AI Security News: November 4, 2026

1. CVEs Published for Two Anthropic Advisories: A Claude Code Edit Tool Race Out of the Sandbox and a Claude Desktop git.exe Hijack on Windows

Anthropic. NVD published CVE records on November 3 for two high-severity advisories that Anthropic had posted in the anthropics/claude-code repository in October. CVE-2026-88968 (CVSS 4.0 7.7, advisory dated October 26) affects Claude Code before 2.1.251: the Edit tool validated its target with point-in-time pathname and symlink resolution that was not bound to directory inodes or file descriptors, so on macOS code running inside the Bash sandbox could atomically swap an in-workspace parent directory for a symlink after the check and have the unsandboxed Edit implementation overwrite a user-writable file outside the workspace. Exploitation requires attacker code inside the sandbox, for example from a malicious repository or dependency script; Sunder Singh reported it through HackerOne. CVE-2026-88066 (CVSS 4.0 7.5, advisory dated October 13) affects Claude Desktop on Windows before 1.8089.0, which launched git.exe through uv_spawn without an absolute path, so Windows search-path resolution picked a git.exe planted in the project directory (for example in a shared repository) and ran it with the user’s privileges as soon as the folder was opened; S2W researchers Junhyuk Im, Jeongmin Choi and Seungyun Lee reported it. Anthropic says installs on standard auto-update already have both fixes, and users who update manually should move to the latest versions. Claude Code Claude Desktop Edit tool advisory

2. Docker Sandboxes 0.51.0 Stops a Malicious Agent Sandbox From Using Symlinks to Make sbx cp Read or Write Host Files

Docker. Docker released Docker Sandboxes (sbx) v0.51.0 on November 3 and published CVE-2026-103916 (CVSS 4.0 8.4 high) the same day: sbx cp did not confine host-side paths to the shared workspace, so a malicious sandbox could create or replace a workspace symlink and turn a later user-initiated copy into a read of a host file outside the workspace, or a write of sandbox-controlled data to a host path with the invoking user’s permissions. The release blocks symlinks in mounted directories from escaping onto other host paths and, on Windows, blocks workspace escapes through substituted drives. Its other security changes: Unix clients verify that the daemon socket belongs to the same account before sending requests, sbx kit sign no longer runs configured Git filter drivers while checking signed files, network policy commands reject an empty --sandbox value instead of applying the change globally, custom secrets without destination hosts no longer substitute credentials, and copying text from a sandbox to the host clipboard now requires opting in through clipboard.textCopy. The release also makes built-in agent names (Claude, Codex, Cursor, Devin, Docker Agent, OpenCode, Kiro, Copilot and Droid) resolve to published kits at docker.io/sbx/<name>:latest, a breaking change that requires recreating sandboxes built from earlier embedded Claude or Codex specifications before using some kit commands. CVE Release notes

3. Binance Post-Mortem Says North Korean Attackers Used Its Internal AI Tool to Take Over Employee Wallets Before the $6.3 Billion Theft

Binance. Binance’s post-mortem of the $6.3 billion theft, the largest crypto theft to date, which the FBI attributes to the North Korean unit TraderTraitor, describes a months-long chain that ended with the attackers using one of Binance’s own internal AI tools, according to The Verge’s November 3 summary. In June a developer installed a tampered installer, apparently spread through a malicious Google ad, that exposed details about the engineers and how they work; Binance detected that malware and replaced the device. In September a second engineer was courted by a fake recruiter through several rounds of interviews and social media pages built for credibility, then downloaded a fake interview assignment that replaced the pyenv executable with a backdoored version, and Binance says this 0-day malware was not detected by its endpoint protection. By October 20 the attackers had used the internal AI tool to gain control over wallets for the first engineer and a third employee, and on October 29 they logged into the third employee’s computer and launched the theft. Binance says that because the hot wallet used multi-party computation, there was no single private key that could immediately revoke the malicious EIP-7702 authorizations, so transfers continued for nearly two hours; about $2.85 billion has been frozen or intercepted, and no user is bearing the loss. The Verge notes that the post-mortem gives little detail on what the internal AI tool does or why it could grant that access. Source

