AI Model Vulnerability Tracker 2026
Last updated: August 9, 2026 — 14:00 UTC Update frequency: Monthly (first Friday of each month) Maintained by: Marcus Chen & Axis Intelligence Research Entries this update: 5 new (May–August 2026) | Total tracked: 52
Quick Answer
Axis Intelligence Research tracks publicly disclosed vulnerabilities in production LLM and agentic AI systems, one row per disclosure, each tied to the vendor advisory or research publication that reported it. Across the five disclosures logged between May and August 2026, the highest-scored issue is Google’s Gemini CLI harness flaw, which Google rated CVSS 10.0 in its own advisory. The Axis Vendor Remediation Gap™ for the GhostApproval cohort — six AI coding assistants disclosed together — stands at a median 85 days from report to fix, with two vendors still unpatched 128 days after notification and one vendor disputing the finding outright.
Key Findings
- According to Wiz Research’s July 8, 2026 disclosure, six major AI coding assistants — Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity and Windsurf — shared a single symlink-based trust boundary flaw named GhostApproval.
- Google rated the Gemini CLI harness vulnerability disclosed at Black Hat USA 2026 at CVSS 10.0 in advisory GHSA-wpqr-6v78-jr5g, affecting Gemini CLI before version 0.39.1.
- Cursor’s GhostApproval advisory, CVE-2026-50549, carries a CVSS 3.1 base score of 9.8 and was fixed in Cursor version 3.0.
- Axis Intelligence Research calculates a median Vendor Remediation Gap of 85 days across the three GhostApproval vendors that shipped fixes, as of August 9, 2026.
- AI Now Institute’s Friendly Fire brief, published July 8, 2026, demonstrated remote code execution against Claude Code CLI and OpenAI Codex CLI when those agents were pointed at an untrusted repository for defensive review.
What Are the Most Recent Disclosed AI Model Vulnerabilities? (August 2026)
Newest entries at top. Every entry links to the vendor advisory or the original research publication.
August 2026
AXV-2026-0005 — Agent Harness Compromise via a Single GitHub Issue (Claude Code, Gemini CLI, Codex) Disclosed: August 5, 2026 | Black Hat USA 2026 | Reported by: Novee Security (Elad Meged)
Novee researcher Elad Meged demonstrated a repeatable pattern in which a zero-privilege input — an ordinary GitHub issue opened by an outside user — reached remote code execution on the vendor’s own CI runner, then exfiltrated live API keys and tokens. The tests ran against Claude Code, Gemini CLI and Codex using the vendors’ own repositories and default workflow configurations, and found paths to code execution, credential theft, repository modification, and instructions that survived from one agent run into the next.
The flaw is not in the model. The core issue sits in the harness — the surrounding code managing tool permissions, execution and sandboxing around each agent. Google’s run-gemini-cli Action restricted its core tools to echo and gh issue view, but the configuration registered a full shell tool without enforcing command-level restrictions at runtime; separately, the CLI sanitised secrets out of the child process while the parent process kept them readable through /proc in a shared namespace. Google rated it CVSS 10.0, with affected versions covering Gemini CLI before 0.39.1, preview builds before 0.40.0-preview.3, and the run-gemini-cli GitHub Action before 0.1.22.
OpenAI’s Codex issue-deduplication workflow ran two agents in the same writable workspace; the first agent could be induced to write an AGENTS.md file, which Codex then read as trusted project instructions on the next run. That is persistence, achieved without a single credential.
Severity (vendor-assigned): Critical — CVSS 10.0 (Google) | Affected: Claude Code, Gemini CLI < 0.39.1, OpenAI Codex workflows | CVE: CVE-2026-54316 (Anthropic, final round) · GHSA-wpqr-6v78-jr5g (Google) Primary source: Novee Security — Black Hat 2026 disclosure
July 2026
AXV-2026-0004 — GhostApproval: Symlink Trust Boundary Bypass Across Six AI Coding Assistants Disclosed: July 8, 2026 | Reported by: Wiz Research (Maor Dokhanian)
Wiz found that a malicious repository can trick an agent into accessing files outside the workspace sandbox, potentially reaching remote code execution on the developer’s machine, across Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity and Windsurf. The primitive is decades old — symlink following, CWE-61. What makes it an AI problem is the second layer. In several cases the agent’s internal reasoning explicitly named the dangerous target, while the confirmation prompt shown to the user concealed it entirely — CWE-451, UI misrepresentation of critical information, stacked on top of the symlink flaw.
