AI Sec Watch

A critical vulnerability called GitLost affects GitHub Agentic Workflows (AI agents that automate repository interactions by reading natural language instructions in markdown files). Attackers can exploit prompt injection (tricking an AI by hiding instructions in its input) in public GitHub Issues to make the AI agent leak private repository data, even without credentials or coding skills. GitHub's security protections failed against variations of the attack, such as adding the keyword "additionally" to bypass safeguards.

OpenAI Academy is hosting in-person workshops called the AI Skills Jam for K–12 Educators across eight U.S. cities to help teachers and school administrators learn practical ways to use AI tools in their work. Research shows teachers who use AI weekly save an average of 5.9 hours per week, which they reinvest in activities like better student feedback and lesson planning. During the Jam, educators will work with OpenAI mentors on real classroom tasks and gain access to OpenAI Academy, a free online platform with ongoing resources for responsible AI use in education.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch an actively exploited vulnerability in Langflow, a popular tool for building AI agents with a drag-and-drop interface. The flaw, tracked as CVE-2026-55255, is an IDOR (insecure direct object reference, where an attacker can access data they shouldn't by manipulating request parameters) that lets authenticated attackers view other users' workflows and steal sensitive data or computing resources. Attackers are already using this vulnerability to gain code execution and deploy malware to compromise servers and steal credentials.

The U.S. Department of Commerce has approved OpenAI to release its GPT-5.6 model widely, with the rollout expected to begin this week after additional testing and government meetings. This decision reflects the Trump administration's hands-on approach to AI regulation (government oversight of AI system capabilities before release), which has also affected competitors like Anthropic whose Claude models faced temporary suspension.

China's government reported that Anthropic's Claude Code, an AI tool for automated coding, contains a back-door vulnerability (a hidden security flaw that lets attackers access a system they shouldn't be able to reach) that can secretly send sensitive user information like location and identity to a remote server. This warning intensifies tensions in the U.S.-China tech competition, as Chinese companies and individuals have been using this American AI tool despite it not being officially available in China.

Estonia is exploring the creation of state-issued digital identities for AI agents (autonomous programs that can perform tasks without direct human control), which would allow these agents to interact with government services. This initiative positions Estonia as a potential leader in establishing rules and standards for how AI agents can be officially recognized and used in government contexts.

U.S. lawmakers are investigating why American companies are adopting Chinese AI models, which are becoming competitive with American alternatives while costing less. Concerns focus on whether these models could advance China's political interests or pose cybersecurity risks, though using Chinese AI models is not currently banned for U.S. companies (unlike some government departments).

OpenAI has launched GPT-Live, a new voice AI model that uses full-duplex architecture (the ability to listen and speak simultaneously) to make conversations feel more natural and human-like. Unlike earlier voice systems that processed speech in separate steps or waited for users to finish speaking, GPT-Live can continuously process audio, respond expressively, and delegate complex tasks to more powerful backend models while maintaining conversation flow.

mem0 (a software tool) has a critical security flaw where API endpoints lack authentication (verification of user identity), allowing attackers to steal LLM API keys (credentials used to access AI services) stored in plaintext, and exploit SSRF attacks (server-side request forgery, where an attacker tricks a server into making requests to unintended internal systems) by controlling the ollama_base_url parameter. The vulnerability has a CVSS score of 9.2, indicating it is extremely severe.