AI Sec Watch

A vulnerability was found in vllm (a language model serving framework) up to version 0.19.0 in the has_mamba_layers function, which can result in uninitialized resource (memory that hasn't been set to a known value before use). An attacker can trigger this flaw remotely, though the attack is difficult to execute and requires high complexity.

OpenAI and Microsoft announced a revised partnership agreement that allows OpenAI to cap its revenue share payments to Microsoft and serve customers through any cloud provider, not just Microsoft Azure. Previously, OpenAI was restricted to primarily using Microsoft's cloud services, but the new deal lets OpenAI work with competitors like Amazon and Google while maintaining Microsoft as its primary provider through 2030.

Customers Bank CEO Sam Sidhu revealed that an AI clone (a digital voice generated to sound like him) delivered his prepared remarks during an earnings call, then announced a partnership with OpenAI to automate banking processes like loan approvals and account openings. The bank plans to deploy AI agents (software that can make decisions and take actions with minimal human input) across lending, deposits, and payments over the next 6-12 months, with goals including reducing loan processing time from 30-45 days to 7 days and account opening time to under 20 minutes.

Microsoft and OpenAI have removed a clause from their partnership agreement that previously governed what would happen if AGI (artificial general intelligence, an AI system that can do any intellectual task a human can do) was developed. Under the new terms, Microsoft remains OpenAI's primary cloud partner with first access to new products, but OpenAI now has freedom to use other cloud providers instead of being locked into Microsoft's Azure platform.

Elon Musk, a cofounder of OpenAI, is suing the company and its leaders Sam Altman and Greg Brockman, claiming they abandoned OpenAI's original mission to develop AI for humanity's benefit and shifted focus to profit instead. OpenAI counters that the lawsuit is a baseless attempt by Musk to harm a competitor to his own AI ventures. Musk is seeking the removal of Altman and Brockman, an end to OpenAI's nonprofit status, and up to $150 billion in damages.

OpenAI has received FedRAMP 20x Moderate authorization (a security certification that allows U.S. government agencies to use cloud services), making ChatGPT Enterprise and the API Platform available for federal use. This certification was achieved through a faster authorization process that emphasizes cloud-native security evidence and automated validation, allowing government agencies to access advanced AI capabilities like GPT-5.5 while meeting federal security and governance requirements.

Qualcomm is reportedly partnering with OpenAI and MediaTek to develop custom smartphone chips, with mass production expected in 2028. According to analyst Ming-Chi Kuo, OpenAI believes controlling both the operating system (the software that runs a device) and hardware will let it deliver comprehensive AI agent services (AI systems that can perform tasks autonomously) that use real-time smartphone data to improve performance.

Deepfake voice and video attacks (AI-generated replicas of real people) are becoming increasingly common and costly, with tools that require only three seconds of audio and cost almost nothing to create. Attackers target finance employees and IT staff by impersonating executives on calls or video meetings to authorize large money transfers or credential changes, and these attacks bypass traditional security tools because they rely on tricking people rather than exploiting software vulnerabilities. Organizations that have successfully stopped these attacks all used the same defense: training employees to pause and verify requests before acting on them.

Some people worry that advanced frontier LLMs (large language models, AI systems trained on massive amounts of text) like Claude Mythos and GPT-5.5 could cause serious cybersecurity problems by being misused for attacks. However, security researcher Ari Herbert-Voss suggests this situation could also present opportunities.