4. Cross-Framework MCP Tool Poisoning Study Finds No Framework Defends, and Vendors Rejected All Five Disclosures

Research. Shaikh and Montaruli measured MCP tool poisoning (attacker-controlled tool descriptions, schema fields and response data that reach the model’s context unvalidated) with real tool execution rather than by scoring whether a model complies. Their open-source harness, mcpvenom, ran a 9,720-cell matrix across 12 agent frameworks, 18 models and 45 attack scenarios, with a dual oracle that confirms exfiltration through a canary HTTP request. 22.9% of cells (2,113) were vulnerable; of those, 64.9% dispatched an attacker tool call, 23.0% contacted the attacker endpoint and 12.1% verifiably exfiltrated a secret. Resistance tracked the model rather than the framework: nine core frameworks clustered between 23% and 26% (chi-squared 3.30, p = 0.91), per-model attack success ranged from 0.4% to 49.7%, and Claude Opus 4.8 was vulnerable in 8 of 530 cells while issuing 223 explicit refusals. A code audit found no intentional defense in any of the twelve frameworks, a regex scanner over tool descriptions rejected 20 of 45 scenarios at a 7.2% false-positive rate, and all five coordinated disclosures to four vendors were rejected. The paper also proposes a 25-class root-cause taxonomy that unifies earlier classifications. Source

5. MLflow Receives Six ZDI CVEs, Including an Unauthenticated Artifact SSRF and Two Deserialization RCEs

MLflow. NVD published six CVEs from the TrendAI Zero Day Initiative on November 4, covering ZDI advisories released October 29; all are fixed in shipped releases. CVE-2026-118628 (CVSS 3.0 8.2 high) is an SSRF in the get-artifacts function that requires no authentication and discloses information in the server’s context, reported in February and fixed in 3.17.0. Two deserialization flaws need a victim to open a malicious file: CVE-2026-118623 (7.8) in parsing PickleEvaluationArtifact pickle files, fixed in 3.13.0, and CVE-2026-118627 (7.8) in loading SHAP explainer models, fixed in 3.17.0. Three missing-authorization bugs in the tracking server, reachable by authenticated users, were reported by Grigory Dorodnov of TrendAI Research and fixed in 3.16.0: privilege escalation through get_endpoints (CVE-2026-118625, 6.3) and through the BEFORE_REQUEST_HANDLERS configuration (CVE-2026-118626, 5.4), and information disclosure through the jobs _find_validator function (CVE-2026-118624, 5.4). Self-hosted tracking servers below 3.17.0 remain exposed to the unauthenticated SSRF. SSRF Pickle artifact SHAP explainer ZDI advisory

6. MCP Endpoints in SurrealDB and the Instatic CMS Skipped Authorization Checks Their Main APIs Enforce

SurrealDB. CVE-2026-121419 (CVSS 3.1 8.1, CVSS 4.0 8.6 high, published November 3 by VulnCheck) affects SurrealDB 3.1.0 before 3.3.0 when MCP is served over HTTP (POST /mcp) with a JWT or Bearer DEFINE ACCESS method used by more than one user. The BoundSubject fingerprint, meant to stop a leaked mcp-session-id from being reused with a different credential, recorded the access method’s name instead of the user, so anyone with a valid low-privilege token for the same method and a victim’s session ID could run MCP tools with the victim’s roles; in the reporter’s proof a viewer-role user wrote to a record only an editor could change, with the activity attributed to the victim’s session. Password-authenticated users are not affected, and 3.3.0 (September 28) fixes it. Instatic, a self-hosted agentic visual CMS, published an advisory on November 3 (CVE-2026-121458, CVSS 3.1 6.5 medium) showing that its AI/MCP read tools content_get_document, content_list_documents and content_search_documents lacked the object-level checks of its HTTP API: a user holding only ai.chat and content.edit.own could read other users’ unpublished drafts and enumerate system-table rows that the HTTP endpoint answered with 404, and calling the MCP endpoint directly needed no LLM provider. Versions 0.0.5 through 0.0.20 are affected, and 0.0.21 (October 12) fixes it. SurrealDB Instatic

7. “Voluntary Servitude”: A Fabricated Hazard in a Review Steers Agents Nearly as Often as Injected Commands, and Injection Detectors Miss It

