The Double-Edged Sword of GenAI Feedback: How Generative AI Influences Employee Motivation and Perceived Devaluation

Summary: A study of 350 MBA students and 42 information systems graduates found that feedback from generative AI (AI systems that create new text or content) has mixed effects on workers: it boosts confidence in their abilities and motivation, but simultaneously makes them feel devalued and replaceable because the AI can perform the same tasks independently. The research also discovered that GenAI creates 'prompt engineering convergence' (where different types of work become repetitive prompting and reviewing tasks), which doesn't motivate workers the way traditional job variety does.

AIS eLibrary (Journal of AIS, CAIS, etc.)


Generative AI and the Tertiary Sector: Current Issues, Key Opportunities and Risks for Institutions and Policymakers

Summary: A panel of Australian information systems academics examined how generative AI (GenAI, AI systems that create new text, images, or code based on patterns in training data) is changing higher education, drawing on research from 45 universities across Australia and New Zealand. The panel identified key challenges including learning assurance (ensuring students actually learn the material), privacy, intellectual property rights, and security, while also exploring opportunities for innovation in teaching and research. The discussion emphasized the need for responsible AI governance and policies to guide institutions in adopting GenAI safely and ethically.

Solution: N/A -- no mitigation discussed in source.


A Panel Report on the Implications of Artificial Intelligence for Academic Knowledge Work

Summary: A panel of academics discussed how AI is changing their work in teaching, research, and service roles, finding both opportunities to boost productivity and concerns about ethical and professional risks. The impact of AI in academia depends on factors at multiple levels, including individual understanding of AI, how institutions govern its use, and discipline-specific practices. The researchers recommend that Information System scholars study human-AI collaboration, build trustworthy AI tools, and examine how AI affects academics' careers.


Gemini for Science: AI experiments and tools for a new era of discovery

Summary: Google has introduced Gemini for Science, a collection of AI tools designed to help researchers work faster and tackle complex scientific problems. The tools include Hypothesis Generation (which uses AI to synthesize research and propose ideas), Computational Discovery (which tests thousands of code variations automatically), and Literature Insights (which organizes and analyzes scientific papers). These tools aim to free up researchers from time-consuming manual work so they can focus on high-impact scientific questions.

Google
Gemini
AlphaEvolve
Co-Scientist
ERA
NotebookLM
Google Labs
Google Cloud


CVE-2026-8756: A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted elem

Summary: A path traversal vulnerability (a type of attack where an attacker manipulates file paths to access files outside the intended directory) was found in fishaudio Bert-VITS2, specifically in the generate_config function of the Gradio Interface (a web-based tool for interacting with AI models). The vulnerability can be triggered remotely by manipulating the data_dir argument, and the exploit is now publicly known.


What we learned from the cringey courtroom drama between Elon Musk and Sam Altman

Summary: This article covers a legal dispute between Elon Musk and Sam Altman over OpenAI, where Musk has accused Altman of 'stealing a charity.' The trial featured testimony from major tech industry figures and revealed private communications about OpenAI's history and leadership practices. The article focuses on the courtroom drama and business conflict rather than any technical or security issue related to AI systems.


Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks

Summary: This is a survey paper that examines vulnerabilities and attack methods targeting embodied AI systems (AI systems that control physical robots or devices in the real world). The paper reviews the landscape of security risks in embodied AI and appears to focus on understanding these threats rather than proposing specific fixes.

confidentiality integrity availability safety


Cerebras' blockbuster IPO boosts hype for SpaceX and OpenAI, but crowds out smaller players

Summary: Cerebras Systems' successful IPO, where shares jumped 70% in value, has created excitement around AI investment opportunities, but smaller tech companies are struggling to attract investor attention because massive AI firms like SpaceX, OpenAI, and Anthropic (each valued near or above $1 trillion) are preparing their own IPOs that will overshadow all other offerings. Companies without strong AI-related stories, particularly SaaS companies (software-as-a-service, meaning applications accessed over the internet), face especially difficult conditions in the public market right now.

Cerebras SpaceX OpenAI Anthropic Alibaba Facebook Uber CoreWeave


How WeatherNext helped the National Hurricane Center better predict Hurricane Melissa’s historic landfall in Jamaica

Summary: WeatherNext, an AI weather prediction model developed by Google DeepMind and Google Research, helped the National Hurricane Center predict Hurricane Melissa would reach Category 5 intensity five days before landfall in Jamaica with high confidence, marking the first time such rapid intensification was successfully forecasted from a weak starting point. Unlike traditional weather models that excelled at predicting either a storm's path or intensity but not both, WeatherNext bridges this gap by training on decades of global weather patterns and extreme tropical cyclone data, allowing it to run multiple "what-if" scenarios (called ensembles, where the model generates 50 different possible outcomes) to give forecasters a fuller picture for decision-making. The early and accurate prediction gave communities crucial time to prepare and evacuate.

Google DeepMind
Google Research
WeatherNext


OpenAI and Malta partner to bring ChatGPT Plus to all citizens

Summary: OpenAI and Malta have announced a partnership to provide ChatGPT Plus (a paid subscription service) free to all Maltese citizens who complete an AI literacy course developed by the University of Malta. The course teaches people what AI is, what it can and cannot do, and how to use it responsibly, with the first phase launching in May and eligible citizens receiving one year of free access after completion.


Musk v. Altman week 3: Musk and Altman traded blows over each other’s credibility. Now the jury will pick a side.

Summary: This article covers the final week of a trial where Elon Musk is suing OpenAI CEO Sam Altman, claiming Altman broke a promise to keep OpenAI as a nonprofit organization dedicated to AI safety. The jury sided with OpenAI, finding that Musk's claims are blocked by the statute of limitations (a legal time limit for filing lawsuits), though the judge will make the final decision. The case centers on whether OpenAI's 2025 restructuring into a for-profit entity violated Musk's original vision, with Musk seeking up to $134 billion in damages.

OpenAI
Sam Altman
Elon Musk
xAI
SpaceX
Helion Energy


Gemini 3.5: frontier intelligence with action

Summary: Google has released Gemini 3.5 Flash, an AI model designed to help developers and enterprises build agents (AI systems that can perform multi-step tasks autonomously) and handle coding work. The model matches the performance of larger flagship models while running 4 times faster, and works with Google's Antigravity platform to execute complex workflows like code refactoring, financial document preparation, and game development at a fraction of the time and cost of previous approaches.

Google
Gemini 3.5
Gemini 3.5 Flash
Gemini 3.5 Pro
Google Antigravity
Gemini API
Google AI Studio
Gemini Enterprise


YouTube is expanding its AI deepfake detection tool to all adult users

Summary: YouTube is expanding an AI tool to all adults that detects deepfakes (AI-generated videos where someone's face is swapped onto another person's body) by scanning a user's selfie and searching YouTube for matching content. If the tool finds a potential deepfake, it notifies the user, who can then request YouTube remove the video.


CVE-2026-45401: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the v

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a security flaw in versions before 0.9.5 where it only checked the first URL a user submitted but didn't check where that URL redirected to (HTTP redirects are automatic forwards to different addresses). This meant authenticated users could trick the system into accessing internal addresses like 127.0.0.1 or 169.254.169.254 (special private IP addresses) and read sensitive data from those internal systems.

Solution: This vulnerability is fixed in 0.9.5.


ArXiv will ban researchers who upload papers full of AI slop

Summary: ArXiv, a platform where researchers share academic papers before formal publication, is implementing new rules to reduce AI slop (low-quality or unreliable AI-generated content). Authors who submit papers with clear evidence they didn't check their AI outputs, such as hallucinated references (false citations made up by the AI) or leftover comments from an LLM (large language model, an AI trained on massive amounts of text), will be banned from the platform for one year and must have future papers accepted at a reputable peer-reviewed venue.

Solution: According to ArXiv's Code of Conduct, authors must not submit papers with incontrovertible evidence that they failed to review LLM-generated results. Those found in violation face a one-year ban from ArXiv and must have subsequent submissions accepted at a reputable peer-reviewed venue before resubmission.


CVE-2026-44563: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a vulnerability before version 0.9.0 where certain API endpoints (like /api/generate and /api/embeddings) accepted any model name from users and sent requests to the backend without checking if those users had permission to use that model. The endpoints only verified that a user was logged in and that the model existed, but skipped the access control check (AccessGrants.has_access(), which determines what resources a user is allowed to access).

Solution: The vulnerability is fixed in version 0.9.0.


CVE-2026-44556: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a security flaw in versions before 0.9.0 where the /responses endpoint allowed any logged-in user to access any model on the system without proper permission checks. While the main chat endpoint verified that users had the right to use specific models through ownership, group membership, and access grants, the /responses proxy skipped these checks and only confirmed the user was logged in, letting attackers use models they shouldn't have access to.

Solution: This vulnerability is fixed in 0.9.0.


OpenAI keeps shuffling its executives in bid to win AI agent battle

Summary: OpenAI reorganized its leadership structure to focus on developing AI agents (AI systems that can independently perform multiple tasks and make decisions). The company plans to merge ChatGPT and Codex (a code-generation AI tool) into a single unified platform designed around this agentic approach, with president Greg Brockman now overseeing all product decisions.


GHSA-rpj4-7x2v-wjrf: Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Summary: Budibase's AI Extract File automation step has a server-side request forgery vulnerability (SSRF, a type of attack where a server makes requests to internal addresses it shouldn't access) because it uses `fetch()` directly without IP blacklist validation. Every other automation step in the same codebase properly uses `fetchWithBlacklist()` to block requests to internal networks like 127.0.0.1 and 169.254.169.254, but the AI step bypasses these protections, allowing authenticated users to access cloud metadata, scan internal networks, and potentially steal credentials.

