AI Sec Watch

Universal Adversarial Perturbations (UAPs, tiny modifications to images that fool AI models across many different inputs) are security threats to deep learning systems, but existing methods make attacks obvious because they either look wrong to humans or cause suspicious misclassifications. This paper presents Stealthy-UAP, a framework that makes UAPs harder to detect by targeting only semantically related classes (so misclassifications seem plausible) and optimizing perturbations to match how humans actually perceive images.

The llm-openrouter tool, version 0.6, added a new 'refresh' command that lets users update their list of available AI models without waiting for the cached (temporarily stored) list to expire. This feature was created so users could access newly available models on OpenRouter immediately.

A vulnerability (CVE-2026-6662) was found in ericc-ch copilot-api versions up to 0.7.0 in the CORS function (a security feature that controls which websites can access an API from a web browser) of the token endpoint. The flaw allows a permissive cross-domain policy with untrusted domains, meaning attackers from other websites could potentially access the API remotely, and the exploit has been publicly disclosed.

Cyber Threat Attribution (CTA) is the process of identifying who carried out a cyberattack by analyzing evidence from the attack. This paper introduces ThreatMAMBA, an AI framework that improves CTA by building knowledge graphs from threat intelligence data (IOCs, or indicators of compromise that identify malicious activity; TTPs, or tactics and techniques used by attackers; and temporal relationships) and using machine learning to identify attackers even in the early stages of ongoing attacks. The system showed significant improvements in accuracy at different stages of attack development, suggesting it can provide reliable attribution information quickly during real incidents.

This paper addresses privacy and security concerns in collaborative data analysis by proposing a new method for computing Jaccard Coefficient (a mathematical measure comparing similarity between two sets). The proposed protocol protects sensitive information like intersection and union cardinalities (counts of shared and combined elements) while maintaining high accuracy and computational efficiency, and can be enhanced further using cloud-assisted encryption to improve performance by 25.5% to 30.4%.

Researchers discovered a critical vulnerability in Anthropic's Model Context Protocol (MCP, a system that allows AI models to interact with external tools and data) that allows attackers to run arbitrary commands on systems using vulnerable implementations. The flaw affects over 7,000 publicly accessible servers and has been found in popular AI projects like LangChain and LiteLLM, but Anthropic has declined to fix the underlying architectural issue, leaving developers responsible for protecting against it.

CISOs (chief information security officers, the top security leaders at companies) are expanding their roles beyond traditional cybersecurity to become broader business risk strategists who manage strategic, operational, and financial risks across their entire organizations. This shift reflects the fact that nearly all business operations are now digital, making any cyber risk a material business risk, and has accelerated since the rise of generative AI (AI systems like ChatGPT that can create new content) and agentic AI (AI systems that can take independent actions). Research shows that most CISOs now share responsibility for enterprise risk management with other executives and are expected to unify regulatory requirements, company risk tolerance, and security controls into a single operating model.

Frontier AI models (advanced AI systems with sophisticated reasoning abilities) can now autonomously discover software vulnerabilities and plan complex attack chains much faster than before, posing a major security threat. Open source software faces particularly high risk because these AI models can analyze publicly available source code to find bugs, whereas they struggle with compiled code (the executable, non-readable version). As these powerful AI models become widely available, attackers with minimal expertise may launch attacks at unprecedented speed and scale across the entire software ecosystem.

Researchers at Capsule Security discovered prompt injection vulnerabilities (attacks where malicious instructions are hidden in normal-looking inputs) in both Microsoft Copilot Studio and Salesforce Agentforce that allow attackers to trick AI agents into stealing data. In Microsoft's case, attackers can inject malicious commands into SharePoint forms to extract sensitive customer data and send it via email, while in Salesforce's case, they can embed harmful instructions in public lead forms to exfiltrate CRM data at scale.