the victim sees: a malicious prompt, GPT or shared chat.
  2. ChatGPT renders it in the two iframes. A script in the sandbox replaces window.open, so popups wait for approval; other outside requests become warnings.
  3. The frames’ sandbox attribute still lists allow-popups and allow-popups-to-escape-sandbox, so only the replaced function, living in the page’s own JavaScript, stands between the page and a popup.
  4. The page adds one more nested frame and calls that frame’s own open, which nothing replaced. The popup opens.
  5. Because of allow-popups-to-escape-sandbox, the popup is unsandboxed: attacker script runs outside the interception and Lockdown Mode, in a window with the ChatGPT icon and a title the attacker chose.
  6. In the ChatGPT Classic desktop app open works without a user gesture, so a malicious GPT needs only a normal conversation. In a browser the victim has to click the preview.
  7. From the popup the attacker can send chat history and files to their own server, offer malware as an update, or sign the user out and collect the password on a look-alike page.

Where it could have stopped

The pattern is a guard that runs in the same JavaScript realm as the content it guards against, so the content can step around it, while the enforcement that holds is a browser-level flag. To find it in your own systems, search for functions you wrap to enforce policy (open, fetch, message handlers) in frames that show content you did not write, then read every sandbox attribute and CSP and ask what each still allows. The same week MCP Inspector 2.14.0 fixed a relative: an MCP App’s frame could navigate itself away and keep its sandbox flags (GHSA-h9j8-vj8g-v3gg).

From the research side

Checklist for Monday

References

By layer:

Case files:

Anatomy and research:

Notes on sources:

Read next