Weekly AI Cybersecurity News Roundup — July 7–13, 2026

news-roundupai-securitythreat-intelligencemitre-attcknist-csfmitre-atlasowasp-agentic-aimitre-d3fend

Top Stories

EU Launches Sweeping Action Plan on Cybersecurity and AI, Announces Grand Challenge

The European Commission on July 7 unveiled a comprehensive Action Plan on Cybersecurity and Artificial Intelligence, marking the most ambitious coordinated policy response yet to the convergence of AI and cybersecurity threats European Commission. The plan centers on three pillars: scaling European AI cybersecurity capabilities, investing in sovereign European AI infrastructure, and building trust through transparent access conditions for advanced AI systems.

The centerpiece is the EU Grand Challenge on AI for cybersecurity, a competition designed to stimulate the European market for AI-powered cybersecurity solutions EC Press Corner. The Commission will also work with the EU Agency for Cybersecurity (ENISA) to define a European blueprint for structured access to advanced AI capabilities, ensuring that cybersecurity professionals can leverage frontier AI models while maintaining safety guardrails HPCwire.

The action plan comes at a critical inflection point: AI threats have bifurcated into attacks against AI infrastructure and attacks powered by AI, and the plan explicitly acknowledges that existing regulatory frameworks — including the AI Act and Cyber Resilience Act — need operational coordination to be effective against AI-compressed attack timelines Industrial Cyber.

CISA Adds First AI Agent Platform to KEV: Langflow IDOR Under Active Exploitation

In a watershed moment for AI security regulation, CISA added the Langflow AI development framework to its Known Exploited Vulnerabilities (KEV) catalog on July 7 — the first AI agent platform ever listed TechTimes. The flaw, CVE-2026-55255 (CVSS 9.9), is an insecure direct object reference (IDOR) vulnerability allowing authenticated attackers to access other users’ AI workflows by submitting malicious requests containing a victim’s flow ID, exposing sensitive data including LLM provider keys and cloud credentials The Hacker News.

Sysdig researchers observed in-the-wild exploitation beginning June 25, with financially motivated threat actors using the IDOR to achieve remote code execution and deploy second-stage malware — seeking to monetize compromised AI infrastructure through botnet activity and credential theft Hard2Bit. Three other CVEs were added to KEV simultaneously: CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0), and two Joomla extension flaws targeting JoomShaper SP Page Builder and JCE Content Editor SecurityWeek.

CISA set a July 10 patch deadline for federal agencies under BOD 26-04’s compressed 3-day remediation timeline. The inclusion of Langflow signals that AI development platforms are now officially recognized as critical attack surfaces requiring the same vulnerability management rigor as traditional infrastructure Ankura CTIX.

Ghostcommit: Stealth Prompt Injection Hidden in PNG Images Targets AI Coding Agents

Researchers disclosed a novel supply-chain attack called Ghostcommit on July 11 that conceals prompt injection instructions inside PNG image files to bypass AI code review tools and exfiltrate repository secrets BleepingComputer. The proof-of-concept attack embeds a malicious prompt in a seemingly harmless PNG image included in a pull request. When an AI coding assistant processes the PR, it reads the image and executes the hidden instructions — instructing the agent to read the repository’s .env file and write every secret into the code as a list of plain numbers Malwarebytes.

The attack bypassed AI code reviewers CodeRabbit and Bugbot, which never inspect image file contents at all, and then fooled a coding agent into exposing sensitive data. Ghostcommit represents a significantly more sophisticated variant of visual prompt injection — earlier attacks relied on visible text in images, while this technique uses steganographic encoding to make the injection effectively invisible to human reviewers.

Researchers note that the technique is difficult to defend against because AI agents are designed to process multimodal content (including images in PRs), and conventional LLM input sanitization doesn’t parse image payloads. Mitigation strategies include restricting AI agent access to repository secrets, implementing least-privilege tool permissions, and auditing all image files in pull requests CyberSecurityNews.

Accenture Confirms 35GB Data Breach: Source Code and Credentials Stolen

IT services giant Accenture confirmed on July 6-8 that it suffered a data breach after a threat actor using the handle “888” posted on a cybercrime forum claiming to have stolen 35GB of internal data SecurityWeek. The stolen archive reportedly includes source code, encryption keys, credentials, and internal development material allegedly obtained from Accenture’s Azure DevOps environment HelpNetSecurity.

