AI Sec Watch

A path traversal vulnerability (a type of attack where an attacker manipulates file paths to access files outside the intended directory) was found in fishaudio Bert-VITS2, specifically in the generate_config function of the Gradio Interface (a web-based tool for interacting with AI models). The vulnerability can be triggered remotely by manipulating the data_dir argument, and the exploit is now publicly known.

This article covers a legal dispute between Elon Musk and Sam Altman over OpenAI, where Musk has accused Altman of 'stealing a charity.' The trial featured testimony from major tech industry figures and revealed private communications about OpenAI's history and leadership practices. The article focuses on the courtroom drama and business conflict rather than any technical or security issue related to AI systems.

This is a survey paper that examines vulnerabilities and attack methods targeting embodied AI systems (AI systems that control physical robots or devices in the real world). The paper reviews the landscape of security risks in embodied AI and appears to focus on understanding these threats rather than proposing specific fixes.

Cerebras Systems' successful IPO, where shares jumped 70% in value, has created excitement around AI investment opportunities, but smaller tech companies are struggling to attract investor attention because massive AI firms like SpaceX, OpenAI, and Anthropic (each valued near or above $1 trillion) are preparing their own IPOs that will overshadow all other offerings. Companies without strong AI-related stories, particularly SaaS companies (software-as-a-service, meaning applications accessed over the internet), face especially difficult conditions in the public market right now.

WeatherNext, an AI weather prediction model developed by Google DeepMind and Google Research, helped the National Hurricane Center predict Hurricane Melissa would reach Category 5 intensity five days before landfall in Jamaica with high confidence, marking the first time such rapid intensification was successfully forecasted from a weak starting point. Unlike traditional weather models that excelled at predicting either a storm's path or intensity but not both, WeatherNext bridges this gap by training on decades of global weather patterns and extreme tropical cyclone data, allowing it to run multiple "what-if" scenarios (called ensembles, where the model generates 50 different possible outcomes) to give forecasters a fuller picture for decision-making. The early and accurate prediction gave communities crucial time to prepare and evacuate.

OpenAI and Malta have announced a partnership to provide ChatGPT Plus (a paid subscription service) free to all Maltese citizens who complete an AI literacy course developed by the University of Malta. The course teaches people what AI is, what it can and cannot do, and how to use it responsibly, with the first phase launching in May and eligible citizens receiving one year of free access after completion.

This article covers the final week of a trial where Elon Musk is suing OpenAI CEO Sam Altman, claiming Altman broke a promise to keep OpenAI as a nonprofit organization dedicated to AI safety. The jury sided with OpenAI, finding that Musk's claims are blocked by the statute of limitations (a legal time limit for filing lawsuits), though the judge will make the final decision. The case centers on whether OpenAI's 2025 restructuring into a for-profit entity violated Musk's original vision, with Musk seeking up to $134 billion in damages.

Google has released Gemini 3.5 Flash, an AI model designed to help developers and enterprises build agents (AI systems that can perform multi-step tasks autonomously) and handle coding work. The model matches the performance of larger flagship models while running 4 times faster, and works with Google's Antigravity platform to execute complex workflows like code refactoring, financial document preparation, and game development at a fraction of the time and cost of previous approaches.

YouTube is expanding an AI tool to all adults that detects deepfakes (AI-generated videos where someone's face is swapped onto another person's body) by scanning a user's selfie and searching YouTube for matching content. If the tool finds a potential deepfake, it notifies the user, who can then request YouTube remove the video.