Just like phishing for gullible humans, prompt injecting AIs is here to stay
2026-04-20T07:23:55Z•6d03f70df4a1d6c0fb3782f38af3e72c317f3791743539ba0bdd764854a12bb1
active-exploitagent-hijackai-securityanthropic-mcpapache-activemqcisa-kevcredential-theftcritical-vulnerabilitiesdata-breachexcel-vulnerabilityfortinetmicrosoft-patch-tuesdaypatchingprompt-injectionransomware
What happened
Feed roundup of emergent security incidents and research: multiple actively exploited and critical vulnerabilities (including a 13-year-old Apache ActiveMQ bug added to CISA's KEV list, a critical 17-year-old Excel flaw under attack, and two critical Fortinet sandbox bugs that allow auth bypass/remote command execution). Heavy focus on AI-related risks — prompt-injection and agent hijacking (GitHub-integrated agents exfiltrating tokens), model/architecture flaws (Anthropic MCP design issue affecting up to ~200k servers), and Git identity spoofing that tricks AI code reviewers. Other items: a N
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- theregister_security
- Record identifier
- 6d03f70df4a1d6c0fb3782f38af3e72c317f3791743539ba0bdd764854a12bb1
- Enrichment time
- 2026-04-20T07:23:55Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.