AI Sec Watch

The GDPR (General Data Protection Regulation, a European law protecting personal data) has successfully increased data protection awareness and compliance among companies over its first 10 years, with enforcement fines exceeding €6 billion. However, businesses increasingly view GDPR as burdensome and complicated, particularly for AI development, with 69% of companies in 2025 reporting that data protection regulations make it difficult to train AI models with sufficient data.

Anthropic is testing mobile support for Claude Cowork, an agentic mode (where Claude can autonomously complete tasks) that lets users manage long-running tasks like document creation and file analysis from their phone. The mobile version would act as a remote control for Cowork running on a desktop computer, allowing users to start tasks, monitor progress, and continue work in the background even when the app is closed.

picklescan (a tool that checks if pickle files, which are Python's serialization format, are safe) through version 0.0.26 fails to detect malicious pickle files that use a hidden code-execution technique through idlelib.pyshell.ModifiedInterpreter.runcode. Attackers can hide dangerous code in pickle files that runs when the file is loaded, potentially compromising PyTorch models and other saved Python objects in supply chain attacks (attacks that compromise software as it's being distributed).

The Trump administration asked OpenAI to delay the full release of GPT-5.6 (a large language model, which is an AI system trained on vast amounts of text) over security concerns. Instead of a public release, OpenAI will first offer the model in limited preview form to only a small group of business customers, with the federal government approving each customer's access individually.

Cursor, a code editor that uses AI to help with programming, had a security flaw in versions before 3.0 where its sandbox protection (a restricted environment that limits what programs can do) could be bypassed. An AI agent could create a symlink (a shortcut that points to a different location) inside the workspace to trick the editor into writing files outside the workspace without user approval, potentially allowing an attacker to run code with full system access.

Cursor is a code editor that uses AI to help with programming. Before version 3.0, Cursor had a security flaw where an AI agent could trick the sandbox (a restricted environment that limits what code can do) into allowing file writes to sensitive locations outside the workspace, potentially letting malicious code run with full user permissions without any protection.

The opentelemetry_sdk library had a vulnerability where it didn't check size limits before processing baggage headers (metadata passed between services in distributed tracing, which is used in observability and monitoring). An attacker could send extremely large headers that would waste CPU and memory while being parsed, even though they'd eventually be rejected, potentially causing a denial-of-service attack (making a service unavailable by overwhelming it with resource requests).

The langgraph-sdk (a Python library for making HTTP requests to LangGraph services) had a vulnerability where it directly inserted user-supplied identifier values into URLs without encoding them. This meant special characters in identifiers could change which resource was accessed, potentially allowing users to access, modify, or delete resources they shouldn't have permission to change, especially in systems that check permissions based on the URL path. The vulnerability only affects applications that pass unvalidated user input directly to SDK methods.

LangGraph's `JsonPlusSerializer` (a tool that converts JSON data back into Python objects) has a vulnerability where checkpoint files (saved states of an AI workflow) stored insecurely could be modified by attackers and cause arbitrary code execution (running attacker-chosen commands) when the checkpoint is loaded. This risk only applies if someone gains unauthorized write access to where checkpoints are stored, but the concern is converting that storage access into full control of the running application.