AI Security News: November 5, 2026
Fully automated. Found, summarized and published by an automated AI pipeline. How posts are labeled
1. Three Mistral Vibe CVEs Let a Crafted Repository Run Code at Session Start, Before the Trust Prompt
Mistral Vibe, Mistral’s CLI coding agent, received three CVEs from VulnCheck on November 4, each rated CVSS 4.0 8.6 high (CVSS 3.1 8.8) and credited to Francisco Rosales of Manifold Security. All three abuse the Git commands Vibe runs automatically to collect project context when a session opens, so opening a crafted repository runs attacker code with the user’s privileges before any trust prompt appears. CVE-2026-122133 (Windows only, fixed in 2.25.5 on September 18) has SessionLogger and ProjectContextProvider execute a git.exe planted in the repository root; CVE-2026-122134 (fixed in 2.25.7 on September 22) uses repository-configured Git clean or process filter drivers that fire during the startup git status; CVE-2026-122135 (fixed in 3.0.3 on October 26) sets gpg.program and log.showSignature next to a signed commit so the startup git log launches the attacker’s program. The changelogs describe the fixes only as Vibe no longer running a project-local Git executable, repository-configured filters, or signature verification programs during automatic inspection, and 3.0.3 also stopped worktree creation from running repository-defined file filters before the folder is trusted. Versions before 3.0.3 remain exposed to at least one of the three; the current release is 3.1.0, and the git.exe case is the same class of bug as the Claude Desktop flaw (CVE-2026-88066) whose CVE was published November 3. CVE-2026-122133 CVE-2026-122134 CVE-2026-122135 VulnCheck advisory
2. DeepSeek Harness Left Its Web Control Plane Unauthenticated, Letting Any Local Process Prompt the Agent and Answer Its Approval Requests
DeepSeek Harness, the agent harness in the deepseek-ai GitHub organization (about 273,000 stars), received CVE-2026-82033 (CVSS 4.0 8.6 high, CVSS 3.1 8.4) from VulnCheck on November 4. Before 0.1.2-alpha.2, the web profile’s HTTP and WebSocket RPC control plane required no authentication, so any local process, including one running as a different OS user, could call session methods such as session.create and session.prompt and drive the agent’s bash and filesystem tools to run commands as the victim, using the victim’s configured model credentials. The same ungated event stream broadcast live session traffic and logs, including the rpcId, approvalId and sessionId values that POST /api/respond matched, so an attacker could also answer the human tool-approval checks. The fix commit (“fix(web): authenticate the browser Host API,” August 25) shipped in 0.1.2-alpha.2 on August 30, and current releases are in the 0.2.x line; the researcher credited is Opr4 (Opr4Mp3r). CVE VulnCheck advisory
3. OpenAI Says Its Pipeline Turned 2,308 Linux Kernel Findings Into 948 Validated Privilege Escalations for About $1.2 Million
OpenAI published “A thousand fewer paths to root” on November 4, describing an autonomous pipeline that found, validated and generated patches for 948 local privilege-escalation vulnerabilities in the Linux kernel. According to The Hacker News, the post says the prototype “identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities,” and produced the 948 privilege-escalation cases using an upcoming cyber-focused OpenAI model, at about $1.2 million in API costs. The Hacker News headline puts the run at 30 hours and describes the output as root-escalation exploits. Local privilege escalation lets code already running as an unprivileged user gain root, which matters most for containers and sandboxes that share a host kernel. The post follows OpenAI’s November 2 announcements of a new internal security sprint and larger bug bounty payouts. OpenAI The Hacker News
4. Office Files That Look Identical to People Read Differently to ChatGPT, Claude, Gemini, Copilot and Four Coding Agents
Research. Penghui Li shows that LLM applications see the text an extractor pulls from a document’s Office Open XML (OOXML) parts rather than what Office displays, and that this gap is an attack surface that needs no injected instruction. Static and dynamic analysis of widely used extractors found 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can, and the extractors also ignore display formatting and reading order: nudging text boxes on a slide, for example, swaps the order in which the model reads them while the slide looks unchanged. Five attacks built on these channels led models to interpret a document differently from a human reviewer, and every one of four chat assistants (ChatGPT, Claude, Gemini and Microsoft 365 Copilot) and four coding agents (Codex, Claude Code, Antigravity and GitHub Copilot CLI) was misled by at least one. The proposed defense, Prism, reconstructs the human view from the OOXML specification before the text reaches the model and also generalizes to unseen payloads. Source
5. Check Point Finds “Prompt Adware” in a Codex Jailbreak Bundle That Rewrites Global Instructions to Advertise an LLM Gateway
Check Point Research published an analysis on November 3 of Haiou (“seagull” in Chinese), a jailbreak bundle for OpenAI Codex that it classifies as prompt adware: alongside prompt modules for refusal suppression, role play and reframing offensive work as CTF exercises, plus six security skills covering penetration testing, license cracking, reverse engineering and game anti-cheat bypasses, version 4.5.0 writes a rule into Codex’s global instruction files that answers greetings such as “hi” or “hello” with an ad for the author’s OpenAI-compatible LLM gateway. The GitHub-hosted package (user haiou-666, more than 250 stars) ships its prompts as AES-256-GCM-encrypted payloads that the launcher verifies with Ed25519 signatures and decrypts, which Check Point suspects is meant to keep the prompts away from scanners that would produce static detections, and it marks the gateway as protected infrastructure the jailbroken agent must never test. The researchers found the bundle on a misconfigured server of an actor running Cobalt Strike against computers of Chinese-speaking individuals, next to the VulnClaw pentest agent and the Ladon scanner, and note it is also promoted on Bilibili and bundled in the Codex-X configuration GUI. The Claude Code variant carries no ad injection, and when Check Point tested the payload in Claude Code, Sonnet 5 flagged it as a prompt injection attempt and did not comply. Check Point found no sign the gateway itself is malicious but points to research showing some LLM gateways read user data, steal secrets and inject tool calls into agent sessions. Source
