AI Sec Watch

OpenSift, an AI study tool that uses semantic search (finding information based on meaning rather than exact word matches) and generative AI to analyze large datasets, had a security vulnerability in versions before 1.6.3-alpha. The vulnerability was an SSRF (server-side request forgery, where an attacker tricks the server into making requests to unintended locations) that allowed attackers to bypass security checks by using private URLs, non-standard ports, or redirects that the URL intake system didn't properly restrict.

OpenSift is an AI study tool that uses semantic search (finding information based on meaning rather than exact keywords) and generative AI to analyze large datasets. Before version 1.6.3-alpha, the software had a path-injection vulnerability (a flaw where attackers could manipulate file paths to access files outside intended directories) in its file storage system, allowing potential unauthorized file read, write, or delete operations.

OpenSift, an AI study tool that uses semantic search (finding information based on meaning rather than exact word matches) and generative AI to analyze large datasets, had a security problem in versions before 1.6.3-alpha where it exposed sensitive information. Specifically, the tool returned raw error messages to users and leaked login tokens (credentials that prove who you are) in responses shown on the screen and in token rotation output (the process of replacing old credentials with new ones).

After the U.S. Department of War labeled Anthropic a supply-chain risk (a company whose products could pose security or operational risks to government systems), Microsoft announced it will continue offering Anthropic's Claude AI models to most customers through platforms like Microsoft 365 and GitHub, except to the Pentagon. The decision comes as other defense companies are moving away from Anthropic's technology toward competing AI providers like OpenAI.

The U.S. Department of Defense has designated Anthropic, an AI company, as a supply chain risk, which blacklists it from government contracts and requires defense contractors to certify they don't use Anthropic's Claude AI models in Pentagon work. Anthropic's CEO says the company will challenge this designation in court, claiming the dispute stems from disagreements over whether Anthropic's AI should be used for fully autonomous weapons or domestic mass surveillance, while the DOD wanted unrestricted access to Claude for all lawful purposes. This makes Anthropic the first American company to be publicly labeled a supply chain risk, a designation traditionally reserved for foreign adversaries.

Anthropic announced it will legally challenge the Department of Defense's decision to label the company a supply-chain risk (a designation that can prevent a company from working with the Pentagon), which the company's CEO called "legally unsound." The dispute arose because the DOD wanted unrestricted access to Anthropic's Claude AI system for all military purposes, while Anthropic refused to allow its AI to be used for mass surveillance or fully autonomous weapons. Anthropic argues the designation is too broad and violates the law's requirement to use the least restrictive means necessary to protect the supply chain.

The Greenshift plugin for WordPress (used to create animations and page builder blocks) has a vulnerability where automated backup files are stored in a publicly accessible location, allowing attackers to read sensitive API keys (for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile) without needing to log in. This affects all versions up to 12.8.3.

OpenAI released GPT-5.4 and GPT-5.4-pro, two new AI models with a 1 million token context window (the amount of text the model can consider at once) and an August 31st, 2025 knowledge cutoff. The models are priced slightly higher than the previous GPT-5.2 family and show significant improvements on business tasks like spreadsheet modeling, achieving 87.3% accuracy compared to 68.4% for GPT-5.2.

The US Defense Department has officially labeled Anthropic (maker of Claude, an AI assistant) a 'supply-chain risk,' which will prevent defense contractors from using Claude in products made for the government. This escalates a dispute between the Pentagon and Anthropic over their policies on acceptable uses of the AI, and may lead to legal action.