AI Sec Watch

Kiro IDE, an AI-powered development tool, had a security flaw in versions before 0.11.133 where authentication token cache files (files storing login credentials) were saved with world-readable permissions on macOS and Linux, meaning any user or process on the same computer could read them instead of just the owner.

The Trump administration ordered Anthropic to take its newest AI models offline and block access for all foreign nationals, including the company's own international employees. This incident highlights how the US government can control access to advanced AI technology, even for American companies, raising concerns about global AI development being dominated by American political decisions.

The U.S. government ordered AI company Anthropic to disable access to its latest AI models, Fable 5 and Mythos 5, citing national security concerns about a potential jailbreak (a method to bypass safety restrictions). Anthropic complied by shutting down access for all users, and senior staff are meeting with Trump administration officials to resolve the dispute, which follows earlier government actions restricting defense contractors from using Anthropic's technology.

Anthropic, an AI company, is meeting with US government officials after releasing Fable 5 and Mythos 5, new versions of its Claude Mythos AI model, which the government suspended due to national security concerns. The government discovered a potential jailbreak (a method to make an AI tool do something unintended) in the publicly available version shortly after release, and Anthropic reported receiving only verbal evidence of the vulnerability so far.

Tech company lobbyists in Washington have been pushing for preemption, a comprehensive federal law that would create one set of AI rules across the entire country instead of having different regulations in each state. Their efforts have faced political obstacles and public backlash, and they worry that after upcoming elections, Congress may have more Democrats who are unwilling to support their proposals.

Salesforce is acquiring Fin (formerly Intercom), an AI customer service platform, for $3.6 billion to strengthen its agentic AI (autonomous artificial intelligence agents that can independently handle tasks) offerings. Fin's main product is an AI agent powered by a proprietary model called Apex that can resolve customer inquiries across multiple channels including chat, email, WhatsApp, and Slack. This acquisition reflects how software companies are competing to invest in more autonomous AI technologies as businesses increasingly demand agentic solutions.

LiteLLM, a widely-used open-source AI gateway (a system that routes AI requests to multiple providers), has a critical vulnerability chain (CVSS score of 9.9, meaning extremely severe) that lets low-privilege users gain full admin control and run code on the server. The three bugs work together: an authorization bypass (CVE-2026-47101) that lets users create keys with unlimited access, a privilege escalation (CVE-2026-47102) that promotes users to admin, and a sandbox escape (CVE-2026-40217) that executes arbitrary code. This compromise exposes all provider API keys, encrypted credentials, and all prompts and responses passing through the gateway, plus allows attackers to alter AI responses in transit.

The U.S. government ordered Anthropic to restrict exports of its Fable and Mythos AI models (advanced models designed to find security vulnerabilities), citing national security concerns, which prompted Anthropic to suspend worldwide access to these models. Dozens of prominent cybersecurity experts published an open letter arguing this ban is dangerous because it removes powerful security tools from defenders while adversaries continue advancing, and they claim the vulnerability that justified the ban can be replicated in other widely available AI models like OpenAI's GPT-5.5 and Claude Opus 4.8.

A critical flaw in Microsoft 365 Copilot Enterprise Search could let attackers steal emails, calendar details, and multi-factor authentication codes with a single click on a malicious link. Researchers discovered that three chained bugs, including parameter-to-prompt injection (tricking the AI by hiding instructions in a URL parameter), a timing flaw in how responses are filtered, and a Content Security Policy allowlist for Bing, allowed attackers to extract sensitive data without the user entering any passwords or clicking again.