AI Sec Watch

Researchers discovered a malicious npm package (a collection of code shared through Node Package Manager, a repository for JavaScript libraries) called "mouse5212-super-formatter" that steals files from Claude AI users' directories. The package disguises itself as a legitimate tool but actually uploads files to a threat actor-controlled GitHub account by authenticating with stolen or hard-coded credentials during installation.

OpenAI and other AI companies have spent millions through a political action committee to oppose Alex Bores, a New York state assemblyman who wrote AI safety regulations, inadvertently making him more famous and turning him into a prominent figure in the AI regulation debate. The article suggests this corporate spending against Bores has backfired by drawing public attention to him and the issue of who should regulate AI technology.

Gradio versions before 6.15.0 have a cookie injection vulnerability that lets attackers perform session fixation (tricking a system into using a fake session ID) across multiple user spaces. An attacker controlling one Gradio Space can inject a cookie into a shared HTTP client (a tool that sends web requests) that automatically gets sent to all other legitimate Spaces, affecting every user on that Gradio deployment.

A flaw in Starlette (CVE-2026-48710), the framework that powers FastAPI, allows unauthenticated attackers to bypass authentication by sending a malformed character in a web request's Host header. The flaw tricks Starlette into parsing the request path differently than the actual server sees it, so security checks on one path may allow access to a protected route, potentially enabling SSRF (server-side request forgery, where an attacker makes the server request data from unintended locations) or even remote code execution on affected systems.

Robinhood has launched a feature allowing traders to create separate accounts for AI agents (software programs that can make decisions automatically) with dedicated funds to buy and sell stocks. The feature is designed to automate investment decisions like monitoring specific industries or rebalancing portfolios, but Robinhood warns that agentic trading carries significant risk, including potential loss of the entire investment.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.0 has a vulnerability that allows a denial of service attack, which is when an attacker overwhelms a system with requests to make it unavailable. The problem is caused by uncontrolled resource consumption (the system fails to limit how much memory, CPU, or other resources a single request can use).

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.1 has a vulnerability that could allow remote code execution (running malicious code on a system from a distance) because it doesn't properly validate symbolic links (shortcuts that point to files) when extracting archive files. This is a path traversal (CWE-22) weakness, meaning an attacker could potentially access or execute files outside the intended directory.

SecurityWeek is hosting the 2026 AI Risk Summit on August 11-12 in Half Moon Bay, California, bringing together security leaders, AI researchers, and policymakers to discuss challenges in AI adoption and security. The conference will cover topics like securing AI systems, adversarial attacks (techniques where attackers try to fool AI models), deepfakes (AI-generated fake media), data protection in AI workflows, and AI governance and compliance.

AI models can now discover zero-day vulnerabilities (previously unknown security flaws) and chain exploits (combine multiple attacks together) faster than organizations can patch them, shrinking response windows from weeks to minutes. To defend effectively, organizations need to operate at machine-speed by focusing on two key areas: reducing the time to identify and fix vulnerabilities, and maintaining visibility across their entire environment including cloud, code, and software supply chains. The Wiz platform helps with this through tools like ASM (attack surface management, which maps all exposed systems and applications) and Red Agent (an AI-based security tester that finds complex vulnerabilities automatically).