Microsoft's MDASH (100+ agent AI scanning harness) discovered 16 vulnerabilities in Windows core networking / auth components, patched May 2026 Patch Tuesday. Four Critical RCEs: CVE-2026-33827 (unauthenticated UAF in IPv4 stack via Strict Source Route packets), CVE-2026-33824 (pre-auth double-free in IKEEXT/RRAS VPN), plus Netlogon and DNS Client flaws (CVSS 9.8). MDASH integrates with Defender Portal and GitHub Copilot Autofix at Microsoft Build 2026. 96% recall rate against 5 years of MSRC CVEs.

CVE-2025-59536 (CVSS 8.8): code injection allowing arbitrary execution from malicious project directory before trust dialog completes — race condition in startup confirmation. CVE-2025-55284: bypass of confirmation prompts enabling silent file reads + network exfiltration via over-broad allowlist. SOCKS5 null-byte hostname injection (silently patched v2.1.90, April 2026, ~130 versions affected, no CVE assigned). Claude.ai prompt injection via invisible HTML in URL params steals conversation memory and sensitive data.

ZombieAgent (Radware, Jan 2026): zero-click attack exploiting ChatGPT Connectors (Gmail, GitHub, Drive) to hijack persistent memory and exfiltrate data cross-session. Check Point Research: hidden DNS side-channel (patched Feb 20, 2026) bypassed the sandbox outbound-request guardrail — a single malicious prompt leaked user messages, uploaded files, and AI summaries via encoded DNS subdomains. Tenable: 7 flaws in ChatGPT-4o / SearchGPT for memory manipulation and zero-click theft, several confirmed on ChatGPT-5.

GeminiJack (Noma Security, Dec 2025): zero-click indirect prompt injection in Gemini Enterprise exploiting the trust boundary in RAG-retrieved content. Attacker plants instructions in Gmail / Google Docs / Calendar — Gemini executes them and exfiltrates corporate data without user interaction. CVE-2026-0628 (Palo Alto Unit 42): malicious Chrome extensions with basic permissions could hijack Gemini Live browser panel — camera/mic access, local file reads. Google GTIG confirms North Korea (UNC2970), Iran (APT42), China, and Russia actively using Gemini API for recon, malware dev, and AI-assisted zero-day creation.

The structurally deepest threat: MCP server supply chain. 13.4% of audited public AI agent skills (ClawHub, skills.sh) contain at least one critical flaw — OS command injection, path traversal, credential exfiltration. CurXecute (CVE-2025-54135/54136): rogue MCP server injected malicious code into Cursor IDE browser. Google GTIG confirmed first AI-developed zero-day — a threat actor built and planned mass exploitation of a 0-day using AI assistance (GTIG cut it off). MITRE ATLAS v5.1 (Nov 2025): 16 tactics, 84 techniques, AML.T0058 (agentic context poisoning) added Feb 2026. AI-enabled attacks surged 89% YoY.