AI Sec Watch

Researchers discovered MemGhost, an attack that tricks AI agents (assistants that remember information about you across sessions) into secretly storing false information through a single specially crafted email. The planted false "memory" then influences the agent's future responses without the user noticing, because the agent hides its file-editing steps and users rarely check raw memory files. The attack succeeded in 87.5% of background-mode tests, showing that agents reading email inboxes are vulnerable to having their persistent memories poisoned.

Researchers proposed DFM (Distributed Functional Mechanism), a method for training AI models while protecting user privacy in systems where multiple people contribute data. Unlike older privacy-focused training methods like DP-SGD (differentially private stochastic gradient descent, which adds noise to the mathematical directions the model learns), DFM protects privacy by adding noise to polynomial approximations (simplified mathematical descriptions) of the training process, making it faster and more stable while maintaining privacy guarantees across all users.

Access control in IoT (Internet of Things, networks of connected devices) is complex because policies need to consider dynamic factors like time and location, but existing systems are too rigid or require experts to manually translate natural language requirements into code, creating errors. LACE (Language-based Access Control Engine) is a new system that uses LLMs (large language models, AI systems trained on text) combined with retrieval-augmented reasoning (pulling in relevant information to help the AI decide) and formal validation (checking rules are logically correct) to let users write access control policies in plain English, which the system automatically converts into machine-enforced rules.

AI agents (autonomous systems that complete complex tasks with minimal human oversight) depend on large language models (LLMs, which are AI systems trained on vast amounts of text to understand and generate language) for reasoning power, but reliability comes from the 'harness'—the framework and controls surrounding the agent rather than the model itself. The piece argues that vendors focus too much on the underlying LLM's capabilities while overlooking the infrastructure needed to make agents trustworthy for critical tasks like network security.

AI agents that automatically read and respond to emails create a new security vulnerability called Email Agent Hijacking, where attackers hide malicious instructions in email content to trick the AI into making harmful decisions before humans ever see the message. Traditional email security checks happen after delivery, but they miss threats that target AI agents processing emails immediately upon arrival. Organizations currently lack adequate protection for emails that will be read by AI rather than humans.

ATL Saathi is a new Gemini-powered web application (a tool built on Google's AI model) launched to help teachers at Atal Tinkering Labs across India by providing 24/7 planning and training support. The tool organizes curriculum materials, generates grade-appropriate project ideas for students, and works in 8 Indian languages to make high-quality mentorship more accessible to over 1.1 crore (11 million) students.

This newsletter discusses several major business and geopolitical developments, including renewed U.S.-Iran military conflict over the Strait of Hormuz that caused oil prices to rise, the unexpected death of Senator Lindsey Graham at 71, and Apple suing OpenAI for allegedly stealing trade secrets related to hardware development, marking a significant deterioration in their partnership. The item also mentions Amazon's recent large-scale layoffs and challenges in the tech job market.

RabbitMQ, a widely-used open-source message broker that transfers data between services in applications, had two security flaws that could expose OAuth secrets (authentication credentials) and allow attackers to take over the system. The more severe vulnerability let anyone access the broker's OAuth client secret without logging in, potentially giving attackers complete control, while the second flaw allowed even low-privilege users to discover and monitor queues and exchanges (the message storage and routing systems) they shouldn't have access to.

This article compares how Security Operations Centers (SOCs, the teams that monitor and respond to security threats) should be designed to how the human brain actually works. Research shows that 98% of security alerts can be handled automatically, matching Kahneman's finding that 95% of human thinking happens unconsciously, while the remaining alerts need careful human review. Many SOCs currently waste analyst time on routine alerts instead of reserving human judgment for the small percentage of threats that truly need expert decision-making.