AI Security Digest: May 28 – June 11, 2026

Your regular briefing on AI security threats, vulnerabilities, and defenses from Darkhunt AI

TL;DR

• An AI support agent handed attackers 20,225 Instagram accounts. Meta's High Touch Support assistant sent password-reset links to attacker-supplied emails without checking they matched the account — a privileged action with a broken authorization check, undetected for six weeks.

• Anthropic published the first hard adversarial number for an agentic surface: its Opus 4.8 browser agent was hijacked 31.5% of the time before safeguards, 0.5% with them, 0% with extended thinking off — across 129 environments. And no two frontier labs measure the same way.

• OWASP's State of Agentic AI Security v2.01 moved from abstract scenarios to cataloged CVEs and breach data. Prompt injection now maps to 6 of 10 categories in the Agentic Top 10, and coding agents dominate the incident data.

• OpenAI shipped Lockdown Mode — and in doing so conceded that prompt injection can't be reliably filtered at input, so the fix is to remove the exfiltration channel by cutting agent capability.

• Supply chain attackers are now targeting the AI defenders. A PyPI campaign (28 packages, 41 versions) ships a prompt injection designed to fool LLM-based security analyzers into clearing it.

🔥 Top Stories

An AI Support Agent Gave Away 20,225 Instagram Accounts

What happened: Attackers exploited Meta's AI-powered High Touch Support (HTS) account-recovery assistant. The agent would send a password-reset link to an email address the requester supplied — without verifying that address matched the account's registered one. Per a breach filing with the Maine Attorney General, 20,225 Instagram accounts were compromised between April 17 and May 31, 2026, including a dormant Obama-era White House account and a U.S. Space Force Chief Master Sergeant's profile. The flaw ran undetected for roughly six weeks. Accounts protected by 2FA survived; accounts without it did not.

Why it matters: This is the defining agentic-AI breach of the cycle. It is not a model that said something embarrassing — it is an agent wired to a privileged action (password reset) executing it on the strength of a broken authorization check. That is the exact risk class that separates agents from chatbots: the damage comes from what the agent is allowed to do, not what it is allowed to say. The six-week detection gap is the second lesson — nobody was watching the AI-driven support flow closely enough to notice 20,000 takeovers in progress.

Darkhunt perspective: Authorization for an agent's privileged actions cannot live inside the agent's own reasoning. The moment "should this reset go to this email?" is a judgment the assistant makes, rather than an invariant the system enforces, you have shipped the vulnerability. Agents need authorization checks that are external, deterministic, and indifferent to how persuasive the input is — and they need observability tuned to the agent's actions, not just its uptime. We did a full teardown of this incident: "Meta's AI Support Agent Handed Hackers the Keys to 20,000 Instagram Accounts".

Anthropic Put a Number on It — and Proved Nobody Else Uses the Same Ruler

What happened: In a 244-page report (May 28), Anthropic disclosed that its Opus 4.8 browser agent was successfully hijacked by prompt injection 31.5% of the time before safeguards engaged, dropping to 0.5% with safeguards and 0% with extended thinking turned off, measured across 129 environments using an adaptive attacker and a week-long live bug bounty. Independent analysis this cycle then lined that up against the 2026 disclosures from OpenAI, Google, and Meta and found there is no shared measurement standard: OpenAI reported on a single surface (connectors), Google moved the metric into a separate framework, and Meta shipped no closed-model card at all.

Why it matters: This is the first concrete, adversarial prompt-injection failure rate a frontier lab has published for an agentic surface — and it is a sobering one. Roughly one in three hijack attempts succeeded before mitigations. The 31.5% → 0.5% → 0% gradient is also the cleanest public evidence yet that capability is attack surface: turn off browsing and extended thinking and the attack vanishes, because you have removed the very machinery the attacker needs. The deeper problem is the second finding — buyers cannot compare vendors, because no two labs measure the same thing.

