A concise, fact-based update for security and risk professionals covering roughly the past 72 hours.

🔐 Core Security Intelligence

1) Second-order prompt injection turns ServiceNow’s Now Assist into a “malicious insider”

What’s new:
AppOmni researchers showed how ServiceNow’s Now Assist generative AI platform can be abused via a technique they call second-order prompt injection. In their scenario, a low-privilege AI agent is tricked into creating tasks that a higher-privilege agent executes automatically, resulting in data exfiltration and privilege abuse without human review.

Source: Second-order prompt injection can turn AI into a malicious insider

Why it matters:
This is not a classic bug but a consequence of default multi agent configuration. It demonstrates how autonomous AI agents can collaborate in ways that silently bypass human approvals and existing access controls, effectively behaving like a coordinated insider threat.

Defenses:

• Harden multi agent configurations and supervision. Disable or tightly restrict fully autonomous task handoffs between agents, especially where low-privilege agents can generate tasks for higher-privilege ones. Require supervised or approval modes for privileged actions, including exports and configuration changes.
• Constrain what agents can see and do. Define per agent scopes for data, systems, and actions, and enforce policy at the orchestration layer so that an agent cannot initiate high-impact actions outside its mandate. This includes limiting external notification endpoints and outbound network paths.
• Instrument and monitor agent behavior like human users. Log all agent-to-agent task creation and execution with clear attribution, and feed this into detection pipelines. Look for suspicious patterns such as repeated bulk exports, unusual destinations, or agent workflows that never involve a human.

Expert Insight:
Most organizations have spent years maturing insider threat programs for people, not for agents. This research shows that as soon as agents can coordinate with each other, misconfiguration becomes equivalent to granting a malicious insider permanent access. Security leaders should treat AI orchestration platforms as high value identity and workflow infrastructure, not as innocuous automation.

2) vLLM RCE vulnerability (CVE-2025-62164) threatens LLM serving stacks

What’s new:
A high severity vulnerability in vLLM, a popular open source LLM inference framework, allows remote code execution via malicious payloads sent to its Completions API endpoint. The issue, tracked as CVE-2025-62164 with a CVSS score of 8.8, affects vLLM versions 0.10.2 and later due to improper handling of user supplied prompt embeddings.

Source: vLLM vulnerability enables remote code execution through malicious payloads

Why it matters:
vLLM underpins many production LLM APIs, internal tools, and AI gateways. An RCE in the serving layer means attackers can move from prompt level influence to full code execution on hosts that often have access to sensitive data, credentials, and adjacent infrastructure.

Defenses:

• Patch or mitigate vLLM deployments immediately. Inventory all instances of vLLM in your environment, including shadow or lab deployments, and upgrade to a fixed version or apply vendor recommended mitigations. Treat public facing and multi tenant instances as priority one.
• Segment and harden inference infrastructure. Place LLM serving nodes in tightly controlled network segments with minimal lateral movement paths. Use least privilege for service accounts, restrict outbound network access, and avoid co locating other critical workloads on the same hosts.
• Monitor for exploit attempts and abnormal use. Add detection for unusual or malformed payloads to the Completions endpoint, spikes in error conditions, or shell and process anomalies on vLLM hosts. Retain and review logs for forensic reconstruction if compromise is suspected.

Expert Insight:
This is a clear example of how LLM infrastructure becomes part of your critical application surface. Many teams still treat model serving as experimental or low risk, but attackers see a path to code execution and pivot. Security teams should bring LLM serving stacks under the same rigor as public web applications and identity infrastructure.

3) DeepSeek-R1 generates weaker code when prompts mention politically sensitive topics

What’s new:
CrowdStrike research found that DeepSeek’s reasoning model DeepSeek R1 generates significantly more vulnerable code when prompts reference politically sensitive topics such as Tibet, Uyghurs, or Falun Gong. In some scenarios, the rate of severe vulnerabilities in generated code increased by nearly 50 percent compared to neutral prompts, despite the modifiers being irrelevant to the coding task.

Source: Chinese DeepSeek-R1 AI generates insecure code when prompts mention Tibet or Uyghurs

Why it matters:
This reveals a subtle but serious model level risk. Content filters and alignment changes tied to political requirements can inadvertently degrade technical output quality, especially for security sensitive code. Developers may unknowingly ship code that looks correct but embeds structural weaknesses tied to these hidden biases.

Defenses:

• Avoid blind trust in model generated code, especially from geopolitically sensitive models. Require static analysis, SAST, dependency scanning, and human review for all AI generated code that touches authentication, payments, crypto, industrial control, or safety critical paths.
• Test models under varied context modifiers. In model risk assessments, include prompts with location, political, or regulatory context and verify whether output quality or security properties degrade. Treat significant deviations as a model risk and adjust usage policies.
• Isolate and monitor AI assisted coding for critical systems. For high assurance or regulated environments, consider restricting AI coding assistance to advisory roles and require strict code review gates before changes reach production.

Expert Insight:
This study shows that alignment and content control are not free. When model owners tune behavior for political or legal reasons, they can unintentionally compromise reliability and safety in unrelated domains. For security teams, “model provenance and policy” should now be part of the software supply chain checklist.