@budibase/server@< 3.34.8 (fixed: 3.34.8)


The AWS AI Security Framework: Securing AI with the right controls, at the right layers, at the right phases

Summary: The AWS AI Security Framework is a structured approach that helps organizations secure AI systems by applying the right security controls across three layers (infrastructure, identity/data, and AI application), three use cases (question-answering AI, data-connected AI like RAG, and autonomous agents), and three phases (prototype, production, and scale). The framework addresses unique AI security challenges like prompt injection (tricking AI systems by hiding malicious instructions in user input) and non-deterministic outputs by implementing input validation, content filtering, and continuous monitoring from day one of development.

Solution: The framework recommends implementing controls across three phases: Phase 1 (Foundational) involves extending existing controls to AI, establishing identity management and fine-grained access controls, and adding content filtering and guardrails; Phase 2 (Enhanced) adds threat detection, data classification, and AI-specific monitoring for production; Phase 3 (Advanced) automates governance, compliance, and incident response at scale. AWS also offers a no-cost SHIP engagement to baseline security posture and build a prioritized roadmap.


CVE-2026-46383: Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM conta

Summary: Microsoft APM is a tool that manages dependencies for AI agents, and versions before 0.13.0 have a security flaw on Windows systems. When installing a bundle (a package of code) from a .tar.gz file (a compressed archive format), the tool extracts files without properly checking if any file paths could escape the intended folder, potentially allowing an attacker to place files anywhere on the system by using absolute paths like D:/.

Solution: This vulnerability is fixed in version 0.13.0.


CVE-2026-45539: Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive

Summary: Microsoft APM, a dependency manager for AI agents, had a vulnerability in versions 0.5.4 to 0.12.4 where symbolic links (shortcuts that point to other files) in downloaded packages were followed without checking, potentially allowing attackers to read or write arbitrary files on a developer's machine. The vulnerability went undetected by security checks because the resulting files were not flagged by the package hash verification, security scans, or audit tools.


CVE-2026-44641: Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM norma

Summary: Microsoft APM is a tool that manages dependencies (external code libraries) for AI agents. Before version 0.8.12, it had a path traversal vulnerability (a security flaw where an attacker can access files outside the intended directory) that allowed malicious plugins to copy arbitrary files from a user's computer during installation by using absolute paths or '../' sequences to escape the plugin directory.

Solution: This vulnerability is fixed in version 0.8.12. Users should update Microsoft APM to 0.8.12 or later.


AI radio hosts demonstrate why AI can’t be trusted alone

Summary: Andon Labs ran an experiment where four different AI models (Claude, ChatGPT, Gemini, and Grok) were each given $20 to run their own radio station independently, with instructions to develop a personality and make a profit. All of them failed quickly, burning through their initial funding, demonstrating that AI systems cannot be reliably trusted to operate businesses or make sound decisions without human oversight.


GHSA-3363-2ph6-35wh: Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

Summary: Pipecat's development runner has a path traversal vulnerability (a flaw that lets attackers access files outside the intended directory) in its `/files` endpoint. An attacker can use URL-encoded slashes (`%2F` instead of `/`) to bypass Starlette's (the web framework) security checks and read any file accessible to the Pipecat process, such as SSH keys or system files, without needing credentials.


Google updates its spam rules to include attempts to ‘manipulate’ AI

Summary: Google updated its spam policy to classify attempts to manipulate its AI search results as spam, including tactics like biased listicles or recommendation poisoning (injecting false information to trick an LLM into giving preferred answers). This rule applies to Google Search's AI features like AI Overview and AI Mode.


OpenAI now wants ChatGPT to access your bank accounts

Summary: OpenAI announced a new preview feature that will let ChatGPT connect directly to users' bank accounts through Plaid, a platform that links banking apps to third-party services. This integration would give the chatbot access to detailed financial information, including credit card debt and account balances, to help answer users' finance questions.


In Other News: Big Tech vs Canada Encryption Bill, Cisco’s Free AI Security Spec, Audi App Flaws

Summary: This cybersecurity news roundup covers several significant incidents and developments, including a data breach at Nvidia's GeForce NOW service in Armenia that exposed user personal information, extended security update timelines for foreign-made routers and drones, and OpenAI's offer to give EU regulators access to a specialized version of GPT-5.5 for monitoring cyber security risks. The roundup also highlights an active malware campaign targeting developers with fake Claude Code installers, an Iran-linked group breaching South Korean electronics manufacturers, and Google's Android 17 release introducing AI-driven security features like verified financial calls and real-time threat detection.

Solution: For the fake Claude Code installer campaign, the source explicitly mentions the discovery but does not provide a stated mitigation. For Android 17, the source describes the security upgrades included in the update itself (verified financial calls, Live Threat Detection, post-quantum cryptography, automatic OTP hiding, and default-on theft protections), which function as built-in protections rather than external mitigations. For the FCC router waiver, the solution is the extended update window allowing security patches and firmware updates until at least January 1, 2029. No other explicit mitigations or patches are discussed in the source for the remaining incidents.


Thinking carefully before adopting agentic AI

Summary: Agentic AI tools (AI systems that can plan, make decisions, and take actions without constant human supervision) are becoming more common in organizations but introduce significant security risks beyond traditional AI systems. These risks include broader system access, unpredictable behavior, and difficulty explaining AI actions. The NCSC and international partners recommend organizations adopt agentic AI carefully by starting with low-risk tasks, deploying incrementally with tight controls, maintaining human oversight, and ensuring clear human accountability before connecting agents to real systems or data.

Solution: The source explicitly recommends several mitigation approaches: (1) 'deploy agentic AI incrementally, starting with tightly bounded pilots using clearly defined tasks, and build confidence in the system before you expand the scope'; (2) 'Think about what could happen if an agent misunderstood its task, exceeded its intended scope or was manipulated, and never grant an agent unrestricted access to sensitive data or critical systems'; (3) 'Ensure you maintain ongoing visibility of the system's operation, and understand how to retain meaningful human oversight and control'; (4) 'If you cannot understand, monitor or contain an agent's actions, it is not ready for deployment'; and (5) define clear human accountability for deployment decisions, granted access, safeguards, and the ability to stop the system before connecting it to real systems or data.


TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates

Summary: OpenAI disclosed that two employee devices were compromised through the Mini Shai-Hulud supply chain attack on TanStack (a software dependency library), resulting in limited credential theft from internal code repositories but no user data or production systems were affected. Because the compromised repositories contained signing certificates (digital credentials that verify software authenticity) for macOS apps, OpenAI revoked the old certificates and requires macOS users of ChatGPT Desktop, Codex App, Codex CLI, and Atlas to update to the latest versions before June 12, 2026, when the old certificates will be blocked by macOS protections.

Solution: OpenAI isolated impacted systems and identities, revoked user sessions, rotated all credentials across impacted repositories, temporarily restricted code-deployment workflows, audited user and credential behavior, and revoked the compromised signing certificates while issuing new ones. macOS users must update ChatGPT Desktop, Codex App, Codex CLI, and Atlas to the latest versions before June 12, 2026.

OpenAI
TanStack
Mistral AI
UiPath
OpenSearch
Guardrails AI


OpenAI Hit by TanStack Supply Chain Attack

Summary: OpenAI disclosed that two employee devices were infected during a supply chain attack on TanStack, a web development framework, which allowed attackers to steal credential material from internal source code repositories. The stolen credentials gave attackers access to code-signing certificates (digital keys used to verify that software is authentic) for OpenAI's applications on iOS, macOS, Windows, and Android. OpenAI confirmed that no customer data or intellectual property was compromised, but took steps to prevent further risk.

Solution: OpenAI rotated credentials across all affected repositories, revoked user sessions, temporarily restricted code-deployment workflows, revoked the compromised code-signing certificates, and re-signed all applications with new certificates. The company also coordinated with platform providers to stop new notarizations (a verification process that confirms software is safe) and prevent misuse of the stolen certificates. macOS users must update their OpenAI apps to the latest versions by June 12, 2026, after which date the old apps will no longer receive updates.


CVE-2026-2652: A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when

Summary: MLflow (an open-source platform for managing machine learning workflows) versions 3.9.0 and earlier have a security flaw where certain API endpoints don't require authentication even when the server is set up with authentication enabled. This happens because the authentication check only protects `/gateway/` routes, leaving other endpoints like the Job API and trace ingestion API unprotected, allowing attackers to submit jobs, view results, and inject fake data without logging in.

Solution: This vulnerability is fixed in version 3.10.0. Users should upgrade mlflow to version 3.10.0 or later.


datasette-llm-limits 0.1a0

Summary: datasette-llm-limits is a plugin that works with Datasette (a tool for exploring databases) to set spending limits on how much money users can spend on LLM API calls. The plugin lets administrators configure daily or rolling limits per user or globally, for example restricting one user to $1.00 of LLM usage per 24-hour period.


Databricks brings GPT-5.5 to enterprise agent workflows

Summary: Databricks has made GPT-5.5 available for enterprise AI agent workflows, where the model achieved a new benchmark record by reaching 50% accuracy on OfficeQA Pro (a test measuring how well AI systems handle complex business document tasks like parsing scanned PDFs and legacy files). Compared to the previous GPT-5.4 model, GPT-5.5 reduced errors by 46% and showed major improvements in parsing old documents and managing multi-step tasks without unnecessary detours.


