AI Sec Watch

The PraisonAI AgentOS server has an insecure default configuration: it listens on all network interfaces (0.0.0.0), has no API key set by default, and uses wildcard CORS (cross-origin resource sharing, which allows web pages from any site to access it). Because the authentication middleware only activates when an API key is configured, the default setup leaves two endpoints unprotected: GET /api/agents leaks agent instructions (system prompts, which are the hidden directions that control how an AI behaves), and POST /api/chat allows anyone to invoke the agents. Any attacker on the network can read the agent instructions and control the agents.

PraisonAI versions npm 1.7.2 / Python 4.6.58 have a security bypass in their shell command execution controls. Attackers can use the `find` command with the `-exec` or `-execdir` built-in actions (which execute commands without shell metacharacters like `;`) to bypass the allowlist (a list of approved commands) that was meant to prevent dangerous shell operations. The vulnerability affects four parallel implementations across TypeScript and Python code.

PraisonAI's AICoder component gives an LLM access to tools that write files and run commands without any safety checks. An attacker can use prompt injection (tricking the AI by hiding malicious instructions in chat messages) to write files anywhere on the system (like sensitive config files) or execute arbitrary commands, and the damage is worse because the software runs as root (the highest permission level) inside Docker containers.

PraisonAI's MCP (Model Context Protocol, a standard for AI tool communication) HTTP-stream server does not require authentication by default because the API key setting defaults to `None`, allowing attackers to discover available tools and call them with invalid arguments that bypass schema validation (a check ensuring inputs match expected formats). The vulnerability affects version 4.6.63 running on the default local address, though remote exposure is possible if the server binds to all network interfaces.

PraisonAI's Jobs API has two security flaws: by default, authentication is disabled unless the PRAISONAI_JOBS_API_KEY environment variable is set, leaving all endpoints open to anyone; additionally, an attacker can exploit a DNS-rebinding TOCTOU (time-of-check-time-of-use, where a value is checked at one time but changes by the time it is used) vulnerability by submitting a webhook URL that passes validation at check time but resolves to an internal IP address during the actual connection, allowing a blind SSRF (server-side request forgery, where the server makes requests to unintended targets) attack on internal services.

Anthropic has created OSS Scanner, a free service that uses AI models to automatically scan open-source projects for security vulnerabilities (weaknesses that attackers could exploit). The scans are fast and frequent, but they are generated entirely by AI without human review, which means some reports might be incorrect or falsely flag non-issues.

OpenAI reported $50 billion in annualized revenue (lower than the previously reported $68 billion figure, which had included partner revenue), causing stock prices to fall for major AI-related companies like Nvidia, Oracle, and CoreWeave. The article also discusses concerns about AI safety at OpenAI and Anthropic, with OpenAI recently canceling its GPT-6.1 Astra model because it did not meet safety standards.

A vulnerability in AWS Bedrock AgentCore (a service that helps AI chatbots perform tasks) allowed attackers to use a single compromised AI chatbot to take control of an entire organization's systems. The vulnerability has been patched, meaning AWS released a fix.

Docker Sandboxes (isolated environments that run code safely) could leak sensitive credentials like OAuth tokens and API keys that were meant to stay hidden outside the sandbox. This happened when a response-body read operation returned both data and an error at the same time, causing some handlers to forward unmasked bytes (unencrypted information) instead of keeping them hidden.