AI Sec Watch

Microsoft's AI Red Team updated their taxonomy of failure modes in agentic AI systems (AI systems that can autonomously perform tasks) from v1.0 to v2.0 based on 12 months of real-world security testing. The update added seven new failure mode categories, including agentic supply chain compromise (injecting malicious instructions into tool registries), goal hijacking (redirecting an agent's objectives through disguised commands), and inter-agent trust escalation (one compromised agent deceiving others about its permissions). The revision was driven by rapid adoption of open-source agentic frameworks, widespread vulnerabilities in tool ecosystems, and the emergence of computer-use agents that interact with graphical interfaces.

OpenMeter has a SQL injection vulnerability (a flaw that lets attackers insert malicious database commands) in its meter creation endpoint. An authenticated tenant can inject arbitrary SQL through the `valueProperty` or `groupBy` fields, bypassing validation and executing commands against the shared ClickHouse database (the system that stores event data for all tenants), allowing any tenant to read or modify other tenants' metering data.

OpenAI has proposed a federal governance framework for frontier AI (the most advanced AI systems) that requires mandatory evaluations by a government body before public release, but stops short of giving regulators the power to block deployments. The proposal also includes broader requirements like third-party audits, transparency reports, incident reporting, and whistleblower protections for frontier AI developers, arguing that voluntary commitments alone are insufficient as AI systems become more capable.

A vulnerability exists in Milvus (a vector database software) versions up to 2.6.13 where the Grantee ID Hash Handler component uses weak hash (a cryptographic function that is easy to break). An attacker would need local access to the system and would face high complexity in exploiting it, though the vulnerability details have been publicly disclosed.

A security flaw in Anthropic's Claude Code GitHub Action allowed attackers to hijack repositories by opening a single malicious GitHub issue that exploited a broken permission check and indirect prompt injection (tricking an AI by hiding instructions in its input). The vulnerability let attackers steal credentials needed to gain write access to code and workflows, potentially poisoning the Claude Code Action itself for downstream projects that use it.

Agentic AI (AI systems that can take independent actions across networks) is being deployed in U.S. defense networks, but security risks are growing just as fast, especially after an unauthorized group reportedly accessed Anthropic's Claude Mythos model within hours. The article emphasizes that AI is only as trustworthy as the data it uses, the networks it connects to, and the security controls protecting it, requiring careful attention to what data enters the model, who can access it, and where the AI sends requests.

Offroad, a new startup, uses agentic AI (AI systems that can take autonomous actions) to help organizations find and fix identity risks across their systems. The company addresses a growing problem where identities (human users, machines, and AI agents) are spreading across many systems, making it difficult for security teams to manually manage access and permissions, especially as AI agents operate at scales and speeds humans cannot match.

Willow, an Israeli startup, launched a platform that manages identity and access for AI agents (autonomous systems that perform tasks independently) in enterprises, securing tools like Claude and ChatGPT through centralized control. The platform assigns verified identities to each AI agent, restricts which systems they can reach using least-privilege access (allowing only the minimum permissions needed), and detects unauthorized AI usage across a company's network. With $7 million in funding, Willow aims to let companies safely deploy AI agents without giving them unrestricted access to sensitive systems and data.

AI is making it faster for attackers to turn newly discovered vulnerabilities into working exploits, with exploitation timelines shrinking from days or weeks to just hours. Security teams are overwhelmed with too many vulnerability alerts to handle, so they need to focus on identifying which exposures actually matter by evaluating reachability (can attackers access it?), exploitability (can it be compromised?), and business impact. To address this, organizations should use AI-powered scanning tools to find complex attack chains and prioritize vulnerabilities based on real-world risk rather than just volume.