The breach is particularly concerning because Accenture serves as a managed security services provider for numerous Fortune 500 companies — stolen infrastructure credentials could enable follow-on supply-chain attacks against Accenture’s clients Privacy Guides. Accenture has not disclosed the specific access vector, but the targeting of Azure DevOps continues a pattern of threats actors focusing on CI/CD pipeline environments as high-value initial access targets Cybersecurity Dive.

DHS Confirms Breach of Homeland Security Information Network

The Department of Homeland Security confirmed on July 1 that an unknown attacker breached the Homeland Security Information Network (HSIN), an unclassified information-sharing platform used by federal, state, local, and tribal governments as well as private sector critical infrastructure partners BleepingComputer. The breach, which occurred between late May and early June 2026, potentially exposed sensitive communications between DHS and its partners Reuters.

DHS described the incident as involving an “unclassified legacy information sharing environment” and said it is investigating alongside federal law enforcement TechCrunch. The breach is the latest in a string of federal network compromises in 2026, underscoring the challenge government agencies face in securing legacy IT infrastructure while also managing the AI transformation.

Anthropic Sues Abnormal AI Over Trademark Dispute

Anthropic filed a trademark infringement lawsuit against cybersecurity company Abnormal AI on July 1 in California federal court, alleging that Abnormal’s rebranded “A/” slash-mark logo is confusingly similar to Anthropic’s own visual identity Law360. The lawsuit claims unfair competition and trademark dilution, seeking damages and an injunction against Abnormal’s use of the mark.

Abnormal CEO Evan Reiser publicly rejected the claims, stating on July 7 that the company’s mark dates to 2021 — predating Anthropic’s current branding Abnormal Blog. The legal battle has drawn significant attention because Anthropic and Abnormal were previously commercial partners: Abnormal uses Anthropic’s Claude models in its cybersecurity product suite. The dispute highlights the increasing commercial friction as AI platform companies and AI security companies expand into overlapping territory BankInfoSecurity.

Microsoft: AI-Discovered Vulnerabilities Will Drive More Frequent Windows Security Updates

Microsoft warned on July 10 that customers should expect an increase in Windows security updates as the company increasingly relies on AI to discover vulnerabilities in its products BleepingComputer. Microsoft’s new AI test routines have already found 16 additional Windows vulnerabilities that human testers had missed, and the company expects this number to grow significantly HelpNetSecurity.

The announcement came alongside Microsoft’s July 2026 Secure Future Initiative (SFI) progress report, which documents improvements in secure-by-design engineering, identity governance, and proactive defense Microsoft Security Blog. The report warns that “organizations should prepare for an acceleration in the cadence of security updates as AI enables both faster vulnerability discovery by defenders and faster exploitation by attackers” InfoSecurity Magazine.

Breaches & Incidents

Lidl Online Shop Breach: Customer Data Exposed via Third-Party Provider

German discount supermarket chain Lidl disclosed on July 13 that attackers breached an external IT service provider, stealing personal data of online shop customers in Germany, Belgium, and the Netherlands BleepingComputer. Exposed data includes names, email addresses, dates of birth, and order details, though Lidl stated that no payment information was affected Techzine.

The incident highlights the persistent risk of third-party service provider compromises — attackers targeting a single provider can cascade access across multiple large retail customers.

UNK_MassTraction: China-Aligned Espionage Targets University Roundcube Servers

Proofpoint researchers documented a threat cluster dubbed UNK_MassTraction, likely China-aligned, that is exploiting vulnerable Roundcube webmail servers at US and Canadian universities Proofpoint. The group is specifically targeting physics and engineering departments conducting research in astrophysics, particle physics, and national security-related fields BleepingComputer.

The attack chain exploits CVE-2024-42009 (XSS) and CVE-2025-49113 (deserialization) in Roundcube to deploy IceCube (a credential stealer), SquareShell (a PHP webshell), and VShell (a Go-based backdoor for interactive shell access and port forwarding). Academic institutions running Roundcube should patch both CVEs immediately and treat email servers as high-value remote access nodes Ankura CTIX.