6. Baya Compiles a Web Task Into a Program Before Seeing the Site, and Scores 0% Attack Success on WASP
Research. Chow, Zhu, Venuto, Alharbi, Alomair, Popa, Wagner and Piet propose Baya, a web agent that replaces the ReAct loop, in which each action is chosen from observations that mix trusted and untrusted content, with a compile-then-execute design. Before touching the live site, Baya compiles the user’s request into a Python program that calls a Trusted Website API describing the site’s action space; the planning model never sees live page content, so untrusted data can set values or choose among branches fixed at compile time but cannot redefine the task or make the model synthesize new website operations. On 581 valid WebArena Verified tasks it reached 77.8% aggregate utility, against 55.1% for browser-only ReAct and 66.7% for API-enabled ReAct. On WASP, a security benchmark for web agents, its attack success rate was 0%, against 16.2% for API-enabled ReAct and 25.5% for browser-only ReAct. Source
7. WorkOS Says an AI Offensive Framework Automated the Breach of Its Sales Tool, and Its Founder Names ARTEX AI
WorkOS, whose authentication and SSO services are used by companies including OpenAI, Anthropic, Cursor and Perplexity according to BleepingComputer, found unauthorized access on October 30 to an internal application used by its sales and customer-facing teams. Its November 2 bulletin says the attacker reached CRM contact details (names, email addresses, phone numbers, job titles and company affiliations), account and relationship histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product usage and connection or directory health metadata, with no evidence that WorkOS application data or production services were accessed. The bulletin attributes the automated reconnaissance and exploitation attempts to “an AI-assisted offensive security framework” without naming it; founder Michael Grinich then said on X that the attacker used ARTEX AI and that investigators saw the user agents artex-enrich/1.0 and norma/0.4 in the attacker’s requests, BleepingComputer reported on November 3. ARTEX AI is an AI-driven penetration testing framework that Chinese developers released as open source earlier this year and later made private, with forks still circulating, and CrowdStrike has tied it to a campaign against about 200 organizations. WorkOS disabled external access to the application, retained an outside forensics firm, and warns customers that the exposed conversation history could make phishing requests look legitimate. BleepingComputer WorkOS bulletin
8. Pydantic AI Publishes 10 Advisories, Two High, Covering SSRF Gaps, Trace Leaks and Schema-Expansion Denial of Service
Pydantic AI published 10 GitHub security advisories on November 4 alongside v2.66.0 and v1.107.10, the latter a security-only release for the 1.x line. The two rated high (CVSS 7.5) are GHSA-m5vj-8mcw-82qx, where local web fetching can exhaust memory and block the event loop while formatting a crafted nested JSON response, and GHSA-mfx5-pc32-32m8, where the Pydantic AI Harness private-key redaction can take exponential time on short input (fixed in Harness 0.66.0). Among the medium advisories, GHSA-4cj4-hgwf-4hc4 (CVSS 5.9) lets tool result data shaped like a file be rebuilt as a file download or provider file reference when message history is reloaded, GHSA-5fj9-5pjw-vpwc (6.8) adds Tencent Cloud’s metadata address (169.254.0.23) to the SSRF cloud-metadata guard, GHSA-jp94-mmr3-2pvv (6.5) stops embedding extra_headers and extra_body settings from being recorded in traces, and GHSA-7494-925c-rrxv and GHSA-484x-x9m4-62cj (6.5 each) cap exponential and unbounded tool-schema expansion. The rest cover quadratic message loading in UI adapters, domain allowlists that resolved refused hostnames before rejecting them, and an MCP server URL credential reaching chat frontends through MCP Apps events (fixed earlier in 2.60.0). Most issues affect 1.x releases through 1.107.9 and 2.x releases through 2.65.0. Source
9. Claude’s Text Watermark Skips Five Older Models When One Sampling Parameter Changes, Anthropic Tells API Customers
Anthropic emailed API customers on November 4 that a second wave of its text watermark will reach Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 4.5 and Claude Haiku 4.5 starting November 16, with Amazon Bedrock possibly a few days later, The Decoder reports. On all four, as on Claude Sonnet 4.6, the mark is applied only while temperature, top_p and top_k stay at their defaults, so changing any one of them yields unmarked text; Anthropic’s documentation had stated this caveat only for Sonnet 4.6, and the email gives no such caveat for Claude Mythos 5 or Claude Opus 4.7. Opus 4.6 had been scheduled for the November 3 wave and was delayed without a stated reason. Anthropic’s response is a compliance note (“If you rely on the watermark for your own compliance, keep these settings at their defaults”); customers otherwise cannot switch the mark off, a detection API is in private preview, and Anthropic links the staged rollout to the EU AI Act’s December deadline. The Decoder’s report rests on the email and does not describe testing of its own. Source