AI Sec Watch

Claude Code, an agentic coding tool (software that can write and execute code), had a vulnerability before version 1.0.39 where it could run code from yarn plugins (add-ons for the Yarn package manager) before asking the user for permission, but only on machines with Yarn 3.0 or newer. This attack required tricking a user into opening Claude Code in an untrusted directory (a folder with malicious code).

This research addresses challenges in federated learning (FL, a method where multiple institutions train an AI model together without sharing private data) by introducing FedDPO, which uses reinforcement learning (a type of AI that learns through trial and error feedback) to automatically adjust regularization terms (mathematical penalties that stabilize training) for each participant based on their unique data and system conditions. The approach also uses local batch normalization (a technique that normalizes data within each institution) to handle differences in how data is distributed across institutions, and testing on medical image classification tasks shows it outperforms existing methods.

This research addresses a problem where image de-raining AI models (systems that remove rain from photos) perform poorly on real-world rainy images because they are trained on limited datasets. The researchers propose a framework inspired by how human brains learn and remember, using generative adversarial networks (GANs, AI systems that generate synthetic images) to capture features of new rainy data and then train the de-raining model with both real and synthetic data, similar to how the brain replays memories to strengthen learning.

Slither-MCP is a new tool that connects LLMs (large language models) with Slither's static analysis engine (a tool that examines code without running it to find bugs), making it easier for AI systems to analyze and audit smart contracts written in Solidity (a programming language for blockchain). Instead of using basic search tools, LLMs can now directly ask Slither to find function implementations and security issues more accurately and efficiently.

PyTorch versions 2.5 and 2.7.1 have a bug where forgetting to call profiler.stop() can cause torch.profiler.profile (a Python tool that measures code performance) to crash or hang, resulting in a Denial of Service (DoS, where a system becomes unavailable). The underlying issue involves improper locking (a mechanism that controls how multiple processes access shared resources).

A flaw in the Observability Operator allows an attacker with limited namespace-level permissions to escalate their access to the entire cluster by creating a MonitorStack resource and then impersonating a highly-privileged ServiceAccount (a Kubernetes identity that the Operator automatically creates). This privilege escalation (gaining unauthorized higher-level access) could let an attacker take control of the entire Kubernetes cluster.

The WP Import – Ultimate CSV XML Importer plugin for WordPress has a security flaw in versions up to 7.33 where the showsetting() function is missing an authorization check (a verification that the person accessing it has permission). This allows authenticated attackers with Author-level access or higher to extract sensitive information, including OpenAI API keys (secret credentials used to access the OpenAI service) that are configured through the plugin's admin interface.

This research proposes FGE-GAN (fuzzy graph evolutionary generative adversarial network, a deep learning model that uses fuzzy graphs to handle uncertainty in disease data) to predict Alzheimer's disease risk and identify disease pathways. The model treats Alzheimer's progression as the spread of fuzzy entropy (uncertain information) through interconnected disease factors, and experiments show it outperforms existing methods at predicting disease risk.

CVE-2025-33202 is a stack overflow vulnerability (a memory safety bug where a program writes too much data into a reserved area of memory) in NVIDIA's Triton Inference Server for Linux and Windows. An attacker could exploit this by sending extremely large data payloads, potentially crashing the service and making it unavailable to users (denial of service).