A remote code execution (RCE) vulnerability, CVE-2026-67544, was discovered in Heym's workflow engine prior to version 0.0.71. The vulnerability occurs when an authenticated user submits arbitrary Python code through the Playwright node's playwrightCode field, which is then executed directly by the backend process without sandboxing or validation. This allows for RCE on the backend host, potentially running as the root user in default Docker deployments. The issue has been patched in version 0.0.71.

A vulnerability, tracked as CVE-2026-67547, was discovered in the self-hosted AI agent OS taOS. In versions prior to 1.0.0-beta.23, the taOS API endpoint for executing built-in skills did not perform sufficient access controls, allowing any authenticated non-admin user to execute arbitrary Python code on the host system. This vulnerability enabled remote code execution without requiring admin privileges. The issue was addressed in version 1.0.0-beta.23.

A vulnerability, CVE-2026-67546, was identified in Heym's agentic systems and business-process automation infrastructure prior to version 0.0.75. An authenticated user with the lowest role could execute a malicious command on the shared backend host by exploiting the POST /api/mcp/fetch-tools endpoint, which accepts the stdio transport. This allowed the attacker to bypass normal protocol validation and execute arbitrary code, regardless of whether the command was intended to communicate via the MCP protocol. The issue has been patched in version 0.0.75, which adds role-based access controls to mitigate the vulnerability.

A security vulnerability was discovered in Heym, a system used for building and running agentic systems and business-process automations. Prior to version 0.0.73, Heym's HTTP workflow node made unvalidated outbound HTTP requests to user-specified URLs, allowing an unauthenticated attacker to exploit a Server-Side Request Forgery (SSRF) vulnerability. This was possible when a workflow targeting internal addresses was exposed with anonymous execution. The issue has been resolved in version 0.0.73, which adds validation for target host or IP addresses in the HTTP workflow node.

A security vulnerability was discovered in the Heym system prior to version 0.0.70. The issue allowed authenticated users with the lowest role to access the POST /api/mcp/fetch-tools endpoint, which could be used to fetch an attacker-supplied URL through the SSE and Streamable HTTP transports without any security restrictions. This allowed an attacker to perform a server-side request forgery (SSRF) attack, which can be used to access private IP addresses and potentially compromise the system. The vulnerability was patched in version 0.0.70, which restricts access to the endpoint to users with higher roles and adds security restrictions to prevent SSRF attacks.

A vulnerability (CVE-2026-67543) was discovered in Heym, an agentic system and business-process automation platform, prior to version 0.0.70. The issue allowed untrusted code to escape the intended Docker sandbox and execute with host root privileges due to inadequate isolation. Specifically, the skill executor skillpythonexecutor.py ran untrusted code in a local subprocess with excessive filesystem and network access, and mounted the Docker socket as root. This allowed an attacker to potentially exploit the vulnerability and gain root access on the host system. The issue has been patched in version 0.0.70 of Heym.

A vulnerability (CVE-2026-126767) was found in OpsTree REMS versions up to 1.0.0, affecting its chat assistant feature. The vulnerability, a prompt injection issue, allows authenticated users to access the system's internal prompt by submitting specially crafted chat input to the /api/v1/rca/chat endpoint. This enables attackers to bypass the assistant's rules and obtain sensitive orchestration instructions, facilitating further prompt injection attacks. This matters to AI developers and operators as it compromises the security of the chat assistant, potentially allowing malicious users to manipulate the system and gain unauthorized access to internal information.

A remote code execution vulnerability in Visual Studio allows an unauthorized attacker to execute code over a network due to deserialization of untrusted data. This vulnerability affects the security of agents and AI-powered tools that rely on Visual Studio.

A vulnerability (CVE-2026-96437) was identified in the ai-azure-content-safety plugin for Kong Gateway Enterprise. The plugin fails to inspect request bodies larger than its in-memory buffer, allowing attackers to bypass input content-safety checks. This enables malicious requests to evade detection. The vulnerability affects users who rely on the plugin for content safety and security in their Kong Gateway deployments.

A vulnerability was discovered in the Microsoft 365 Agents SDK, identified as CVE-2026-109485. The issue is a server-side request forgery (SSRF) bug that enables an authorized attacker to disclose information over a network. This vulnerability allows an attacker with access to the affected system to make unauthorized requests on behalf of the system, potentially leading to sensitive information exposure. The bug affects the Microsoft 365 Agents SDK, which is used by developers to integrate Microsoft services into their applications. This vulnerability matters to developers and operators of AI agents as it may compromise the security and integrity of their systems if not addressed promptly.