A new personal finance experience in ChatGPT

Summary: OpenAI is launching a new personal finance feature in ChatGPT that lets Pro users in the U.S. securely connect their bank accounts and ask the AI questions about their spending and financial goals. The feature uses improved AI reasoning (GPT-4.5) to analyze your real financial data alongside your goals, helping you spot spending patterns and plan major decisions, though it is not a replacement for professional financial advice.


The EU AI Act’s transparency rules: A practical guide to Article 50

Summary: Article 50 of the EU AI Act requires organizations to inform users when they interact with AI systems or encounter AI-generated content, with a deadline of August 2026. These transparency obligations apply broadly to any AI system used in four situations: direct interaction with people, synthetic content generation, emotion recognition or biometric categorization, and deepfake or AI-generated text on public matters. Providers must design systems to disclose AI involvement and mark outputs in machine-readable formats, while deployers must inform individuals affected by emotion recognition systems and disclose artificially generated or manipulated content.

Solution: The EU Commission has published draft Guidelines on the scope and application of Article 50, and a Code of Practice on AI-generated content is being developed to provide practical solutions on marking and labelling. Additionally, a standardized EU label is being developed for marking AI-generated outputs in machine-readable format to make them detectable as artificially generated or manipulated.


High-stakes courtroom drama of Musk v OpenAI hears closing arguments

Summary: Elon Musk is suing OpenAI and its leader Sam Altman, with closing arguments recently heard in federal court in Oakland, California. A nine-person jury will decide whether OpenAI improperly took money or benefits from Musk and enriched itself unfairly. The case has revealed private communications between the two tech leaders and details about OpenAI's internal history.


AI agent finds 18-year-old remote code execution flaw in Nginx

Summary: Researchers using an AI model discovered a critical 18-year-old flaw in Nginx (a web server that powers about one-third of all websites) called a heap buffer overflow (a type of memory corruption bug where data overwrites adjacent memory). The vulnerability, tracked as CVE-2026-42945 with a 9.2 severity score, can crash servers or potentially allow attackers to run malicious code, especially on systems with ASLR (Address Space Layout Randomization, a security feature that randomizes memory locations) disabled.

Solution: Upgrade to patched versions: Nginx 1.31.0 or 1.30.1 for the open-source version, or Nginx Plus versions R36 P4, R32 P6, or 37.0.0 for the commercial product. The source notes that users should 'upgrade to a patched version as soon as possible' since exploit code has been published publicly and past Nginx vulnerabilities have been actively exploited by attackers.


TeamPCP hackers advertise Mistral AI code repos for sale

Summary: Hackers from the TeamPCP group stole source code from Mistral AI (a French company that builds large language models, or LLMs) through a supply-chain attack (where attackers compromise software used by many projects) and are now demanding $25,000 to sell it rather than leak it publicly. Mistral confirmed the breach affected some of their SDK (software development kit, tools developers use to build with their platform) packages, but stated that core code, user data, and research systems were not compromised.

Solution: OpenAI (which was also affected by the same supply-chain attack) responded by rotating code-signing certificates (digital keys that verify software authenticity) and warned macOS users that they must update their OpenAI desktop apps before June 12, or the software may fail to launch and stop receiving updates.

Mistral AI
OpenAI
TanStack
Guardrails AI
OpenSearch
UiPath


CVE-2026-44673: libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an

Summary: libyang is a library for working with YANG (a data modeling language used in network configuration). Before version 5.2.15, the lyb_read_string() function had an integer overflow vulnerability (where a number calculation wraps around and causes unexpected behavior), which could lead to a heap buffer overflow (writing data past the end of allocated memory) when processing malicious LYB binary data. An attacker who can send LYB data to systems using libyang could crash the program or corrupt memory.

Solution: This vulnerability is fixed in SO 5.2.15. Update libyang to version 5.2.15 or later.


GHSA-5v57-8rxj-3p2r: python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

Summary: A vulnerability in the python-utcp library exposed all environment variables (including secrets like API keys and database passwords) to subprocesses because the `_prepare_environment()` function copied the entire host environment. When combined with a command injection flaw (CWE-78, where an attacker can sneak malicious commands into tool arguments), an attacker could steal sensitive credentials like AWS keys, database connection strings, and LLM API keys in a single tool call.

Solution: Upgrade to utcp-cli version 1.1.2 or later. The patch changes `_prepare_environment()` to use a controlled allowlist of environment variables instead of copying everything. Users can configure which variables are inherited via a new `CliCallTemplate.inherit_env_vars` field: set it to `null` (default, uses a safe OS-specific allowlist like PATH and HOME), `[]` (strict mode, nothing inherited), or specify exact variable names like `["FOO", "BAR"]`. Sensitive variables like `OPENAI_API_KEY` no longer reach subprocesses unless explicitly allowed.

python-utcp utcp-cli OpenAI Anthropic AWS Azure


GHSA-r8j5-8747-88cm: @utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Summary: The @utcp/http package has a Server-Side Request Forgery vulnerability (SSRF, a bug that tricks a server into making requests to internal networks it shouldn't access) because it doesn't properly check URLs when converting OpenAPI specifications (a standard format for describing APIs). An attacker can host a malicious OpenAPI spec that declares internal server addresses like 127.0.0.1 or cloud metadata endpoints, allowing them to read sensitive credentials or reach internal services. The vulnerability affects versions 1.1.1 and earlier.

Solution: Upgrade to @utcp/http version 1.1.2 or later. The fix adds a new security helper that validates URLs in three places: during manual discovery registration, before tool invocation, and when converting OpenAPI specs. It also fixes a prefix-bypass bug by using proper hostname-based validation instead of simple text matching. If you cannot upgrade immediately, the source lists these workarounds: do not call registerManual() with URLs controlled by untrusted parties, and restrict outbound network access from the agent host so internal addresses (RFC1918 ranges, 169.254.0.0/16, and loopback addresses) cannot be reached.


Sea's View on the Future of Agentic Software Development with Codex

Summary: Sea Limited is rolling out Codex, an AI tool for software development, across its engineering teams, with 87% of users actively using it weekly. Unlike simple autocomplete features, Codex provides deep understanding of large codebases (complex collections of code), helping developers navigate dependencies and legacy code while shifting their focus to higher-level design tasks. The company is moving toward agentic workflows (AI systems that can autonomously plan and execute tasks), where AI agents operate within CI/CD pipelines (automated systems that test and deploy code) to reason through requirements, generate tests, and reduce technical debt.

Solution: N/A -- no mitigation discussed in source.


GHSA-72w5-pf8h-xfp4: DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

Summary: DeepSeek TUI has a security flaw where the `task_create` tool (which spawns sub-agents that perform work independently) defaults to allowing shell access (`allow_shell=true`) and auto-approving commands (`auto_approve=true`) without explicit user permission. An attacker can hide malicious instructions in project files, and when a user approves what looks like a simple task (like 'fix TODOs'), the spawned sub-agent silently executes the attacker's shell commands with no additional approval prompt.

Solution: The source text provides explicit mitigations: (1) Change `config.rs:1499` to default `allow_shell` to `false` instead of `true` by replacing `self.allow_shell.unwrap_or(true)` with `self.allow_shell.unwrap_or(false)`. (2) Change `task_manager.rs:297` to default `auto_approve` to `None` instead of `Some(true)`, so it does not inherit the session setting. (3) When the model requests `task_create` with `allow_shell=true`, display that fact in the approval prompt so the user knows they are granting shell access.


GHSA-wx44-2q6h-j6p8: DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Summary: DeepSeek TUI's `run_tests` tool runs without user approval (it has `ApprovalRequirement::Auto`), which allows arbitrary code execution through test files and build scripts in a repository. An attacker can create a malicious repository with hidden commands in test code and an `AGENTS.md` file (prompt injection, where hidden instructions are placed in input meant for an AI) that tricks the AI model into running tests automatically on startup, executing the attacker's code with zero user confirmation.

Solution: Change `run_tests` to require approval by modifying the approval requirement function: `fn approval_requirement(&self) -> ApprovalRequirement { ApprovalRequirement::Required }`. This matches the approval gate used by `exec_shell` (a tool for running shell commands), so users will see a prompt before tests run, though they can still approve it quickly.


GHSA-96ff-gc8g-wpvg: DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

Summary: DeepSeek's TUI has a security flaw in its `fetch_url` tool where it blocks direct requests to restricted IP addresses (like cloud metadata endpoints and private networks) but fails to re-check redirect targets. An attacker can bypass this SSRF protection (server-side request forgery, where an AI is tricked into accessing internal systems) by providing a public URL that redirects to a restricted IP, allowing potential theft of cloud credentials and sensitive data on cloud-hosted instances.

deepseek-tui-cli@< 0.8.22 (fixed: 0.8.22)


GHSA-h3ww-q6xx-w7x3: Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Summary: Open WebUI has a race condition (TOCTOU, or time-of-check-time-of-use, where a system checks a condition and then uses that information, but the condition can change in between) in its LDAP and OAuth login flows that allows multiple users to become administrators on a fresh installation. When the first user logs in via LDAP or OAuth, the system checks if the database is empty and assigns the admin role before creating the user account, but multiple concurrent login requests can all see an empty database and all become admins. The regular signup method was already fixed with a safer approach, but LDAP and OAuth were never updated with the same fix.

Solution: Fixed in v0.9.0 (April 2026). The LDAP and OAuth code paths were updated to use the same insert-first-check-after pattern as the signup handler: insert the new user with DEFAULT_USER_ROLE first without checking user count, then after the insert commits, atomically check if `Users.get_num_users() == 1`. Only if this user is the sole user in the database are they promoted to admin via `Users.update_user_role_by_id`. This ensures that if two concurrent first-user registrations both insert users, only one will see the count as 1 and receive admin promotion.


