The security intelligence platform for AI teams
AI security threats move fast and get buried under hype and noise. Built by an Information Systems Security researcher to help security teams and developers stay ahead of vulnerabilities, privacy incidents, safety research, and policy developments.
Independent research. No sponsors, no paywalls, no conflicts of interest.
Google's DeepMind Falls Behind in Frontier Model Race: Google's AI division has lost ground to OpenAI and Anthropic in developing the most advanced AI systems, prompting a leadership change to close the performance gap, particularly in coding capabilities where competitors hold significant advantages.
Critical Flaw in OpenAI, Anthropic, and Google APIs Exposes Hidden Reasoning: Researchers discovered a vulnerability in how major AI providers handle encrypted reasoning objects (encrypted data storing an AI's hidden thinking between API calls) that allowed weaker models to decode stronger models' concealed thoughts, exposing API keys, passwords, private user data, and enabling injection of malicious prompts inside supposedly opaque blocks.
Snowflake Python API Vulnerability Enables Privilege Escalation: CVE-2026-19594 in Snowflake Python API versions before 1.13.0 allowed attackers to bypass security restrictions through path traversal (using `..` to access parent resources) and HTTP parameter pollution (injecting special characters to alter request interpretation), potentially executing privileged operations under higher-permission accounts.
Fujitsu's OneCompression Library Vulnerable to Code Execution via Malicious Models: CVE-2026-73325 in OneCompression 1.2.0 unsafely deserializes (converts data back into executable code) checkpoint files using Python's pickle module, allowing attackers to run arbitrary commands by embedding malicious instructions in model.pt files that execute when the library loads them.
Context Bombing Uses Prompt Injections as Defensive Tool: Researchers demonstrated that embedding prompt injections (hidden instructions that override AI guidelines) alongside secrets in cloud storage can disable AI hacking agents by triggering their guardrails (built-in protections preventing harmful outputs), causing the agents to shut down rather than follow attacker instructions.