AI Sec Watch

OpenAI is running a bug bounty program (a competition where security researchers find vulnerabilities and report them for rewards) to test GPT-5.5 and GPT-5.6 for universal jailbreaks (methods that can trick the AI into ignoring its safety rules for biology-related requests). The company increased rewards from $25,000 to $50,000 for researchers who successfully find these vulnerabilities, aiming to strengthen safeguards before releasing advanced AI models.

Organizations spend billions upgrading AI detection models in cybersecurity, but the real problem is often poor data quality upstream in the data pipelines. Issues like fragmented telemetry (data collected from multiple tools in different formats), schema drift (gradual changes to data format structures), and stale behavioral baselines cause AI models to produce unreliable results, leading to false alarms and missed threats.

AI coding agents like Claude Code and OpenAI's Codex can be tricked into running malicious code when they are supposed to be scanning code for security problems. Researchers at the AI Now Institute demonstrated an attack called "Friendly Fire" that hides a malicious script in a README file (a standard text file in code projects), and the agent runs it without warning because it looks like a legitimate security check. The researchers say this is a design problem, not a bug that can be patched, because the AI models cannot reliably tell the difference between the code they are reading and the instructions they should follow.

Many organizations have AI governance policies on paper, but in reality, employees widely use unapproved AI tools outside company oversight, a problem called shadow AI (unauthorized use of AI applications). This creates security and data risks, such as employees accidentally pasting sensitive information into chatbots or connecting company systems to AI tools without approval, and traditional security controls weren't designed to monitor these new AI interactions.

Researchers discovered GhostApproval, a flaw in six AI coding assistants that exploits symlinks (shortcuts that point to different files on a computer) to trick developers into approving edits that secretly modify sensitive files like SSH login keys. The assistants show approval dialogs that name harmless files while actually writing to dangerous system files, bypassing informed consent even though developers think they are approving safe changes.

OpenAI released GPT-Live, a new voice mode for ChatGPT that uses an updated model and can delegate complex tasks like web searches or deep reasoning to GPT-5.5 (a more powerful model) in the background while maintaining conversation flow. The previous voice mode used an older GPT-4o era model with a knowledge cutoff from 2024, which the author found too limited to be useful.

Stanza, a Stanford library for processing human language in Python, had a vulnerability where loading malicious model files could allow attackers to run arbitrary code on a user's computer. The problem occurred because the library would try a secure loading method first, but if that failed, it would fall back to an unsafe method that could execute malicious instructions hidden in pickle (a Python format for storing data).

Attackers are systematically abusing GitHub's public APIs to map organizations, steal source code, and find secrets like API keys and cloud credentials, using a mix of fake dormant accounts and leaked credentials that blend into normal usage patterns. GitHub's public APIs don't require authentication for many operations and don't log geolocation data for external access, making it difficult to detect and stop this reconnaissance activity. The attacks involve automated scanner tools and coordinated networks of fake accounts that operate in short bursts across many organizations.

Serena, an AI agent framework, runs an unauthenticated Flask web dashboard on a fixed port (24282) with no login protection or security checks. An attacker can use DNS rebinding (a technique where an attacker controls a domain and redirects it to a victim's local machine) to write malicious commands into Serena's memory from a malicious webpage, which the agent then executes using `shell=True` (a mode that allows shell code injection). This creates a complete remote code execution vulnerability that requires only visiting a malicious website while Serena is running.