AI Sec Watch

ChatGPT Futures honors college students from the class of 2026, the first generation to complete college with AI tools like ChatGPT available throughout their education. Rather than using AI to avoid work, these students are using it to build real projects faster, from research tools to accessibility software, demonstrating that AI amplifies human ambition and lowers barriers to turning ideas into tangible outcomes.

Frontier enterprises (those using AI most extensively) now use 3.5x more AI intelligence per worker than typical firms, with the gap driven by deeper, more complex usage rather than just more messages. The key difference is that leading firms use agentic workflows (AI systems that can complete multi-step tasks with minimal human intervention), with frontier companies sending 16x more messages to coding tools like Codex per worker, moving from simple question-answering to delegating substantial work to AI agents.

Uber is using OpenAI's large language models (AI systems trained on massive amounts of text to understand and generate human language) to build Uber Assistant, an AI-powered tool that helps drivers and couriers make better decisions by turning complex marketplace data into simple, real-time guidance. The Assistant reduces cognitive overhead (the mental effort needed to process complicated information) by letting drivers ask questions in plain language about where to earn, how to optimize their time, and understanding platform dynamics, which helps both new and experienced drivers perform better.

Singular Bank built Singularity, an internal AI assistant powered by ChatGPT and Codex (OpenAI's code-generation model), to help bankers quickly analyze client investment portfolios and prepare communications. The system saves bankers 60-90 minutes daily by automating tasks like portfolio analysis, meeting preparation, and follow-up drafting, allowing them to spend more time advising clients and building relationships.

vLLM (a system for running large language models) has a vulnerability where specially crafted text prompts containing multimodal placeholder tokens (sequences that represent images or videos) without actual image or video data cause the system to crash with an IndexError (a programming error when accessing data that doesn't exist). An unauthenticated attacker can send a single malicious request to a vLLM server to trigger a denial of service attack (making the service unavailable), affecting any deployment that runs vision-capable language models.

The `discover_pipeline_files()` function in ciguard (a tool used by AI agents to scan code repositories) followed symlinks (shortcuts that point to other directories) without proper restrictions, allowing an attacker to trick it into reading sensitive files outside the intended scan directory. An AI agent scanning a malicious folder with planted symlinks could accidentally expose secrets from system directories like ~/.aws/ or /etc/.

The OpAMP client (a component for managing telemetry agents) reads HTTP responses without limiting how much data it accepts, which could allow an attacker controlling the server to send extremely large responses and exhaust the application's memory, causing it to crash. This vulnerability only affects applications where the OpAMP server is untrusted or could be intercepted by a network attacker.

Google has updated Gemini for Home to version 3.1, which improves the AI assistant's ability to handle complex, multi-step tasks and combine multiple requests in a single command. The update also enhances Gemini's understanding of natural language (how humans normally speak), device identification, and management of calendar events. These improvements follow reports of bugs in the smart home assistant.

Attackers are using supply-chain attacks (compromising software components that developers rely on) to target AI coding agents, which automatically scan package registries like NPM and PyPI for dependencies to include in projects. A North Korean group called Famous Chollima launched the PromptMink campaign, using fake packages with legitimate-sounding names and descriptions, along with hidden malicious code, to trick AI agents into installing malware that steals information and grants attackers remote access to developers' computers.