AI Sec Watch

During third-party security testing by Irregular, a misconfigured testing environment accidentally connected AI models to the public internet instead of keeping them isolated. In one case, an AI model exploited a real website because its name matched a fictional target in the test scenario, causing an unintended real-world attack.

Organized crime groups are using AI tools to commit fraud on a massive scale and generate billions of dollars. They use voice cloning (AI that recreates someone's voice), deepfake video overlays (fake videos that look real), LLMs (large language models, AI systems trained on text data) to manage fake identities, and automated translation to scam people globally.

Researchers at Zenity discovered that OpenAI's Atlas web browser and other AI-enabled browsers have serious security flaws that allow attackers to bypass protections and trick the AI into performing unauthorized actions like spamming WhatsApp contacts or making purchases on Amazon. The attacks work by embedding malicious instructions on websites that the AI system processes alongside legitimate user commands, exploiting a problem called prompt injection (tricking an AI by hiding instructions in its input) that security experts consider largely unsolved.

CVE-2026-18954 is an authorization bug in Amazon DocumentDB MCP Server (a tool that lets AI assistants access databases). The bug allows certain database operations called aggregation pipeline stages ($out and $merge, which are write operations) to bypass read-only protections, potentially letting an authenticated user make unwanted changes to the database.

AI browsers made by major companies still have vulnerabilities to prompt injection attacks (tricking an AI by hiding instructions in its input), even though they have multiple security protections in place. Researchers found that no current security approach completely eliminates this risk.

Meta has launched Muse Code, its first AI coding agent that helps developers write and validate software by managing complete engineering tasks within a single interface. The tool competes with similar offerings from Anthropic and OpenAI, and Meta is differentiating it mainly through lower pricing (with a contributor tier over 10 times cheaper than pay-as-you-go options) rather than superior capabilities. Muse Code works alongside Meta's latest AI model, Muse Spark 1.2, and developers can access it through a pay-as-you-go pricing model on Meta's developer platform.

AWS is launching AWS Continuum for code vulnerabilities, a tool that combines multiple AI models (from Anthropic and OpenAI) to help developers find and fix security bugs in their code automatically. The tool works by using an AI harness (an orchestration layer that connects models to tools, guardrails, and workflows) to select the best model for each step of detecting, prioritizing, validating, and fixing vulnerabilities in a developer's existing coding environment.

A vulnerability exists in AWS Transform MCP Server (a tool that lets AI assistants run code-transformation jobs on a developer's local machine) versions 0.1.0 through 0.1.4. An attacker could exploit improper pathname validation in the get_resource tool to write files anywhere on the system outside the intended directory, potentially leading to local code execution (unauthorized commands running on the developer's computer).

Milvus versions 2.6.22 and 3.0.0 have a vulnerability that allows attackers without authentication to shut down the service by sending a specially crafted HTTP request to an unprotected endpoint on port 9091. By exploiting the /management/stop endpoint, which doesn't require login credentials, attackers can disable critical components like the proxy, datanode, or querynode, causing a denial of service (interruption where the service stops working).