AI Sec Watch

Over 80,000 AI relay servers (intermediary computers that pass traffic between two points while hiding the original source) are being used by people in China to hide their identities while accessing advanced large language models (AI systems trained on massive amounts of text) in the United States, likely to create unauthorized copies of these models.

GPT-6 introduces an improved prompt caching system (a technique that stores repeated instructions and context to avoid reprocessing them) that achieves higher cache hit rates by default and offers developers up to 90% discounts on cached input tokens. The update includes new monitoring tools like the Prompt Caching Dashboard and diagnostics tool to help developers track cache performance and identify why cached content isn't being reused. Developers can also optimize caching by explicitly choosing which prompt sections to cache, adjusting reasoning effort without breaking the cache, and prewarming (loading context ahead of time) the cache to reduce wait times.

Rabbit has released OS3, an agentic operating system (software that can independently take actions to complete tasks) that runs in the cloud but works across Windows, Mac, and Linux devices without requiring Rabbit's R1 hardware. Users can connect up to five devices to one account, choose their preferred AI models, and access OS3 through a desktop website, messaging apps like Telegram or iMessage, or the R1 device.

LightRAG WebUI has a stored cross-site scripting (XSS) vulnerability where it renders chat answers as raw HTML without sanitization, allowing an attacker to inject malicious JavaScript through uploaded documents that executes when other users view the response. Because answer content comes from user-uploaded files and is rendered with `rehypeRaw` plugin enabled and no HTML sanitizer, an attacker can steal authentication tokens and take over the API.

The `upload_attachment` method in MCP Atlassian (a tool that connects AI agents to Atlassian software) reads and uploads any file from the server without checking if the file path is safe, while the download methods correctly use a safety check called `validate_safe_path()`. This means an AI agent or attacker could read sensitive files like SSH keys, passwords, or credentials and steal them by uploading them to Confluence.

The MCP Atlassian tool for Jira and Confluence has a vulnerability where the file upload functions accept file paths controlled by the caller and read those files from the server's local filesystem before uploading them as attachments. This means an attacker using the tool can trick the server into reading and uploading any file the server process can access, especially in HTTP or multi-user deployments where the caller and server are separate security boundaries.

The `mcp-atlassian` tool has a path traversal vulnerability (CWE-22, a weakness that lets attackers access files outside intended directories) in its `confluence_upload_attachment` function. An attacker can read any file the server can access by passing an arbitrary file path, then upload that file to an attacker-controlled server. This is especially dangerous because the default setup exposes the tool over the network without authentication, making it remotely exploitable.

The upload attachment tools in MCP Atlassian (a system that connects AI assistants to Atlassian software) accept file paths without validation, allowing an authenticated user or an AI tricked via prompt injection (hidden instructions in text) to read and upload any file from the server to Confluence or Jira. The code has a validate_safe_path function that protects downloads but does not use it for uploads, creating a security gap.

Anthropic and OpenAI released cheaper AI models this week, with OpenAI introducing GPT-6 Sol and GPT-6 Luna at 50% lower API prices (the cost to use them through their services), and Anthropic launching Claude Opus 5.5, which uses fewer tokens (the small chunks of text the AI processes) and costs about 40% less than the previous version. These releases come despite recent industry calls for slowing down advanced AI development, as both companies face competition from cheaper alternatives and customer demand for more cost-effective models.