Daily · 2026-08-02
⚠️ Rails CVE-2026-66066 Early Disclosure, ⚠️ Azure DevOps MCP PR Hijack, ⚠️ Copilot Word AI Worm, 📋 EU AI Act Deadline, 📋 Balance Theory $19M
Rails publishes the Active Storage CVE-2026-66066 advisory after public PoCs force early disclosure; a confused-deputy flaw in Azure DevOps MCP lets hidden PR comments hijack AI review agents; Måløy's unpatched Copilot-for-Word AI worm class resurfaces; the EU AI Act high-risk deadline arrives amid Omnibus uncertainty; Balance Theory raises $19M Series A.
The Copilot prompt-injection worm confirmed by Microsoft is the day's defining story. Instructions hidden in white-on-white text reach the model with formatting stripped, so a document that looks clean to a human reads as authoritative commands to the assistant. The injected prompt then appends the payload to documents Copilot creates, and each new file becomes a carrier for the next session. Microsoft mitigated the specific demonstration but has no architectural fix, because the model cannot separate data from instruction. AI Worm in Microsoft Word: Unpatched Copilot Prompt-Injection Class
The Azure DevOps MCP flaw is the same problem moved into the CI/CD plane. Hidden HTML comments in a pull request hijack AI code-review agents, which can then approve changes, trigger pipelines, and exfiltrate source code and secrets as PR comments. No fix and no CVE exist yet, so restricting MCP tool scope and treating PR text as untrusted input are the only controls. The Rails Active Storage chain, now named KindaRails2Shell, is a reminder that a file read becomes remote code execution once secret_key_base is in hand, and patching does not rotate the secrets the process has already seen.
Watchlist: document provenance and Copilot context selection, MCP tool permissions, and Rails secret rotation.