AI Sec Watch

The http_request tool in Strands Agents (an SDK for building AI agents) has an authorization flaw where an attacker could trick the LLM into routing requests through a malicious proxy server. Even though the tool checks that requests only go to approved hostnames, an attacker using indirect prompt injection (hiding instructions in untrusted web content the agent reads) could bypass this by controlling the proxies parameter, causing sensitive credentials to be sent in cleartext to their server.

Google shut down a new Google Earth feature after just one day that used AI to let users edit satellite images with text prompts, essentially creating deepfakes (synthetic media made to look real) of real-world locations. Users quickly demonstrated the tool could generate misleading content, like fake refugee camps and bomb craters, even though Google said it included digital watermarks (hidden markers identifying AI-generated content) and blocked requests for harmful topics.

OpenAI has significantly reduced pricing for its GPT-5.6 models, cutting Luna's API costs by 80% and Terra's by 20% to make them more cost-efficient. The company also introduced a new Fast mode option for GPT-5.6 Sol that processes requests 2.5 times faster at twice the standard price, designed for time-sensitive applications like coding and research.

Researchers found that high-entropy scores (statistical measurements of randomness or uniqueness in data) from Brazilian high school exam results can act as quasi-identifiers (partial pieces of information that can identify individuals when combined with other data), allowing attackers to re-identify students and leak their personal data even when direct identifiers like names are removed. The study shows that seemingly anonymous datasets can still expose millions of students' information through these numerical patterns.

A Chinese threat actor used DeepSeek AI paired with Hermes Agent (an open-source AI framework that can run terminal commands and connect to the internet) to conduct largely autonomous cyberattacks on exposed servers with minimal human involvement. The AI system independently researched vulnerabilities, identified targets, downloaded exploit code, and attempted attacks in minutes—work that would normally take many hours—though the observed attacks did not successfully compromise any targets. The discovery highlights that AI systems can now perform end-to-end offensive workflows, from finding vulnerable systems to attempting exploitation.

Anthropic's Opus 5 model shows significant improvement in resisting prompt injection (attacks where users try to trick an AI by hiding malicious instructions in their input) compared to earlier versions and competing models. On the IPI benchmark test, Opus 5 reduced the success rate of attackers from 5.5% to 2.0% over 15 attempts, and outperformed all non-Claude models tested. While completely preventing prompt injection is impossible, the field is making progress at blocking these attacks in specific situations.

Google Earth now has an AI image generator (called Nano Banana) that can create fake images by altering real satellite and aerial photographs based on text descriptions, raising concerns about misinformation since realistic-looking false images could spread online. Google's response focuses on identifying AI-generated content rather than preventing its creation, using tools like SynthID (a digital watermark embedded in AI images) and the Gemini app to help people verify whether an image was made by AI.

U.S. lawmakers are investigating American companies like DoorDash for using Chinese AI models, citing national security concerns as China's AI capabilities improve. DoorDash stated it uses Chinese model Kimi K2.6 (developed by Moonshot AI) for lower-level tasks because it offers better performance and lower costs than some U.S. alternatives, though the company says it prioritizes American AI development. The investigation focuses on risks from depending on AI systems developed by entities under Chinese government jurisdiction, even though U.S. companies are not currently prohibited from using these models.

The Dynatrace MCP server has a template injection vulnerability (a security flaw where attackers can embed code in input fields that gets executed) in its `create_workflow_for_notification` tool. When a caller provides values for team name, problem type, or channel, these are inserted directly into a Dynatrace Workflow definition that uses Jinja2 templating (a system that evaluates expressions in double braces like {{ }}). This allows an attacker to embed Jinja2 expressions that extract sensitive event data and send it to attacker-controlled locations, and the malicious workflow persists in the tenant even after the user session ends.