Robowise // Insights

AI security in October 2026: what builders should know

The most important AI security discoveries and incidents from mid-September to October 23, 2026, what they mean for teams building with AI, and the safeguards worth putting in place now.

Published

Executive summary

Four themes stood out over the past six weeks. First, trusted AI packages were hijacked. Popular AI libraries on npm and PyPI shipped versions that stole credentials as soon as they were installed. Second, coding agents treat repository files as instructions. A config file inside an untrusted project can make several AI coding tools run an attacker's commands. Third, AI is finding serious bugs at internet scale. AI-assisted research uncovered critical flaws in PHP and Next.js, and both were patched in October. Fourth, voice and agent workflows can be steered. New research shows a tampered speech model can slip a command into a transcript that a downstream agent then carries out.

The good news is that most of these have fixes or clear defenses. The teams that come through well will be the ones that patch quickly, pin their dependencies, keep credentials out of reach of their tools, and require human confirmation before an agent takes a sensitive action.

Main findings

Poisoned packages in AI tooling

  • Oct 21

    LiteLLM 1.107.0 shipped a credential stealer

    LiteLLM's release pipeline was compromised. A malicious version was live on PyPI for about two hours, and Docker images were affected for about two and a half hours. The malware stole credentials and loaded remote-code tools. Earlier versions are safe.

  • Oct 8

    tensorlake 0.5.144 on npm carried a self-spreading worm

    An AI sandbox SDK was published from a hijacked maintainer account. It stole GitHub, npm, cloud and AI-tool credentials, and it planted .claude and .vscode files so it would run again. If a stolen token was revoked, it could wipe the user's home directory, so responders were told to remove the monitor process before rotating keys.

  • Oct 13

    npm Trusted Publishing could be claimed through renamed repos

    Researchers at Bloom Security reported that npm bound trusted publishing to a repository's name rather than its permanent ID. They found more than 1,500 packages that could be exposed this way.

One lesson stands out. The tensorlake release carried a valid provenance attestation, which only proves where a package was built, not that its code is safe.

Coding agents and MCP servers

  • Oct 2

    ConfigPoisoning: a repo's own git config can hijack a coding agent

    GitLab's threat researchers showed that viewing a diff in DeepSeek-Reasonix Studio could run attacker code from a repository's .git/config or .gitattributes (CVE-2026-102437). They said several widely used coding agents share the same class of flaw.

  • Oct 23

    Aider runs shell commands from a repo's config file, with no fix yet

    Aider 0.86.2 and earlier run commands from a project's .aider.conf.yml without asking (CVE-2026-115726, reported by VulnCheck). Opening an untrusted repo is enough to trigger it.

  • Oct 13

    Prompt injection could plant commands in VS Code Copilot hooks

    Microsoft fixed CVE-2026-102232 in VS Code 1.141.1. Injected text could get the agent to edit hook files that then ran shell commands with the user's privileges.

  • Oct 21

    MCP Inspector could run code when connecting to a remote server

    On Windows and WSL, a remote MCP server could execute code through a crafted OAuth URL, with no click or approval needed. Fixed in @modelcontextprotocol/inspector 2.12.0.

  • Oct 15

    Langflow's MCP command flaw is being exploited in the wild

    Sensors logged 1,674 attempts to exploit CVE-2026-105740 in Langflow, and the payloads read Langflow's own secrets. The fix shipped in Langflow 1.9.0 in September.

  • Oct 15

    Infostealers now target AI coding assistant credentials

    Symantec reported that the Aoki infostealer now collects tokens and config files for Claude, Codex, GitHub Copilot, Cursor, Gemini and other coding assistants.

Web frameworks and servers

  • Oct 14

    Next.js fixed two critical remote-code flaws and a denial-of-service bug

    One flaw is in image optimization for SVGs on glibc-based Linux. Another affects use cache functions that return typed arrays. A third lets crafted requests tie up apps that use Server Actions. The fixes are in 15.5.28 and 16.4.1, and sharp 0.35.5 or later covers the image flaw.

  • Oct 21

    PHP2Shell: two critical PHP flaws found with AI assistance

    CVE-2026-109618 and CVE-2026-109619 are rated 9.2. They allow unauthenticated remote code execution on PHP 5.4 through 8.5.11. Fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and DigitalOcean says proof-of-concept exploit code is public. PHP 8.1 and older get no official release.

