The security intelligence platform for AI teams
AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.
Independent research. No sponsors, no paywalls, no conflicts of interest.
OpenAI Launches ChatGPT for Teens with Enhanced Safety Controls: OpenAI introduced a dedicated version of ChatGPT for users aged 13-17 with features including Study Mode (which prompts students to work through problems rather than providing direct answers), human-reviewed parental alerts for harmful requests like eating disorder content, and options to disable human-like voice responses. The rollout comes amid growing pressure on AI platforms to implement age verification and youth-specific protections.
LLMs Leak Sensitive Data When Using Persistent Memory: Research found that frontier LLMs (the most advanced current systems) inappropriately share private details from past conversations at rates up to 69% attribute-level violations, even when explicitly instructed to protect privacy. The findings reveal that models struggle to make context-appropriate decisions about what information to share, tending to either overshare or withhold everything rather than apply nuanced judgment.
AI Excels at Finding Zero-Days but Doubles Security Flaw Rates in Generated Code: While LLMs demonstrate growing capability in discovering zero-day vulnerabilities (previously unknown security flaws) and building exploits, AI-generated code contains security weaknesses at roughly twice the rate of human-written code, with 44% containing at least one OWASP Top 10 vulnerability (the most critical categories of code weaknesses). Despite 99% syntax correctness, the asymmetry between AI's offensive and defensive security capabilities remains unexplained.
Attackers can use large language models (LLMs, AI systems trained on vast amounts of text to generate human-like responses) to create phishing pages that appear safe at first but transform into malicious sites after a victim visits them. The attack works by having a webpage secretly request the LLM to generate malicious JavaScript (code that runs in web browsers) using carefully crafted prompts that trick the AI into ignoring its safety rules, then assembling and running this code inside the victim's browser in real time. Because the malicious code is generated fresh each time and comes from trusted AI services, it bypasses traditional network security checks.
Fix: The source explicitly recommends runtime behavioral analysis to detect and block malicious activity at the point of execution within the browser. Palo Alto Networks customers are advised to use Advanced URL Filtering, Prisma AIRS, and Prisma Browser with Advanced Web Protection. Organizations are also encouraged to use the Unit 42 AI Security Assessment to help ensure safe AI use and development.
Palo Alto Unit 42