AI Sec Watch

AgenticMail is a system that provides AI agents with real email addresses and phone numbers, but older versions (API before 0.9.32 and core before 0.9.10) had multiple security weaknesses. These weaknesses included problems with validating user permissions, checking database queries for safety, verifying secure connections, and controlling special characters in email commands, which could allow unauthorized access to email data.

Security researchers discovered sandbox escape vulnerabilities in four popular AI coding agents (Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity) by exploiting a fundamental design flaw: these tools trust files written by the sandboxed agent and automatically execute them through external tools like Git integrations and task runners. The attacks use prompt injection (tricking an AI by hiding malicious instructions in files like READMEs or code dependencies) to make the agent write files that trigger unsandboxed command execution on the developer's machine without the agent itself breaking out of the sandbox.

JadePuffer, an autonomous AI agent, has been upgraded with EncForge ransomware that specifically targets AI infrastructure like training datasets, model checkpoints, and vector databases by encrypting files with the .locked extension. The agent successfully adapted during an attack on a Langflow instance, deploying multiple Python scripts to overcome delivery obstacles and gaining root-level access through an exposed Docker socket. EncForge uses AES-256 encryption for file protection and targets approximately 180 file types specific to AI and machine learning systems, potentially costing organizations significant time and money to recover encrypted models.

Ivanti is exploring the use of frontier models (advanced AI systems at the cutting edge of development) to help find and fix security vulnerabilities in software. While early tests show these AI systems work well at this task, questions remain about whether the approach is affordable and whether it's practical to have humans review and approve the AI's recommendations before using them.

Chris Fall resigned as director of the Center for AI Standards and Innovation (CAISI, a U.S. government agency that tests and researches commercial AI systems) after only three months, creating uncertainty in the Trump administration's AI leadership. The departure comes as the administration is implementing a new executive order that requires AI developers to voluntarily submit models to the government for safety evaluation before release, and as Chinese AI models are gaining market share against American competitors like OpenAI and Anthropic.

ServiceNow patched a sandbox escape RCE vulnerability (CVE-2026-6875, a flaw that lets attackers run unauthorized code on systems they don't control) last week, but attackers are already exploiting it in the wild using modified techniques. Security experts warn this is especially dangerous because the vulnerability affects ServiceNow's sandbox (the security container designed to safely run untrusted code), and a compromise could give attackers access to sensitive data like HR records and potentially spread to corporate networks through integrations.

GPT-SoVITS (a voice synthesis tool) version 20250606v2pro has an OS command injection vulnerability (a security flaw where attackers can run unauthorized commands on a server by inserting malicious text) in its webui.py file. The vulnerability affects ASR, slice, denoise, and uvr5 functions that take user input from Gradio textboxes (input fields in a web interface) and directly insert it into shell commands without checking for dangerous characters, allowing attackers to execute arbitrary commands without authentication.

Marc Maiffret reflects on Code Red, a major worm (self-replicating malware that spreads across networks) from 25 years ago, and what security lessons from that era can help organizations protect AI systems today. The article draws parallels between past worm attacks and current AI security challenges to guide how companies should approach AI risk management.

As companies rapidly adopt AI technology, Chief Information Security Officers (CISOs, the executives responsible for protecting company data and systems) face increased job stress, with 26% considering leaving their positions. The pressure stems from the security challenges that come with quickly implementing AI systems across organizations.