company
Security research firm credited with disclosing CVE-2026-22708 and with recommending isolated full-execution environments over command allowlists.
No evidence-backed relationships are recorded.
Unsloth fixed Studio in version 2026.6.9 after Pillar Security showed that reading a malicious model's config.json could run an attacker's Python code. Unsloth disputed parts of the finding and declined to publish an advisory, so no CVE was assigned.
Reality
Pillar Security CEO Ziv Karliner says OpenAI's sandbox escape shows AI agent limits must be enforced outside the model. The escape cases he cites broke through trusted software beyond the sandbox, so his test-before-credentials rule has to cover that outside layer too.
Reality
A four-container demo runs one Deadbugz-shaped MCP server behind two brokers. Only the broker that hashes name, description and inputSchema on the first tools/list refused the swap that lands after three tool calls.
Reality
Oren Yomtov of Accomplish found two ways out of the Codex sandbox, both silent and neither stopped by an approval prompt. OpenAI patched them within eight days, and other researchers have found the same design in rival agents.
Reality
Oren Yomtov of Accomplish AI found two escapes from the Codex sandbox. The worse one ran unsandboxed commands from read-only mode through a helper tool that Codex Desktop writes into the global config at install.
Reality
A dev.to survey walks seven AI supply chain entry points and the named incidents behind each. The two dataset-poisoning numbers in it are the ones that should change how a model review is scoped.
Reality
The chain in OpenAI's post-mortem on the Hugging Face incident runs through a RubyGems processing bug, an HDF5 dataset file and 14 write tokens that were already public, according to Pillar Security's Dor Sarig. OpenAI calls the result a warning shot.
Reality
Pillar Security's Dor Sarig argues the non-human identity buildout answers who an agent is rather than what it does, and cites an internal agent any Slack message could trigger across a thousand private repositories.
Reality
Grafana's MCP server checked that a session ID looked like one instead of checking that it had issued it. Paired with a CVSS 9.1 SSRF in the same server, that gave unauthenticated callers a proxy inside the network.
Reality
Pillar Security's researcher filed a bug report that carried orders for Google's triage agent, which returned Workload Identity Federation credentials good enough to impersonate a privileged account. Google has since fixed it.
Reality
Novee Security's Black Hat findings land the same lesson on three agents: a validator that inspects a cleaned-up copy of a command is not a control, and a sandbox built too late is not one either.
Reality
CVE-2026-22708 let injected text rewrite a Cursor agent's environment, so an approved "git branch" ran something else. It worked with an empty allowlist too.
Reality