AI Sec Watch

An authenticated user in n8n (a workflow automation platform) could bypass the AST validator (a security check that analyzes code structure) in the Python Code node and access restricted modules, potentially exposing environment variables (configuration data stored by the system) on self-hosted instances. This vulnerability only affects instances with the Python Task Runner enabled.

n8n (a workflow automation tool) has a stored XSS vulnerability (cross-site scripting, where malicious code is saved and runs when users visit a page) in its Chat Trigger feature. An authenticated user with edit access could inject harmful JavaScript code that executes with the privileges of anyone who visits the chat URL, potentially compromising their session.

n8n, a workflow automation tool, has a reflected XSS vulnerability (a type of attack where malicious code is injected into a webpage and executed in a user's browser) in its Facebook, WhatsApp, and Microsoft Teams trigger endpoints. When a logged-in user visits a specially crafted URL, an unsanitized query parameter gets reflected back in the response, allowing an attacker to run arbitrary code in the user's browser within n8n's origin.

A vulnerability in n8n (a workflow automation tool) allows authenticated users to perform prototype pollution (a type of attack that modifies the base object all objects inherit from) through the Microsoft SQL node by providing a specially crafted table parameter. This attack can completely break the n8n instance by causing validation failures across the entire application until the server is restarted.

Anthropic shut down access to its Fable 5 and Mythos 5 AI models to comply with U.S. export control directives citing national security concerns, forcing all customers to lose access immediately. This incident highlighted a key risk for companies relying on closed-source AI models (proprietary systems run by companies rather than made publicly available), driving increased interest in open-source alternatives (AI models whose code is publicly available and can be downloaded and run on a company's own servers) that companies can control themselves.

Databricks is experiencing rapid revenue growth of over 80% as businesses use its data analytics tools, but profit margins are shrinking because AI agents (software programs that can perform tasks autonomously) are generating many more queries and consuming more resources. The company is addressing cost concerns by offering tools like Unity AI Gateway that help customers monitor their spending on AI tokens (units of text that language models process), allowing them to use expensive advanced models for important tasks while switching to cheaper open-source models for routine work.

Security experts have publicly objected to US export restrictions placed on Anthropic's Claude Fable 5 and Mythos 5 AI models, calling for the government to lift these bans. The criticism comes from an open letter signed by dozens of security professionals who believe these restrictions should be reversed.

Crawl4AI's Docker API server had two security flaws that let attackers steal secrets. First, attackers could change where the server sent LLM (large language model) requests by controlling a `base_url` parameter, causing the server to send its API keys to an attacker's server. Second, attackers could read any environment variable (including passwords and secret keys) from the server by using the `env:` syntax in configuration, then combine this with the first flaw to steal those secrets. Since the Docker API required no authentication by default, anyone could exploit these flaws.

Crawl4AI's Docker API had a security flaw in its SSRF protection (a filter meant to block requests to internal servers). An attacker could bypass this filter by encoding internal IP addresses using IPv6 transition forms like NAT64, 6to4, or IPv4-mapped addresses, potentially accessing internal services and cloud metadata endpoints without needing credentials.