AI Sec Watch

Flowise, a tool for building AI applications, has a security vulnerability in its MCP feature (model context protocol, which lets AI tools run system commands) that allows attackers to bypass command restrictions and execute arbitrary code. The vulnerability has three bypass methods: the 'docker build' command isn't blocked (allowing remote code execution through malicious Dockerfiles), the 'npx --yes' long parameter isn't blocked (allowing installation of malicious packages), and a third unspecified method. Any Flowise user can exploit this if the system has docker or npx installed.

FlowiseAI's checkBasicAuth endpoint (a feature that checks login credentials) has a security flaw where it accepts plaintext passwords without rate limiting (restrictions on how many login attempts are allowed), making it vulnerable to brute-force attacks (where attackers try many password combinations rapidly). The endpoint also reveals whether a username exists by returning different success and failure messages, and uses direct string comparison instead of constant-time comparison (a timing-attack-resistant method that takes the same time regardless of where strings differ).

FlowiseAI has a mass assignment vulnerability (a flaw where an attacker can modify server-controlled fields by including them in their input) in its chatflow update endpoint that allows authenticated users to change protected properties like workspaceId, deployed status, and visibility settings. An attacker can reassign chatflows to other workspaces and modify deployment or visibility settings without authorization because the server doesn't validate which fields should be editable.

FlowiseAI has a mass assignment vulnerability (a security flaw where an attacker can modify fields they shouldn't be able to change) in its tool update endpoint that allows authenticated users to reassign tools to different workspaces by manipulating the workspaceId field in their requests. The server fails to validate which properties users can modify, allowing attackers to change server-controlled fields like workspaceId, createdDate, and updatedDate, which breaks tenant isolation (the security boundary that keeps different users' data separate) in multi-workspace environments.

FlowiseAI has a mass assignment vulnerability (a flaw where an application accepts unintended user input to modify server-controlled data) in its variable update endpoint that lets authenticated users change internal fields like workspaceId, createdDate, and updatedDate. Because the server doesn't properly validate or check permissions, attackers can reassign variables to different workspaces, potentially breaking tenant isolation (the separation that keeps different organizations' data separate in shared systems).

Researchers created a testing framework to evaluate how deepfakes (AI-generated fake videos or images of people) can fool face recognition systems (AI that identifies people by their faces). The study found that deepfake attacks succeed over 70% of the time, sometimes exceeding 90%, and discovered that attack success depends more on how well attackers can control the person's identity in the fake content rather than on how realistic the deepfake looks visually.

Agentic AI (systems that can independently plan and take actions to complete tasks) offers significant potential for financial services, but its success depends primarily on the quality, security, and accessibility of its underlying data rather than the sophistication of the AI itself. Financial services companies must establish centralized, well-indexed, and secure data stores that can be searched and managed at scale, while ensuring all data processes are auditable and explainable to meet regulatory requirements and avoid errors like hallucinations (false or made-up information from the AI).

Companies are shifting away from relying on third-party AI providers because they worry about losing control of their proprietary data and competitive advantage when that data passes through external systems. This movement toward AI and data sovereignty, meaning companies want to build and control their own AI models rather than depend on centralized cloud providers, is now a major business priority, with 70% of executives surveyed believing they need sovereign data and AI platforms to succeed.

Codex, an AI coding assistant, is now available in the ChatGPT mobile app, allowing users to manage and guide AI-assisted coding work from their phones while Codex runs on their laptops or remote machines. The mobile app lets users review outputs, approve commands, answer questions, and provide direction to Codex in real time from anywhere, with a secure relay layer (an encrypted connection system) protecting machines from direct internet exposure while syncing updates between devices.