The proof of concept fits in four lines of shell. A repository ships a symlink named project_settings.json pointing at ~/.ssh/authorized_keys, plus a README instructing the agent to write a key into it; the victim asks the assistant to set up the workspace, and the attacker gains persistent password-less SSH access.
Vendor responses split three ways, and the split is the story. AWS remediated in language server 1.69.0 under CVE-2026-12958; Cursor fixed in 3.0 under CVE-2026-50549; Google fixed Antigravity in 1.19.6 and is assessing CVE issuance. Augment and Windsurf acknowledged receipt without shipping a fix. Anthropic declined, arguing the scenario — a user who trusted the directory and approved a permission prompt inside it — falls outside the Claude Code threat model. Wiz rated Windsurf’s variant most severe because the agent writes to disk before the Accept/Reject buttons appear, making the dialog an undo mechanism rather than an authorization gate.
Anthropic’s position is coherent and worth stating fairly: consent was given twice. The counter-position is equally clean — consent to a prompt that names the wrong file is consent to nothing. Anthropic later confirmed that the symlink warning in the Edit/Write permission dialog shipped in Claude Code v2.1.32 on February 5, 2026, nine days before Wiz’s report arrived, as proactive internal hardening.
Severity (vendor-assigned): Critical — CVSS 9.8 (Cursor) · High — CVSS 7.8 (AWS) | Affected: Amazon Q Developer < 1.69.0, Claude Code, Augment 0.754.3, Cursor < 3.0, Google Antigravity, Windsurf | CVE: CVE-2026-50549 · CVE-2026-12958 Primary source: Wiz Research — GhostApproval
AXV-2026-0003 — Friendly Fire: Defensive Code-Review Agents Induced Into Executing the Payload Disclosed: July 8, 2026 | Reported by: AI Now Institute (Boyan Milanov, Heidy Khlaaf)
AI Now Senior Research Scientist Boyan Milanov and Chief AI Scientist Heidy Khlaaf built a proof-of-concept against one of the most heavily advertised defensive use cases: asking an AI agent to analyse an untrusted open-source codebase or third-party library. The agent, asked to look for malicious code, ran it.
When Claude Code runs in auto-mode, or Codex in auto-review, the agent reads the target repository’s files as part of the audit; instructions worded to look like ordinary documentation can talk the agent into treating a malicious binary as a routine part of the security check and executing it without asking. AI Now’s brief states the attack needs no hooks, skills, plugins, MCP servers or special configuration files — the injections sit in ordinary repository content, including README-style documentation referencing a plausible security script. The tested configurations included OpenAI Codex CLI 0.142.4 with GPT-5.5, and the researchers frame the issue as a workflow design problem rather than a vulnerable version range.
AI Now states its PoC does not proceed past the first RCE stage and falls outside the security disclosure policies of either Anthropic or OpenAI; both providers were contacted and offered support to reproduce the findings. No CVE, therefore, and no patch to wait for — which is precisely why it belongs in a disclosure log rather than a vulnerability database.
Severity: Not vendor-scored — no CVE assigned | Affected: Claude Code CLI (auto-mode), OpenAI Codex CLI 0.142.4 (auto-review) | CVE: None Primary source: AI Now Institute — Friendly Fire exploit brief
AXV-2026-0002 — DuneSlide: Prompt-Injection Sandbox Escape in Cursor Disclosed: June 25, 2026 (NVD publication) | Reported by: Cato AI Labs
The entry point is not the keyboard. The attacker plants instructions in something the agent reads on the user’s behalf — a service connected over the Model Context Protocol, or a page returned by a web search. CVE-2026-50549 abuses a safety check: Cursor resolves symlinks before writing to confirm the destination sits inside the project, but when that resolution fails — because the target does not exist, or the attacker removes read access to a folder in the path — Cursor falls back to trusting the shortcut’s in-project path. Cato AI Labs found the pair, tracked as CVE-2026-50548 and CVE-2026-50549, both rated 9.8, and both patched in Cursor 3.0.
