AI Sec Watch

CVE-2026-13236 is a missing authorization vulnerability (a flaw where the software fails to check if a user has permission to access something) in Drupal AI Agents that allows forceful browsing, which means attackers can access restricted pages or data by guessing URLs. This affects versions 0.0.0 to 1.1.4, 1.2.0 to 1.2.5, and 1.3.0 to 1.3.1.

CVE-2026-13233 is a server-side request forgery (SSRF, a vulnerability that tricks a server into making unwanted requests to other systems) vulnerability in the Drupal OpenAI Provider module that affects versions 0.0.0 through 1.1.1 and 1.2.0 through 1.2.2. The vulnerability allows attackers to exploit this flaw, though specific attack details are not provided in this summary.

Apple has sued OpenAI, claiming that former Apple employees at the company stole Apple's trade secrets (confidential business information) to help OpenAI develop hardware products. The lawsuit also names IO Products, a hardware startup founded by designer Jony Ive that OpenAI purchased in 2025, and two specific employees involved in the alleged theft.

The AI industry is shifting focus from building the largest models to creating systems that intelligently choose which model to use for specific tasks, balancing performance and cost. Companies are increasingly using open-weight models (AI models that can be downloaded and run by companies themselves) instead of expensive proprietary models, with experts predicting most AI computation will come from these cheaper, customizable options within 18 months.

Greg Brockman, OpenAI's president and co-founder, has taken over leadership of the company's most important business areas after Fidji Simo stepped down due to illness. Brockman now oversees ChatGPT's product business, go-to-market strategy, and computing initiatives as OpenAI prepares for an expected IPO and faces growing competition from rivals like Anthropic and Google.

The mcp-atlassian tool's `confluence_upload_attachment` function has a critical vulnerability where it reads files from any path without validation, allowing authenticated users or AI agents tricked via prompt injection (hidden malicious instructions in text input) to steal sensitive files like SSH keys and environment variables containing API credentials. Attackers can exploit this by manipulating an AI agent to upload protected files to Confluence, or by directly calling the vulnerable function if they have MCP (model context protocol, a tool-calling interface) access.

BabelDOC's PDF parser has a critical vulnerability where it deserializes untrusted pickle data from CMap files without proper path validation. An attacker can craft a malicious PDF with a specially encoded filename in the `/Encoding` name field (e.g., `/#2Ftmp#2Fattacker#2Fevil`, which decodes to `/tmp/attacker/evil`) that tricks the path-joining logic into loading an attacker-controlled pickle file instead of a trusted one, leading to arbitrary code execution (running attacker code with the program's permissions).

A malicious Rust package called `exploration` was removed from crates.io (a repository where developers share reusable code libraries) after it was discovered to contain code that downloaded and executed files from a remote server without authorization. The package was live for only about an hour before being removed, and there was no evidence that anyone actually used it.

Meta's stock rose 15% this week after the company announced new AI models and tools, including Muse Image (for creating images) and Muse Spark 1.1 (for running agentic and coding workloads, which means AI systems that can plan and act independently). The optimism reflects investor confidence that Meta's large spending on AI infrastructure and data centers will eventually create profitable new business lines beyond its traditional advertising revenue.