AI Sec Watch

OpenAI has proposed giving the U.S. government a 5% stake in the company (worth about $42.6 billion) to reduce political pressure from Washington, with CEO Sam Altman arguing this would let the public share in AI's financial success. The proposal suggests a broader arrangement where the government would hold similar stakes in other major U.S. AI companies like Anthropic, Google, and Meta through a government investment vehicle, though it is unclear if these companies would agree.

Researchers discovered two sandbox bypass vulnerabilities (CVE-2026-50548 and CVE-2026-50549) in Cursor, a popular AI-assisted coding tool, that allow attackers to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) through prompt injection (tricking an AI by hiding instructions in its input). The flaws exploit logic errors in Cursor's command execution sandbox, the protective layer meant to prevent the internal AI agent from performing unauthorized actions on the operating system, and can be triggered when users unknowingly process malicious instructions from untrusted sources like web results or MCP servers (model context protocol servers, which provide external data to AI tools).

oras-go (a tool for working with container registries) didn't validate where it sent credential requests when a registry gave it a new URL in its response. This allowed a malicious registry to trick the tool into either sending credentials over unencrypted connections (defeating HTTPS security) or probing internal network endpoints like cloud metadata services (SSRF, or server-side request forgery, where a program makes requests to places the user didn't intend).

The @hey-api/openapi-ts library has a vulnerability in its `buildClientParams` template where an attacker can inject a special key like `$query___proto__` to replace the prototype chain (the object that provides inherited properties) of generated request parameters. This affects all applications that use this library to generate SDKs (software development kits) and pass user-controlled data to those generated functions, particularly in proxy servers or API gateways.

AWS Network Firewall now supports container attribute-based rules that let you write firewall rules for Kubernetes pods using their attributes (like namespace and pod name) instead of their IP addresses, which constantly change as containers restart or scale. This solves the problem of maintaining static firewall rules in dynamic container environments, and it enriches security logs with container context so security teams can trace blocked traffic back to its source workload.

Gradio versions before 6.16.0 contain a path traversal vulnerability (a security flaw where attackers bypass restrictions on which directories they can access) in the FileExplorer component's preprocess() method. Unauthenticated attackers can supply specially crafted file paths that cause the system to escape the intended root directory and read arbitrary files outside the configured location, potentially exposing sensitive data.

Repomix's MCP server (a protocol for connecting AI assistants to tools) has a security weakness where the `attach_packed_output` function can register arbitrary local files with certain extensions (.json, .txt, .md, .xml) and bypass the secret-scanning check that normally blocks sensitive files from being read. An attacker using MCP tools can register any supported file type as output, get an ID for it, then use `read_repomix_output` to read the full file content without the safety check being applied.

CVE-2026-56149 is a vulnerability in Elasticsearch where an attacker with elevated privileges can submit a specially crafted machine learning request that causes the system to allocate excessive memory without limits (CWE-770, a weakness where resources are allocated without proper restrictions), potentially crashing the affected server. This is a denial of service attack (making a service unavailable to legitimate users) that exploits the system's inability to throttle resource consumption.

Keras versions up to 3.13.2 have a security flaw that lets attackers read files from your computer by hiding malicious instructions in model files. When you load a model using Keras functions like `keras.models.load_model()`, the vulnerability doesn't properly check if datasets are virtual (pointing to other files), so it automatically reads files an attacker specifies, potentially exposing sensitive data.