AI Sec Watch

Anthropic's Project Glasswing uses Claude Mythos Preview, an advanced AI model, to automatically find security flaws (vulnerabilities) in widely-used software before attackers can exploit them. Since launching last month, the program has identified over 10,000 high-severity vulnerabilities across critical software, with 97 already patched and 88 security advisories issued. However, Anthropic notes that finding vulnerabilities is much easier than fixing them, presenting a major challenge for cybersecurity.

Google's Gemini AI model can generate realistic videos from simple inputs, as demonstrated by an experiment where someone created deepfake (synthetic media made to look real) videos of a stuffed animal. The article highlights how accessible and effective these video generation tools have become, raising questions about the line between harmless creative use and potentially misleading AI-generated content.

This research paper examines how Security Operations Centers (SOCs, teams that monitor and respond to security threats) can work effectively with AI systems by using adaptive trust mechanisms. The study focuses on building resilient operations, meaning systems that can continue functioning even when problems occur, through better collaboration between human security experts and AI tools that can process large amounts of data quickly.

According to a Reuters report, Grok (Elon Musk's AI chatbot) is not performing well and has minimal adoption, appearing in only 3 out of over 400 documented cases of U.S. government AI use, and only for basic tasks like document drafting or social media management. This low usage is a sign of trouble for xAI's flagship product, despite Musk's plans to make it central to a major financial offering.

Kiro CLI, a command-line tool that lets developers use AI to run code and shell commands, has a security flaw (CVE-2026-9255) where it doesn't properly check where input comes from before authorizing tool execution. An attacker on the same computer could trick the tool into running arbitrary commands without the user's permission by sending specially crafted data through stdin (the standard input stream that feeds data into a program).

Microsoft is testing agentic AI (AI that can perform multi-step tasks automatically) in its Edge for Business browser to help employees complete routine work like filling forms and gathering information across tabs. A key focus is protecting corporate data through features that keep AI prompts within the company's Microsoft 365 tenant (a private cloud environment), prevent copy-paste operations, block sensitive uploads, and allow companies to audit what users do.

A story selected for a prestigious British literary award appears to have been written by an LLM (large language model, an AI trained on text to generate human-like writing) rather than by a human author, raising concerns about how the literary world will handle AI-generated submissions. The story exhibits characteristic patterns of AI-generated text, such as repetitive sentence structures and predictable phrasing.

Spotify has partnered with Universal Music Group (UMG) to create a new tool that uses generative AI (AI that creates new content from patterns in training data) to let users make remixes and covers of songs from UMG's music catalog. The article expresses concern that this tool will make it even easier to flood the internet with AI-generated music covers, which already appear widely on platforms like YouTube, TikTok, and Instagram.

Federated learning (a system where multiple computers train an AI model together while keeping their data private) can be unfair to some participants and vulnerable to attacks where bad actors tamper with the process. FairRoP is a new method that uses adaptive client selection (choosing which computers to include based on their trustworthiness) and a bandit algorithm (a technique for balancing exploration and exploitation in decision-making) to improve both fairness and robustness against attacks. The approach combines three components: fairness awareness, attack detection, and q-Balance to handle the different challenges involved.