Threats, patches and defender intel · Friday, 29 August 2026
A deliberately light edition today — only stories that cleared sourcing made the cut; no filler.
▶ Cosmos EVM Flaw Exploited After Labs Reportedly Knew Every Chain Was Vulnerable
Category: Vulnerabilities / Exploited
Attackers have exploited a flaw in Cosmos EVM, and reporting indicates Cosmos Labs was aware that every blockchain running the affected component was vulnerable before the exploitation occurred. For teams building on or securing Cosmos-based chains, the takeaway is urgency: confirm whether your deployments use the affected EVM component and apply available fixes or mitigations right away. The case is also a pointed reminder that knowing about a vulnerability isn't the same as remediating it — disclosure and patching timelines matter, and delays leave an entire ecosystem exposed to real-world attacks rather than theoretical ones.
Why it matters to you
- Actively exploited — treat any exposed Cosmos EVM deployment as urgent.
- Inventory whether your chains rely on the affected component.
- Reinforces that awareness without timely patching leaves you exposed.
▶ Prompt-Injection Risk: Claude Code Tricked Just by Summarizing a Website
Category: AI Security
A researcher has demonstrated that Claude Code, an AI coding agent, can be manipulated simply by being asked to summarize a website — the page's content can carry hidden instructions the agent then follows. This is a classic prompt-injection problem, and it's increasingly relevant as more organizations let AI agents browse, read and act on external content. For security and IT teams, it underscores that agentic AI tools need guardrails, least-privilege access and human review before they touch sensitive systems. Treat any AI agent that ingests untrusted web content as a potential path for attacker-supplied instructions.
Why it matters to you
- Untrusted web content can smuggle instructions into AI agents.
- Apply least privilege and human review to agentic AI workflows.
- Assume anything an agent reads online could be an attack vector.