The security intelligence platform for AI teams
AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.
Independent research. No sponsors, no paywalls, no conflicts of interest.
OpenAI Launches ChatGPT for Teens with Enhanced Safety Controls: OpenAI introduced a dedicated version of ChatGPT for users aged 13-17 with features including Study Mode (which prompts students to work through problems rather than providing direct answers), human-reviewed parental alerts for harmful requests like eating disorder content, and options to disable human-like voice responses. The rollout comes amid growing pressure on AI platforms to implement age verification and youth-specific protections.
LLMs Leak Sensitive Data When Using Persistent Memory: Research found that frontier LLMs (the most advanced current systems) inappropriately share private details from past conversations at rates up to 69% attribute-level violations, even when explicitly instructed to protect privacy. The findings reveal that models struggle to make context-appropriate decisions about what information to share, tending to either overshare or withhold everything rather than apply nuanced judgment.
AI Excels at Finding Zero-Days but Doubles Security Flaw Rates in Generated Code: While LLMs demonstrate growing capability in discovering zero-day vulnerabilities (previously unknown security flaws) and building exploits, AI-generated code contains security weaknesses at roughly twice the rate of human-written code, with 44% containing at least one OWASP Top 10 vulnerability (the most critical categories of code weaknesses). Despite 99% syntax correctness, the asymmetry between AI's offensive and defensive security capabilities remains unexplained.
This recap highlights how attackers are exploiting trusted tools and marketplaces rather than breaking security controls directly. Key threats include malicious skills appearing in ClawHub (a registry for AI agent add-ons), a record-breaking 31.4 Tbps DDoS attack (a flood attack that overwhelms servers with massive traffic), and compromised update infrastructure for Notepad++ being used to distribute malware. The pattern shows attackers are abusing trust in updates, app stores, and AI workflows to gain access to systems.
Fix: OpenClaw has announced a partnership with Google's VirusTotal malware scanning platform to scan skills uploaded to ClawHub as part of a defense-in-depth approach to improve security. Additionally, the source notes that open-source agentic tools like OpenClaw require users to maintain higher baseline security competence than managed platforms.
The Hacker News