Claude, Codex, and Hermes installed unowned code inside corporate networks

Ars Technica security feed covering active exploitation, supply-chain compromise, credential exfiltration, AI-enabled attacks and prompt-injection failures, device and server takeover vulnerabilities, browser fingerprinting, phishing, surveillance, and account-takeover defenses. The most urgent reports involve an actively exploited macOS screen-sharing flaw, a maximum-severity Microsoft Exchange vulnerability exploited by Kremlin-linked actors, compromised AI packages leaking terabytes of credentials, and vulnerabilities enabling remote device or server control.