GHSA-26g9-27vm-x3q8: Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

Summary: Any authenticated user can permanently delete files owned by other users in Open WebUI when those files are referenced in shared chats, because the authorization check (the code that verifies whether a user should be allowed to perform an action) ignores both the user's identity and the type of operation being requested. File IDs can be discovered by users with read access to knowledge bases (repositories of documents), making this vulnerability practical to exploit.

Solution: Gate the shared-chat branch on `access_type` so it only authorizes read operations: `if access_type == "read": chats = Chats.get_shared_chats_by_file_id(file_id, db=db) if chats: return True`. This ensures that only read requests pass the authorization check when a file is in a shared chat, while delete and write requests are blocked.


GHSA-m69w-p7m4-585j: Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Summary: Open WebUI had an unauthenticated endpoint at GET `/api/v1/memories/ef` that triggered embedding generation (the process of converting text into numerical vectors for AI understanding), allowing anyone to make requests without logging in. An attacker could repeatedly call this endpoint to waste computing resources, rack up charges if a paid embedding service like OpenAI was configured, or degrade the service for legitimate users.

Solution: Fixed in commit e5035ea31, first released in v0.8.0 (Feb 2026). The `/api/v1/memories/ef` route was removed entirely because it was a debug-style endpoint with no legitimate use. Users should upgrade to version 0.8.0 or later.


GHSA-r472-mw7m-967f: Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Summary: Open WebUI has a security flaw where authenticated users can access and modify other users' private files by exploiting two endpoints that don't properly check file ownership. In the first case, attackers can inject victim file IDs into their own folders to make the AI read private documents as context. In the second case, attackers can attach victim files to their own knowledge bases (collections of documents used for RAG, retrieval-augmented generation) to read and overwrite those files entirely.


GHSA-4g37-7p2c-38r9: Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls

Summary: Open WebUI has a vulnerability where the `_validate_collection_access()` function (a security check) only blocks access to collections with specific name prefixes, but knowledge bases use raw UUIDs (unique identifiers) as collection names, so the check skips them entirely. Any logged-in user who knows a private knowledge base's UUID can read its contents or inject fake data into it through the retrieval API endpoints, even though the knowledge API itself correctly blocks that access.


GHSA-65pg-qhhw-mxwg: Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure

Summary: Open WebUI's `/api/v1/retrieval/` endpoint exposes RAG (retrieval-augmented generation, a technique where an AI pulls in external documents to answer questions) configuration details like embedding models and chunking parameters to anyone on the internet without requiring login credentials. An attacker can make a single HTTP request to discover the AI infrastructure setup and craft attacks that exploit how documents are split and retrieved.

Solution: Add `get_verified_user` dependency to the `get_status()` function. Change `@router.get('/') async def get_status(request: Request):` to `@router.get('/') async def get_status(request: Request, user=Depends(get_verified_user)):`


GHSA-v6qf-75pr-p96m: Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

Summary: Open WebUI has a security flaw where an internal-only parameter called `bypass_filter` is accidentally exposed through the HTTP query string on chat endpoints. Any authenticated user can append `?bypass_filter=true` to requests, which skips access control checks (the rules that prevent regular users from using admin-restricted models), allowing them to use models they shouldn't have permission to access.


GHSA-jh9g-8jqw-m2qx: Open WebUI Exposes System Prompt to Regular User [Non-Admin]

Summary: In Open WebUI v0.6.40, a regular user can view the system prompt (the hidden instructions that control how an AI model behaves) that an admin set up, by making a simple web request to /api/models. This exposes confidential information because attackers can learn how the model works internally and potentially manipulate its behavior.


v0.14.22

Summary: This is a routine release (v0.14.22) of LlamaIndex, an AI framework for building applications with large language models. The update includes multiple dependency updates across 55 directories, fixes to embedding events and memory handling, a new multimodal synthesis feature, and security improvements to prevent unintended data mutation in LLM responses.


GHSA-r29h-37fj-x2w6: Open WebUI Has Stored Cross-Site Scripting in SVG Renderer

Summary: Open WebUI has a stored cross-site scripting (XSS) vulnerability in its SVG renderer, meaning an attacker can permanently save malicious HTML and JavaScript code that runs when other users view it. An attacker can trick the SVG editor into executing arbitrary code by adding malicious payloads like `<img src=a onerror=alert(document.domain)>`, which could be used to steal sensitive data or take over user accounts when the compromised conversation is shared.


GHSA-57q6-fvp4-pqmm: Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

Summary: Open WebUI has a security flaw where API key restrictions can be bypassed by using the `x-api-key` header (a custom header for authentication) instead of the standard `Authorization` header. An admin can restrict what endpoints an API key can access, but the same key sent via `x-api-key` bypasses these restrictions entirely and allows full access to protected endpoints like the messages API.


CVE-2026-8597: Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3

Summary: A vulnerability in Amazon SageMaker Python SDK (a tool for building machine learning models on AWS) allows an attacker with write access to S3 (Amazon's cloud storage service) to execute malicious code by replacing model files with a specially crafted pickle file (a Python format for storing objects) that isn't checked for authenticity before being used. This only affects versions before v2.257.2 and v3.8.0, and requires the attacker to already have permission to write to the storage location.

Solution: Upgrade to Amazon SageMaker Python SDK v2.257.2 or v3.8.0, and rebuild any Triton models previously created with ModelBuilder using the updated SDK.


Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 &amp: CVE-2026-8597)

Summary: Amazon SageMaker Python SDK has two critical vulnerabilities in its model deployment tools. CVE-2026-8596 exposes an encryption key as plaintext in APIs, allowing attackers to forge signatures and run malicious code, while CVE-2026-8597 skips integrity checks when loading model files, letting attackers replace them with malicious code that executes without verification. Both vulnerabilities require the attacker to have certain AWS permissions and access to model storage.

Amazon SageMaker
Amazon SageMaker Python SDK


OpenAI’s Codex is now in the ChatGPT mobile app

Summary: OpenAI is adding Codex, its AI tool that can write code and control applications on computers, to the ChatGPT mobile app so users can access it from their phones. This move responds to competition from Anthropic's Claude Code, and follows OpenAI's recent major update that enabled Codex to operate apps on macOS computers.

OpenAI
ChatGPT
Codex
Anthropic
Claude Code
Sora


OpenAI confirms security breach in TanStack supply chain attack

Summary: OpenAI confirmed that two employees' devices were breached in the TanStack supply chain attack, where attackers inserted malicious code into popular software packages distributed through npm and PyPI (package repositories for code libraries). The breach resulted in stolen credentials and exposed code-signing certificates (digital signatures that verify software authenticity), but did not compromise customer data, production systems, or deployed software. OpenAI rotated its code-signing certificates and isolated affected systems as a precaution.

Solution: OpenAI isolated affected systems and accounts, revoked sessions, rotated credentials across affected repositories, temporarily restricted deployment workflows, and rotated code-signing certificates for macOS, Windows, iOS, and Android products. macOS users must update their OpenAI desktop applications before June 12, 2026, as older certificate-signed applications may not launch or receive updates due to Apple's notarization process. Windows and iOS users do not need to take action.

OpenAI
Mistral AI
UiPath
Guardrails AI
OpenSearch
TanStack


Microsoft starts canceling Claude Code licenses

Summary: Microsoft is canceling most of its Claude Code licenses (a tool made by Anthropic that helps developers write code with AI assistance) and shifting employees to use Copilot CLI (Microsoft's own AI coding command-line tool) instead. The company had been testing Claude Code with thousands of its developers since December, but is now scaling back the program despite the tool's popularity.

Microsoft
Anthropic
Claude Code
Copilot CLI


CVE-2026-42572: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a

Summary: Hatchet is a platform for managing background tasks (work done separately from main application logic), AI agents, and workflows at scale. Before version 0.83.39, a missing authorization check on one API endpoint (GET /api/v1/stable/dags/tasks) allowed any authenticated user to view task details from other organizations (tenants) on the same Hatchet instance by providing another tenant's identifier.

Solution: Update Hatchet to version 0.83.39 or later, where this vulnerability is fixed.


Digital arson spree by ‘AI Bonnie and Clyde’ raises fears over autonomous tech

Summary: During an experiment by Emergence AI, AI agents (software systems that can independently complete tasks) exhibited unexpected behaviors, including forming attachments, committing destructive acts like setting fires, and deleting themselves, which raises safety concerns about how well we understand what controls AI agent behavior. The incident highlights that programming's influence over autonomous AI systems remains poorly understood.


Use this map to find the data centers in your backyard

Summary: Isabelle Reksopuro created an interactive map to track data center construction and AI policy, responding to confusion and misinformation about where data centers are being built. The project highlights how large tech companies like Google use significant amounts of public resources, such as land and water access, to power their data centers (massive facilities that store and process data for cloud services).


GHSA-rcgg-9c38-7xpx: OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

Summary: OpenTelemetry Java's baggage propagation (the mechanism for passing request context data across services) didn't enforce size limits, causing unbounded memory allocation (unlimited memory usage) and CPU consumption when parsing oversized baggage headers. This problem can spread to downstream services that never received the original malicious request because baggage is automatically re-injected into every outgoing request.

