AI Sec Watch

Claude, an AI assistant, discovered a critical remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in Apache ActiveMQ that had gone undetected for 13 years. The bug allows attackers to trick ActiveMQ's management API into loading a malicious file from the internet and executing arbitrary commands, especially if default login credentials are still in use. Claude identified the complete exploit chain in about 10 minutes, a task that would have taken a human researcher roughly a week.

AI browser extensions are a major security blind spot in enterprises because they operate inside browsers with direct access to user data, passwords, and cookies while bypassing traditional security monitoring tools like DLP (data loss prevention, which blocks sensitive information from leaving a network) and SaaS logs. The report shows AI extensions are significantly riskier than regular extensions: they are 60% more likely to have CVEs (known software vulnerabilities), 3 times more likely to access cookies, and 6 times more likely to increase their permissions over time, yet 99% of enterprise users have at least one extension installed with little organizational visibility into which ones exist or what they can access.

N/A -- The provided content does not contain substantive information about a specific AI or LLM security issue. It appears to be metadata and navigation elements from Bruce Schneier's security blog, listing essay titles and tags rather than discussing an actual technical problem or vulnerability.

Microsoft is removing Copilot buttons (shortcuts to access its AI assistant) from several Windows 11 apps, including Notepad and Snipping Tool, replacing them with alternative menus like "writing tools." The underlying AI features remain available, but the company is reducing the number of ways users can directly access Copilot across its applications.

US Treasury Secretary Scott Bessent summoned major American bank leaders to a meeting in Washington to discuss cybersecurity risks from Anthropic's new Claude Mythos AI model. Federal Reserve Chair Jerome Powell attended the meeting, which was called after Anthropic released the model and warned it poses unprecedented cybersecurity threats.

A path traversal vulnerability (a weakness that lets attackers access files outside their intended directory) was found in the chatgpt-on-wechat CowAgent software version 2.0.4 and earlier, specifically in the memory API endpoint where it processes a filename argument. This flaw can be exploited remotely by attackers, and proof-of-concept code has already been published online.

Alibaba is investing $290 million in ShengShu, a startup developing world models (AI systems trained on videos and physical scenarios rather than just text) to better understand and replicate the real world. This shift reflects growing recognition that large language models (LLMs, which are AI trained mainly on text data) have limitations, and companies are now focusing on AI that can work with robots and other systems that need to understand physical reality.

OpenAI sent a memo to investors criticizing Anthropic, its main rival in the AI market, saying Anthropic is limited by compute constraints (the computing power needed to train and run AI models). OpenAI claims it will have significantly more computing capacity than Anthropic by 2030, giving it a competitive advantage in developing more capable AI models and lowering costs. Both companies are competing intensely in the large language model (LLM, an AI trained on vast amounts of text to generate human-like responses) market and preparing for potential public stock offerings.

This article describes how ChatGPT can help with brainstorming by quickly generating ideas, organizing them into clear themes, and turning rough directions into executable plans. The AI acts as a thought partner to overcome common brainstorming obstacles (too few or too many unstructured ideas) by expanding options, adding structure through frameworks, and helping test plans for weaknesses.