AI Sec Watch

This is a BBC article featuring advice from leaders at Google, Nvidia, and Anthropic about artificial intelligence for students. The content appears to be primarily editorial commentary rather than technical analysis of an AI security issue or vulnerability.

Estonia's AI Council is proposing to create government-issued digital identities for AI agents (software programs that perform online tasks on behalf of users), which would specify what actions each agent is allowed to perform, such as viewing data, editing documents, or making payments up to a limit. This approach aims to establish clear accountability by showing who is acting, on whose behalf, and with what permissions, addressing the risk that AI agents might exceed their intended authority or be misused by others.

Open WebUI has a security flaw where authenticated users can access other users' files through the `/api/chat/completions` endpoint. When a user sends an image request with a file ID (instead of a web link) in the `image_url` field, the server reads that file from disk without checking if the user owns it, then converts it to a format the AI can process. An attacker can exploit this by using another user's file ID to make the AI read and describe private files, leaking their content.

vLLM's audio transcription endpoint checks the size of compressed audio files but not the decoded output, allowing a decompression bomb attack. A 25MB OPUS file can expand to about 14.9GB of PCM audio (raw, uncompressed audio data) in memory, letting an attacker crash the server by exhausting RAM with just a few requests.

vLLM's fix for an earlier vulnerability (CVE-2026-22778) was incomplete, leaving five code paths in the Anthropic router and speech-to-text API that still leak memory addresses. When users send malformed image data, the PIL library raises an error message containing a BytesIO object's memory address (like `<_io.BytesIO object at 0x7a95e299e750>`), and these five locations pass the error directly to clients without removing the address, defeating ASLR (address space layout randomization, a security feature that randomizes where code lives in memory).

vLLM's GGUF dequantize kernels (specialized functions for decompressing quantized neural network weights) use a 32-bit integer parameter to specify tensor size, which truncates when processing very large tensors. This causes the output tensor to be only partially filled by the processing kernel, leaving the remaining memory uninitialized. In multi-tenant deployments (where multiple users share GPU hardware), this unfilled memory may retain sensitive data from other users' previous requests, leaking their information.

vLLM, an AI framework for running large language models, has three image processing bugs that cause mismatches between what the model sees and what users expect. First, EXIF orientation data (metadata that tells how an image should be rotated) is ignored, so rotated images are processed in the wrong orientation. Second, PNG images with transparency information (the tRNS chunk, which marks certain pixels as see-through) aren't properly flattened to solid colors before processing, causing transparent pixels to become visible or distorted. Third, animated PNG and GIF files only process their first frame. These issues could alter how the model interprets image content.

vLLM has a validation bypass where temperature values set to NaN (not-a-number) or positive Infinity pass all safety checks because comparison operators silently return False for these special float values in Python. These invalid values then reach GPU sampling kernels, causing crashes that take down the inference worker and affect all users running models on it.

n8n had a security flaw where three endpoints that change data in workflow test runs used the wrong permission scope (workflow:read instead of workflow:execute), allowing users with read-only access to start, cancel, and delete test runs they shouldn't be able to modify. This only affected enterprise versions with Advanced Permissions enabled.