Leaked and exposed API keys

  • Oct 17

    OpenCode Console breach may have exposed stored provider keys

    OpenCode said a breach of a legacy system may have exposed the OpenAI, Anthropic and Google keys stored by 1.4% of Console users. Affected users were told to revoke those keys directly with each provider.

  • Oct 20

    A scan of 535 AI-built apps found keys and endpoints anyone could abuse

    Of the apps that had a server endpoint calling an AI model, 32 of 104 let anyone call it with no login and no rate limit. Eight apps had committed a real-looking provider key, and most of those keys were still readable in git history.

  • Oct 13

    GitHub now blocks Anthropic keys at push time by default

    GitHub's secret scanning added new Anthropic key types and blocks commits that contain them in any repository that has secret scanning turned on.

Voice agents

  • Oct 23

    A speaker-activated backdoor hides commands in speech transcripts

    Researchers fine-tuned speech recognition models to recognize one person's voice and quietly add an instruction to their transcript. In a sandboxed banking test, connected AI agents went on to make a fake $5,000 transfer in 47.9% to 82.3% of cases. The attack requires access to the model's fine-tuning, and retraining on clean audio greatly weakened it in one model.

The authors' advice applies to any voice agent. Never let a single spoken command trigger a sensitive action. Confirm it through an independent channel, and check speech models before you deploy them.

Attackers using AI agents

  • Oct 21

    An AI pentest agent was reportedly behind a major tenant breach

    According to reporting on Microsoft's analysis, a China-aligned actor tracked as Storm-0940 used the open-source ARTEX agent framework in the ConnectWise Cloud Backup compromise. The actor attempted sign-ins to more than 2,250 Microsoft 365 tenants.

  • Oct 22

    The same campaign widened to software vendors

    Wiz Research reported password-spraying against hundreds of Okta and Entra ID accounts, mostly belonging to software engineers.

  • Oct 2

    AI-found vulnerabilities are arriving in volume

    As of October 2, Anthropic's disclosure dashboard listed 6,157 AI-found vulnerabilities reported across 591 open-source projects, and 516 of them were known to be patched. Defenders can expect a steady stream of patches.

What it means for companies building with AI

  • GitHub and coding agents

    An untrusted repository is now an attack surface, not just untrusted code. Config files, hook files and MCP settings inside a repo can turn an agent against the developer running it. Developer laptops hold the most valuable keys in the company, and infostealers know it.

  • APIs and dependencies

    A single malicious release of a popular AI package can take every secret on the machine that installs it, at install time, before any code is called. Floating version ranges and auto-updating containers widen that window.

  • Voice agents

    Speech models sit upstream of everything an agent does. A tampered or unvetted transcription model can make an agent act on words the caller never said, and reading the transcript will not reveal it.

  • Cloud infrastructure

    Critical bugs in everyday building blocks like PHP and Next.js are being found faster, partly by AI, and public exploits follow quickly. Forgotten servers and side projects are the likeliest to be missed.

  • Healthcare and other sensitive data

    When an agent can reach patient records or move money, any of the risks above becomes a data-exposure event. Least privilege and human confirmation matter more than any single patch.

Recommended safeguards

  1. Patch the October criticals now

    Upgrade Next.js to 15.5.28 or 16.4.1 with sharp 0.35.5 or later. Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and inventory every server and image that runs PHP.

  2. Pin and verify dependencies

    Commit lockfiles, pin exact versions for AI SDKs, and use a short cooling-off period before adopting new releases. Disable install scripts in CI where you can, and treat provenance as a signal, not a guarantee.

  3. Treat repos as untrusted input to agents

    Open unfamiliar repositories with agent auto-run off. Review .git/config, agent config files, hook files and MCP settings before trusting them, and keep coding tools updated.

  4. Keep secrets out of agents' reach

    Use short-lived, narrowly scoped tokens. Keep production keys off laptops, turn on GitHub secret scanning and push protection, and set hard spend limits with every AI provider.

  5. Lock down AI endpoints

    Every route that calls a model needs authentication and rate limits. Never ship a provider key to the browser.

  6. Require confirmation for sensitive agent actions

    For voice and chat agents, confirm payments, record changes and data disclosures through a second channel or a human. Vet speech and other models before deployment.

  7. Protect branches and releases

    Require reviews on the main branch and on release workflows, and use phishing-resistant MFA for maintainers, since several of these compromises started with a hijacked account.

  8. Have a credential-rotation playbook ready

    Know how to isolate a machine, rotate every key it could reach, and rebuild it from a clean image. Check for persistence first, as the tensorlake worm showed.