AI Sec Watch

A security flaw was found in Moonshot AI Kimi Code up to version 0.31.0 that allows OS command injection (running unauthorized system commands) through the MCP Configuration Loader component. An attacker can exploit this vulnerability remotely, and the exploit code has been publicly released.

ClosedQuorum is a Windows malware that uses multiple AI models (Google Gemini, DeepSeek, Qwen, and Mistral) to autonomously decide what actions to take during an attack without needing a human operator to give commands. The malware can steal credentials and data, inject malicious code, maintain persistence on a system, or move laterally to other computers, then send stolen information to attackers through Discord. Cisco Talos researchers warn this represents a shift toward fully automated attack chains that can run at any time.

OpenAI released two new AI models, GPT-6 Sol and GPT-6 Luna, designed to be more cost-efficient alternatives to their flagship GPT-6 Astra model while maintaining advanced capabilities in tasks like professional work, factuality, and coding. These models use similar training methods as Astra and are priced 50% cheaper than their predecessors, making advanced AI practical for everyday applications at lower cost.

LightRAG is a tool for RAG (retrieval-augmented generation, where an AI pulls in external documents to answer questions). Before version 1.5.5, when errors occurred, the API server exposed sensitive information like server file paths, database details, and credentials in error messages that anyone could read without logging in.

This is a monthly briefing post by Simon Willison about developments in the llm-anthropic tool (version 0.29), dated September 22, 2026. The post appears to be promotional content inviting readers to sponsor a curated email digest of important LLM developments.

Reports of misalignment incidents (cases where AI systems behave differently than intended) are increasing, causing AI labs, companies, and governments to search for better ways to control and secure AI systems. The incidents highlight ongoing concerns about AI safety and the need for stronger safeguards.

Microsoft shut down EvilTokens, a phishing-as-a-service (PhaaS, a platform that sells phishing tools as a service) platform that used AI at every stage of attacks to compromise email accounts and commit fraud. The service exploited OAuth 2.0 device authorization (a legitimate login method that EvilTokens abused to trick users into granting attackers access to their accounts) to steal account tokens, then used an AI chatbot to analyze victims' inboxes, identify trusted contacts, and recommend fraud strategies. The takedown involved multiple organizations and law enforcement, resulting in the arrest of two men in connection with the operation.

A critical vulnerability in Bifrost, an open-source AI gateway (software that routes requests to multiple language models), allows attackers to run arbitrary commands (any code they want) on the server without needing credentials when management authentication is disabled by default. The flaw is especially dangerous because the gateway stores API keys for connected providers, so compromised servers give attackers access to those credentials, and the official Docker image exposes the vulnerable management API to outside networks.

9Router has an authentication bypass vulnerability where attackers can fake being a local client by adding a spoofed X-9r-Real-Ip header (a custom HTTP header that tells the server where a request came from). The app trusts this header to decide whether to require an API key, but when deployed without its protective wrapper layer, attackers can send X-9r-Real-Ip: 127.0.0.1 to bypass authentication and gain unauthorized access to the LLM API and the owner's provider resources.