This Week in AI Security - 3rd September 2026

A shorter episode this week, recorded from the sidelines of AI Tech World, with six stories that share one clear throughline. Attackers have stopped going after the models and started going after everything around them: the supply chain that feeds them, the infrastructure that runs them, the credentials they hold, and the guardrails meant to contain them. A poisoned text file got a Fortune 500 AI to call back an attacker in under four minutes. A critical Langflow flaw is handing over cloud keys. Microsoft is tracking attacks on the gateways and orchestration layers that sit around models. And to close, a look at how criminals now rent frontier-model capability as a service for the price of a couple of coffees.

Key Discussion Points

• Compromised llms.txt files across thousands of corporate domains are pointing AI crawlers at attacker-registered "slopsquatted" packages. One researcher claimed an abandoned package name and saw a Fortune 500 callback in under four minutes. No phishing, no exploit, just a text file.
• A critical Langflow flaw, rated 9.8 on CVSS, is being exploited for unauthenticated remote code execution with root, harvesting superuser credentials and cloud keys. It is the sixth Langflow CVE this year, with 300-plus exploit attempts already seen.
• Microsoft Threat Intelligence documented attacks on three pieces of AI infrastructure: a command injection in a model gateway, a server-side request forgery in a RAG tool, and a container escape in an orchestration layer that dropped a crypto miner. The infrastructure around the model is the real prize.
• The Aurora ransomware gang used an AI coding agent running Claude Sonnet to plan and execute attacks across ten organizations in nine countries, including a full Active Directory Certificate Services exploitation plan written in Russian.
• OpenAI's new Astra model is the first rated "critical" for cybersecurity capability under its own Preparedness Framework. OpenAI says it will pause development to strengthen safeguards, a notable shift given the dual-use risk.
• ThreatDown unpacked Kriminal.ai, a jailbreak wrapper that rents inference from frontier models and sells unrestricted capability for $12.99 a month. Criminals no longer need their own AI, they just rent it.

Episode Links

https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/

https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/

https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/

https://thehackernews.com/2026/08/aurora-ransomware-operators-use-cursor.html

https://openai.com/index/path-to-astra/

https://www.threatdown.com/blog/kriminal/