AI Sec Watch

Grackle's MCP (Model Context Protocol) tool layer has inconsistent authorization checks that let scoped agents (restricted AI assistants) perform operations they shouldn't be allowed to, like deleting or modifying other agents' tasks or reading data across workspaces (an IDOR vulnerability, where attackers access resources by guessing IDs). The root cause is that the server uses its full API key for all backend requests without passing caller information, making the MCP tool layer the only place where permissions are checked, and some tools skip these checks entirely.

The llm-coding-agent is a new Python library that creates a coding agent (an AI system that can perform tasks by using tools) built on top of an LLM (large language model) framework, capable of reading files, editing files, executing shell commands, and searching code to help automate coding tasks. The agent was developed using test-driven development (TDD, a method where you write tests before writing code) and includes features like file operations, command execution with timeouts, and pattern-based file searching. Users can interact with it through command-line options like "llm code --yolo" or a Python API that lets them request specific coding tasks.

Langroid's SQLChatAgent contains a security flaw where its `_validate_query` blocklist (a list of dangerous SQL patterns to reject) fails to block several PostgreSQL file-reading functions like `pg_read_file()` and `pg_ls_logdir()`. An attacker who can influence the SQL queries the AI generates (through direct input or by injecting instructions into data the AI reads) can exploit this to read arbitrary files from the database server, even when the agent is configured to only allow SELECT statements and forbid dangerous operations.

Langroid's ReadFileTool and WriteFileTool have a path traversal vulnerability (a security flaw where attackers use sequences like ../ to access files outside intended boundaries) because they only change the working directory but don't validate that file paths stay within the configured curr_dir (current directory) boundary. An attacker can use paths like ../secret.txt to read or write files outside the intended sandbox directory, potentially compromising applications that rely on curr_dir to restrict file access.

mcp-memory-service has a critical authentication bypass vulnerability where all endpoints under `/api/documents/*` lack authentication checks, allowing unauthenticated attackers to read, write, and delete memories even when the server has API key or OAuth protection enabled. This is particularly dangerous because the `/api/memories` endpoints correctly enforce authentication, creating an inconsistent security boundary that attackers can exploit.

In early 2024, Google's Gemini AI model generated historically inaccurate and racially offensive images, such as depicting non-White figures in Nazi-era settings, exposing failures in AI training and ethical oversight. The root cause was a flawed "diversity injection" mechanism (a technique meant to reduce bias in training data) that lacked safeguards to understand historical context, resulting in distorted outputs. The incident caused significant financial and reputational damage to Google and raised broader questions about how to build fairness and accuracy into generative AI systems.

AI systems used by organizations often appear reliable but actually suffer from algorithmic fragility, a persistent instability caused by how machine learning interacts with complex real-world environments, leading to biased outputs and performance drift (a decline in accuracy over time). Organizations manage this instability through stabilization work, which involves three practices: buffering (absorbing problems), reframing (reinterpreting failures), and patching (fixing issues), that become routine organizational processes to maintain the appearance of reliability. The paper argues that algorithmic fragility is a structural condition of AI systems rather than a temporary bug, and that effective AI governance requires continuous practice-based management rather than one-time technical fixes.

IBM and Red Hat are investing significant resources (20,000 engineers) into Project Lightwell, a new service aimed at fixing bugs in open-source software (publicly available code that anyone can use and modify). This initiative was sparked by findings from Anthropic's Mythos research, which demonstrated that AI can discover security vulnerabilities (weaknesses that attackers could exploit) in open-source code, raising concerns about how to better protect the supply chain (all the software components and processes used to build applications).

CVE-2025-69134 is a vulnerability in the OpenAI Chatbot for WordPress Helper plugin (version 1.1.4 and earlier) that allows attackers without authentication to delete arbitrary content from WordPress sites. The flaw stems from missing authorization checks (CWE-862, a weakness where code doesn't properly verify if a user should be allowed to perform an action).