AI Sec Watch

Coinbase launched a tool called Coinbase for Agents that allows AI agents (software programs that can make decisions and take actions automatically) like ChatGPT or Claude to execute cryptocurrency trades and make payments on behalf of users using natural language instructions. The tool uses Coinbase's x402 machine-to-machine payments protocol (a system that lets AI agents pay for digital services directly without human involvement) and is expected to expand to stock trading and other financial activities, positioning AI agents as primary economic actors on the internet.

OpenAI announced it is acquiring Ona, a startup that provides secure cloud environments where AI agents (software that independently completes tasks for users) can access tools and information. Ona's technology will enable OpenAI's Codex coding assistant to handle longer-running tasks and help more organizations deploy AI agents into production. The acquisition reflects OpenAI's ongoing investment in Codex, which now has over 5 million weekly active users, as it competes with rival companies like Anthropic.

IBM Langflow OSS versions 1.0.0 through 1.9.1 have a security flaw where authenticated users (those already logged in) can bypass proper access controls using insecure direct object references (IDOR, where an attacker can access other users' data by guessing or modifying object identifiers in requests), allowing them to read or modify sensitive information they shouldn't have access to.

IBM Langflow Desktop versions 1.0.0 through 1.9.2 has a vulnerability called SSRF (server-side request forgery, where an attacker tricks the server into making unauthorized requests on their behalf). An authenticated attacker could use this to perform unauthorized network requests from the system, potentially discovering network information or launching further attacks.

A former engineer at xAI (Elon Musk's AI company) filed a lawsuit claiming he was illegally fired for trying to implement safety mechanisms, known as guardrails (built-in limitations to prevent harmful outputs), on the Grok chatbot. The engineer, Devin Kim, alleges that his efforts to address AI safety risks led to retaliation from company leadership.

Check Point, a security company, has joined OpenAI's Trusted Access for Cyber (TAC) program and Daybreak initiative, which gives vetted security organizations access to OpenAI's AI models for defensive operations. The program aims to help security teams catch threats faster, investigate incidents more accurately, and trust their AI-assisted security results. This represents Check Point's commitment to carefully integrating AI into their security defenses and customer protections.

Keras versions before 3.14.0 have a path traversal vulnerability (a security flaw where attackers can access files outside the intended directory) in its archive extraction utilities because the safety checks compare paths against the current working directory instead of the actual extraction destination. When running in environments like Docker containers where the current working directory is set to the filesystem root, attackers can bypass these checks and write malicious files anywhere on the system, potentially compromising configurations, code, and machine learning data.

Netty's RedisArrayAggregator handler has a bug where it leaks pooled direct-memory buffers (reusable chunks of memory managed by the JVM) when a Redis pipeline connection closes before finishing. The handler doesn't clean up its internal state properly, so buffers can't be returned to the shared memory pool, and repeated connection closures eventually cause all network operations in the program to fail due to memory exhaustion.

This bulletin covers multiple serious threats including 3.3 billion stolen credentials from infostealer malware (malware designed to steal passwords and login information), a $5,000-per-month RAT (remote access trojan, malware that lets attackers control a victim's computer) called SilabRAT that clones browser profiles to steal financial data, and a North Korean group conducting hands-on intrusions (attacks where human operators directly control compromised systems) against tech companies. The U.S. Department of Justice also seized 13 domains used to trick government employees into revealing classified information through fake job offers.