Daily brief · 2026-10-08
New incidents (4), most serious first
-
Meta Muse AI agent KVM escape vulnerability discovered before launch
Meta’s pre-launch Muse AI agent, which runs inside a KVM to isolate it from Meta’s infrastructure, was found by engineers to have a vulnerability that could let an ordinary Muse account break out of the virtual machine and reach sensitive data in Meta databases.
-
DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)
DB-GPT 0.8.0, an open-source platform bridging AI agents to databases and knowledge bases, contains two unauthenticated RCE flaws: CVE-2026-51862 (CVSS 9.1), a directory traversal in the skill_upload endpoint, and CVE-2026-51869 (CVSS 9.8), a sandbox failure where the platform silently falls back to LocalRuntime and executes code on the host.
-
AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks
An attacker targeting South Korea's financial sector used ARTEX, a Chinese-developed open-source AI agent for automated penetration testing, alongside large language models including Anthropic's Claude, in a campaign against South Korean financial institutions from late September to early October.
-
Deepfake investment-scam ads impersonating Nigerian public figures on Facebook
Deepfake videos impersonating Nigerian public figures, including Senator Natasha Akpoti-Uduaghan, Peter Obi and Ngozi Okonjo-Iweala, were used in paid Facebook ads promoting fraudulent investment schemes.