AI Sec Watch

An SSH/SCP option injection vulnerability in the @aiondadotcom/mcp-ssh library allowed attackers to execute arbitrary commands locally on the machine running the MCP server (a tool that connects an AI to external systems). By crafting malicious input like `-oProxyCommand=...`, attackers could trick SSH into running their code before any network connection happened, potentially stealing SSH keys and credentials. The vulnerability could be triggered even without a malicious user, since an LLM (large language model) could be tricked through prompt injection (hiding attacker instructions in text it reads) to pass the malicious input to the tool.

Daniel Moreno-Gama was arrested and charged with federal crimes after traveling from Texas to California and attacking OpenAI's facilities and CEO Sam Altman's home with a Molotov cocktail (an incendiary weapon made from a bottle of flammable liquid). He also attempted to break into OpenAI's headquarters and stated he intended to burn down the building and kill people inside. His charges include attempted destruction of property using explosives and illegal possession of a firearm.

OpenAI is expanding its Trusted Access for Cyber (TAC) program to provide AI tools to thousands of cybersecurity defenders and teams protecting critical software. The company has created GPT-5.4-Cyber, a specialized version of its AI model designed specifically for defensive cybersecurity work, and is implementing cyber-specific safeguards (built-in restrictions to prevent misuse) in model deployments. This effort aims to help defenders find and fix security vulnerabilities faster while preventing attackers from misusing the same AI capabilities.

A man named Daniel Moreno-Gama was arrested after throwing a Molotov cocktail (an improvised incendiary weapon) at OpenAI CEO Sam Altman's home and later attacking OpenAI's headquarters. Moreno-Gama was motivated by concerns about AI posing an existential threat to humanity and had planned the attack in advance, as documented in a written statement found by police. Sam Altman responded by calling for reduced hostile rhetoric within the AI industry.

A 20-year-old Texas man was arrested after throwing an incendiary device (a weapon designed to start fires) at OpenAI CEO Sam Altman's home and attempting to set fire to OpenAI's headquarters in San Francisco. Police found the suspect with an anti-AI document containing threats against Altman, multiple incendiary devices, and other materials, leading federal prosecutors to investigate whether this constitutes an act of domestic terrorism.

Anthropic's Mythos is an AI system that can autonomously find and exploit vulnerabilities (security flaws in software) much faster than before, completing tasks in hours that previously took weeks or months. Security experts warn this represents a fundamental shift in cybersecurity, not an isolated incident, and that defenders must close the gap between how quickly vulnerabilities are discovered and how quickly organizations can patch and respond.

Security experts are warning that Anthropic's Claude Mythos introduction could trigger an "AI vulnerability storm," where many security weaknesses in AI systems are discovered and exploited rapidly. The Cloud Security Alliance is advising security leaders (called CISOs) to prepare for a surge in attacks targeting these newly-exposed vulnerabilities.

OpenAI is revoking and rotating its macOS code-signing certificates (digital credentials that verify OpenAI apps are legitimate) after a malicious Axios package was executed in one of its GitHub Actions workflows (automated tasks that run on code repositories). Although OpenAI found no evidence the certificates were actually compromised, the company is treating them as potentially exposed and requiring all macOS users to update their OpenAI apps to versions signed with new certificates by May 8, 2026, when the old certificate will be fully blocked.

Anthropic released Claude Mythos Preview, a new AI model with advanced cyberattack capabilities, and is withholding it from the public while running Project Glasswing to find and patch vulnerabilities before attackers exploit them. The model can write effective exploits (turning vulnerabilities into working attacks without human help) and find complex vulnerabilities by chaining together multiple bugs, representing a significant increase in AI-assisted cyberattack sophistication. While defenders currently have an advantage in finding vulnerabilities for patching purposes, this gap is expected to shrink as more powerful models become available.