AI Sec Watch

Isabelle Reksopuro created an interactive map to track data center construction and AI policy, responding to confusion and misinformation about where data centers are being built. The project highlights how large tech companies like Google use significant amounts of public resources, such as land and water access, to power their data centers (massive facilities that store and process data for cloud services).

OpenTelemetry Java's baggage propagation (the mechanism for passing request context data across services) didn't enforce size limits, causing unbounded memory allocation (unlimited memory usage) and CPU consumption when parsing oversized baggage headers. This problem can spread to downstream services that never received the original malicious request because baggage is automatically re-injected into every outgoing request.

Hackers compromised the TanStack open source library (a tool that helps developers build web applications) and pushed out malicious updates containing malware designed to steal credentials and spread to other systems. OpenAI confirmed that two of its employees were affected by this attack, and hackers gained unauthorized access to some internal source code repositories, though the company found no evidence that user data or production systems were compromised.

FlowiseAI's Evaluator feature has a mass-assignment vulnerability (a bug where client-controlled data is copied directly into server objects without filtering) that allows authenticated users to change an evaluator's `workspaceId` field, moving it to another workspace they don't own. This breaks workspace isolation (the separation that keeps different teams' data apart) and lets attackers in workspace B read, modify, and use evaluators belonging to workspace A.

FlowiseAI has a mass assignment vulnerability (a bug where client input is copied directly into objects without filtering) in its Evaluation feature that allows authenticated users to move evaluations between workspaces by including a `workspaceId` field in their request. This breaks workspace isolation (the separation that keeps data from different teams or organizations separate) and allows attackers to access or modify other workspaces' evaluation data, including sensitive information like model outputs and prompts.

FlowiseAI has a mass assignment vulnerability (a code pattern where user input is directly copied into a database object without filtering) in its DatasetRow feature that allows authenticated attackers to change which workspace owns a data row by including a `workspaceId` field in their request, giving them access to other teams' data. This breaks workspace isolation (the security boundary that keeps different teams' data separate) and lets attackers move training records between workspaces they shouldn't have access to.

FlowiseAI has a mass assignment vulnerability (a flaw where client input is copied directly into database objects without filtering) in its Dataset feature that lets authenticated users move datasets between workspaces by including a fake `workspaceId` field in their request. This breaks workspace isolation (the boundary that keeps each workspace's data separate) and allows attackers to steal or modify datasets belonging to other workspaces.

FlowiseAI has a mass assignment vulnerability (a security flaw where an attacker can modify database fields they shouldn't be able to) in its CustomTemplate feature that allows authenticated users to move templates between workspaces by including a `workspaceId` field in their request. This breaks workspace isolation (the separation that prevents users from accessing data outside their assigned workspace), allowing an attacker to take over templates from other workspaces, since the code uses `Object.assign()` to copy user input directly into database records without filtering which fields are allowed.

FlowiseAI has a mass-assignment vulnerability (a bug where user input is copied directly into database objects without filtering) in its Assistant service that allows authenticated attackers to change the `workspaceId` field of an assistant they own, moving it to another workspace and gaining unauthorized access. This breaks workspace isolation (the security boundary that keeps data from different organizations separate) and exposes sensitive information like LLM configuration and credentials to unintended users.