Darkhunt perspective: A self-reported number, measured by the team that built and is selling the model, against a methodology it chose, is a starting point, not an audit. The absence of a cross-vendor benchmark is precisely the gap that vendor-neutral, adversarial red-team evaluation exists to fill. The 31.5% figure should be read as encouraging that someone published it — and as a reminder that the only number you should trust about your deployment is the one an independent attacker produced against your configuration.

OWASP's Agentic Security Report Grows Teeth

What happened: OWASP's State of Agentic AI Security and Governance v2.01 (June 11) replaced last year's abstract threat scenarios with cataloged CVEs, advisories, and real breach reports. Prompt injection now maps to 6 of the 10 categories in the Top 10 for Agentic Applications. Coding agents dominate the new incident data — 28 of 53 tracked agentic projects. The advisory leaderboard reads as a ready-made targeting map: n8n (57), Claude Code (22), AutoGPT (15), Dify (13), Roo-Code (11). And only 37% of organizations report having any shadow-AI detection policy.

Why it matters: This is the authoritative annual stocktake, and it has stopped theorizing. Grounding the Top 10 in real CVEs and breaches confirms three uncomfortable facts: risk concentrates in tool-using and coding agents, prompt injection is the dominant root cause across the majority of categories, and most organizations cannot even see the AI agents running in their environment.

Darkhunt perspective: Prompt injection spanning 6 of 10 categories is not ten separate bugs — it is one architectural reality (a single, undifferentiated token stream where instructions and data are indistinguishable) showing up ten different ways. You do not patch that; you design around it with trust boundaries, least-privilege tool access, and continuous adversarial testing. The advisory leaderboard is the honest version of a red-team scope document: it tells you exactly where the live damage is.

🎯 Attack Vectors & Vulnerabilities

Untrusted input → CI/CD write access (Claude Code GitHub Action). Researcher RyotaK (GMO Flatt Security) disclosed on June 1 that a single malicious GitHub issue could inject instructions into Anthropic's claude-code-action running in GitHub Actions, exfiltrating secrets via paths like /proc/self/environ. Root cause: a flawed checkWritePermissions check that waved through any actor whose name ended in [bot]. Reported January 12, fixed within four days (January 16), rated 7.8 under CVSS v4.0, with a $4,800 bounty — but no CVE and no public advisory. The textbook agentic supply-chain pattern: untrusted external text reaching an agent that holds CI/CD write access and secrets. The missing CVE is its own problem — downstream users have no advisory to track their exposure against. (GMO Flatt Security disclosure)

Malware that attacks the AI defender (Hades Campaign). A Miasma/Shai-Hulud-lineage PyPI campaign compromised 28 packages across 41 versions (per StepSecurity; ensmallen, embiggen, gpsea and others). Its bundle opens with a plain-text prompt injection engineered to hijack LLM-based security analyzers into classifying the package as verified infrastructure, while sending decoy traffic to Anthropic servers. It also deploys cross-platform memory scrapers, harvests AI-tool configs, and runs a gh-token-monitor wiper daemon that destroys files if stolen tokens are revoked. This is the clearest case yet of malware weaponizing prompt injection against the AI now doing security triage — the defender is part of the attack surface — paired with an anti-revocation extortion mechanic that quietly rewrites incident-response economics. (StepSecurity analysis)

Memory poisoning as the persistence layer. New academic work (MPBench, below) catalogs how untrusted input can corrupt an agent's long-term memory — a write that survives across sessions, long after the malicious prompt has scrolled out of context.

🛡️ Defensive Developments

OpenAI Lockdown Mode. OpenAI shipped a deterministic control (rollout began June 4) that severs the exfiltration stage of prompt injection by disabling live browsing, web image retrieval, deep research, and agent mode for high-sensitivity users. Crucially, OpenAI says plainly that it does not stop injections from entering context — it removes the channel they'd use to get data out. This is a frontier lab conceding that input filtering is not reliable and choosing capability reduction instead. It validates two things we say often: guardrails are controls, not boundaries; and capability and attack surface are the same dial viewed from opposite ends. (TechCrunch)

Membrane — a self-evolving safety memory. A guardrail (arXiv) that learns from each problematic interaction without retraining, pairing block-conditions with permit-conditions for superficially similar benign requests ("Contrastive Safety Memory"). It posted the highest F1 across six jailbreak types, cut benign refusals to 7–14% (versus 28–85% for prior guards), transferred at 87–88% F1 across attack types, and stayed stable under attempts to poison its own memory. The close-the-loop pattern done right: update from new attacks, generalize to variants, keep false-refusals low.