4) Adversarial poetry jailbreaking achieves 62 percent success against major LLMs

What’s new:
Researchers from Dexai and several universities demonstrated that large language models can be reliably jailbroken using adversarial poetry. By expressing harmful instructions as poetic metaphors, they achieved an average jailbreak success rate of about 62 percent for handcrafted poems, and around 43 percent for prose prompts automatically converted into poetic form, across 25 models from multiple providers.

Source: Poets are now cybersecurity threats: adversarial poetry jailbreak study

Why it matters:
This work highlights a systematic weakness in current safety heuristics. Many guardrails are tuned for straightforward, literal language. When harmful intent is wrapped in figurative or poetic structures, the models often comply, even when they would reject an equivalent prose prompt.

Defenses:

• Expand safety evaluations beyond literal prompts. Red team and evaluation suites should include figurative language, metaphor, and narrative framing, not just direct instructions. Models should be tested against creative attackers, not just obvious ones.
• Combine semantic and structural analysis for safety. Build filters that consider meaning across multiple levels, including implied actions and analogies, and do not rely solely on keyword or surface level pattern matching. Use ensemble checks or external policy engines where possible.
• Implement strong output monitoring and downstream controls. Even when prompt filters fail, limit where outputs can flow and what they can trigger. For example, require additional checks before generated content can drive automation, infrastructure changes, or code deployment.

Expert Insight:
The takeaway is uncomfortable but clear: creative language is a jailbreak surface. As models become better at understanding literature and metaphor, attackers can weaponize those same capabilities to slip past defenses. Security teams should expect safety evaluations to look more like adversarial linguistics than simple blocklists.

5) Lessons from real world GenAI deployments show perimeter defenses are not enough

What’s new:
A field oriented article analyzes Anthropic’s internal experiments and enterprise deployments of generative AI, arguing that GenAI security is fundamentally about controlling what models and agents can see and do. The piece emphasizes risks from prompt injection, agent manipulation, and shadow models created via reverse engineering, and recommends shifting focus from perimeter controls to fine grained access and behavior governance.

Source: Securing GenAI in enterprises – lessons from the field

Why it matters:
Many organizations still approach GenAI like a web app behind a firewall. In practice, attacks exploit data and tool access inside the system rather than network reachability. Without strong constraints on tools, context windows, and agent powers, prompt level attacks can have infrastructure scale impact.

Defenses:

• Treat context and tools as primary control surfaces. Carefully curate what data, documents, and tools each model or agent can access, and assume that any reachable tool can eventually be misused by a successful prompt injection.
• Design for least privilege at the AI layer. Break large, powerful agents into smaller, tightly scoped ones, and gate access to high impact tools or data with separate policies or human approvals. Regularly review which prompts and tasks actually require powerful capabilities.
• Continuously test for injection and agent abuse. Build or adopt testing harnesses that simulate hostile prompts, data poisoning, and tool misuse across deployments. Use findings to iteratively adjust guardrails, tool access, and monitoring.

Expert Insight:
This aligns with a growing consensus: GenAI security is access control and system design, not just content filtering. If your models can see everything and do anything, no amount of safe prompting will save you. The organizations that win here will be the ones that treat AI security as a cross between identity, data governance, and application security.

🌐 Extended Risk and Governance

6) Where AI helps in cybersecurity, and where it still falls short

What’s new:
An InformationWeek analysis examines current AI cyber use cases, highlighting areas where AI already delivers value (for example noise reduction in alerting and pattern detection) and areas where it is underperforming or overhyped, such as fully autonomous decision making without human oversight. It also calls out integration, data quality, and change management as key blockers.

Source: What AI gets right in cybersecurity and where it must improve

Why it matters:
Security leaders face intense pressure to “do something with AI” while also defending shrinking budgets and growing risk. Understanding where AI is practically useful today, versus where it needs more guardrails and validation, is essential for rational planning.

Expert Insight:
The article reinforces a pragmatic view: AI is strongest as a force multiplier for analysts and engineers, not as a replacement. Teams that lean into human plus AI workflows, with clear success criteria and feedback loops, will see better security outcomes than those chasing fully autonomous magic.

7) SBOM adoption lags while AI accelerates software complexity

What’s new:
A CyberScoop piece notes that despite regulatory pushes in the United States and Europe, software bill of materials (SBOM) adoption in the private sector remains slow. At the same time, AI assisted coding and code generation are accelerating the use of open source components and nested dependencies, often without transparent tracking.

Source: The slow rise of SBOMs meets the rapid advance of AI

Why it matters:
As AI tools generate and glue together more code, the underlying component graph becomes even harder to reason about. Without robust SBOMs and dependency visibility, organizations will struggle to assess exposure when a new vulnerability hits or when model generated code silently pulls in risky libraries.

Expert Insight:
AI does not remove the need for software transparency, it multiplies it. Security programs that combine AI assisted development with mature SBOM practices and automated dependency management will be in a far better position when the next supply chain vulnerability lands.

⚠️ Updates / Follow-ups

No previously featured stories from earlier briefings showed clear, material updates in the last 72 hours that met your criteria for inclusion.

Summary Table

Categories: Cybersecurity News

Tags: AI in Cyber Defense, AI Security, GenAI Governance, LLM Infrastructure, Model Risk, Prompt Injection, SBOM