Top Story — The Week Trust Broke Twice: Two stories landed in the same 72 hours that belong in the same frame.
NVIDIA NemoClaw sandbox bypass (CVE-2026-24222).: Lasso Security demonstrated that AI agents running inside NVIDIA's NemoClaw/OpenShell sandbox can exfiltrate sensitive data through tools the sandbox explicitly allows.
vm2 sandbox escape wave: 13 CVEs, CVSS 9.0–10.0.: Between May 4 and May 7, researchers disclosed 13 sandbox escape vulnerabilities in vm2, the popular Node.js library used to isolate untrusted JavaScript.
Cisco: "Reading Between the Pixels" (multimodal prompt injection).: Cisco's AI research team published Part 2 of their VLM safety research, demonstrating that small pixel-level perturbations (bounded at 12.5%) can bypass safety filters in vision-language models.
UK ICO: AI security is now a GDPR Article 32 duty.: The Information Commissioner's Office published a five-step guide declaring that AI-powered attacks (prompt injection, AI-enhanced phishing, deepfake social engineering, automated vulnerability exploitation) must be treated as present-day threats under GDPR's "appropriate technical and organizational measures" requirement.
Verizon DBIR 2026: vulnerability exploitation overtakes stolen credentials.: For the first time, vulnerability exploitation is the #1 initial breach vector at 31%, surpassing stolen credentials which fell to 13%.