Two independent teams reached the same defect from different directions — Wiz through a malicious repository, Cato through prompt injection. Cursor’s advisory credits both. When separate researchers converge on one flaw within months, the finding is not a vendor oversight; it is a design assumption the category has not retired.
Severity (vendor-assigned): Critical — CVSS 3.1 base 9.8 | Affected: Cursor < 3.0 | CVE: CVE-2026-50548, CVE-2026-50549 Primary source: GitHub Security Advisory GHSA-3v8f-48vw-3mjx (Cursor)
May 2026
AXV-2026-0001 — SymJack: The Same Approval-Path Pattern Across Six Coding Agents Disclosed: May 2026 | Reported by: Adversa AI
Adversa AI published SymJack in May 2026, describing the same symlink-and-approval pattern against six coding agents including Claude Code, Cursor, GitHub Copilot and Grok Build. It predates the Wiz disclosure by roughly two months and covers a partly different tool set, which is the reason it earns its own row rather than a footnote under GhostApproval.
[verification flag: pending_primary] — the Adversa publication page has not yet been fetched and read at source. The claim above is currently supported by secondary reporting only. Marcus Chen to retrieve the original Adversa write-up and either upgrade this row to is_primary = yes or remove it at the September update. It appears here flagged rather than hidden, per Axis policy on open verification states.
Severity: Not vendor-scored | Affected: Claude Code, Cursor, GitHub Copilot, Grok Build and two further agents | CVE: None Primary source: Pending retrieval — see flag above
Axis Vendor Remediation Gap™ (VRG): How Long Does a Disclosed AI Agent Flaw Stay Open?
A CVSS score tells you how bad a flaw is if exploited. It says nothing about how long the vendor left it open. The Vendor Remediation Gap is Axis Intelligence Research’s answer to that second question — the elapsed days between the date a researcher notified a vendor and the date that vendor shipped a fix, computed only from dates published in the disclosure timeline itself.
Formula. VRG (days) = date_fix_deployed − date_report_submitted. Vendors that dispute the finding are recorded as disputed and excluded from the median. Vendors that have neither fixed nor disputed are recorded as open, with days counted to the public disclosure date. The cohort median is taken across fixed vendors only.
Baseline reading — GhostApproval cohort, as of August 9, 2026. This is the inaugural VRG computation; no prior readings exist for comparison.
| Vendor | Reported | Fixed | VRG (days) | Status |
|---|---|---|---|---|
| AWS (Amazon Q Developer) | 2026-03-05 | 2026-05-27 | 83 | Fixed |
| Google (Antigravity) | 2026-02-26 | 2026-05-22 | 85 | Fixed |
| Cursor | 2026-02-27 | 2026-06-05 | 98 | Fixed |
| Windsurf (Cognition) | 2026-03-02 | — | 128 | Open |
| Augment | 2026-02-12 | — | 146 | Open |
| Anthropic (Claude Code) | 2026-02-14 | — | — | Disputed |
Median VRG across fixed vendors: 85 days. Mean: 88.7 days. Two vendors open at ≥128 days; one disputed. All dates from the Wiz Research responsible-disclosure timeline, published July 8, 2026. Axis-calculated; formula above. Source: Wiz Research.
What the reading says. Three of six vendors treated a category-level trust boundary flaw as a vulnerability and closed it in under a hundred days. Two went quiet after acknowledging. That distribution matters more to a security team choosing a coding agent than any single CVSS number does, because it forecasts what happens to the next flaw. A vendor’s disclosure history predicts its disclosure behaviour better than its security page does.
Limitations. VRG measures published dates, not internal effort, and a vendor that discloses transparently can score worse than one that patches silently and says nothing. It does not capture severity, and it cannot distinguish a fix that was hard from a fix that was deprioritised. Open rows will move as vendors ship; readings are re-computed, never back-edited, and each carries its as-of date.
