AI Sec Watch

A vulnerability in BentoML allows command injection through environment variable names in bentofile.yaml files. When a user runs `bentoml containerize` (the command that builds a container image) on a malicious bento configuration, unquoted environment variable names get inserted into the generated Dockerfile, allowing attackers to execute arbitrary commands on the build host during the `docker build` process. This is a sibling vulnerability to two earlier command injection bugs (CVE-2026-33744 and CVE-2026-35043) that were patched for a different field but missed this one.

BentoML has a command injection vulnerability where the `docker.base_image` field in a bento.yaml configuration file is inserted directly into a Dockerfile template without any validation or escaping. An attacker can supply a malicious bento.yaml with newlines in the `docker.base_image` value to inject arbitrary Dockerfile commands (like `RUN` directives that execute code) which get executed when a victim runs `bentoml containerize` to build a container image.

Open WebUI has an authorization flaw in standard channels (regular channels, not group or direct message channels) where the message update endpoint incorrectly allows access with read permission only. This means any authenticated user can modify other users' messages if they know the message ID, violating data integrity (the guarantee that information stays accurate and unchanged by unauthorized parties).

Threat actors are increasingly using AI and large language models (LLMs, systems trained on massive amounts of text to generate human-like responses) to discover vulnerabilities, create malware, and conduct cyberattacks at industrial scale, with groups linked to China, North Korea, and Russia demonstrating significant AI-enabled capabilities. AI is being used both as an attack tool (for generating exploits, evading defenses, and creating deepfakes) and as a target for compromise, with attackers seeking unauthorized access to AI systems through supply chain attacks and illicit model access. Google's Threat Intelligence Group reports these threats are advancing from experimental to mature operations, including autonomous malware like PROMPTSPY that can dynamically adapt to victim systems.

This is a podcast interview transcript where tech journalist Joanna Stern discusses her new book 'I Am Not a Robot,' in which she spent a year integrating AI into every aspect of her life to evaluate the technology's current state. She found that many hyped AI products, especially humanoid robots (physical machines designed to look and act like humans), are not yet ready for real-world use, though she is optimistic about wearable AI (AI embedded in portable devices like smartwatches) as a potential breakthrough application.

Cerebras Systems, an AI chipmaker, increased its IPO (initial public offering, when a private company sells shares to the public for the first time) price range to $150-$160 per share, up from $115-$125, potentially raising $4.8 billion. The company makes specialized chips that compete with Nvidia's GPUs (graphics processing units, hardware that processes AI calculations) and claims its chips are faster and cheaper, with major backing from OpenAI.

Machine learning systems used to detect Android malware (malicious software on Android phones) are vulnerable to evasion attacks, where attackers modify malware to trick the detection system into missing it. Researchers developed MalPurifier, a defensive framework that uses adversarial purification (a technique that removes deceptive modifications from suspicious code) combined with a Denoising AutoEncoder (a type of neural network that learns to clean up noisy or corrupted data) to protect detection systems and maintain accuracy above 90% against various evasion attacks.

OTT Cybersecurity LLC announced that its product Lyrie.ai has been accepted into Anthropic's Cyber Verification Program, and released the Agent Trust Protocol (ATP), an open cryptographic standard (a set of math-based rules for secure communication) that allows systems to verify the identity, permissions, and integrity of autonomous AI agents operating on the internet. ATP addresses a security gap by letting organizations confirm who an AI agent is, what it's authorized to do, and whether it has been tampered with.

This research develops a privacy-preserving method for face recognition systems using the Privacy Funnel model, which balances the usefulness of facial data against protecting sensitive information like identity or demographic attributes. The authors introduce new versions of this model, including the Generative Privacy Funnel (GenPF) and deep variational Privacy Funnel (DVPF), and demonstrate that their approach works with modern face recognition systems while reducing information leakage about sensitive attributes.