AI Sec Watch

This is a routine release (v0.14.22) of LlamaIndex, an AI framework for building applications with large language models. The update includes multiple dependency updates across 55 directories, fixes to embedding events and memory handling, a new multimodal synthesis feature, and security improvements to prevent unintended data mutation in LLM responses.

Open WebUI has a stored cross-site scripting (XSS) vulnerability in its SVG renderer, meaning an attacker can permanently save malicious HTML and JavaScript code that runs when other users view it. An attacker can trick the SVG editor into executing arbitrary code by adding malicious payloads like `<img src=a onerror=alert(document.domain)>`, which could be used to steal sensitive data or take over user accounts when the compromised conversation is shared.

Open WebUI has a security flaw where API key restrictions can be bypassed by using the `x-api-key` header (a custom header for authentication) instead of the standard `Authorization` header. An admin can restrict what endpoints an API key can access, but the same key sent via `x-api-key` bypasses these restrictions entirely and allows full access to protected endpoints like the messages API.

A vulnerability in Amazon SageMaker Python SDK (a tool for building machine learning models on AWS) allows an attacker with write access to S3 (Amazon's cloud storage service) to execute malicious code by replacing model files with a specially crafted pickle file (a Python format for storing objects) that isn't checked for authenticity before being used. This only affects versions before v2.257.2 and v3.8.0, and requires the attacker to already have permission to write to the storage location.

Amazon SageMaker Python SDK has two critical vulnerabilities in its model deployment tools. CVE-2026-8596 exposes an encryption key as plaintext in APIs, allowing attackers to forge signatures and run malicious code, while CVE-2026-8597 skips integrity checks when loading model files, letting attackers replace them with malicious code that executes without verification. Both vulnerabilities require the attacker to have certain AWS permissions and access to model storage.

OpenAI is adding Codex, its AI tool that can write code and control applications on computers, to the ChatGPT mobile app so users can access it from their phones. This move responds to competition from Anthropic's Claude Code, and follows OpenAI's recent major update that enabled Codex to operate apps on macOS computers.

OpenAI confirmed that two employees' devices were breached in the TanStack supply chain attack, where attackers inserted malicious code into popular software packages distributed through npm and PyPI (package repositories for code libraries). The breach resulted in stolen credentials and exposed code-signing certificates (digital signatures that verify software authenticity), but did not compromise customer data, production systems, or deployed software. OpenAI rotated its code-signing certificates and isolated affected systems as a precaution.

Microsoft is canceling most of its Claude Code licenses (a tool made by Anthropic that helps developers write code with AI assistance) and shifting employees to use Copilot CLI (Microsoft's own AI coding command-line tool) instead. The company had been testing Claude Code with thousands of its developers since December, but is now scaling back the program despite the tool's popularity.

Hatchet is a platform for managing background tasks (work done separately from main application logic), AI agents, and workflows at scale. Before version 0.83.39, a missing authorization check on one API endpoint (GET /api/v1/stable/dags/tasks) allowed any authenticated user to view task details from other organizations (tenants) on the same Hatchet instance by providing another tenant's identifier.