AI Sec Watch

China is promoting a different approach to AI safety and governance than the U.S., announcing plans for a global AI cooperation organization and emphasizing free or cheap AI models accessible to developing countries. Meanwhile, the U.S. and its Group of Seven allies are pursuing a more restrictive strategy, planning to limit access to advanced AI models to only "trusted partners" and keeping them subscription-only. The two countries previously agreed to work on AI guardrails (safety rules and limits), but details remain unclear.

Microsoft claims that Defender for Office 365 catches most malicious emails before delivery and that adding extra email security tools provides minimal additional benefit (less than 0.05% improvement). However, security experts warn that these statistics can be misleading because even a single missed dangerous email can cause a serious incident, and Microsoft's metrics don't reveal how severe the threats that slip through actually are.

Pi Agent, a coding assistant tool, had a security weakness in how it exports chat sessions to HTML files. Attackers could hide malicious links in Markdown (a text formatting system) by using special control characters that browsers would ignore, allowing XSS (cross-site scripting, where malicious code runs in a webpage) to execute in the exported HTML file if a user clicked the link. The attack requires multiple steps: an attacker must inject harmful content into a session, the user must export it as HTML, and the user must click the malicious link.

LiteLLM proxy had an authentication bypass vulnerability where a crafted Host header (the part of a web request that specifies which server is being contacted) could trick the auth layer into checking the wrong route, potentially allowing unauthorized access to protected management features. Most deployments are protected because upstream security layers like CDNs or reverse proxies validate the Host header, and LiteLLM Cloud customers are not affected.

An authenticated user in n8n (a workflow automation platform) could trick the SecurityScorecard node (a component that connects to SecurityScorecard's API) into sending an API token (a credential for accessing the service) to an attacker's server by configuring it to download reports from a malicious URL, bypassing security restrictions meant to limit where credentials can be sent. This allows the attacker to steal the API token and use it themselves.

When n8n's MCP Browser tool runs in HTTP transport mode (a way of sending data over the network), it accepts requests without authentication (verification of identity), meaning anyone on the network or visiting a website can control the user's browser, including navigating to sites, running code, and accessing cookies and stored data. This vulnerability only affects the HTTP transport mode; the default stdio transport (direct computer communication) is safe.

n8n (a workflow automation tool) has a security flaw in its Enterprise Edition where three endpoints for the Dynamic Credentials feature (a system that manages authentication tokens across workflows) fail to check if users should have access to specific workflows or credentials. An authenticated attacker could steal another user's credential tokens, take over their integrations, or disable their credentials entirely, affecting any workflows that rely on those credentials.

A vulnerability in n8n (a workflow automation tool) allowed member-level users with editor access to shared workflows to access credentials (stored login information) they shouldn't have permission to use, because permission checks weren't fully enforced on certain API endpoints. This only affected instances where workflow sharing was enabled and workflows had been shared with member-level editors.

A vulnerability in n8n's Compression node allows unauthenticated attackers to crash the entire application by sending specially crafted compressed files to public webhooks. The node decompresses archives without limiting memory usage, causing the process to run out of memory and stop working for all users on that server.