In this episode of This Week in AI Security for April 2, 2026, Jeremy discusses a "perfect storm" for offensive cyber operations. As AI begins to discover vulnerabilities in legacy software faster than humans can patch them, regulators are sounding the alarm on the "intolerable risks" of AI-generated code.

Key Stories & Developments:

The AI-Generated Vulnerability Surge: Georgia Tech’s Vibe Security Radar tracked 35 CVEs in March 2026 alone that were directly attributable to AI-generated code, a sharp increase from just 6 in January.
NCSC Warning: Richard Horne, head of the UK’s National Cyber Security Centre, warned at RSAC that "vibe coding" currently presents "intolerable risks" for most organizations as software volume is on track to double every 42 months.
Langflow RCE Exploited: CISA has added a critical unauthenticated remote code execution (RCE) flaw in Langflow to its Known Exploited Vulnerabilities catalog.
"MAD" Bugs in Legacy Tools: The "Month of AI Discovered Bugs" initiative utilized LLMs to find critical zero-day RCE vulnerabilities in decades-old tools like Vim and GNU Emacs.
The Claude Mythos Leak: Anthropic confirmed a major leak of unpublished assets related to its next-generation model, Claude Mythos, following a content management system misconfiguration.
Offensive AI Multiplier: Hacker crew Team PCP claimed in Forbes that they are using AI-powered automated agents to turbocharge attacks on developer tools and repository infrastructures.

Episode Links

https://www.forbes.com/sites/ronschmelzer/2026/03/27/major-security-breach-of-critical-ai-dependency-exposes-cloud-secrets/

https://threatprotect.qualys.com/2026/03/26/cisa-added-langflow-vulnerability-to-its-known-exploited-vulnerabilities-catalog-cve-2026-33017/

https://siliconangle.com/2026/03/30/openai-codex-vulnerability-enabled-github-token-theft-via-command-injection-report-finds/

https://www.infosecurity-magazine.com/news/ai-generated-code-vulnerabilities/

https://www.itpro.com/security/ncsc-warns-vibe-coding-poses-a-major-risk

https://www.forbes.com/sites/thomasbrewster/2026/03/26/hackers-launch-devastating-attacks-on-ai-devs/

https://markaicode.com/prompt-injection-attacks-ai-security-2026/

https://cyberscoop.com/ai-cyberattacks-two-years-insane-vulnerabilities-kevin-mandia-alex-stamos-morgan-adamski-rsac-2026/

https://fortune.com/2026/03/26/anthropic-says-testing-mythos-powerful-new-ai-model-after-data-leak-reveals-its-existence-step-change-in-capabilities/

https://cyberwebspider.com/cyber-security-news/ai-critical-rce-flaws-vim-emacs/

Worried about AI security?

Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

This Week in AI Security - 2nd April 2026