AI Sec Watch

IBM CEO Arvind Krishna stated that geopolitical uncertainty, particularly the Iran conflict, is causing the company to provide cautious financial guidance despite beating first-quarter earnings expectations. He also expressed concerns about potential economic slowdowns affecting consumer spending and European growth, though he noted IBM's Middle East business performed well. Additionally, Krishna discussed how new AI models like Anthropic's Mythos, which can find security vulnerabilities at unprecedented speed, will likely be replicated by competitors and pose significant cybersecurity concerns that have caught the attention of U.S. government officials.

OpenAI has released workspace agents (AI systems that can independently perform tasks) for users on Business, Enterprise, Edu, and Teachers plans within ChatGPT. These agents can handle business tasks like gathering product feedback and drafting emails, building on growing interest in autonomous AI agents across the industry.

DDEV, a local development tool, has a ZipSlip vulnerability (a path traversal flaw where attackers use special path names like '../' to escape the intended extraction directory) in its archive extraction functions. When DDEV extracts tar or zip archives from remote sources, it doesn't validate file paths, allowing attackers to write files anywhere on a developer's machine by crafting malicious archives.

Researchers have developed a fingerprint-based watermarking technique to protect and track natural language processing models (AI systems trained to understand and generate text) that operate as black boxes (systems where users cannot see how internal decisions are made). This method allows owners to prove they created a model and trace where it has been used or copied without permission.

AI models can now autonomously discover vulnerabilities and create working exploits, which compresses the time between when a weakness is found and when it's attacked. However, the same AI capabilities that help attackers can also help defenders by accelerating vulnerability discovery and reducing response time. Microsoft is partnering with AI model providers and using tools like advanced models to identify security issues faster and deploy fixes through their existing update processes.

Anthropic released Mythos Preview, an AI model designed to find and fix security vulnerabilities (weaknesses in software that attackers could exploit), and several US federal agencies are using it. However, CISA (the Cybersecurity and Infrastructure Security Agency, which is America's main government cybersecurity coordinator) reportedly does not have access to the tool, while other agencies like the Commerce Department and NSA do.

Google's Gemini AI can now generate summaries and transcripts not just for Google Meet video calls, but also for in-person meetings, Zoom calls, and Microsoft Teams meetings. The feature, which was previously only available to early testers on Android devices, now works for both scheduled and impromptu meetings, and can be transitioned to a video call if remote participants need to join.

Anthropic, the company behind Claude chatbot, has decided not to release its new AI model called Mythos to the public due to cybersecurity risks. The company is investigating a report that unauthorized people may have gained access to Mythos, raising concerns about whether tech companies can adequately protect their most powerful AI systems from being misused.

OpenAI introduced ChatGPT for Clinicians, a free AI tool designed to help doctors, nurse practitioners, and pharmacists with clinical tasks like documentation, medical research, and patient care consultation. The tool includes advanced AI models, trusted medical search powered by peer-reviewed sources, and optional HIPAA compliance (a federal privacy law for healthcare data) support, with conversations kept private and not used to train the AI.