AI Sec Watch

Webflow, a website-building platform, has acquired Vidoso, an AI content-generation startup that uses large language models (AI systems trained on text data to generate new text) to help companies create marketing materials like images, videos, and blog posts. The acquisition aims to help Webflow expand its marketing capabilities and address a key problem: frontier models (AI systems trained on general internet data) create generic content without understanding a company's specific brand rules and approval workflows.

Google and Samsung announced that Gemini, their AI assistant, can now automate tasks by controlling apps on your behalf through a virtual interface, starting with food delivery and rideshare services. Users can give simple text prompts and Gemini will interact with these apps to complete actions like ordering food or booking rides, which is a capability AI assistants have long promised but rarely delivered.

Bumble, a dating app company, has introduced 'Bee,' a generative AI assistant (software that creates text and generates responses) that learns users' preferences, values, and relationship goals through private conversations to recommend better matches. The AI will power a new feature called 'Dates' that identifies compatible users and notify both parties, and Bumble plans to expand Bee's use to features like date suggestions and match feedback in the future.

Bumble is launching an AI assistant called 'Bee' that learns users' dating preferences, values, and communication styles through private conversations to recommend more compatible matches. The AI-powered feature is currently in beta testing and will initially power a new matching experience called 'Dates,' with plans to expand into other areas like date suggestions and feedback collection.

Anthropic has updated Claude, its AI chatbot, to generate and display custom charts, diagrams, and other visual content directly in conversations when it determines visuals would be helpful. Examples include interactive visualizations like periodic tables or structural diagrams that users can click on for more details.

Gumloop, a platform that lets non-technical employees build AI agents (autonomous programs that handle multi-step tasks without human intervention) to automate work, just raised $50 million in funding from investment firm Benchmark. The company competes with tools like Zapier and Anthropic's Claude Co-Work, and investors believe its easy-to-use interface and flexibility to work with different AI models will help it dominate enterprise automation.

Palantir continues using Anthropic's Claude (a large language model, or LLM, which is AI software trained to understand and generate text) despite the Pentagon designating Anthropic a supply-chain risk (a company or product deemed potentially unreliable or unsafe for government use). The Department of Defense plans to phase out Anthropic's tools over six months, though exemptions may be granted for critical national security operations.

Microsoft and other major tech companies filed legal briefs supporting Anthropic's court challenge against a Pentagon designation that blocks the AI company from government work. Microsoft argued that the restriction would disrupt suppliers who use Anthropic's AI tools, including those providing systems to the US military.

The ha-mcp OAuth consent form has a cross-site scripting (XSS) vulnerability, where user-controlled data is inserted into HTML without escaping (the process of converting special characters so they display as text rather than execute as code). An attacker could register a malicious application and trick the server operator into visiting a crafted authorization URL, allowing the attacker to run JavaScript in the operator's browser and steal sensitive tokens. This only affects users running the beta OAuth mode, not the standard setup.