AI Sec Watch

Meta has launched Muse Image, a new AI image generation model from its Superintelligence Labs that creates images across Meta AI, Instagram, and WhatsApp (with Facebook and Messenger coming soon). The model is described as "agentic," meaning it works together with another AI model to understand your request, search the web, and plan before generating an image. The article notes the model can pull other Instagram users into AI photos, but does not provide details about how this works or its implications.

9Router versions before 0.4.44 have a critical vulnerability where an unauthenticated attacker can execute arbitrary OS commands through the /api/tunnel/tailscale-install endpoint. The vulnerability exists because the sudoPassword field from user input is passed directly to a shell command without proper validation, and the endpoint lacks authorization checks (middleware matcher protection). An attacker can exploit this when sudo doesn't prompt for a password, such as when the process runs as root or NOPASSWD is configured.

Amazon Bedrock allows organizations to control whether prompts and model outputs are retained after processing through different data retention modes (none, some, inherit, or provider_data_share). To enforce consistent data retention policies across multiple accounts, especially when using models that require data sharing with third parties like Claude Fable 5, organizations can use Amazon Bedrock Projects and service control policies (SCPs, which are rules that limit what actions users in an organization can perform). The key principle is that your configured retention mode sets a ceiling (upper limit) on retention, not a guarantee, so models that support zero retention will still use zero retention even if your account allows higher retention.

Meta released Muse Image, a new AI model for generating images, making it available free to regular users through Meta AI, WhatsApp, and Instagram Stories, while requiring a paid subscription for creators and power users who want to generate many images. The company is also integrating Muse Image into its advertising tools to help brands create and customize ad designs more easily, reducing Meta's dependence on third-party image-generation services from other companies.

Anthropic is expanding access to Claude Cowork, an AI collaboration platform (a tool where users can work together with AI), beyond its desktop-only availability to iOS, Android, and web versions starting this week. The mobile and web versions will have reduced features compared to the desktop app, though cloud-based sessions will allow users to continue their work across different devices.

A flaw called 'GitLost' in GitHub's agentic workflows (AI systems that automatically perform tasks) allows an attacker to create a fake issue in a public repository and use it to secretly access data from private repositories without needing to log in. This means private data can be leaked even though the attacker never had official access to those repositories.

Researchers discovered that attackers can trick GitHub Agentic Workflows (AI agents that automate tasks based on plain English instructions) into leaking private repository data by opening a public issue with hidden malicious instructions. This attack, called GitLost, exploits indirect prompt injection (when an AI cannot distinguish between legitimate instructions and hidden commands embedded in content it reads), and only requires the attacker to create a normal-looking public issue if the organization has given the agent read access to private repositories.

The US Cybersecurity and Infrastructure Security Agency (CISA, the federal agency responsible for protecting government computer systems) is using Anthropic's Mythos AI model to scan government software code for security vulnerabilities (flaws that attackers could exploit). The AI-driven audits have already uncovered a large number of vulnerabilities, though specific details about their severity and which agencies were affected have not been publicly disclosed.

ONNX has a null pointer dereference (a crash caused by accessing invalid memory) in its version converter when processing Upsample nodes that have zero inputs. The converter checks that required attributes exist but fails to verify that the node actually has inputs before trying to access them, causing a crash (SIGSEGV) when converting models from opset version 6 to 7.