AI Sec Watch

Anthropic announced a discovery that provides insight into how Claude (an AI model) reasons internally by examining its 'thoughts' as it works through problems. The article notes this research shows a new window into AI model operations, though the full implications of what this reveals about how AI systems actually work remain unclear.

AI security systems currently make decisions based on fragmented data from separate tools, which cannot detect real attack paths because attackers chain exposures across multiple systems in ways individual tools don't see. The article argues that AI security workflows need validation (testing whether vulnerabilities can actually be exploited in a real environment) rather than just severity scores, so teams act on proven attack evidence instead of guesswork. Pentera addresses this by using AI to safely emulate real attacker techniques against production environments and generate validated attack paths showing exactly how an attacker could move through the system.

This article discusses how enterprise leaders should manage spending on AI tools as they move from simple chat interfaces to more complex, longer-running workflows. It recommends focusing on the actual value delivered (tasks completed, time saved) rather than just the cost per token (a unit of text the AI processes), and emphasizes the need for better visibility into who is using AI, what they're using it for, and how much it costs.

Grok Build, xAI's coding assistant, was uploading entire Git repositories (a version control system that tracks code changes) to cloud storage, not just the files it needed to read. A researcher discovered that a 12 GB repository generated only 192 KB of traffic to the model but 5.10 GB to storage, and even files the AI was instructed not to open were included, along with unredacted credentials like API keys and passwords. Unlike competing tools from Claude and Google, Grok Build was the only one collecting the entire workspace.

Most organizations have AI systems in production but lack incident response (IR) playbooks specifically designed for AI failures, relying instead on traditional security frameworks that don't address AI-specific problems. AI incidents fall into two categories with very different causes and defenses: model-originated failures (like hallucinations or bias that happen during normal operation) and externally induced failures (like adversarial attacks or data poisoning), plus hybrid cases where AI errors create legal liability. Traditional security frameworks like the CIA triad (confidentiality, integrity, availability) don't detect many AI incidents because they assume deterministic, static failures, but AI systems produce probabilistic outputs that can't be patched like code vulnerabilities.

Attackers are increasingly using AI agents (autonomous AI systems that can perform multiple tasks without human control) to automate all stages of cyberattacks, from initial entry to stealing data and establishing persistence (maintaining long-term unauthorized access). This automation dramatically speeds up attacks compared to traditional manual hacking, and security experts warn that most organizations haven't updated their defenses to handle this threat, especially since these AI attacks often exploit unpatched systems and common weaknesses rather than requiring advanced zero-day vulnerabilities (previously unknown security flaws).

Keras version 3.12.0 has a vulnerability where an attacker can create a specially crafted tar archive (a compressed file format) that gets extracted in unintended locations. The problem is that symlinks (shortcuts that point to other files or directories) bypass safety checks that regular files must pass, allowing attackers to read files, overwrite files, or escape the intended extraction directory. This is especially dangerous on Python 3.10 and 3.11.

Labor MP Ed Husic argues that AI companies should not be allowed to regulate themselves and warns that weakening copyright laws (rules controlling who can use creative works) to help AI companies would contradict his party's values. The Media Entertainment & Arts Alliance, a union representing journalists and artists, is calling on the government to create stricter copyright rules to stop AI models from being trained on creative works without permission.

A security vulnerability (CVE-2026-15628) was found in the Vision Tool component of chatgpt-on-wechat CowAgent up to version 2.1.1, where attackers can manipulate image arguments to trigger SSRF (server-side request forgery, where the server is tricked into making unwanted requests to other systems). The flaw can be exploited remotely, and exploit code has been publicly released.