AI Sec Watch

Coder's Azure identity verification has a critical flaw: it checks that a certificate comes from a trusted Azure authority but never verifies the actual PKCS#7 signature (a cryptographic stamp that proves data hasn't been tampered with). An attacker can forge identity data and steal session tokens that grant access to Git keys, OAuth tokens, and secrets. All Coder v2 versions are affected.

PenPot's MCP REPL server binds to all network interfaces (0.0.0.0:4403) and exposes an unauthenticated /execute endpoint that runs arbitrary JavaScript code, allowing anyone on the network to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own). The vulnerability exists because the server listen call omits a host argument, defaulting to 0.0.0.0, and the /execute endpoint has no authentication checks before executing user-supplied code.

Coder's Azure identity endpoint was vulnerable to SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) because it accepted unsigned certificates and fetched arbitrary URLs without validation. An attacker could craft a fake certificate pointing to any internal or external address, forcing the Coder server to connect to it and reveal whether the target was reachable through error messages, enabling network reconnaissance and potential attacks on internal services.

9router, a tool for managing AI plugins, has a critical vulnerability where two unprotected API endpoints can be chained together to run arbitrary OS commands. The problem occurs because the authentication middleware (a security check) only protects 8 specific routes, while 40+ routes under `/api/cli-tools/*` and `/api/mcp/*` have no protection, allowing attackers with network access to register malicious commands and then trigger them without any credentials.

The npm (node package manager, a repository for reusable code libraries) registry was attacked on May 19 when hackers compromised a maintainer account and published 637 malicious versions of 317 packages, including the popular AntV data visualization tool used by Alibaba. The malware, called Mini-Shai-Hulud worm, steals credentials like npm tokens, GitHub tokens, and passwords from cloud platforms and wallets. After detection, AntV's maintainers deleted the infected packages and marked remaining ones as deprecated, advising users to download only the latest verified versions.

Google and Volvo announced that Gemini, an AI assistant, will soon be able to access external cameras in Volvo's EX60 SUV to help interpret the vehicle's surroundings. This capability works because Volvo uses Google's Android Automotive (an operating system designed for vehicles) in the car. The first planned use is helping drivers understand confusing parking signs, though Google expects other applications in the future.

Google announced new AI models called Gemini 3.5 at its I/O 2026 conference, including Gemini 3.5 Flash (available immediately) and Gemini 3.5 Pro (coming next month). The Gemini 3.5 Flash model will now be the default AI powering Google's Gemini app and AI Mode in Search. The announcement was part of a broader keynote that also covered updates to Gmail, Search features, and Project Aura smart glasses.

Meta is forcing over 7,000 employees to transfer to new teams focused on AI, including groups building AI cloud infrastructure and an internal AI agent called Hatch. This reorganization is mandatory, with the company previously telling workers that similar transfers to an AI data labeling team were non-optional, even after initially offering them as voluntary.

Google is expanding access to CodeMender, an AI agent (a software system that can perform tasks autonomously) for code security that can both identify and fix vulnerabilities (security weaknesses) in software. This move appears to be Google's response to Anthropic's recent announcement of Claude Mythos Preview, intensifying competition in the AI security tools market.