AI Sec Watch

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 have a missing authentication vulnerability in the /api/v1/build_public_tmp/ endpoints, which allows attackers without credentials to read build event data or cancel jobs if they know the job identifier, leading to information disclosure (unauthorized data access) and denial of service (disrupting service availability). This vulnerability is caused by improper authentication (CWE-287, a weakness in verifying user identity).

IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making requests to unintended locations) in the URL component. The vulnerability is caused by a TOCTOU race condition (a timing bug where a system checks something at one moment but uses it at another, allowing attackers to change it in between), which attackers can exploit through DNS rebinding (a technique where an attacker changes what a domain name points to after the server checks it).

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a vulnerability in voice mode where API client credentials are improperly shared across different tenants (separate user accounts or organizations). An authenticated attacker can manipulate cached data to make requests from other users run under wrong API credentials, leading to incorrect billing charges and misattribution of actions to the wrong user.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.3 has a critical vulnerability that lets attackers read sensitive secrets (like passwords or API keys), modify flows (the workflows that connect AI components together), access the database, connect to internal systems, and create persistent backdoors by injecting malicious code into public flows.

IBM Langflow OSS versions 1.0.0 through 1.9.3 have a vulnerability where attackers can bypass SSRF protection (a security feature that prevents the server from making requests to internal systems). An authenticated user with basic permissions can enable a follow_redirects setting and use a public URL that redirects to internal addresses, allowing them to access sensitive internal services and data that should be blocked.

Modern AI systems can now automatically discover software vulnerabilities and create working attacks, making the time between when a vulnerability is discovered and when it's exploited much shorter. Container base images (the foundational software packages that applications run on top of) are a major security risk, accounting for 39% of critical vulnerabilities in production containers. The source recommends using hardened, minimal base images that are continuously patched to reduce the amount of vulnerable code in your systems.

Microsoft researchers discovered that attackers can poison tool descriptions in MCP (Model Context Protocol, an open system that lets AI agents call outside tools) to trick AI agents into leaking company data without breaking any rules. The attack works by hiding malicious instructions inside the plain-text description of a tool, so when an agent reads the description to decide what to do, it follows the hidden orders along with legitimate ones, making the data theft look like normal activity.

The Trump administration's restrictions on U.S. AI companies like Anthropic and OpenAI are slowing their development, while Chinese AI companies like Zhipu are rapidly closing the gap with competitive models that cost less to run. According to researchers and industry experts, Zhipu's GLM 5.2 model now matches or beats some top U.S. AI models on certain benchmarks, suggesting that export controls intended to protect American AI leadership may inadvertently be helping China catch up.

Google announced two new AI models: Nano Banana 2 Lite, a fast and cheap image generation model that produces images in 4 seconds, and Gemini Omni Flash, a model for video generation and editing. These models are designed to help developers quickly experiment with and scale creative projects involving images and videos.