# LLM security radar: hacks, tricks and exploits

By Ivo Donker · 13 November 2026 — written with AI assistance (Claude Opus 5.5); facts checked against the sources listed below

In the first two weeks of November 2026, the security community was unusually focused on language models themselves: a prompt injection that reached the publishing rights of an official OpenAI package, a backdoor that fits in seven neurons, and a series of leaks in MCP bindings. For this radar we searched X for reports of LLM hacks, tricks and exploits and placed whatever remained alongside the primary sources. Below is what is accurate, what it means and what you should do with it. We deliberately omit attack details.

## One issue on GitHub, almost a poisoned release

Researchers from the French Depi described on 11 November how they could influence the AI agent that automatically labels issues for openai/codex via an ordinary GitHub issue. That prompt injection was the start of a chain: code execution in the workflow sandbox, credentials from the build environment and ultimately a route to the publishing pipeline of the official npm package @openai/codex. A real attacker could have poisoned a future version in this way. That did not happen: OpenAI patched the vulnerability after the report and no malicious release has been observed.

**Lesson:** an agent that reads text from outsiders and has privileges in your build pipeline is an attack vector. Do not give such agents secrets or write permissions. More on the mechanism: [prompt injection explained](https://cyber.llmnet.nl/en/hoe-ai-aanvalt#prompt-injection).

## A backdoor of seven neurons

Microsoft Research demonstrated on 10 November that you can give an open model a hidden backdoor by modifying fewer than ten rarely used neurons, without retraining the model. The technique is called Lazarus. In one tested model, seven neurons were sufficient: when a particular string appeared in the prompt or in the output of a tool, the model returned the attacker’s command in over 98 % of cases, with the agent’s privileges. Without that trigger it behaved normally.

**Lesson:** a model file is supplier software. Download models from the original publisher, verify the hash, store approved versions in a private registry and restrict what an agent may execute and where it may connect.

## Stolen API key turns a coding agent into an implant

Darktrace demonstrated in a lab test how an attacker with a stolen Claude API key and access to a development machine can remotely control the Claude Code coding agent. The platform's memory served as a command channel and the file API as an exit for data; all traffic went to the vendor's normal address and therefore went unnoticed. According to Darktrace this is not a vulnerability in the platform and has not been observed in the wild.

**Lesson:** treat API keys like passwords with a debit card attached. Use short‑lived keys with limited scope and a usage cap, and do not run agents with permission prompts disabled on a machine that also stores your keys.

## MCP: handy, and often vulnerable this month

The Model Context Protocol, which allows assistants to talk to tools and data, appeared in virtually every security update. Microsoft patched a vulnerability in Visual Studio Code on 10 November (CVE‑2026‑120779, score 9.6): a malicious MCP server could trigger a command via a notification as soon as the user clicked. The fix is in version 1.145.3. At the same time, GitHub’s malware list featured packages masquerading as MCP or Claude components, such as @rclaude/darwin-x64; anyone who installed such a package should treat the machine as compromised.

**Lesson:** an MCP server runs code with your privileges. Only connect to servers whose provenance you know, keep your editor up to date, do not expose local MCP servers to the network, and trust “read‑only” only after you have tested it.

## Does the sandbox hold up?

Perplexity let twelve models attempt to break out of SPACE, the virtual machines that run its computer agents. No model reached the host. Bypassing the network restrictions succeeded for five top models in every attempt, provided they were allowed to view the source code. Those two weaknesses have been patched; Perplexity found similar issues in eight of ten other sandbox platforms, which have been notified.

**Lesson:** isolation works, but the network edge is the weak spot. For a homelab: give an agent its own user or VM and a whitelist of allowed destinations. See [protect your homelab](https://cyber.llmnet.nl/en/bescherm-jezelf#homelab).

## AI now finds the vulnerabilities itself

Anthropic described at the end of October how an as‑yet‑unreleased research model found five complete attack chains in Chrome, Safari, Android, Windows and Linux, including a flaw in the Linux kernel (CVE‑2026‑98432) that allowed an attacker to become root on servers with multipath‑TCP without logging in or any interaction. Vendors were given ninety days and have patched it. The good news: defenders are now finding such bugs more quickly. The bad news: attackers with comparable models are doing the same. This fits the trend in our [outlook to 2030](https://cyber.llmnet.nl/en/vooruitblik-2030): the window between patch and exploitation is shrinking.

## What’s circulating on X, with a pinch of salt

- **Collections of jailbreak prompts** for all major models are going viral. Their effectiveness varies and is short‑lived; vendors are actively training against them. Anthropic and OpenAI both published this week on automated red‑team testing to discover such prompts earlier.

- **“AI‑hacker legions” as open source**, tools that let a swarm of agents operate classic pentesting programmes, are receiving thousands of likes. They are packages built around existing tooling, intended for authorised testing. The hype exceeds the news, but the barrier is indeed lowering.

- **Lists claiming “the largest number of attacks ever”** mix confirmed incidents with rumours. Verify an incident at the source before forwarding it; good starting points are listed in [where you track threats](https://cyber.llmnet.nl/en/dreigingsniveau-volgen).

- **Sites offering “uncensored” models for security** are being promoted. You never know who is listening or what changes have been made to the models; see the backdoor above.

## What to do this week

- Update Visual Studio Code to 1.145.3 or newer and audit your linked MCP servers.

- Check whether any unknown packages containing “mcp” or “claude” in their name are present in your projects or global npm directory.

- Replace long‑lived API keys with short‑lived, limited ones; remove keys from prompts, notes and repositories.

- Do not let agents that read issues, email or web pages use secrets or publish anything in the same step.

- Download models only from the publisher and record the hash.

## How this radar was built

We searched X using fourteen queries covering prompt injection, jailbreaks, MCP, coding agents, model poisoning and local model servers (1 – 13 November 2026, 367 posts). Posts without a traceable source were not treated as facts. Each item above has been cross‑checked with the researcher or vendor themselves. Earlier, larger cases are listed in [the incidents](https://cyber.llmnet.nl/en/incidenten).

## Sources

- Depi, [Backdooring Codex](https://depi.security/blog/[BSN_1]-backdooring-codex/) (11 November 2026)

- The Hacker News, [Microsoft researchers show AI agents can be backdoored](https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html) (11 November 2026)

- Microsoft Research, [Reprogramming dormant neurons to backdoor AI agents](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) (10 November 2026)

- Help Net Security, [Stolen Claude API keys turn Claude Code into a remote-controlled implant](https://www.helpnetsecurity.com/[GEBOORTEDATUM_1]/stolen-claude-api-keys-remote-controlled-implant/) (12 November 2026)

- Microsoft Security Response Center, [CVE-2026-120779](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120779) (10 November 2026)

- GitHub Advisory Database, [Malware in @rclaude/darwin-x64](https://github.com/advisories/GHSA-gm9f-q9rw-p3gm) (12 November 2026)

- Perplexity, [Escaping SPACE, part II](https://www.perplexity.ai/hub/blog/escaping-space-part-ii) (11 November 2026)

- Anthropic, [Discovering vulnerabilities with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) (27 October 2026)