AgentRedGuard — integration-aware defense. Released alongside the AgentRedBench benchmark (below), this trained guard cut panel attack-success-rate from 69.9% to 2.4% at a 0.37% false-positive rate, generalizing across enterprise connectors rather than memorizing payloads.

🔬 Research & Papers

AgentRedBench (arXiv 2606.02240). A dynamic red-teaming benchmark of 215 underspecified-authorization scenarios across 24 enterprise integrations (Gmail, Salesforce, Jira). Unprotected attack-success-rate ranged from 32% (Claude Sonnet 4.6) to 81% (Gemini 3 Flash); the trained AgentRedGuard cut it to 2.4% at sub-1% false positives, beating prior guards. Practical implication: "underspecified authorization" — the gap between what an agent is authorized to do and what it actually executes — is now a measurable, exploitable surface, and a dynamic benchmark resists the staleness that kills static payload sets. (arXiv)

MPBench — memory poisoning (arXiv 2606.04329). A systematic study of memory poisoning in LLM agents: four memory write channels, nine structural vulnerabilities, a six-class attack taxonomy, and a benchmark. The key result: agents with more aggressive memory write/retrieval are more exploitable, and existing prompt-injection defenses do not cover memory poisoning. Practical implication: agent memory is its own trust boundary and needs its own primitives — a PI filter on the input stream does nothing for a poisoned write that persists across sessions. (arXiv)

Membrane (arXiv 2606.05743). See Defensive Developments — evaluated on HarmBench and AgentHarm. (arXiv)

📊 Industry Moves

• OWASP shipped its first-ever AI/Agentic Red Teaming Landscape in Q2 2026 alongside the v2.01 State report — a signal that agentic red teaming is consolidating into a recognized discipline with shared reference material. (Help Net Security)

• The disclosure ecosystem is lagging the threat. The Claude Code GitHub Action flaw was responsibly reported, fixed in four days, and bounty-paid — yet shipped with no CVE and no public advisory. As agentic supply-chain bugs multiply, the absence of consistent disclosure machinery leaves downstream users unable to track exposure.

• Shadow AI remains a governance black hole. OWASP's finding that only 37% of organizations have shadow-AI detection policies means the majority cannot inventory the agents already operating inside their perimeter — the precondition for every story above.

💡 The Darkhunt Take

The through-line this cycle is uncomfortable and consistent: every serious incident lived in the gap between what an agent was authorized to do and what it actually did. Meta's support agent was authorized to send reset links — to the right person. It sent them to attackers. Anthropic's browser agent was authorized to browse and act on behalf of a user — and a third of the time, an attacker did the authoring. The Claude Code action was authorized to operate in CI — until a [bot] suffix let an outsider drive it. OWASP's data and the AgentRedBench paper name the same disease from opposite ends: underspecified authorization, executed by a system that treats instructions and data as one undifferentiated stream.

That diagnosis reframes the defenses. OpenAI's Lockdown Mode works not because it filters attacks better but because it removes capability — proof that the industry's most resourced labs have concluded you cannot reliably sanitize the input stream, only constrain what the agent can do with it. The most promising research (Membrane, AgentRedGuard, the memory-poisoning work) converges on the same shape: defenses that learn from each new attack, generalize to its variants, and protect their own state from being poisoned. That is not a static filter. It is a loop.

Which is the real lesson of the period. Static, reactive, input-side security is being retired in front of us — by a 31.5% hijack rate, by a six-week detection gap, by malware that now targets the analyzer instead of the analyst. What replaces it is adversarial pressure applied continuously against your configuration, and defenses that reason about each new attack and harden against it before it runs again. The attackers are already adaptive. The defense has to be too.

Darkhunt AI builds autonomous systems that probe, reason, and harden AI defenses. Learn more