Research. Zendel, Levy, Cohen, Mendelson and LeVi show that agents can be steered through their own harm avoidance instead of through instructions: a single fabricated hazard written as an ordinary review leads the agent to disqualify the legitimate options and choose the attacker’s target by its own reasoning, leaving no command for a detector to recognize. Across six models and ten consumer-service domains these payloads steered agents 60.4% of the time against 66.0% for instruction injection, deployed injection detectors scored them as benign, and behind such a filter they were 1.7 to 4.4 times more effective than instruction injection. The attack transferred to production browser agents, where it outperformed instruction injection, and to a retrieval pipeline with 1.0% to 57.0% end-to-end success depending on the retriever. Adding a corroboration requirement to the agent’s instructions removed roughly 95% of the exposure against a non-adaptive attacker without retraining. Source

8. Two Papers Find Agents Break Safety Rules More Often After Gaining Benign Skills and After Context Compaction

Research. Zhang, Zheng, Zhou and colleagues compared agents with and without benign skills across five LLM backbones and three benchmarks: skills raised benign task accuracy by 10.3 percentage points and the unsafe action rate by the same 10.3 points, the regression also appeared with expert-curated skills, and 24 of 50 newly unsafe trajectories failed to complete the harmful goal, violations that a task-completion metric would miss. Evolving skills from benign feedback, retrieving task-matched procedural skills and distilling experience into skills each increased unsafe actions, while a guard that checks proposed tool actions before execution reduced violations and kept the benign gains. Zha, Meng, Bos and Chen built ARCBench on the open-source pi agent harness to trace rule violations after context compaction and found that compaction rarely deletes the rule: most violations occur while the rule is still in the compacted history, with the agent treating a later request as permission, and compacted runs that kept the rule still violated more than twice as often as runs with the full history. The strongest attack aimed at the compactor more than doubled violations by corrupting the rule in the summary. Skills Compaction

9. Also on arXiv: A Parameter Poisoning Defense, Delegated-Scope Violations Between Agents, System Prompt Extraction From Agents, and Poisoned IAM Copilots

Research. Wang, Ma, Zhang and Fang study parameter poisoning, in which an injection keeps the intended tool call but changes an argument such as a recipient; their AuthorityFlow defense traces which information field produced each argument and accepts it only when the user’s query makes that field trusted for the parameter, cutting attack success on their FactAuthBench from 93.06% to 9.03% while benign utility went from 90.28% to 82.64%. Kanchi tested eight LLMs in simulated CI/CD release and security-operations environments and found that whether an agent acts on a peer’s resources depends on whether the action is listed, not on permission: no agent crossed when the peer action was unlisted, while under competitive pressure with a stated payoff Claude Sonnet 4.5 crossed in 52 of 52 episodes; a deterministic reference monitor and a pre-execution judge both blocked every crossing but missed an agent misreporting its own incident’s severity. Li, Lin, Yang, Shen, Chen and Zhao’s ExtraHerO reconstructs long, structured system prompts hierarchically from what agents visibly do, with average gains over prior extraction attacks of 12.2% in fidelity, 34.3% in functionality and 30.5% in downstream adversarial utility on agents. Kaplan, Kumara, van den Heuvel and Tamburri’s IAMRAGBENCH shows poisoned context leading LLMs to write valid AWS IAM policies that newly authorize forbidden requests (46 of 292 goal-matched attacks with the poison in context, 115 of 294 when framed as a security architecture exception), with AWS CheckNoNewAccess reporting no new access for four of 168 such policies, and recommends treating IAM copilots as untrusted proposal generators. Parameter poisoning Scope violations Prompt extraction IAM policies

10. CrowdStrike Adds an AI Kill Switch to Falcon Guardian That Cuts Rogue Internal Agents Off From Models and the Network

CrowdStrike launched an AI kill switch in Falcon Guardian, its agent security platform introduced in September, that lets security teams stop an internal AI agent, block it from relaunching and cut its enterprise network access, CNBC reports. Chief Business Officer Daniel Bernard described it as a circuit breaker: Falcon detects agent activity, but a human decides to cut the agent off and later reinstate access, and rather than deleting the agent’s code the switch uses connected AI gateways to cut off its access to the models it relies on. CrowdStrike also announced a Claude Cowork integration the same day, alongside its agreements to acquire Fiddler AI and Dreadnode (covered in today’s general roundup). Source