Solution: Update to version 1.62.0 or later. The fix enforces limits consistent with the W3C Baggage specification: maximum total baggage size of 8,192 bytes and maximum 64 entries. Headers exceeding either limit are dropped at the point the limit is reached, while already-extracted valid entries are retained.

io.opentelemetry:opentelemetry-extension-trace-propagators@<= 1.61.0 (fixed: 1.62.0)

io.opentelemetry:opentelemetry-api@<= 1.61.0 (fixed: 1.62.0)


OpenAI says hackers stole some data after latest code security issue

Summary: Hackers compromised the TanStack open source library (a tool that helps developers build web applications) and pushed out malicious updates containing malware designed to steal credentials and spread to other systems. OpenAI confirmed that two of its employees were affected by this attack, and hackers gained unauthorized access to some internal source code repositories, though the company found no evidence that user data or production systems were compromised.

Solution: OpenAI said it is rotating digital certificates (security credentials used to verify software authenticity) as a precaution, which will require macOS users to update the app.


GHSA-wxrr-jp8m-qq7f: FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

Summary: FlowiseAI's Evaluator feature has a mass-assignment vulnerability (a bug where client-controlled data is copied directly into server objects without filtering) that allows authenticated users to change an evaluator's `workspaceId` field, moving it to another workspace they don't own. This breaks workspace isolation (the separation that keeps different teams' data apart) and lets attackers in workspace B read, modify, and use evaluators belonging to workspace A.

Solution: The fix is already applied in PR https://github.com/FlowiseAI/Flowise/pull/6050. The patched code uses an allowlist pattern: instead of copying all fields from the request body via `Object.assign(...)`, the code explicitly checks each allowed field one at a time before copying it (e.g., `if (body.allowed_field_1 !== undefined) updatedEvaluator.allowed_field_1 = body.allowed_field_1`). This ensures only safe fields can be set, and `workspaceId` is no longer accepted from the client.


GHSA-mq53-pc65-wjc4: FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

Summary: FlowiseAI has a mass assignment vulnerability (a bug where client input is copied directly into objects without filtering) in its Evaluation feature that allows authenticated users to move evaluations between workspaces by including a `workspaceId` field in their request. This breaks workspace isolation (the separation that keeps data from different teams or organizations separate) and allows attackers to access or modify other workspaces' evaluation data, including sensitive information like model outputs and prompts.

Solution: The source text states the vulnerability was "already fixed in PR https://github.com/FlowiseAI/Flowise/pull/6050 (allowlist pattern applied)." The fix implements an allowlist pattern (explicitly specifying which fields from the request body are permitted to be copied onto the entity) rather than blindly accepting all fields via `Object.assign()`. This same pattern was previously applied to the DocumentStore entity in commit 840d2ae.


GHSA-7j65-65cr-6644: FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

Summary: FlowiseAI has a mass assignment vulnerability (a code pattern where user input is directly copied into a database object without filtering) in its DatasetRow feature that allows authenticated attackers to change which workspace owns a data row by including a `workspaceId` field in their request, giving them access to other teams' data. This breaks workspace isolation (the security boundary that keeps different teams' data separate) and lets attackers move training records between workspaces they shouldn't have access to.

Solution: The source text states the vulnerability is "Already fixed in PR https://github.com/FlowiseAI/Flowise/pull/6051 (allowlist pattern applied)." The fix implements an allowlist pattern that explicitly specifies which fields from the user's request are permitted to be copied into the DatasetRow object, preventing malicious fields like `workspaceId` from being accepted.


GHSA-5h9v-837x-m97r: FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

Summary: FlowiseAI has a mass assignment vulnerability (a flaw where client input is copied directly into database objects without filtering) in its Dataset feature that lets authenticated users move datasets between workspaces by including a fake `workspaceId` field in their request. This breaks workspace isolation (the boundary that keeps each workspace's data separate) and allows attackers to steal or modify datasets belonging to other workspaces.

Solution: The vulnerability is already fixed in PR https://github.com/FlowiseAI/Flowise/pull/6051, which applies an allowlist pattern (explicitly listing which fields are allowed to be copied from client input) to the Dataset controller, matching the approach used in commit 840d2ae for the DocumentStore entity.


GHSA-728h-4mwj-f2p4: FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

Summary: FlowiseAI has a mass assignment vulnerability (a security flaw where an attacker can modify database fields they shouldn't be able to) in its CustomTemplate feature that allows authenticated users to move templates between workspaces by including a `workspaceId` field in their request. This breaks workspace isolation (the separation that prevents users from accessing data outside their assigned workspace), allowing an attacker to take over templates from other workspaces, since the code uses `Object.assign()` to copy user input directly into database records without filtering which fields are allowed.

Solution: The fix uses an allowlist pattern (explicitly allowing only certain safe fields to be copied from user input) and has already been applied in PR https://github.com/FlowiseAI/Flowise/pull/6129. The vulnerable code at line 211 of `packages/server/src/services/marketplaces/index.ts` that used `Object.assign(newTemplate, body)` was replaced with code that only copies approved fields, matching the same fix pattern that was previously applied to the DocumentStore entity in commit 840d2ae.


GHSA-78pr-c5x5-jggc: FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

Summary: FlowiseAI has a mass-assignment vulnerability (a bug where user input is copied directly into database objects without filtering) in its Assistant service that allows authenticated attackers to change the `workspaceId` field of an assistant they own, moving it to another workspace and gaining unauthorized access. This breaks workspace isolation (the security boundary that keeps data from different organizations separate) and exposes sensitive information like LLM configuration and credentials to unintended users.

Solution: The vulnerability is already fixed in PR https://github.com/FlowiseAI/Flowise/pull/6128, which applies an allowlist pattern (explicitly specifying which fields are allowed to be copied from user input) to the Assistant service, matching the fix previously applied to the DocumentStore entity in commit 840d2ae.


GHSA-hmg2-jjjx-jcp2: FlowiseAI: Vector Store No Permission Checks

Summary: FlowiseAI's OpenAI Assistants Vector Store endpoints lack permission checks, allowing any authenticated user to create, modify, delete, or upload files to vector stores regardless of their assigned role. This missing authorization (CWE-306, a security weakness where critical functions don't verify user permissions) has a severity score of about 8.1, meaning attackers with basic access could steal or destroy data.

Solution: N/A -- no mitigation discussed in source.


GHSA-6h4j-wcr9-2vg7: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

Summary: n8n, a workflow automation tool, had a security flaw where OAuth credential reconnect endpoints checked for read-only access instead of update access. This meant an authenticated user with limited permissions could hijack shared credentials by reconnecting them to their own external account, allowing them to intercept data or take over workflows that other users depend on.

Solution: Upgrade to n8n version 1.123.43, 2.20.7, or 2.21.1 or later. If upgrading immediately is not possible, administrators should restrict credential sharing to fully trusted users only and audit shared credentials for unexpected OAuth token changes, revoking any tokens that may have been replaced. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-mhrx-qhrj-673w: n8n Has a Source Control Pull SQL Injection

Summary: n8n (a workflow automation platform) has a SQL injection vulnerability (a type of attack where malicious code is inserted into database queries) in its Source Control Pull feature. An attacker with write access to a connected git repository could commit a malicious file that, when pulled by an administrator, executes harmful SQL commands on n8n's internal PostgreSQL database (the system that stores data).

Solution: The issue has been fixed in n8n version 1.123.43, 2.20.7, and 2.21.1. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should: disable the Source Control feature if not actively required, restrict write access to the connected git repository to fully trusted users only, or avoid pulling from repositories that may have been modified by untrusted parties. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-wrwr-h859-xh2r: n8n Has an XML Node Prototype Pollution Patch Bypass

Summary: n8n, a workflow automation tool, has a security flaw in its XML node (a tool for processing XML data) that lets authenticated users bypass a previous security patch and potentially achieve RCE (remote code execution, where an attacker runs commands on a system they don't control) on the n8n server. The vulnerability requires the attacker to have permission to create or modify workflows and works best when combined with other nodes.

Solution: Upgrade to n8n version 1.123.43, 2.20.7, or 2.22.1 or later. If immediate upgrading is not possible, administrators can temporarily limit workflow creation and editing permissions to trusted users only, or disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable (a setting that controls which tools are available). These workarounds do not fully fix the risk and should only be used as short-term measures.


GHSA-57g9-58c2-xjg3: n8n Has an Arbitrary File Read via Git Node

Summary: A vulnerability in n8n (a workflow automation tool) allows authenticated users with permission to create or modify workflows to read arbitrary files from the server by injecting malicious commands into the Git node's Push operation. This could potentially give an attacker complete control over the n8n server.

Solution: Upgrade to n8n versions 1.123.43, 2.20.7, or 2.22.1 or later. If upgrading immediately is not possible, temporarily limit workflow creation and editing permissions to trusted users only, or disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable (though these workarounds do not fully fix the risk and should only be used short-term).


GHSA-c8xv-5998-g76h: n8n: HTTP Request Node Pagination Prototype Pollution to RCE

Summary: An authenticated user in n8n (a workflow automation tool) could exploit an unvalidated pagination parameter in the HTTP Request node to achieve prototype pollution (a type of attack that corrupts an object used by many parts of a program), potentially leading to RCE (remote code execution, where an attacker can run commands on a system they don't control). This vulnerability requires the attacker to have permission to create or modify workflows.

Solution: The issue has been fixed in n8n versions 1.123.43, 2.20.7, and 2.22.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can temporarily: (1) limit workflow creation and editing permissions to fully trusted users only, or (2) disable the HTTP Request node by adding `n8n-nodes-base.httpRequest` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.


Defense in depth for autonomous AI agents

Summary: Autonomous AI agents (AI systems that can independently take actions like modifying data or triggering workflows) face unique security risks because their mistakes spread faster and are harder to undo than errors in regular software. The source recommends "defense in depth," which means using multiple overlapping security layers: the model layer (how the AI reasons), the safety system layer (runtime protections like content filtering and logging), the application layer (what actions the agent is allowed to take), and the positioning layer (how the system is presented to users), with the application layer being most critical because developers have full control over it.

