AI Sec Watch

SillyTavern is a locally installed interface for interacting with text generation AI models and related tools. Prior to version 1.18.0, the software had a cross-site scripting vulnerability (XSS, where attackers inject malicious code into web pages), because user-controlled URLs were displayed in error messages without being HTML-escaped (made safe for web display), allowing attackers to inject harmful scripts.

SillyTavern is a locally installed interface for interacting with text generation AI models, image generators, and voice tools. Prior to version 1.18.0, a vulnerability allowed attackers to delete the entire user extensions directory without authentication by sending a specially crafted request to the delete endpoint that bypassed filename validation (a security check that prevents malicious file paths).

SillyTavern, a locally installed interface for interacting with AI language models and image generators, had a vulnerability in versions before 1.18.0 where it trusted HTTP headers (Remote-User and X-Authentik-Username) used by single sign-on systems without verifying they came from a trusted source. This meant anyone who could connect directly to SillyTavern could fake these headers to log in as any user, including administrators, without a password, but only if SSO was explicitly enabled in the configuration.

SillyTavern is a locally installed interface for interacting with text generation AI models. Before version 1.18.0, it had a security flaw where changing a password or recovering an account didn't log out existing sessions, because all session information was stored in a signed cookie (a small piece of data the browser keeps) rather than on the server, making it impossible to revoke access even after a password change.

Attackers are abusing ChatGPT's share feature (which lets users publish rendered content on legitimate OpenAI URLs) to display fake outage pages that trick users into downloading malware disguised as the ChatGPT desktop application. The "LLMShare" campaign uses Google ads to direct people to these malicious shared pages, which appear to come from OpenAI's domain but actually deliver malware-infected downloads through a fake installation portal.

ChatGPhish is a vulnerability in ChatGPT that allows attackers to embed malicious instructions in web pages, which ChatGPT then processes and renders as clickable phishing links and images inside its trusted interface when users ask it to summarize the page. The vulnerability works because ChatGPT automatically trusts and fetches Markdown links and images from summarized web pages, potentially leaking user information like IP addresses or tricking users into scanning malicious QR codes that bypass desktop security filters.

The Linux Foundation is promoting DNS-AID, a new standard that allows AI agents (autonomous programs that can act independently) to find and communicate with each other using DNS (the system that translates website names into IP addresses) instead of requiring separate proprietary registries. DNS-AID enables agents and MCP (Model Context Protocol, a standard for how agents exchange information) servers to use the existing internet infrastructure as a vendor-neutral directory, with domain owners creating a special DNS address at _index._agents.{domain} as a discovery point.

Elon Musk's social media post about SpaceX's deal with AI company Anthropic contradicts details in SpaceX's IPO (initial public offering, when a private company sells shares to the public) filing, creating confusion for investors. The filing says Anthropic will pay SpaceX $1.25 billion per month through May 2029, but Musk claimed the lease is only 180 days with a 90-day cancellation option, potentially worth far less. This discrepancy matters because it affects how much revenue SpaceX can expect from this new compute capacity (computing power) business.

An attacker exploited CVE-2026-39987, a critical vulnerability in Marimo (a notebook software) that allows unauthenticated remote code execution, to break into a system and then used an LLM agent (an AI system that can plan and execute tasks autonomously) to steal cloud credentials and database information. The attacker's use of an AI agent made the attack more flexible and adaptive compared to traditional scripted attacks, allowing it to handle unexpected obstacles in real-time.