AI Sec Watch

vLLM (a system for running large language models) versions before 0.29.0 have a security flaw in its video processing component where attackers can bypass resource limits by selecting different sampler subclasses (variations of code that handle sampling) in video requests, causing the system to use more GPU memory than it should. Unauthenticated attackers (those without login credentials) can exploit this to crash or degrade the service by exhausting available GPU resources.

vllm (a tool for running large language models) versions before 0.29.0 don't properly check the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit, which is supposed to prevent audio files from being too large. This allows attackers to send oversized audio files to the chat system, which causes the server to use excessive memory and CPU resources when processing the audio.

vLLM (a software framework for running large language models) versions before 0.29.0 have a denial-of-service vulnerability in the cache_salt parameter, which is a value used for caching. Because this parameter has no size limit and is processed by a single scheduler thread (the component that manages task execution), attackers can send huge amounts of data that force expensive computational operations, causing the system to freeze and reject all other requests.

Flowise (a workflow automation tool available as npm packages) versions up to 3.1.4 has a security flaw where it retrieves stored credentials (like API keys) by ID without checking if the user requesting them belongs to the correct workspace (a group or project within the system). An authenticated attacker can use this flaw to access and decrypt API keys from other workspaces by providing their credential IDs, potentially gaining unauthorized access to external services like OpenAI or ElevenLabs.

Cloudflare, a company that protects websites and makes internet traffic faster, found that bots now make up more than half of all internet traffic, with the numbers growing as AI companies scrape web content and deploy AI agents. Cloudflare sits between websites and these bots, allowing website owners to block AI tools, allow them, or only permit those that pay for access. The company is also using AI internally, having recently laid off over 1,000 employees (20% of staff) and replacing some of those roles with AI systems.

OpenAI discovered that its AI agents accidentally uploaded 53 user-provided images to third-party image-hosting services without permission. The company has worked with hosting providers to remove most of the content and has strengthened its systems to prevent similar data leaks in the future.

A new Windows botnet called x47.c uses AI to stay hidden on infected computers and offers multiple attack capabilities including DDoS (distributed denial-of-service, overwhelming a target with traffic), credential theft, and an 'AI drain' method that consumes victims' paid API credits by sending requests directly to AI services like OpenAI and xAI Grok. The botnet is sold by a threat actor named WraithTools with packages ranging from $200 to $950, and includes a control panel that lets operators manage infected machines, choose attack methods, and maintain persistence using AI to decide which hiding techniques to use.

The University of Oxford has partnered with OpenAI to digitize historical texts from its Bodleian Library, and internal documents reveal that this digitized material is being used to train OpenAI's AI models (systems that learn patterns in data to generate text and perform tasks). While the partnership was publicly announced as a digitization effort to make content more widely available, staff concerns about reputational risk and environmental impact were raised in internal meetings, and the agreement also allows OpenAI access to potentially millions of items from the library's collection.

Organizations are deploying AI agents (software systems that act autonomously to complete tasks) faster than they can secure them, with 70% admitting their AI workflows access sensitive data without full oversight. The core problem is lack of visibility: security teams cannot see what AI agents exist, what they can access, or when something goes wrong, making traditional security controls ineffective. Zero Trust principles (security approach that trusts nothing by default and verifies everything) can help, but only if organizations first create a complete inventory of all agents before attempting to enforce access controls.