AI Sec Watch

MUFG, one of Japan's largest financial groups, is partnering with OpenAI to become an AI-native company (an organization where AI is integrated into everyday work processes) by rolling out ChatGPT Enterprise to approximately 35,000 employees at Mitsubishi UFJ Bank starting in 2026. The bank chose ChatGPT Enterprise for its broad applicability and enterprise-grade security (security features designed for large organizations), and paired the technology rollout with mandatory employee training, custom workshops, and guidance to help workers understand how to use AI confidently and in compliance with financial regulations.

Governments and private companies must quickly adapt their security practices as adversaries use AI to evade financial sanctions and finance weapons of mass destruction, with countries like North Korea and Iran now deploying AI models to create fraudulent documents, manage fake company networks, and hide cryptocurrency transactions. AI is making these illegal activities faster, higher quality, and more coordinated, shifting from AI-assisted evasion (using AI for individual tasks like writing emails) to AI-enabled evasion (where AI orchestrates entire deception schemes across multiple systems and channels). Enterprise IT managers face a critical challenge because traditional security boundaries designed for human attackers are being bypassed by automated technologies.

Cybercriminals are increasingly using data theft and extortion without encryption (ransomware, a type of malware that locks files until payment is made), shifting from the 90% encryption rates seen in 2021-2024 to just 78% in 2025. This change is driven by better backup systems, stricter regulations like GDPR's 72-hour reporting requirement, and the fact that data exposure alone now costs organizations an average of $5.08 million in fines and lawsuits. Threat actors are particularly targeting mid-sized firms in Professional Services, Healthcare, and Construction, focusing on valuable business data like financial records and bids.

A Cisco study found that popular AI models from OpenAI, Anthropic, Google, and others are much more vulnerable to attack when faced with multiple prompts in a conversation compared to single-prompt tests. Current safety benchmarks (standardized tests that measure how well models resist harmful requests) only test models with one prompt at a time, but real attackers use iterative techniques like role-playing, breaking tasks into smaller steps, and gradually escalating requests across multiple turns, which bypass safety guardrails far more effectively than official scores suggest.

claude-code-cache-fix is a tool that speeds up Claude Code by caching results. Versions 3.5.0 through 3.5.1 have a code injection vulnerability (CWE-94, inserting malicious code into a program) in a file called tools/quota-statusline.sh, where user input containing certain byte sequences (''') can break out of a Python string and execute arbitrary code on the user's system. This is a high-severity bug that affects local attackers who can control the input to Claude Code.

ATLAS v2026.05 introduces a major structural overhaul that separates versioning for content updates from format changes, moving to a new YAML format (v6.0.0) with improved consistency and relationship handling. The update adds support for multiple AI platforms (Predictive, Generative, Agentic, and Enterprise) to techniques and introduces new tooling including Pydantic schemas (strict data validation), SQLAlchemy ORM models (database storage), and a FastAPI REST API (web service for managing the data). Historical ATLAS releases have been migrated and preserved in the new structure.

Langroid versions before 0.63.0 have a vulnerability where SQLChatAgent (a tool that lets an AI execute SQL queries) can be tricked through prompt injection (hiding malicious instructions in input data) into running dangerous SQL commands. If the database is configured with elevated privileges, an attacker can achieve RCE (remote code execution, where an attacker runs commands on a system they don't own) on the database server, potentially stealing or deleting data.

Gryph is a security tool that protects AI coding agents (software that writes code with AI help) by controlling what information gets saved to a local database. Before version 0.7.0, Gryph's documentation incorrectly stated that logging (recording activity) was set to a minimal level by default, but it was actually set to standard, causing sensitive file content to be stored in the database even though Gryph was supposed to filter it out.

Researchers have developed PacketPatch, a method for creating adversarial packets (malicious network data designed to fool AI systems) that can deceive byte-feature-based encrypted traffic classification systems (AI models that identify what type of network traffic is flowing through encrypted connections by analyzing raw data patterns). The work demonstrates how attackers could potentially manipulate encrypted network communications to evade detection by these AI-powered security systems.