How We Curate This Tracker
Four criteria gate every entry:
1. Publicly disclosed by a named party. Each row traces to a vendor security advisory, a CVE record, or a research publication with named authors. We do not log rumours, and we do not log findings that exist only in aggregator summaries.
2. Primary source fetched at entry time. The linked source is read before the entry is written, and the retrieval date is logged in the CSV. Secondary outlets are used to locate a disclosure, never to supply its details. Any row we could not verify at source carries an open pending_primary flag visible in both the article and the dataset.
3. Affects a production LLM or agentic system. Research on model behaviour in the abstract is out of scope. A flaw in the harness — permissions, tool routing, sandbox, workspace — is in scope, because that is where 2026’s disclosures have concentrated.
4. Severity reported as the vendor scored it. Where a CVSS score exists, we publish the vendor’s score and name the vendor. Where none exists, the field reads “not vendor-scored.” Axis does not assign severity scores to third-party findings.
What this tracker is not. It is not a record of Axis laboratory testing. Every finding here was made, reproduced and disclosed by the named external researcher. Where a row describes a success rate or a reproduction count, that figure comes from the disclosing party’s own publication and is attributed to them.
Conflicts of interest. Axis Intelligence Research has no commercial relationship with any vendor or research firm named in this tracker. If that changes, it will be stated in this header.
Frequently Asked Questions
What is the Axis Vendor Remediation Gap?
The Vendor Remediation Gap (VRG) is a metric developed by Axis Intelligence Research measuring elapsed days between a researcher’s vendor notification and the vendor’s deployed fix, computed only from dates the disclosing party published. Disputed findings are recorded separately and excluded from the median; unfixed findings are counted as open to the public disclosure date. The formula and inputs are published in full so any reader can recompute the reading.
Which AI coding assistant had the most severe disclosed flaw in 2026?
By vendor-assigned score, Google’s Gemini CLI harness vulnerability is the highest, rated CVSS 10.0 in Google’s own advisory GHSA-wpqr-6v78-jr5g and disclosed at Black Hat USA 2026. Cursor’s CVE-2026-50549 follows at CVSS 9.8. A caveat worth carrying: score comparability across vendors is imperfect, because vendors score their own products under differing assumptions about deployment context.
What is prompt injection in AI coding agents?
Prompt injection occurs when instructions from an attacker-controlled source — a README, a GitHub issue, an MCP server response, a retrieved web page — are read by an agent and treated with the authority of instructions from the user. In agentic coding tools the consequence is not a bad answer but a command executed on the developer’s machine, which is why 2026 disclosures in this category routinely carry CVSS scores above 9.0.
How often is this tracker updated?
Monthly, on the first Friday. Entries carrying a pending_primary flag are resolved or removed at the following update rather than left standing indefinitely.
How do I submit a disclosure for inclusion?
Send the vendor advisory URL, CVE identifier if assigned, and the disclosure date to [email protected]. We verify against the primary source before adding a row.
Archive: Q1–Q2 2026 Entries
The 47 entries logged between January and July 2026 — AVI-2026-0001 through AVI-2026-0104, scored on the Axis Vulnerability Index — remain in the archive and in the downloadable dataset. Full rubric and reproduction detail: tracker methodology.
Representative Q1 entries:
- AVI-2026-0071 — Tool-result injection in RAG pipelines (AVI 9.1, Critical)
- AVI-2026-0058 — System prompt extraction via translation request (AVI 6.7, Medium)
- AVI-2026-0034 — Multi-turn crescendo bypass via pedagogical framing (AVI 7.9, High)
- AVI-2026-0017 — Indirect injection via PDF annotation layer (AVI 8.4, High)
About This Dataset
The CSV contains every tracker row with full provenance: source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, and method_note for calculated fields. Temporal coverage: May 2026 – August 2026. Licensed CC BY 4.0.
Cite as: Axis Intelligence Research, “AI Model Vulnerability Tracker,” 2026.
Last updated: August 9, 2026.
Review trigger: a new vendor advisory carrying CVSS ≥ 9.0 against a production LLM or agentic system, a status change on any open VRG row, or the first Friday of the month — whichever comes first.