AI Sec Watch

A sandbox escape vulnerability in nono (a sandboxing tool using Landlock/seccomp, which are Linux security features that restrict what programs can do) allows processes running inside the sandbox to break out by communicating with systemd D-Bus sockets (the inter-process communication system that manages user services). An AI agent or untrusted tool with bash access could exploit this to write files or run commands outside the sandbox with the user's permissions.

vLLM version 0.14.1 has a security flaw where a setting called `trust_remote_code` is permanently turned on in two model files, even when users try to turn it off. This allows RCE (remote code execution, where attackers can run harmful code on your computer) through malicious models downloaded from HuggingFace, a popular model repository. This is a partial fix attempt for two earlier vulnerabilities that didn't fully solve the problem.

GreyVibe is a Russia-linked hacking group that uses AI tools like ChatGPT and Google Gemini across all stages of attacks, from creating fake websites to building custom malware, targeting Ukrainian military and government entities since August 2025. Although the group appears less sophisticated than elite state actors (evidenced by design flaws in their AI-generated malware and casual naming conventions), they leverage AI to operate at a much higher capability level than their technical skill would normally allow. Researchers expect GreyVibe's AI expertise and attack complexity to continue increasing over time.

OpenTelemetry Go's `ParseFile` function has a file descriptor leak (a reference to an open file that is never closed), where each call to parse a schema file leaves the file open in memory. In a long-running application that repeatedly parses schema files, these open files can accumulate until the process runs out of available file descriptors and crashes, causing a denial of service (unavailability).

Geordie, an AI security startup, raised $30 million to expand its platform that helps organizations monitor and control AI agents (AI systems designed to complete tasks independently) deployed across their systems. The platform provides real-time visibility into agent behavior and risks, while its Beam tool uses context engineering (a technique that shapes how AI systems understand and respond to instructions) to constrain agent behavior at scale.

A removed safety check in OpenTelemetry Go's baggage parsing (the mechanism for passing contextual data between services) allows attackers to send extremely large or malformed baggage headers that consume excessive CPU and memory while being fully processed and logged, creating a denial-of-service vulnerability. The parser no longer rejects oversized inputs upfront and instead processes every invalid member completely, sending errors to the logging system by default.

Anthropic is releasing Claude Opus 4.8, a new AI model designed to be more 'honest' by better recognizing when it doesn't have enough information to answer confidently. The model addresses a common problem where AI systems make unsupported claims (stating things as fact without solid evidence), and early testers found that Opus 4.8 is about 4 times less likely to do this compared to its predecessor.

AI agents (AI systems that can take actions by using external software tools) aren't inherently dangerous, but the risk comes from how they're set up and deployed in organizations. The main concern is the overlap between what the AI can do and what tools it has access to, which can create security vulnerabilities if not managed carefully.

Apple is planning a major redesign of Siri, its voice assistant, for iOS 27, which may feature a ChatGPT-like chat interface. The redesign shows a pill-shaped chat bubble that appears from the Dynamic Island (the notch area on iPhones) with options to choose between Ask, Siri, and ChatGPT, though Apple has not officially confirmed these details and the final design may differ.