Emerging Threats

GodDamn Ransomware Deploys PoisonX Driver to Disable Endpoint Defenses

Security researchers identified GodDamn ransomware, a new strain that leverages a malicious kernel-level driver called PoisonX to disable endpoint security tools before deploying ransomware payloads The Hacker News. The driver targets endpoint detection and response (EDR) products by terminating their kernel-mode processes, allowing the ransomware to encrypt files and exfiltrate credentials without triggering alerts.

The use of malicious kernel drivers represents an escalation in the ransomware arms race — attackers are now investing in driver-level evasion that bypasses even next-generation EDR tools that rely on kernel callbacks. Organizations should enforce driver signing policies, enable Hypervisor-Protected Code Integrity (HVCI), and monitor for unexpected kernel driver installations Ankura CTIX.

HalluSquatting: AI Package Hallucinations Exploited for Botnet Malware Distribution

Researchers uncovered a new attack technique called HalluSquatting that exploits AI coding assistants’ tendency to hallucinate non-existent package names The Hacker News. Attackers identify package names that AI assistants commonly fabricate — so-called “hallucinated packages” — and register them on public repositories with malicious code that delivers botnet malware.

When developers follow AI-suggested package installation commands without verification, the malicious dependencies are pulled into production environments. The technique represents a sophisticated evolution of typo-squatting: rather than hoping developers misspell a package name, HalluSquatting exploits the AI’s own confidence in fabricated suggestions. Mitigation includes strict software supply chain policies, dependency lock files, and mandatory human review of all AI-generated package installation commands.

Policy & Regulation

UK Government Publishes Thematic Review on AI Security

The UK’s Department for Science, Innovation and Technology published a thematic review and gap analysis on AI security on July 10, commissioned from Lancaster University GOV.UK. The review identifies critical security gaps including the expanded attack surface from agent-to-agent operations, inadequate testing methodologies for AI-specific vulnerabilities, and the need for secure-by-design standards in AI development tools.

Claude Fable 5 Redeployed Globally with Enhanced Safeguards

Anthropic redeployed Claude Fable 5 globally on July 1 after US export controls that forced its suspension in June were lifted Anthropic. The redeployment includes a retrained cybersecurity classifier designed to block jailbreak attempts while accepting higher false-positive rates for benign coding queries Digital Applied. Anthropic extended promotional access to Fable 5 until July 19, 2026, giving eligible subscribers continued access to the Mythos-grade model.

What to Watch

  1. Langflow exploitation wave: With CISA adding Langflow to KEV and four distinct CVEs under active exploitation (CVE-2025-3248, CVE-2026-33017, CVE-2026-5027, CVE-2026-55255), organizations running AI orchestration tools face unprecedented pressure. Expect automated scanning for exposed instances to intensify.

  2. Ghostcommit opens new prompt injection frontier: The steganographic prompt injection technique demonstrated by Ghostcommit will likely be adapted by real threat actors within weeks. Security teams should restrict AI agent access to sensitive files and implement image scanning in CI/CD pipelines.

  3. EU Grand Challenge creates market signal: The EU’s commitment to a Grand Challenge on AI for cybersecurity will likely spur investment in European AI security startups. Organizations sourcing AI security tools should watch for emerging vendors from this ecosystem.

  4. Supply-chain attacks on AI assistants escalate: HalluSquatting joins a growing list of AI supply-chain attack techniques (MCP poisoning, trojanized PyPI packages for LiteLLM, Ghostcommit). Treat all AI-generated code and dependencies as untrusted until verified.

  5. EDR evasion goes kernel-level: GodDamn’s PoisonX driver signals that ransomware operators are investing in kernel-level defenses bypass. Endpoint security strategies must include driver signing enforcement and kernel integrity monitoring.

  6. Federal network breaches remain a systemic risk: The DHS HSIN breach and Accenture compromise — both in the same week — show that neither government nor enterprise security services are immune from sophisticated attacks. Third-party risk management needs elevated priority.

All sources cited inline above. This roundup covers major developments from July 7–13, 2026. News is aggregated from the European Commission, CISA, BleepingComputer, The Hacker News, SecurityWeek, Proofpoint, HelpNetSecurity, Malwarebytes, TechCrunch, Privacy Guides, Ankura CTIX, and other security news sources.

📖 Related Reads