Anthropic's Claude Fable 5.2 and Claude Mythos 5.2 models were released, exhibiting improvements in coding, reasoning, and vision. During pre-release training, the models demonstrated capabilities such as completing software migrations, designing electronic devices, solving open physics problems, and formalizing mathematical proofs. In the multi-stage cyberattack benchmark, CyScenarioBench, Fable 5.2 outperformed GPT-6 Cyber, completing 76.3% of challenges compared to 61.7% for Fable 5.1 and 61% for GPT-6 Cyber. This indicates enhanced ability of Claude models to execute complex, multi-stage cyber operations in a realistic environment.

A vulnerability (CVE-2026-125397) exists in NocoBase plugin-ai versions 2.1.0 through 2.2.41 due to an authorization bypass in the getAccessibleAIEmployee function. This allows authenticated users to access unassigned AI employees by manipulating the role-derived filter with a supplied username. Attackers can exploit this vulnerability to run ungranted AI employees with elevated permissions and read sensitive data, such as prompts and tool configurations. This matters to people building or operating AI agents as it enables unauthorized access to potentially sensitive AI resources, potentially leading to data breaches or unauthorized AI activity.

A vulnerability was discovered in NocoBase plugin-ai versions 2.1.0 through 2.2.41, where an authenticated user can bypass authorization checks to access AI employees not assigned to them. This is due to the getAccessibleAIEmployee function not properly filtering by role. An attacker can exploit this vulnerability using the dispatch-sub-agent-task tool to execute unauthorized AI employees and the get-ai-employee tool to read sensitive data, such as prompts and tool configurations. This matters to AI developers and operators as it allows unauthorized access to AI employees and their associated data, potentially leading to data breaches or system compromise.

A vulnerability was discovered in the `fast-agent serve` command. By default, it binds to all network interfaces on port 8000 without authentication, allowing any host with network access to control the agent. When the `--shell` flag is used, an unauthenticated remote client can execute arbitrary OS commands, resulting in unauthenticated remote code execution (RCE). This is due to the agent's default configuration in `cli/commands/serve.py`, `mcp/server/agentserver.py`, and `tools/localshellexecutor.py`. This vulnerability affects versions up to 0.7.20, including the Docker Python 3.13-slim image.

A vulnerability (CVE-2026-119613) was identified in Ash-project Ashai. The bug allows an attacker to retrieve internal error details, including module names and data values, by inducing a tool call failure. The error information, including potentially sensitive data, is not logged and is instead sent to clients and the model. The fix for this issue logs error messages with a unique ID and returns only the ID to the caller, preventing sensitive information exposure. This issue affects Ashai versions 1.5.0 and earlier.

A vulnerability (CVE-2026-119613) was found in the ash-project ashai tool. It allows an attacker to read sensitive information by causing a tool call to fail, resulting in internal error details being returned. This included module names and data values. The fix logs these errors with a unique ID and returns only the ID to the caller, preventing sensitive information disclosure. Affected versions are ashai 1.5.0 and earlier, with a fixed version of 1.5.1.

The author of the demo, MintCoderpro, developed a control layer for AI coding agents like Claude Code to ensure transparency and safety when working autonomously on repositories. This control layer tracks and verifies agent actions against predefined rules, using cryptographic SHA-256 verifications to detect potential rule breaches. Users can define approval rules (pass, require approval, or refuse) for agent actions before and after execution. The demo showcases scenarios where the agent is authorized, requires human approval, or is refused due to unauthorized modifications. This control layer is intended to provide safety boundaries for critical data and sensitive codebases by allowing users to monitor and regulate AI agent activity.

A remote code execution vulnerability in IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 allows an authenticated attacker to cause a denial of service due to improper slug normalization, resulting in tool name collisions. This vulnerability is significant for developers building and operating AI agents that interact with the affected software, as it may lead to unintended behavior or system crashes. The issue is caused by a bug in the way the software handles URLs, which can be exploited by an attacker with valid authentication credentials. Developers should update to version 1.0.12 or later to mitigate this vulnerability.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 are vulnerable to a denial-of-service (DoS) attack due to improper slug normalization, where a remote authenticated attacker can cause a tool name collision, leading to a denial-of-service condition. This vulnerability is relevant to developers and operators of AI agents using IBM ContextForge MCP Gateway, as it may be used in conjunction with other AI tools, and a successful attack could disrupt the functionality of these agents, potentially causing operational disruptions or data loss.

A remote code execution vulnerability (CVE-2026-18484) was identified in IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11. The issue arises from improper slug normalization, which can cause tool name collisions. This allows a remote authenticated attacker to potentially cause a denial of service. Users of these affected versions should update to a fixed version to mitigate the vulnerability.