AI Sec Watch

OpenAI is shifting its focus toward enterprise customers and preparing to go public, while Google and Apple are competing to bring AI features directly to everyday consumers through their existing devices and services. Google and Apple can afford to offer consumer AI for free to keep users in their ecosystems, whereas OpenAI and Anthropic are pursuing profitable enterprise deals with companies willing to pay for AI tools like code-generation software.

Anthropic apologized for secretly adding hidden guardrails (safety restrictions that limit what an AI model can do) to Claude Fable 5, which prevented researchers and competitors from fully using the model. The company says it will now be more transparent about when these restrictions activate, even if it means the model refuses more user requests.

Google DeepMind and partner organizations are funding $10 million in research to understand the risks of multi-agent systems (multiple AI agents working together), because deploying millions of these agents could create new security threats like scams and prompt injection attacks (where an AI agent is manipulated by hidden malicious instructions). The researchers plan to study these risks by running realistic simulations where AI agents interact in controlled environments called sandboxes, since predicting behavior from studying single agents alone is insufficient.

vLLM (an open-source tool for running large language models) versions 0.8.0 and later have a vulnerability where attackers can crash the server by sending a single request with thousands of video frames packed into one data URL. The vulnerability exists because the code that processes video frames doesn't limit how many frames it will try to load into memory, so an attacker can force it to decode so many frames that the server runs out of memory and stops working.

AI agents (programs that perform tasks automatically) can install third-party skills (add-on packages, like apps on a phone) from public registries, but until now there was no automated way to check if a skill actually does what it claims before it gains access to sensitive data and system commands. Researchers introduced Behavioral Integrity Verification (BIV), a tool that compares what a skill says it does (in its documentation and metadata) against what its code actually does, and found that most skills deviate from their claims, with some containing dangerous multi-stage attack chains (sequences of seemingly harmless capabilities combined to steal credentials, execute unauthorized commands, or secretly extract data).

Site reliability engineering (SRE) teams should only trust AI agents in production when they have three foundational elements: grounded observability (complete logs, traces, and ownership data that the AI can reason over), clear guardrails (explicit permission models and approval gates that limit what the agent can do), and a progressive autonomy approach (starting with read-only tasks like summarizing incidents before allowing automated actions). Trust in AI for operations is earned through evidence of reliable behavior under real stress, not through impressive demos.

Advanced AI models like Claude Mythos and GPT-5.5 make it much faster and easier for attackers to discover vulnerabilities (security weaknesses in software) and chain them together at scale, forcing cybersecurity teams to rethink their defenses. Security experts warn that defenders should assume AI will increase the likelihood of initial compromise and should focus on limiting damage through stronger identity controls, least privilege (giving users only the minimum access they need), and internal segmentation (dividing networks into isolated sections) rather than trying to patch every vulnerability perfectly.

A vulnerability in Spring Web Services allows attackers to exploit XML parsing by sending malicious XML to applications that evaluate XPath expressions. The flaw occurs because the software uses Java's default XML parser instead of Spring's safer parser configuration, making it susceptible to XXE attacks (XML External Entity attacks, where attackers embed malicious references in XML files to access unauthorized data or execute commands).

Anthropic reversed a policy in Claude Fable 5 that secretly blocked requests related to frontier LLM development (cutting-edge AI research) without telling users. The company acknowledged the hidden approach was wrong and apologized, stating they prioritized speed over transparency.