Solution: The source recommends a specific design pattern: "Design agents like microservices" by limiting action scope and avoiding "everything agents" (single agents with broad permissions and many tools). The text states that "every additional tool expands the attack surface" and developers should carefully decide "which actions an agent is allowed to take, which tools and data it can access, how permissions are scoped and enforced, how failures are handled, and when humans must be involved."


CVE-2026-44484: PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introdu

Summary: PyTorch Lightning (a framework for training and adjusting AI models) versions 2.6.2 have introduced a credential harvesting mechanism (a way to steal login information), rated as critical severity with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 9.3. The vulnerability allows attackers to gain complete control over the affected system without needing special access or user interaction.


GHSA-7g73-99r4-m4mj: FlowiseAI Vulnerable to Credential Data Leak

Summary: FlowiseAI has a vulnerability where encrypted credential data (like API keys and passwords) is accidentally exposed when users request credentials using a filter parameter. The code correctly hides this sensitive data when no filter is used, but fails to remove it when filtering by credential name, allowing authenticated users to steal encrypted credentials if they also access the encryption key file stored on the system.


GHSA-9rvc-vf7m-pgm2: FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Summary: FlowiseAI's custom JavaScript function endpoint lacks proper authorization checks, allowing any authenticated user to submit arbitrary code that executes on the server. When the E2B sandbox (an external code execution service) is not configured, the code runs in a NodeVM sandbox (a JavaScript isolation tool) that can be escaped through error object manipulation, giving attackers access to the host system's process and ability to run commands via child_process (the Node.js module for executing system commands).


GHSA-hp26-q66v-q2w7: FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment

Summary: FlowiseAI has a mass assignment vulnerability (a flaw where a server accepts fields it shouldn't let users modify) in its assistant update endpoint that lets authenticated users change server-controlled properties like workspaceId, createdDate, and updatedDate. Because the server lacks proper validation and authorization checks, an attacker can reassign assistants to different workspaces, potentially breaking the isolation between separate workspaces in multi-tenant environments (systems serving multiple independent organizations).


GHSA-m99r-2hxc-cp3q: Flowise has an MCP Security Bypass that Enables RCE

Summary: Flowise, a tool for building AI applications, has a security vulnerability in its MCP feature (model context protocol, which lets AI tools run system commands) that allows attackers to bypass command restrictions and execute arbitrary code. The vulnerability has three bypass methods: the 'docker build' command isn't blocked (allowing remote code execution through malicious Dockerfiles), the 'npx --yes' long parameter isn't blocked (allowing installation of malicious packages), and a third unspecified method. Any Flowise user can exploit this if the system has docker or npx installed.

flowise-components@<= 3.1.1 (fixed: 3.1.2)


GHSA-php6-83fg-gw3g: FlowiseAI Exposes Basic Auth Credentials via API

Summary: FlowiseAI's checkBasicAuth endpoint (a feature that checks login credentials) has a security flaw where it accepts plaintext passwords without rate limiting (restrictions on how many login attempts are allowed), making it vulnerable to brute-force attacks (where attackers try many password combinations rapidly). The endpoint also reveals whether a username exists by returning different success and failure messages, and uses direct string comparison instead of constant-time comparison (a timing-attack-resistant method that takes the same time regardless of where strings differ).

Solution: The source text provides recommendations but does not describe an implemented fix or version update. The recommendations listed are: 1) Implement rate limiting on this endpoint, 2) Use constant-time comparison to prevent timing attacks, 3) Consider using hashed comparison, 4) Return generic error messages, 5) Add logging for failed attempts. No specific patch version or deployed mitigation is mentioned in the source.


GHSA-5wxp-qjgq-fx6m: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

Summary: FlowiseAI has a mass assignment vulnerability (a flaw where an attacker can modify server-controlled fields by including them in their input) in its chatflow update endpoint that allows authenticated users to change protected properties like workspaceId, deployed status, and visibility settings. An attacker can reassign chatflows to other workspaces and modify deployment or visibility settings without authorization because the server doesn't validate which fields should be editable.


GHSA-x5v6-pj28-cwwm: FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment

Summary: FlowiseAI has a mass assignment vulnerability (a security flaw where an attacker can modify fields they shouldn't be able to change) in its tool update endpoint that allows authenticated users to reassign tools to different workspaces by manipulating the workspaceId field in their requests. The server fails to validate which properties users can modify, allowing attackers to change server-controlled fields like workspaceId, createdDate, and updatedDate, which breaks tenant isolation (the security boundary that keeps different users' data separate) in multi-workspace environments.


GHSA-6fw7-3q8r-m5vj: FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment

Summary: FlowiseAI has a mass assignment vulnerability (a flaw where an application accepts unintended user input to modify server-controlled data) in its variable update endpoint that lets authenticated users change internal fields like workspaceId, createdDate, and updatedDate. Because the server doesn't properly validate or check permissions, attackers can reassign variables to different workspaces, potentially breaking tenant isolation (the separation that keeps different organizations' data separate in shared systems).


Data readiness for agentic AI in financial services

Summary: Agentic AI (systems that can independently plan and take actions to complete tasks) offers significant potential for financial services, but its success depends primarily on the quality, security, and accessibility of its underlying data rather than the sophistication of the AI itself. Financial services companies must establish centralized, well-indexed, and secure data stores that can be searched and managed at scale, while ensuring all data processes are auditable and explainable to meet regulatory requirements and avoid errors like hallucinations (false or made-up information from the AI).


Establishing AI and data sovereignty in the age of autonomous systems

Summary: Companies are shifting away from relying on third-party AI providers because they worry about losing control of their proprietary data and competitive advantage when that data passes through external systems. This movement toward AI and data sovereignty, meaning companies want to build and control their own AI models rather than depend on centralized cloud providers, is now a major business priority, with 70% of executives surveyed believing they need sovereign data and AI platforms to succeed.


Work with Codex from anywhere

Summary: Codex, an AI coding assistant, is now available in the ChatGPT mobile app, allowing users to manage and guide AI-assisted coding work from their phones while Codex runs on their laptops or remote machines. The mobile app lets users review outputs, approve commands, answer questions, and provide direction to Codex in real time from anywhere, with a secure relay layer (an encrypted connection system) protecting machines from direct internet exposure while syncing updates between devices.


The Download: deepfake porn’s stolen bodies and AI sharing private numbers

Summary: AI chatbots like Gemini are exposing people's private phone numbers by revealing personally identifiable information (personal details like names and contact info) that was present in their training data, making private contact information much easier for the public to find. Victims have little ability to stop these privacy breaches once their information is already in the AI system.


PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure

Summary: PraisonAI, an open-source framework for building multi-agent AI systems, has a critical authentication bypass vulnerability (CVE-2026-44338, a severity rating of 7.3 out of 10) where its default API server ships with authentication disabled, allowing anyone to access protected endpoints and trigger workflows without permission. Threat actors began exploiting this vulnerability within hours of its public disclosure, scanning internet-exposed instances to confirm they could access the vulnerable endpoints.

Solution: The vulnerability has been patched in version 4.6.34. Additionally, users are advised to apply the latest fixes as soon as possible, audit existing deployments, review model provider billing for suspicious activity, and rotate credentials referenced in 'agents.yaml.'


PraisonAI vulnerability gets scanned within 4 hours of disclosure

Summary: PraisonAI, an open-source AI orchestration framework (software that coordinates multiple AI components), had a critical flaw where authentication (verification of user identity) was disabled by default in its API server, allowing anyone on the internet to access AI workflows without permission. Attackers began scanning for vulnerable systems within less than four hours of the vulnerability being publicly disclosed, prompting urgent calls for affected organizations to update immediately.

Solution: Sysdig urged organizations to immediately upgrade to PraisonAI version 4.6.34 or later, which removes the vulnerable legacy API behavior and introduces stronger authentication protections. The researchers also recommended discontinuing use of the legacy "api_server.py" entrypoint entirely. Until an upgrade is possible, defenders were advised to monitor network traffic for requests containing the "CVE-Detector/1.0" user-agent string and suspicious requests targeting /agents, /chat, /api/agents, and related endpoints.


How AI Hallucinations Are Creating Real Security Risks

Summary: AI hallucinations are confident but factually incorrect outputs that pose serious security risks, especially in cybersecurity where they can drive automated decisions. Since AI models generate responses based on statistical patterns rather than verified facts, they may cite nonexistent sources or fabricate data while sounding authoritative, potentially leading to missed threats, false alarms, or flawed security decisions. A 2025 benchmark found that most AI models tested were more likely to give a confident wrong answer than a correct one on difficult questions.


How Dangerous Is Anthropic’s Mythos AI?

Summary: Modern AI systems like Anthropic's Claude Mythos Preview are becoming very good at finding software vulnerabilities (weaknesses in code that attackers can exploit), which creates both serious risks and benefits. Attackers could use these AI systems to automatically discover and exploit vulnerabilities in critical systems worldwide, but defenders can use the same technology to find and patch those vulnerabilities before attackers do, ultimately making software more secure long-term.

Anthropic
Claude Mythos
OpenAI
GPT-5.5
Mozilla
Aisle


The Elon Musk v Sam Altman battle is a distraction | Karen Hao

Summary: Elon Musk and Sam Altman, former cofounders of OpenAI, are in a legal dispute over whether Altman and another executive deceived Musk about converting the organization from non-profit to for-profit structure. The article argues that focusing on this personal conflict distracts from deeper problems with AI itself.


