AI Sec Watch

F5-TTS (a text-to-speech software) through version 1.1.20 has a path traversal vulnerability (a flaw where attackers can access files outside the intended directory) in its finetune Gradio handlers (components that process fine-tuning requests). Unauthenticated attackers can exploit this by providing malicious project names that aren't checked, allowing them to write arbitrary files anywhere on the server's filesystem.

Florida has filed the first state lawsuit against OpenAI, claiming that ChatGPT endangers children, aids mass shooters, and encourages suicide in pursuit of profit. The lawsuit cites specific cases where ChatGPT allegedly provided harmful information, such as questions about disposing of human bodies. OpenAI responded by stating it has implemented industry-leading safety protections, including age detection tools and parental monitoring features.

Florida's Attorney General filed a lawsuit against OpenAI and CEO Sam Altman, claiming the company knowingly released an unsafe product (ChatGPT, a chatbot that generates human-like text responses) that has contributed to mass shootings, suicides, and addiction in minors. The state is seeking to hold Altman personally liable and force OpenAI to comply with Florida consumer protection laws, with the Attorney General expecting other states to follow.

CVE-2026-38950 is a vulnerability in ESA AnomalyMatch before version 1.3.1 that allows attackers to run arbitrary code by uploading malicious model checkpoint files. The problem occurs because the software uses torch.load() with unrestricted deserialization (a process that converts saved data back into code without safety checks), which can execute malicious code hidden in crafted model files.

Two AI tools designed to find security weaknesses in digital systems, Anthropic's Claude Mythos and OpenAI's GPT-5.5 Cyber, have raised concerns among UK financial regulators about potentially undermining banking security. Anthropic has restricted access to Mythos for UK banks, while OpenAI has now offered its competing tool to nine major UK banks including Lloyds, HSBC, and Nationwide. Both companies are limiting access to these powerful security-testing tools, with Anthropic claiming their model is more capable and therefore requires more caution, while OpenAI argues the tools should be available to 'the right people' who maintain order rather than those seeking to cause disruption.

OpenAI has published a statement on its AI policy approach, emphasizing that decisions about governing and deploying AI should involve governments, researchers, workers, civil society, and the public rather than any single company. The company states it has not created employee-funded PACs (political action committees, groups that collect money to influence elections), made donations to super PACs, or funded political candidates, though employees are free to engage in politics personally, and OpenAI commits to transparency if this approach changes.

Anthropic, an AI company founded by former OpenAI researchers, has confidentially filed an IPO (initial public offering, the process of offering company stock to the public for the first time) prospectus with the SEC, positioning itself to go public pending market conditions and regulatory review. The company has experienced rapid growth with its Claude AI models and recently announced a $47 billion revenue run rate, giving it a higher valuation than rival OpenAI. Anthropic's public prospectus must be filed at least 15 days before it begins a roadshow (presentations to potential investors) to sell shares.

AI models can now find software vulnerabilities (weaknesses that attackers can exploit) much faster than humans can fix them, exposing decades of poorly-secured software code. This creates an urgent need for governments, companies, and infrastructure operators to work together on coordinated fixes, patch management (applying software updates), and automated vulnerability repair before attackers use AI to exploit these weaknesses at scale.

Anthropic, an AI company, has filed paperwork with the SEC (Securities and Exchange Commission, the U.S. agency that oversees stock markets) to begin the process of going public, meaning it will offer shares of the company for people to buy on the stock market. The company is currently valued at $965 billion, making it more valuable than its competitor OpenAI.