AI Sec Watch

A vulnerability called CVE-2026-14471 exists in Amazon mcp-gateway-registry (a tool that manages AI agent access to different services) versions 1.0.3 through 1.0.12. An authenticated user can exploit SQL injection (inserting malicious SQL commands into inputs) in the metrics tracking system to read sensitive data like API keys, or delete and modify stored information.

Langroid has a security flaw where tools registered with `use=False, handle=True` (meant to prevent the AI from calling them) can still be invoked directly by users sending raw JSON chat messages, because the message-handling code doesn't verify whether the message came from a user or the AI. This could allow unauthorized access to sensitive operations like file access or database queries depending on which tools are enabled.

Langroid's TableChatAgent and VectorStore have a critical vulnerability where they use Python's `eval()` function to execute code generated by the AI, but fail to properly sandbox it. Even though they pass an empty dictionary for local variables, Python automatically includes built-in functions like `__import__()` in the execution environment, allowing an attacker to run arbitrary commands on the host system through prompt injection (tricking the AI into generating malicious code).

Langroid's SQLChatAgent has a security flaw in its dangerous-function blocklist, which uses a regex pattern (a rule for matching text) to block dangerous PostgreSQL functions like pg_read_file. However, attackers can bypass this blocklist by writing the function name in quoted form, adding comments, or using schema-qualified names (like pg_catalog."pg_read_file"), because PostgreSQL accepts all these variations but the regex only checks for the function name directly followed by an opening parenthesis. This means the earlier fix that tried to block file-reading functions doesn't actually work.

Attackers are running a phishing campaign that impersonates over 30 major brands (like Adobe, Netflix, and OpenAI) by sending fake job interview emails to marketing professionals. The emails use real recruiter names and photos, then redirect victims through legitimate services like PeopleForce and Salesforce Marketing Cloud to a malicious page where a fake Google login (created using browser-in-the-browser, a technique that mimics a real authentication popup) steals Google account credentials.

vLLM (a system for running large language models) versions 0.22.0 to 0.23.0 have a vulnerability where two audio processing routes load uploaded files entirely into memory before checking if they exceed the maximum allowed file size limit (25 MB by default), allowing attackers to cause memory exhaustion or crash the system by uploading oversized files. This happens because the size check occurs too late in the process, after the file has already been loaded.

The OpenAI Codex desktop app for macOS had a security flaw where it automatically loaded remote images from AI responses without user confirmation. An attacker could use indirect prompt injection (tricking the AI by hiding instructions in untrusted input like tool results) to make the app fetch images containing sensitive data like API keys or source code, secretly sending that information to the attacker's server.

OpenAI CEO Sam Altman has proposed giving Americans equity stakes in major AI companies as compensation for the human-generated work (books, movies, art) that AI learns from without payment, and as a potential safety net against job losses from AI. If a 5% stake in OpenAI were distributed equally among American households, each would receive about $320 in equity, though details remain vague and the proposal has not yet become concrete policy.

The flyto-core library has a security flaw in its SSRF protection (SSRF is server-side request forgery, where an attacker tricks a server into making requests to internal systems). The protection checks if a URL points to a private IP address, but it only recognizes standard private IP formats and misses special IPv6 transition address forms (formats that embed IPv4 addresses like ::ffff:127.0.0.1). An attacker who can write workflows can use these alternate address formats to bypass the protection and access internal services like cloud metadata endpoints, potentially reading sensitive data.