Overview
Severity: CRITICAL | Affected: Cognosys | Category: incident
The popular autonomous AI agent platform Cognosys reported a critical security incident originating from a compromised third-party machine learning library on PyPI. Malicious actors injected obfuscated code into a widely used data-processing library, a key dependency for the Cognosys agent framework. Once deployed in the company's production environment, the malicious code established a backdoor, allowing attackers to exfiltrate sensitive data, including API keys, user credentials, and proprietary model weights stored in connected cloud environments. The attack went undetected for nearly two weeks, impacting an estimated 15% of the platform's enterprise customers. Cognosys has since patched the vulnerability and is working with affected clients on remediation efforts. The incident serves as a stark reminder of the growing threat of supply chain attacks targeting the MLOps pipeline.