AI’s constant patching treadmill can be a security problem

Backslash Security reviewed Claude Code changelogs and found >30 security-relevant patches (data poisoning, prompt injection, arbitrary code execution, OAuth credential leaks, agent-planted backdoors) pushed between April and early June 2026; Anthropic patched the issues but did not publicize all fixes. The report warns that rapid, frequent AI model updates create short windows of exposure because developers often delay upgrades for stability, regulatory, or operational reasons, producing novel risks unique to LLMs that affect both external attackers and insider misuse.