'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...
InfoWorld

GitHub AI agent leaks private repositories via prompt injection attack

A prompt injection attack can trick GitHub’s preview Agentic Workflows into retrieving content from private repositories and ...
SecurityWeek

Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection

A critical prompt injection vulnerability in GitHub Agentic Workflows could allow unauthenticated attackers to leak private repository data, ...
techtimes

Google agents-cli: One Command Adds AI Agent Lifecycle Skills to Claude Code and Codex

The offices of Google are pictured in London on February 28, 2026. JUSTIN TALLIS/AFP via Getty Images Google released agents-cli on April 21, 2026, and it has shipped 13 updates in the 71 days since — ...
techtimes

North Korea macOS Malware Gaslight Manipulates AI Triage Tools, Not the Sandbox

An IT specialist in cyber security looks at a morphological analysis of a software containing a malware at the Loria (Lorraine Laboratory for Research in Computer Science and Applications) ...

7,000 Langflow servers are under attack. LangGraph and LangChain have the same holes

Attackers are actively exploiting path traversal and SQL injection in Langflow, LangGraph, and LangChain — below where your security tools look.
GitHub

Tortoise ORM

Why was Tortoise ORM built? Tortoise ORM was built to provide a lightweight, async-native Object-Relational Mapper for Python with a familiar Django-like API. Tortoise ORM performs well when compared ...