AI Security News: October 24, 2026

1. Critical LiteLLM Flaw Lets Internal Users Forge Admin Tokens and Run Commands via MCP

LiteLLM. CVE-2026-114612 (CVSS 9.9, Critical) affects the LiteLLM AI gateway proxy from version 1.87.0 up to the fixed releases. The proxy reuses one cryptographic context for at-rest secrets and session tokens, so an authenticated internal user can get crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow, then replay that ciphertext as a bearer token. That grants proxy administrator access and arbitrary command execution through the MCP stdio endpoint. Versions after 1.91.0 are exploitable in the default configuration, and fixes ship in 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2. Source

2. Wiz Tracks Storm-0940-Linked Actor Using the ARTEX Autonomous Pentest Agent

Wiz Research. Wiz reported an actor using ARTEX, an open-source autonomous AI penetration-testing framework with more than 12,000 forks, against IT and software vendors throughout October 2026. The activity overlaps with Storm-0940, which Microsoft attributes to a Chinese state-aligned group. The agent chained steps without human input: it mapped apps through source maps and OpenAPI docs, probed OAuth callbacks and unsigned JWTs, password-sprayed Okta and Microsoft Entra ID accounts, abused AWS Cognito sign-up and recovery flows, and rotated IPs and user agents when blocked. Most attempts failed, but Wiz observed sessions lasting 24 to 30 hours and spray bursts with a one-second median gap between attempts. Source

3. AgenticSeek RCE Through Hardcoded Flask Debug Mode

AgenticSeek. CVE-2026-115727 (CVSS 8.1, High) covers the AgenticSeek local agent project before commit 409840c, where llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. An attacker who can reach the server port and derive the Werkzeug debugger PIN can execute Python code and OS commands with the privileges of the LLM server. VulnCheck published the advisory, and the fix landed via pull request 558. Source

4. obsidian-tc MCP Server Executed Destructive Calls After Humans Declined Them

obsidian-tc. CVE-2026-115477 (GHSA-737x-cwfr-5vvc, CVSS 7.1, High) affects obsidian-tc, an MCP server for Obsidian vaults, in versions 1.13.0 through 1.31.3. On Streamable HTTP deployments, a destructive tool call offered a human-in-the-loop elicitation confirmation could still complete after the user declined or cancelled, as long as the client echoed the valid request state on resubmission. The server treated that call-bound state as proof of approval, enabling deletes, moves, and frontmatter rewrites the user had refused. The fix is in version 1.31.4. Source

5. Cypher Injection in Flexible GraphRAG via LLM-Extracted Entities

Flexible GraphRAG. CVE-2026-114510 (CVSS 7.1, High) affects Flexible GraphRAG versions 0.6.0 through 0.8.1 when configured with the LangChain graph backend and FalkorDB. A faulty _escape() helper lets attacker-influenced document content steer the extraction model into producing entity or relationship values that break out of Cypher strings. Injected clauses can modify or delete graph data and, where results are surfaced to users or the LLM, disclose it. Version 0.8.2 fixes the issue (GHSA-vqrg-773h-4wxc). Source

6. “Compaction Laundering” Forges User Approvals in Coding Agent Memory

Arshan Dabirsiaghi. A new arXiv paper shows that context compaction in coding agents is an exploitable trust boundary. Harnesses that flatten conversations into plain text with labels like [User]: before summarizing let an attacker who controls anything the agent reads forge a user turn that survives compaction. Across pi, opencode, Cline, Aider, and OpenHands, the forged approval landed in agent memory 87-100% of the time, while role-typed harnesses (Codex, Gemini CLI, Qwen Code, Continue) resisted it at 0%. In end-to-end tests the laundered approval drove agents to run attacker-controlled curl | sh in a sandbox. Source

7. AgentPhishing Benchmark Finds Email Agents Vulnerable to Adapted Phishing

Justin Tan, Miao Li, and Ding Zhao. The AgentPhishing paper introduces a benchmark and an optimizer, PhishOpt, that tunes persuasive phishing emails against individual LLM email agents under realism constraints. The authors report that agents handle pre-existing phishing emails safely but remain susceptible to attacks adapted to agent behavior. In an evaluation of nine agents, four had phishing-detection rates below 10%. Source

8. Snyk Opens Preview of Evo Remediation Agent for Dependency Fixes

Snyk. Snyk put its Evo Remediation Agent into Open Preview, letting AppSec teams run scheduled remediation campaigns that plan dependency upgrades, apply them in a hosted sandbox, verify with builds, tests, and rescans, and open pull requests without merging. Snyk says the engine passed all four verification checks on 90.2% of 307 tasks in its VulnBump benchmark, versus 77.5% for Claude Code with Snyk findings and 59.6% for Claude Code alone on the same model. Access requires an SCM integration and is requested through a Snyk account team. Source