AI Sec Watch

Companies are leaving AI agents (automated tools that run independently) active even after employees who created them leave, giving these tools permanent access to sensitive data and code without proper oversight. Traditional security tools miss this risk because they monitor AI like regular software and don't know which human authorized each AI action, making it hard to track whether an AI's data access is legitimate. The article describes this as a significant security problem but focuses mainly on identifying where these orphaned agents exist rather than fixing them.

This bulletin covers multiple cybersecurity threats including malicious browser extensions that hijack search results and route them through hidden monetization layers, a fileless macOS attack using fake system dialogs to steal credentials, and threat actors abusing Claude's legitimate chat-sharing feature to deliver malware. The common theme is attackers exploiting user trust in legitimate tools and services to conduct fraud, steal data, and distribute malware.

Pipecat's development runner has an unauthenticated WebSocket endpoint (`/ws`) that accepts telephony connections without verifying who is connecting. An attacker can send a fake Twilio handshake message with a call ID they choose, and the server will use its own Twilio credentials to hang up that call, potentially terminating calls on the victim's account. The same vulnerability exists for Telnyx and Plivo telephony providers.

The githubreceiver component in opentelemetry-collector-contrib has a security flaw where it validates the `required_headers` configuration at startup but never actually checks these headers on incoming webhook requests. This means an attacker can send fake data to the webhook endpoint by bypassing the authentication headers that operators thought were protecting it, especially when the `secret` field is left empty (which skips HMAC validation entirely).

The Sentry exporter in opentelemetry-collector-contrib has a path traversal vulnerability (a type of attack where an attacker manipulates file paths to access unintended locations) because it builds Sentry API URLs by directly inserting the service.name attribute, which remote attackers can control, without checking if it's valid. Since the operator's bearer token (a credential that proves the operator's identity) is automatically added to every request, an attacker can craft a malicious service.name to reach privileged Sentry admin and organization endpoints that they shouldn't have access to.

PraisonAI's search tools contain a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can trick the AI into making HTTP requests to arbitrary internal URLs by controlling the `searxng_url` parameter. Because this parameter is exposed to the language model as a tool option and search tools are enabled by default, an attacker can inject malicious instructions through web pages or files to make the server access internal services, read sensitive data, or in cloud environments reach the instance metadata endpoint (169.254.169.254) to potentially steal credentials.

The `multiedit` tool in PraisonAI allows an AI agent to read and write any file on the system without checking file paths or boundaries, because it passes the filepath directly to the `open()` function without validation. An attacker who can control what the agent does, such as through crafted prompts or malicious workflow configurations, could steal sensitive files like SSH keys and credentials, or overwrite important files to take control of the system.

The US government imposed export controls on Anthropic's Fable 5 AI model and its underlying Mythos model, restricting access even for foreign nationals working at Anthropic in the US. Anthropic then took both models offline because the company said it couldn't reasonably comply with the restrictions while keeping the models publicly available. This incident raises broader questions about how the US government should regulate AI and whether its approach will be a genuine safety framework or a political tool.

Retrieval-augmented generation (RAG, a technique where AI systems pull in external documents to answer questions) enhances large language models but introduces a new security risk: external data extraction attacks (EDEAs), where attackers can trick the system into revealing sensitive or copyrighted information from its knowledge base. Researchers developed an attack called Secret that uses AI-optimized prompts and adaptive strategies to extract data from RAG systems, successfully extracting data from commercial models where previous attacks failed.