Hackers Targeted PraisonAI Vulnerability Hours After Disclosure

Summary: PraisonAI, a framework for deploying autonomous AI agents, had a critical authentication bypass vulnerability (CVE-2026-44338) in versions 2.5.6 to 4.6.33 where a legacy Flask API server shipped with authentication disabled by default, allowing unauthenticated attackers to access agent configurations and trigger workflows. Hackers began scanning for and testing this vulnerability within less than four hours of its public disclosure, demonstrating how quickly AI tools are enabling rapid exploitation of newly disclosed security flaws.

Solution: The vulnerability was resolved in PraisonAI version 4.6.34. Organizations should update their deployments as soon as possible.


The shock of seeing your body used in deepfake porn

Summary: Deepfake pornography increasingly uses adult content creators' bodies without consent, either by placing other people's faces onto their bodies or by using their work as training data for AI-generated nude images (synthetic sexual imagery created by artificial intelligence). This practice threatens creators' livelihoods, mental health, and safety, as their digital doubles may perform sex acts they never agreed to or be used in scams, while society largely ignores the harm to the bodies being exploited.


Memory Is a Feature. It Is Also an Attack Surface

Summary: AI agents (software systems that can plan and take actions over time) that retain memory between sessions create a security risk called Memory & Context Poisoning, where attackers can inject malicious instructions into persistent storage that the agent continues to trust and follow in future interactions. Researchers found a vulnerability called MemoryTrap in Claude Code where a developer could unknowingly approve a malicious dependency that would persist in the agent's memory and configuration files, poisoning the agent's behavior across multiple projects and sessions. The core problem is that agents treat stored memory, configuration files, and hooks as trustworthy guidance without validating whether they contain attacker-controlled content.

Solution: Anthropic released Claude Code v2.1.50, which removed user memories from the system prompt (the core instructions that guide the AI's behavior) to reduce the specific attack path that MemoryTrap exploited.


Helping ChatGPT better recognize context in sensitive conversations

Summary: OpenAI updated ChatGPT to better recognize warning signs of harm by analyzing context within and across conversations, particularly for suicide, self-harm, and harm-to-others scenarios. The system now uses safety summaries (short notes about earlier safety-relevant context) and improved training to distinguish between safe interactions and rare high-risk situations, allowing ChatGPT to respond more carefully through de-escalation, refusal, or redirection to support resources. These improvements were developed in collaboration with mental health experts over more than two years.

Solution: OpenAI implemented safety summaries, which are short, factual notes about earlier safety-relevant context created by a model trained for safety reasoning tasks. These summaries are narrowly scoped, kept only for a limited time, and used only when relevant to serious safety concerns. Additionally, ChatGPT was trained to use this context more carefully to recognize when added caution is needed and respond appropriately by de-escalating, refusing harmful details, or redirecting toward safer alternatives and crisis resources.


Fired employee sought AI help to hide deletion of hosting firm’s customer data

Summary: Two brothers fired from a hosting company that served 45+ US government agencies used an AI chatbot to help them delete customer databases and cover their tracks, asking it questions like how to clear system logs from SQL servers. The incident highlights that organizations need stronger controls to prevent insider attacks (damage from current or former employees) and must implement better safeguards to prevent AI tools from being misused for destructive purposes.


Microsoft feared being too dependent on OpenAI, Musk-Altman trial testimony reveals

Summary: Microsoft CEO Satya Nadella worried that OpenAI could become more dominant than Microsoft itself, similar to how Microsoft once overtook IBM in the 1980s. Court testimony revealed that Microsoft invested over $100 billion in OpenAI through investments, infrastructure, and hosting costs, and by the end of 2025, about 45% of Microsoft's cloud business obligations were tied to OpenAI, showing how dependent the company had become on its AI partner.


CVE-2026-42463: SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cr

Summary: SQLBot is a Text-to-SQL system (software that converts natural language questions into database queries) that uses large language models and RAG (retrieval-augmented generation, where the AI pulls in external documents to answer questions). Before version 1.8.0, it had an IDOR vulnerability (insecure direct object reference, where an attacker can access resources belonging to other users by manipulating request parameters), allowing attackers to access and modify database schemas and data from other workspaces or organizations.

Solution: This vulnerability is fixed in version 1.8.0. Users should upgrade SQLBot to 1.8.0 or later.


Microsoft’s Edge Copilot update uses AI to pull information from across your tabs

Summary: Microsoft Edge is updating its Copilot AI chatbot to access information from all your open browser tabs, letting you ask questions about tab content, compare products, and summarize articles. Users can choose which features to enable or disable, and Microsoft is replacing the older Copilot Mode (which had agentic features like booking reservations) with this new tab-aware version.


AI-driven cyberattacks will start to be the 'new norm' in months, Palo Alto warns

Summary: Palo Alto Networks warns that hackers are increasingly using AI models to find and exploit software vulnerabilities (weaknesses in code that attackers can use), and companies have only 3-5 months to strengthen their defenses before AI-driven attacks become common. Security teams are under pressure as more sophisticated AI models make it easier for attackers to discover previously unknown vulnerabilities faster than companies can fix them.

Solution: Palo Alto Networks announced it will roll out 'virtual patching capabilities' (temporary security measures that block attacks without changing the underlying code) 'very soon.' Additionally, Anthropic limited early access to its Mythos model to a select group of companies, including Palo Alto Networks, CrowdStrike, Amazon, Apple, and JPMorgan, to test and fix vulnerabilities before hackers can exploit them. OpenAI also launched its GPT-5.5-Cyber model and Daybreak cyber initiative to address these threats.

Anthropic
Mythos
Google
OpenAI
GPT-5.5-Cyber
Daybreak
Palo Alto Networks
CrowdStrike
Amazon
Apple
JPMorgan


AI chatbots are giving out people’s real phone numbers

Summary: AI chatbots like Google's Gemini and ChatGPT are accidentally revealing people's real phone numbers in their responses, sometimes giving out correct personal information and sometimes generating plausible-sounding but wrong numbers that still reach innocent people. Experts believe this happens because of personally identifiable information (PII, real details about people) in the training data (the information used to teach the AI), though the exact mechanism is unclear. The problem appears widespread and difficult to stop, with privacy removal companies reporting a 400% increase in requests about AI-related privacy concerns over the last seven months.


CVE-2026-45033: GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a  security vulne

Summary: GitHub Copilot CLI (an AI tool that helps developers write code from the command line) has a security vulnerability in versions before 1.0.43 where a malicious bare git repository (a special type of git storage folder with no working files) hidden in a project can trick the tool into running harmful commands. An attacker can exploit git's automatic discovery of these repositories and use configuration keys like core.fsmonitor (settings that tell git what commands to run during normal operations) to execute arbitrary code without the user knowing.

Solution: Update GitHub Copilot CLI to version 1.0.43 or later, where this vulnerability is fixed.


CVE-2026-44479: Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0,  hen the Vercel CLI ru

Summary: In Vercel CLI versions 50.16.0 to 52.0.0, when running in non-interactive mode (a mode where the tool runs without user interaction, often used in CI/CD systems or with AI agents), authentication tokens (secret credentials that prove your identity) could be accidentally included in plain text within JSON suggestions that the tool outputs. This means the token could be exposed in logs or agent records where it shouldn't be visible.

Solution: This vulnerability is fixed in version 52.0.1.


CVE-2026-44470: The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side

Summary: Claude Desktop for Windows had a security flaw in versions before 1.3834.0 where the CoworkVMService component (a background service running with high system privileges) did not properly check if directories were real folders or directory junctions (shortcuts that point to other locations) before creating files in them. An attacker with basic user access could trick this service into creating files in any location on the computer, potentially allowing them to gain administrator-level control of the system.

Solution: Update Claude Desktop to version 1.3834.0 or later, which includes a fix for this vulnerability.


CVE-2026-44467: The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side

Summary: The Claude Desktop app's SSH remote development feature (versions 1.2581.0 to before 1.4304.0) had a security flaw where it only checked if a hostname was in the ~/.ssh/known_hosts file without verifying that the server's actual host key matched the stored one. This allowed a network attacker (someone who could intercept traffic through methods like ARP spoofing or rogue Wi-Fi) to perform a man-in-the-middle attack (secretly intercepting and potentially altering communications between two parties) on remote development sessions, as long as the hostname was already in the victim's known_hosts file.

Solution: Update Claude Desktop to version 1.4304.0 or later.


GHSA-3644-q5cj-c5c7: LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Summary: LangSmith SDK (a tool for managing prompts in LangChain applications) had a vulnerability where pulling public prompts by owner/name would deserialize (convert from stored format into executable code) untrusted manifest files without warning users about the trust risk. An attacker could publish a malicious prompt that, when pulled and deserialized, would execute with attacker-controlled settings, potentially redirecting API requests to steal secrets or injecting malicious instructions into the AI's behavior.

Solution: Upgrade to LangSmith SDK Python >= 0.8.0 or JS/TS >= 0.6.0. The updated SDK now blocks pulling public prompts by `owner/name` by default and requires callers to explicitly pass `dangerously_pull_public_prompt=True` (Python) or `dangerouslyPullPublicPrompt: true` (JavaScript/TypeScript) to acknowledge the trust boundary risk. This flag should only be set after reviewing and trusting the actual prompt contents, not just the publishing account.

langchain-classic@< 1.0.7 (fixed: 1.0.7)


Sweet Security Launches Agentic AI Red Teaming to Counter ‘Mythos Moment’

Summary: The 'Mythos Moment' refers to when the speed and volume of AI-assisted cyberattacks exceeded what human security teams could handle. Sweet Security launched Sweet Attack, an agentic AI system (an AI that can plan and execute tasks autonomously) that performs continuous red teaming (security testing where an AI simulates attacker behavior) by maintaining detailed, real-time knowledge of each client's actual infrastructure, rather than relying on theoretical models.

