Adblock for YouTube has over 11 million installations. However, it can inject script code into any page uncontrollably.

Microsoft’s AutoJack research shows how a malicious webpage rendered by an AI browsing agent can reach local MCP services and execute arbitrary processes on the underlying system. Microsoft is warning ...

Malicious SVG uploads in DotNetNuke execute JavaScript when clicked Attack requires only one admin click to trigger full server compromise XSS flaw allows attackers to act using the victim’s ...

Security researchers from GoDaddy found a cheeky new malware campaign that used comments made by Steam Community accounts as command-and-control (C2) infrastructure. Here is how the attack plays out: ...

An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code. According to Island, the ...

A Chrome ad blocker with more than 10 million installs has reopened an old browser security debate. The tool may work as promised, but researchers say its design leaves room for a much riskier outcome ...

Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution. Steer the agent to load an attacker's web page, ...

Discover the AI Agent Safety Directory that evaluates AI agents before deployment with trusted safety ratings, risk insights, and performance benchmarks.

June 19, 2026 update: Microsoft assesses with high confidence that this activity is attributable to Sapphire Sleet, a North Korean state actor that primarily targets the financial sector. The ...

Awareness of all the ways prompt injection can be effected will help security teams spot a new generation of attacks.

Indirect prompt injection attacks are now draining cryptocurrency from AI agents in production. Zscaler ThreatLabz documented ...