AI Sec Watch

Researchers developed a new attack method called Perspective-Invariant Attack (PIA) that generates adversarial examples (inputs crafted to fool AI models) with improved transferability across different neural networks. By using geometric transformations that simulate different viewpoints (perspective changes), PIA makes adversarial perturbations (small, intentional changes) less dependent on the original model they were designed to attack, allowing them to more successfully fool other models including large language models.

Fireworks, an Nvidia-backed startup that hosts AI models on cloud infrastructure (computing servers that developers can access over the internet), has reached a $17.5 billion valuation by helping companies use cheaper and more specialized AI alternatives instead of expensive models from major labs like OpenAI and Anthropic. The company is growing rapidly because finance executives are pushing their teams toward open-source models (freely available code that anyone can use and modify) to reduce costs, and Fireworks makes it easy for developers to customize these models with their own data for specific tasks.

1Password has created a new integration that lets Claude (an AI chatbot made by Anthropic) access your stored login credentials to complete tasks like booking travel without you having to type them in manually. The system uses a 'zero-exposure security framework' that shares credentials with Claude only when needed, without revealing them to Anthropic's servers.

OpenAI has unveiled GPT-Red, an AI system that automates red-teaming (a type of security testing where evaluators try to find ways to break or hijack a system), traditionally done by human testers. The goal is to identify as many vulnerabilities as possible before attackers can exploit them, potentially helping OpenAI stay ahead of malicious actors.

The European Union ordered Google to give rival AI assistants and search engines better access to key parts of Android (Google's mobile operating system) and Google Search, aiming to reduce Google's control over these major platforms. Google must start sharing search data by January 2027 and make Android changes by July 2027. These decisions could reshape how Google's AI tool Gemini operates and create new opportunities for competitors.

Researchers discovered a new attack called agent data injection (ADI), where attackers plant fake information in data that AI agents trust, like email sender names or button IDs, causing the agents to misclick or run unintended commands while still completing their original task. Unlike prompt injection (hiding commands in text input), ADI works by corrupting small facts the agent relies on, using fake punctuation characters that language models often misread as real delimiters even though a strict parser would ignore them. The attack successfully compromised real tools including web agents (Claude, Google's Antigravity, Nanobrowser) and coding assistants (Claude Code, OpenAI's Codex, Google's Gemini CLI).

Nvidia announced Cosmos 3 Edge, a world model (a system that learns from various inputs to help robots and AI agents understand and move through physical environments in real time), as part of its expansion into Japan's AI market. The company is forming partnerships with major Japanese firms like Fujitsu, Hitachi, and Kawasaki Heavy Industries, and is also investing in healthcare and drug discovery through initiatives like the Tokyo-1 AI drug discovery consortium.

Google DeepMind and Isomorphic Labs are developing AI tools to improve society's ability to prevent, detect, and respond to disease outbreaks and biosecurity threats. Their approach includes using AI models like AlphaFold (which maps protein structures) and drug design systems to help researchers create vaccines and treatments, while also implementing safeguards to prevent misuse of their AI systems by bad actors.

The WPBot plugin for WordPress (a platform for building websites) has a security flaw where it doesn't properly check if users have permission to perform certain actions, allowing subscribers and higher-level users to re-embed stored RAG documents (external documents that an AI uses to answer questions). This vulnerability lets attackers waste the site owner's paid API credits (money spent on third-party AI services like OpenAI or Gemini) by triggering unnecessary document processing.