AI Sec Watch

Australian Payments Plus (AP+), which manages payment and identity systems across Australia, adopted ChatGPT Enterprise and Codex (OpenAI's AI tools for code and technical work) to help employees work faster on complex tasks. The organization uses these AI tools to investigate technical issues more quickly, find information in dense documents faster, and turn rough notes into structured summaries, while keeping human experts responsible for final decisions and accuracy.

Researchers at Sysdig documented JadePuffer, an agentic ransomware attack (malware controlled by an AI agent rather than a human operator) where an AI system independently executed a cyberattack, including breaking into servers, stealing data, and writing ransom notes. However, humans still set up the operation, chose the victim, obtained initial credentials, and controlled the infrastructure, so the attack wasn't entirely automated.

Alibaba has banned its employees from using Anthropic's Claude AI tools starting July 10, citing concerns about back-door security risks. This move follows Anthropic's accusation that Alibaba conducted a distillation attack (a technique where someone tries to copy an AI model's capabilities by studying its outputs), which Anthropic called the largest known case of this type. The ban also comes after reports that Chinese companies had found ways to bypass Anthropic's geographic restrictions by using third-party access methods.

Langroid's Neo4jChatAgent passes Cypher queries (the query language for Neo4j databases) directly from the LLM to the database without checking them first, allowing attackers to inject malicious instructions through prompt injection (tricking the AI by hiding commands in its input). This can lead to data theft, deletion, or remote code execution if certain server features are enabled, and mirrors a similar bug in SQLChatAgent that was already fixed in version 0.63.0.

9Router (a Next.js dashboard for routing AI requests) contains multiple critical vulnerabilities in versions 0.4.41 and earlier. The `/api/providers` endpoints lack authentication, allowing anyone to create, modify, or delete AI provider connections, while `/api/usage/stats` exposes full API keys (secret credentials used to access AI services) in plaintext, and `/api/usage/request-details` leaks other users' complete conversation histories without requiring a password or login.

vLLM, a system that runs large language models efficiently, has a vulnerability in versions before 0.24.0 where users can submit malicious regular expressions (patterns used to match text) through the structured_outputs.regex parameter that cause the system to hang indefinitely, making it unavailable to other users. The vulnerability exists because the regex patterns are sent directly to backend compilers without checking if they will take too long to process, and patterns with nested quantifiers (like repeated matching operations inside each other) can cause exponential state-space expansion (the number of possible states the regex checker must evaluate grows exponentially). An attacker could exploit this to perform a denial-of-service attack (making a service unavailable to legitimate users).

vLLM is a library for running and serving large language models (LLMs, AI systems that generate text). Versions 0.12.0 through 0.23.x have a bug where sending certain specially crafted requests to the /v1/completions endpoint (an API route for generating text) with models using M-RoPE (a rotary position embedding technique) causes the server to crash and stop working entirely, and any authorized user can trigger this crash.

vLLM (a system for running LLMs efficiently) versions before 0.24.0 have a bug where certain requests can cause the rejection sampler (a component that filters generated tokens) to produce an invalid token value that crashes the engine's GPU worker. Because these requests can be sent remotely through public endpoints, an attacker can trigger this crash to shut down the service for all users until the worker restarts, creating a denial of service attack (making a service unavailable to legitimate users).

Coder's AgentLogLine dashboard component failed to escape HTML characters before displaying workspace agent logs, allowing a workspace owner to inject arbitrary HTML that would render in other users' browsers when they viewed the workspace page. While a Content Security Policy blocked inline scripts, attackers could still inject redirects or CSS-based attacks.