AI Sec Watch

Despite excitement about generative AI transforming filmmaking, current AI video models can only produce short clips with inconsistent visuals, and several major Hollywood-AI partnerships have ended, suggesting studios cannot yet depend on this technology for professional entertainment products.

The US government issued an export control directive requiring Anthropic to block access to its two most advanced AI models, Fable 5 and Mythos 5, for all foreign nationals worldwide, citing national security concerns. Anthropic complied by suspending these models for all users globally, though the company disputes the government's reasoning, which appears related to a reported jailbreak (a method to bypass the model's safety restrictions) that Anthropic says it reviewed and found to be minor and not unique to their system.

Anthropic took its latest AI models, Fable 5 and Mythos 5, offline after receiving a directive from the U.S. government to comply with new export controls (restrictions on who can access advanced technology) that prevent foreign nationals from using them. The company disagreed with how the government handled the order, saying it lacked transparency and technical justification, and expressed hope to restore access soon.

The U.S. government ordered Anthropic to suspend access to its advanced AI models Claude Fable 5 and Mythos 5 for all foreign nationals due to national security concerns, citing a discovered method of bypassing (jailbreaking, or tricking the AI's safety rules) these models. Anthropic disputed the order, arguing that the vulnerabilities identified are minor and already known, that its safety systems are robust, and that perfect jailbreak resistance is impossible for any AI company.

Anthropic disabled access to its Fable 5 and Mythos 5 AI models after receiving a U.S. government order citing national security concerns and export control restrictions, preventing foreign nationals from using them whether inside or outside the United States. The company immediately suspended the models for all customers to ensure compliance, though other Anthropic models remain available. Anthropic stated the government did not provide specific details about the security concern and said the action did not follow transparent or fair procedures.

OpenAI says it will work constructively with state attorneys general who are investigating the company over concerns about advertising, data handling, and potential harms to minors and seniors. The investigation comes amid multiple lawsuits against OpenAI, including cases where families allege ChatGPT (a conversational AI chatbot) was misused to cause harm, and as the company prepares for a public stock offering.

OpenAI released a new model called GPT-Realtime-2 for their WebRTC API (a protocol for real-time audio communication in web browsers), which offers improved reasoning capabilities with knowledge through September 2024. A developer updated their audio conversation tool to support this new model and added the ability to paste document context, allowing users to have voice conversations in their browser about custom information.

AgenticMail, a tool that allows AI agents to access email and phone services, has a security flaw in versions before 0.9.27 where the /mcp endpoint (a communication interface) accepts requests without requiring authentication (verification of identity) when started in HTTP mode. This means a remote attacker could connect to the service and use its tools directly to access real email addresses and phone numbers.

Parse Server, an open source backend framework that runs on Node.js, has a vulnerability where attackers can send specially crafted HTTP requests that cause the server to spend seconds or minutes processing a single request before checking user permissions or rate limits. An attacker only needs to know the application's public ID and can overload the server by sending a few concurrent requests or one large request, making it slow or unresponsive for legitimate users.