AI Sec Watch

OpenAI released GPT-Live, a new voice mode for ChatGPT that uses an updated model and can delegate complex tasks like web searches or deep reasoning to GPT-5.5 (a more powerful model) in the background while maintaining conversation flow. The previous voice mode used an older GPT-4o era model with a knowledge cutoff from 2024, which the author found too limited to be useful.

Stanza, a Stanford library for processing human language in Python, had a vulnerability where loading malicious model files could allow attackers to run arbitrary code on a user's computer. The problem occurred because the library would try a secure loading method first, but if that failed, it would fall back to an unsafe method that could execute malicious instructions hidden in pickle (a Python format for storing data).

Attackers are systematically abusing GitHub's public APIs to map organizations, steal source code, and find secrets like API keys and cloud credentials, using a mix of fake dormant accounts and leaked credentials that blend into normal usage patterns. GitHub's public APIs don't require authentication for many operations and don't log geolocation data for external access, making it difficult to detect and stop this reconnaissance activity. The attacks involve automated scanner tools and coordinated networks of fake accounts that operate in short bursts across many organizations.

Serena, an AI agent framework, runs an unauthenticated Flask web dashboard on a fixed port (24282) with no login protection or security checks. An attacker can use DNS rebinding (a technique where an attacker controls a domain and redirects it to a victim's local machine) to write malicious commands into Serena's memory from a malicious webpage, which the agent then executes using `shell=True` (a mode that allows shell code injection). This creates a complete remote code execution vulnerability that requires only visiting a malicious website while Serena is running.

LiteLLM is a proxy server (an intermediary that forwards requests to AI language model APIs) that had a security flaw before version 1.84.0 where attackers could fake an Authorization header to bypass authentication checks and access AI tools without a valid LiteLLM key. The vulnerability affected the MCP Streamable HTTP endpoint (a network interface for handling streaming data) and allowed unauthenticated requests to reach protected systems.

LiteLLM is a proxy server (a middleman program that forwards requests to different AI language model services) that had a security flaw in versions before 1.82.0-stable. Privileged users could upload custom Python code (a programming language) to create or update guardrails (safety filters), but this code wasn't properly sandboxed (isolated from the rest of the system) and could expose secrets (sensitive credentials) stored in the server's memory. The vulnerability affected the production create and update paths but not the test endpoint.

LiteLLM is a proxy server (a middleman that forwards requests to different AI services) that had a vulnerability before version 1.83.7-stable where it didn't properly check file paths when extracting uploaded skill files (packaged as ZIP archives). This meant an authenticated user could upload a specially crafted file that uses path traversal (a technique to write files outside the intended folder) to place files in dangerous locations on the server.

LiteLLM is a proxy server (an intermediary that forwards requests to AI language model APIs) that had a security flaw in versions before 1.83.10-stable. The /health/test_connection endpoint (a tool used to check if model connections work) allowed privileged users to read files from the server's local filesystem by supplying specially crafted references, which is a file disclosure vulnerability (CWE-73, external control of file name or path).

Composio SDK versions before 0.2.32-beta.283 have a path validation bypass vulnerability (a security flaw where file path checks are missing) that allows attackers to read and steal sensitive files like SSH private keys. Attackers can exploit prompt injection (tricking an AI by hiding instructions in its input) to manipulate file upload parameters and cause the CLI to send credential files to attacker-controlled storage.