AI Sec Watch

As companies rapidly adopt AI technology, Chief Information Security Officers (CISOs, the executives responsible for protecting company data and systems) face increased job stress, with 26% considering leaving their positions. The pressure stems from the security challenges that come with quickly implementing AI systems across organizations.

Cybersecurity researchers discovered nearly 7,600 malicious GitHub repositories spreading SmartLoader malware, with over 800 posing as AI skills or MCP servers (Model Context Protocol servers, which are tools that help AI assistants perform specialized tasks). A particularly dangerous aspect called AgentBaiting allows AI agents like Claude, Gemini, and ChatGPT to inadvertently discover these fake repositories and execute malware without human intervention, by simply searching for legitimate-sounding tools. The attack leverages copied projects, fake developer profiles, and convincing documentation to trick both users and AI systems into downloading malicious files.

Chinese AI company Moonshot released Kimi, a free open-source AI model that performs as well as paid models from US companies like OpenAI and Anthropic, causing disagreement among Trump's AI advisors about how to respond. The situation creates economic and political problems for the Trump administration because free Chinese models reduce demand for expensive US models, while also raising questions about whether the government should intervene to protect US companies or allow open competition.

WhatsApp MCP Server before version 0.2.1 has a critical security flaw where its HTTP API runs without authentication or Host header validation (a check that prevents attackers from impersonating the service), allowing local processes or remote attackers to send WhatsApp messages, steal sensitive files like SSH keys, and exfiltrate data without permission. This vulnerability is especially dangerous in MCP environments (where Claude can use multiple tools together) because sibling servers and IDE extensions running in the user's session can exploit it.

AMD has launched Helios, its first rack-scale system (a large computing unit designed for data centers) for AI, which competes with Nvidia's similar systems and has attracted major customers including Microsoft, Meta, and OpenAI. The system combines AMD's own GPUs (graphics processing units, specialized chips for AI calculations), CPUs (central processing units, the main processors), networking, and software to offer what AMD claims is the lowest cost per token (the cost to process individual units of text in AI models). AMD will begin shipping Helios to customers later this year.

AI is being adopted quickly across businesses, but security programs haven't kept pace, creating a gap where organizations struggle to understand their actual risks. Traditional security problems like weak access controls (permissions given too broadly) and poor logging (records of system activity) become more dangerous when AI agents connect to company data and workflows, potentially spreading damage from a small issue into something that affects the entire business. Security leaders are now expected to help businesses move fast with AI while identifying which initiatives are safe, where the company is exposed, and what needs immediate action.

Alphabet is developing a specialized AI chip called 'Frozen v2' that embeds parts of its Gemini model (a large language AI) directly into the hardware to run queries more efficiently, potentially serving 6-10 times more tokens (text units) per unit of power than current chips. The company aims to deploy it by 2028 to address internal computing shortages, though the chip would only work with future Gemini models if Google maintains the same underlying architecture.

Adversarial training (a method where AI models learn to defend against adversarial attacks, which are inputs designed to fool the model) typically requires expensive multi-step calculations, so researchers use single-step versions to save computing power. However, single-step methods create some misleading adversarial examples, called "fakers," that actually weaken the model instead of strengthening it. This paper proposes FAST (Faker-Alleviating Single-step adversarial Training), which reduces the impact of fakers during training by dynamically adjusting how the model learns from difficult examples and introducing auxiliary samples to stabilize the training process.

Object detectors used in safety-critical systems are vulnerable to physical adversarial patch attacks (images or objects designed to fool AI vision systems), which work by disrupting how information flows through layers of the neural network rather than simply corrupting visual features. The paper proposes CaDe, a defense method that uses hierarchical stability constraints and adaptive sparse causal decoupling to stop adversarial perturbations from propagating through the network layers, improving detection accuracy by 5-6% against these attacks while maintaining real-time performance.