// AI threat desk · 30 Sept 2026
Sample content · apart from the Arup deepfake case, every company, product and CVE ID is fictional
Home/Eric Leung
EDITOR // OWLEVAL.COM

Eric Leung_

Editor at owleval.com. Writes the AI-security news and the weekday Cyber Brief, working from primary documents and listing every source.

Covers
AGENTATK-AIAI-ATKSUPPLYLEAKCVE
Follow
XEditorial policy & corrections

Latest stories

8 stories
AGENTCI KEYS
Critical

Hidden page instructions hijack Loomwork review agent, leak CI secrets

29 Sept 20261 min read
Office towers in Central, Hong Kong, at nightAI-ATKUS$25.6M
High

Deepfake CFO on a video call cost Arup's Hong Kong office about US$25.6M

29 Sept 20262 min read
Server racks in a data centreSUPPLY31 MODELS
Critical

31 models on ModelBay run hidden code the moment they load

29 Sept 20261 min read
A server aisle in a data centreCVEPATCH
High

Two exploited Vellum Serve flaws allow remote code execution

29 Sept 20261 min read
Code on a computer screenATK-AIPOISON
High

Poisoning 0.01% of training data plants a backdoor in code models

29 Sept 20261 min read
LEAK1.2M
Medium

Support-bot vendor left 1.2M customer chats in an open database

29 Sept 20261 min read
AGENTMCP
Medium

Audit of 2,000 MCP servers finds 41% ask for more access than they use

29 Sept 20261 min read
AI-ATKPHISH
Medium

AI-written phishing emails draw 4.5 times more clicks

29 Sept 20261 min read