AI Sec Watch

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 has a vulnerability where the username field is not properly checked, allowing attackers to use path traversal (a technique to access files outside intended directories by using sequences like '../'). This flaw could let attackers delete files from any directory, destroy data belonging to other users, or remove JWT signing keys (cryptographic keys used to verify user sessions), which would invalidate all user sessions.

PraisonAI (a system for running multiple AI agents together as teams) versions before 4.6.40 have a command injection vulnerability (a flaw where attackers can sneak malicious commands into the system) in its GitHub Actions workflow (an automation tool for running code when repository changes happen). An outside contributor can create a pull request with a malicious branch name and trigger the vulnerable workflow with a comment, allowing them to run harmful commands with powerful permissions like writing to the repository and accessing authentication tokens.

IBM Langflow OSS (an open-source AI tool framework) versions 1.0.0 through 1.10.3 has a vulnerability that allows an authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) on the system through code injection (inserting malicious code into the application's input). The vulnerability has a CVSS score (severity rating on a 0-10 scale) that has not yet been assigned by NIST.

IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where a logged-in attacker could run malicious code on the system because the software doesn't properly check Python code during AST-based security scanning (a method that analyzes code structure before execution). This is a code injection vulnerability (CWE-94), meaning attackers can insert and execute their own code.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) due to improper validation of module imports (not properly checking which code libraries are being loaded). The vulnerability is classified as CWE-94, a type of code injection (inserting malicious code into a program).

IBM Langflow OSS (an open-source workflow tool) versions 1.0.0 through 1.10.3 has a vulnerability where an authenticated user can inject malicious graph data into a shared cache by exploiting improper ownership validation in a deprecated API endpoint. This could allow attackers to corrupt data for other users, run workflows without permission, or crash the system.

Microsoft is directing its developers to use OpenAI's GPT-5.6 Sol model as the default option in GitHub Copilot (a tool that uses AI to help write code) to reduce costs and get more value from the company's token (units of AI processing) spending. This shift reflects a broader industry trend where companies are moving away from "tokenmaxxing" (running up large AI processing bills without concern for cost) and instead focusing on efficiency as Wall Street pressure increases on massive AI spending.

OpenAI shut down a scam network based in Cambodia that used ChatGPT to run multiple fraud schemes, including romance scams, fake investment opportunities, gambling fraud, and impersonation of law enforcement. The banned accounts created fake online personas, generated messages to trick victims, and produced forged documents like passports and legal notices. The scammers used a three-step method called ping-zing-sting (initial contact, building trust, then requesting payment) and may have targeted hundreds of people, with individual victims losing thousands of dollars.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a server-side request forgery (SSRF, a vulnerability where an attacker tricks a server into making unwanted requests to other systems) in the validate_model_provider_key() function for the Ollama provider. The vulnerability exists because the function accepts a user-supplied URL parameter without checking if it's safe, allowing attackers to potentially access private internal networks or services.