AI Sec Watch

A vulnerability called bucket squatting (exploiting unprotected cloud storage locations) in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions before 1.166.1 lets attackers run arbitrary code on systems (RCE, remote code execution) and steal authentication tokens belonging to tenant projects (shared computing environments).

AI models are developing their own unusual dialects (unique ways of communicating) that mix poetic language with tech jargon, making them difficult for humans to understand and monitor. Researchers are concerned that as AI agents communicate autonomously in these hard-to-read languages, it becomes harder for people to oversee what the AI systems are doing.

Vercel ran a $1 million bug-bounty program for two weeks to find security flaws in its sandbox (an isolated environment for running untrusted AI code), receiving 1,285 reports. The most significant finding was two independent defects in the Linux kernel's networking stack that could leak memory from the host system or crash it, affecting many cloud providers that use the same isolation approach. No reports successfully accessed real customer data, but the discovered kernel flaws were reported to Linux maintainers ahead of public disclosure.

Exein, an IoT (Internet of Things, devices connected to the internet like sensors and smart devices) cybersecurity startup, raised $270 million to reach a $1.7 billion valuation. The company has built security technology that detects and blocks attacks on IoT devices, and is now developing a foundation model (a large AI model trained on broad data that can be adapted for specific tasks) focused on Physical AI security to protect machines at the speed attacks now happen.

CodeRAG, a tool that helps AI coding agents search through code, has a security flaw in versions before 1.3.1 where it automatically runs build files from repositories without checking if they're safe. An attacker can hide malicious code in a fake Gradle repository (a build system for Java projects), and when someone uses CodeRAG to index that repository, the hidden code runs with the user's full system permissions, potentially allowing the attacker to steal data, change files, install backdoors, or crash the system.

ATLAS v2026.09 is an updated database of AI security threats that now includes 120 techniques and 40 mitigations for defending AI systems. The update adds new attack methods like prompt injection (tricking an AI by hiding malicious instructions in its input), AI agent compromises, and exposed AI infrastructure scanning, along with new defensive strategies including AI honeypots (fake AI systems designed to catch attackers).

Meta is launching subscription bundles called Meta One that combine its social media app subscriptions with extra AI usage, including access to its new AI assistant called Muse. The company says the basic experience will remain free, and users can still buy individual subscriptions without bundling.

This article describes synchronous control monitoring, a safety technique where a monitoring system watches an autonomous agent (a program that can act independently) in real time and blocks harmful actions before they happen, operating at very fast speeds (under 100 milliseconds). The approach continuously analyzes the agent's execution trace (a record of what the agent is doing) to catch and prevent problems, and was developed following a security incident at Hugging Face that highlighted the need for better runtime safety checks.

Exaforce has expanded its AI Security tool to monitor AI agents from multiple providers (Claude, OpenAI, Gemini, Microsoft Copilot) by correlating existing security data that enterprise security teams already collect, rather than requiring new monitoring software. When threats are detected, the tool can take actions like revoking sessions, deactivating API keys, isolating devices, or ending agent processes using existing security controls. However, experts note this passive approach may be weaker at runtime inspection (monitoring what's happening as it happens) and automatic blocking compared to dedicated agent security solutions.