AI Sec Watch

FastGPT (a platform for building AI agents) has a broken access control vulnerability (IDOR/BOLA, a flaw where one user can access another user's data by guessing or changing IDs) that allows any authenticated team to run AI applications belonging to other teams by using a different application ID. The system checks that users are logged in but doesn't verify that the application they're trying to use actually belongs to their team, leading to unauthorized access to private AI workflows across teams.

n8n-mcp (a tool for connecting AI systems to external services) had security problems where certain HTTP endpoints (the connection points a program offers over the internet) didn't require authentication and exposed sensitive system information. An attacker with network access could shut down active sessions and gather details to plan further attacks.

The LangSmith JavaScript SDK contains a prototype pollution vulnerability (a type of attack where an attacker modifies the base object that all JavaScript objects inherit from) in its internal lodash `set()` function. The vulnerability exists because the code only blocks the `__proto__` key but allows attackers to bypass this protection using `constructor.prototype` instead, potentially affecting all objects in a Node.js application if they control data being processed by the `createAnonymizer()` API.

PraisonAI's browser bridge server (started with `praisonai browser start`) has a security flaw where it accepts WebSocket connections (a two-way communication channel between a client and server) without proper authentication checks. An attacker on the network can connect without credentials, trick the server into linking their connection to a legitimate browser extension session, and then intercept all commands and responses from that session, effectively taking control of the browser automation without permission.

PraisonAI Agents has a security flaw where tool approval decisions are cached by tool name only, not by the specific command arguments. Once a user approves the `execute_command` tool (a function that runs shell commands) for any command like `ls -la`, all future shell commands in that session bypass the approval prompt entirely. Combined with the fact that all environment variables (including API keys and credentials) are passed to subprocesses, an LLM agent can silently steal sensitive data without asking permission again.

A new vulnerability (CVE-2026-34040, rated 8.8 on the CVSS score, a 0-10 severity rating) allows attackers to bypass authorization plug-ins (add-on security tools that control who can run Docker commands) in Docker Engine and gain root-level access to host systems. The flaw exploits the same underlying problem discovered in 2016, where oversized API requests (over 1MB) are silently dropped before the authorization plug-in can inspect them, causing the plug-in to approve requests it cannot see, which Docker then executes in full.

Anthropic released Claude Mythos Preview, an AI model that can automatically discover vulnerabilities (weaknesses in software) and create working exploits (code that takes advantage of those weaknesses) across operating systems and software products. The company is currently limiting access to a few dozen organizations through Project Glasswing to give defenders time to find and fix weaknesses in their own systems before attackers gain widespread access to the model.

This research paper examines how visual explanation techniques can help protect federated learning (a machine learning approach where multiple computers train a model together without sharing raw data) from poisoning attacks (attempts to corrupt the training data or model). The authors propose an enhanced version of LayerCAM (a method that visualizes which parts of an input an AI focuses on), combined with autoencoders (neural networks that compress and reconstruct data), to detect and defend against such attacks.

A cyber-attack on a London pathology company in June 2024 caused widespread hospital disruptions and contributed to a patient's death, highlighting real dangers from digital attacks. The article warns that a new AI release could enable more frequent and severe cyber-attacks by giving attackers powerful hacking capabilities, potentially creating widespread chaos in critical digital systems we depend on.