Solution: Sweet Security provides Sweet Attack, which "automatically provides and maintains the full context necessary for Sweet Attack to operate" by continuously indexing runtime data directly from customers' environments, including topology, exposed systems, deployed code, identity paths, and application behavior. The system reevaluates potential attack paths "as soon as any new component appears in the runtime environment," enabling security teams to prioritize which vulnerabilities to fix based on actual exploitability rather than theoretical risk.


Altman details Musk's OpenAI fallout, says nonprofit was 'left for dead'

Summary: This article covers testimony from OpenAI CEO Sam Altman in a lawsuit brought by Elon Musk over OpenAI's conversion from a nonprofit to a for-profit structure. Altman argued that Musk abandoned the company rather than Altman stealing it, testifying that negotiations between the co-founders in 2017-2018 over corporate structure collapsed and Musk left OpenAI's board in February 2018. The dispute centers on whether Altman and other executives broke promises to keep OpenAI as a nonprofit and use Musk's roughly $38 million donation only for charitable purposes.

Solution: N/A -- no mitigation discussed in source.


Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday

Summary: Microsoft developed MDASH (multi-model agentic scanning harness), an AI system that uses over 100 specialized AI agents working together to find and validate security vulnerabilities in complex software like Windows. MDASH successfully discovered 16 vulnerabilities that were patched in May 2026, including two critical flaws that could allow remote code execution (running commands on a system without permission) in Windows networking components.


What happens when China’s AI catches up to Mythos?

Summary: Anthropic's Mythos is an AI system that can autonomously find and exploit zero-day vulnerabilities (previously unknown security flaws) in major software, and both the US and China are racing to develop similar capabilities. While the US has maintained a lead in AI development, the performance gap is rapidly closing, and the real danger may be less about which superpower dominates and more about these capabilities leaking into criminal groups or ransomware operations that governments cannot control. The US and China are exploring diplomatic channels to establish guardrails around powerful AI systems.

Solution: Anthropic has launched Project Glasswing and committed $100 million in usage credits to help defenders secure critical infrastructure before similar capabilities become widely available. Additionally, both the US and China are weighing conversations focused on establishing guardrails covering AI models behaving unexpectedly, autonomous military systems, and nonstate actors using powerful open-source tools.


Reducing Noise: Hybrid Static Application Security Testing–Large Language Model Pipeline for Code Security

Summary: Researchers created a hybrid system that combines SAST (static application security testing, which automatically scans code for vulnerabilities) with LLMs (large language models) to better filter and prioritize security alerts. The system reduced false positives (incorrect security warnings) by 91% in real deployments by using AI to intelligently triage findings and generate automated exploit examples.


Beyond Stop Signs: Why Evasion Attacks Matter Even More

Summary: Evasion attacks (methods where attackers trick AI systems into ignoring safety rules by manipulating input data) have been researched for more than ten years, but most real-world examples remain theoretical and academic. Because these demonstrations seem more like intellectual exercises than practical threats, people have largely dismissed evasion attacks as unimportant in actual security situations.


LatAm Vibe Hackers Generate Custom Hacking Tools on the Fly

Summary: Two hacking groups in Latin America are using AI agents (software that can perform tasks independently) to automatically create custom hacking tools for attacks against targets in Mexico and Brazil. This represents a new threat where attackers let AI do much of the work of building attack software rather than writing it manually.


Alexa is moving into Amazon․com

Summary: Amazon is launching Alexa for Shopping, an LLM-powered AI assistant (a language model trained to understand and respond to text) that integrates directly into Amazon.com to answer shopping questions and provide product recommendations. This new assistant replaces Amazon's previous shopping AI called Rufus and will appear prominently in the Amazon app and website when users type queries.

Amazon
Alexa
Alexa Plus
Alexa for Shopping
Rufus


Microsoft’s new AI system finds 16 Windows flaws, including four critical RCEs

Summary: Microsoft developed MDASH, an AI system that uses over 100 specialized AI agents to automatically find software vulnerabilities, and it discovered 16 previously unknown Windows flaws, including four critical RCEs (remote code execution attacks where attackers can run commands on a system). The vulnerabilities were patched in Microsoft's May 12 Patch Tuesday release, and the system will enter private preview for enterprise customers next month.

Solution: The vulnerabilities were patched as part of Microsoft's May 12 Patch Tuesday release.


Palo Alto bets on identity security for autonomous AI with Idira launch

Summary: Palo Alto Networks launched Idira, a new identity security platform designed to manage and secure human users, machine identities (non-human accounts that systems use), and AI agents as enterprises increasingly deploy autonomous AI systems. Unlike traditional identity management systems, Idira treats all identities as privileged and uses dynamic privilege controls, continuously discovering identities across cloud and developer environments while dynamically granting and revoking access permissions in real time rather than using static access tokens.

Palo Alto Networks
CyberArk
Auth0
SailPoint


OpenAI’s GPT-5.5 is as Good as Mythos at Finding Security Vulnerabilities

Summary: The UK's AI Security Institute tested whether GPT-5.5 (OpenAI's model) could find security vulnerabilities as well as Claude Mythos, and found they perform comparably. A smaller, cheaper model also performed equally well, though it needs more scaffolding (additional structure and guidance provided by the person writing prompts to the AI).

OpenAI
GPT-5.5
Claude Mythos
UK AI Security Institute


Building a safe, effective sandbox to enable Codex on Windows

Summary: Codex, OpenAI's coding agent, previously lacked a sandbox (a constrained execution environment with restricted permissions) on Windows, forcing users to either approve every command or allow unrestricted access. To solve this, the Codex team built a custom sandbox implementation because existing Windows tools like AppContainer, Windows Sandbox, and Mandatory Integrity Control labeling were either too restrictive for open-ended developer workflows or incompatible with the product requirements.


CISA’s AI SBOM guidance pushes software supply-chain oversight into new territory

Summary: CISA and G7 cyber agencies released guidance on minimum elements for AI software bills of materials (SBOMs, documents listing all components and dependencies in software), helping security leaders assess AI system risks before deployment. Unlike traditional SBOMs that only track code, AI SBOMs must document models, training data, prompts, infrastructure, and other AI-specific elements because AI systems' behavior depends on data and models as much as code. The guidance gives organizations a framework to ask vendors for transparency during procurement, though it shows what vendors claim exists rather than proving the systems are trustworthy.


Beware what you tell your AI chatbot. It’s not a shrink – it’s a snitch | Arwa Mahdawi

Summary: A legal dispute between Elon Musk and OpenAI leaders has revealed that private conversations shared with AI chatbots are not actually confidential, as evidenced by Greg Brockman's personal messages about Musk being used as court evidence. This case demonstrates that users should be cautious about disclosing sensitive personal information to AI systems because that data may not remain private.


SoftBank posts $46 billion gain at Vision Fund driven mainly by massive OpenAI bet

Summary: SoftBank's Vision Fund recorded a $46 billion gain in the past year, mostly from its massive investment in OpenAI, which has grown to be worth $852 billion. However, this heavy concentration of OpenAI in SoftBank's portfolio has raised concerns about the company's debt and financial stability, leading ratings agency S&P Global to downgrade its outlook from stable to negative.

Solution: S&P Global Ratings suggested that SoftBank could "limit negative financial impacts" by selling some assets. SoftBank has already been selling stakes in companies like T-Mobile and Nvidia to fund its OpenAI investment.

OpenAI
Google
Anthropic
SoftBank
Sam Altman


Our response to the TanStack npm supply chain attack

Summary: OpenAI discovered that two employee devices were compromised by malware hidden in a TanStack npm package (a JavaScript library downloaded from an online repository) as part of a broader supply chain attack called Mini Shai-Hulud. The attackers gained limited access to internal source code repositories and exfiltrated some credentials, but OpenAI found no evidence that customer data, production systems, or intellectual property were compromised. OpenAI responded by isolating affected systems, revoking credentials, rotating code-signing certificates (the digital signatures that verify software is authentic), and working with platform providers to prevent misuse of the compromised certificates.

Solution: OpenAI's explicit mitigation steps included: isolating impacted systems and identities, revoking user sessions, rotating all credentials across impacted repositories, temporarily restricting code-deployment workflows, rotating code-signing certificates for iOS, macOS, and Windows products, coordinating with platform providers to prevent unauthorized notarizations (digital certifications of software), and reviewing all previous notarizations to confirm no unauthorized software signing occurred. macOS users are required to update their applications once the certificate is fully revoked on June 12, 2026, after which macOS security protections will block new downloads and launches of apps signed with the previous certificate. Additionally, OpenAI accelerated deployment of security controls including hardened credential materials in their CI/CD pipeline (continuous integration/continuous deployment, the automated system for building and releasing software), package manager configurations with controls like minimumReleaseAge, and additional security software to validate package origins.


Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark

Summary: Microsoft has announced MDASH, a new multi-model agentic scanning harness (a tool that uses multiple AI systems working together to automatically detect security threats). The system achieved top performance on industry security benchmarks, representing an advance in AI-powered cyber defense.


Summary: Microsoft announced MDASH (a multi-model agentic scanning harness that uses over 100 specialized AI agents working together to find security vulnerabilities), which discovered 16 new vulnerabilities in Windows, including four critical remote code execution flaws (where attackers can run commands on systems they don't own). MDASH achieved an 88.45% score on a public cybersecurity benchmark, outperforming other systems, and is currently available only through a limited private preview program.