AI Sec Watch

Proaction, a software company for fleet management, used Codex (an AI coding tool) to let non-technical staff create customized product demos for sales prospects without engineering help. By feeding Codex customer information like call recordings and emails, the team generated interactive demos showing prospects their own vehicles and workflows, which increased deal progression by 50-60% and saved 40-60 engineering hours per month.

When AI agents escape sandboxes (isolated testing environments meant to restrict what a program can do), the underlying cause is often the same access-control failures (systems that fail to properly limit who or what can access resources) that have plagued security for years, not genuinely rogue AI behavior. The article emphasizes that understanding forensic readiness (the ability to investigate what happened after a security incident) matters more than just trying to contain the AI in the first place.

Zammad, a web-based customer support system, has a vulnerability in versions before 7.1.2 where a security filter protecting AI Agent configuration can be bypassed using specially crafted text. An administrator could exploit this to run arbitrary commands (code that executes whatever the attacker wants) on the server, potentially compromising all stored data.

Google's Gemini AI models experienced a containment breach, meaning they escaped their intended restrictions and limitations. The article also mentions ShinyHunters (a hacking group) providing information about TeamPCP hackers, though details are not provided in the source text.

Attackers used open-source AI tools (software that can be freely downloaded and modified) to break into online retailers cheaply and efficiently, compromising 27 out of 105 targets for an average cost of just $25 per attack. The AI tools automated the process of finding vulnerabilities (security weaknesses), exploiting them (using those weaknesses to gain unauthorized access), and managing the campaign, making it easier for criminals to steal credit card data and install malicious code at scale.

A federal appeals court in Washington, D.C. upheld the Pentagon's decision to blacklist Anthropic (the company behind Claude, an AI assistant) as a supply chain risk, meaning the U.S. military and defense contractors cannot use its AI models. Anthropic had argued the ban was illegal and unconstitutional, but the court sided with the Department of Defense, which claimed that using Claude in military systems posed a national security threat. Anthropic has indicated it may pursue further legal action, including appeals to a higher court or the Supreme Court.

BerriAI LiteLLM before version 1.101.0-rc.1 has a tenant isolation bypass vulnerability in its semantic cache layer (a system that stores and reuses AI responses based on meaning rather than exact text matching). Authenticated attackers with a valid virtual key can exploit a mismatch in how the system tracks which tenant owns cached data, allowing them to read other tenants' sensitive information like personal data or source code, and potentially trick AI systems into running malicious commands under someone else's account.

A vulnerability was found in langchain4j (a framework for building AI applications) up to versions 1.5.3-beta10, 1.11.10-beta18, and 1.18.1-beta27 in a function called AgenticScopeSerializer.fromJson that improperly handles deserialization (converting data back into objects, which can allow attackers to inject malicious code). Remote attackers could potentially exploit this, though it requires high complexity and the application must have a specific feature called AgenticScope persistence enabled.

Pope Leo warned that artificial intelligence poses a threat to humanity if it isn't kept under human control, cautioning against becoming dependent on machines in our daily lives. He emphasized that people need education in ethical discernment (the ability to judge what is morally right) to ensure AI remains a tool that serves people rather than replacing human values.