How Ceros Gives Security Teams Visibility and Control in Claude Code

Summary: Claude Code, Anthropic's AI coding agent, operates on developers' machines with full developer permissions but outside traditional enterprise security controls, reading files and executing commands before security tools can monitor them. Ceros is an AI Trust Layer (a security tool that sits on a developer's machine) built by Beyond Identity that provides real-time visibility, runtime policy enforcement, and an audit trail of Claude Code's actions by capturing device context, process history, and tying sessions to verified user identities through cryptographic keys.

Solution: Ceros provides mitigation through installation and enrollment: developers run two commands (curl -fsSL https://agent.beyondidentity.com/install.sh | bash and ceros claude) to install the CLI and launch Claude Code through Ceros. After email verification, Ceros captures full device context (OS, kernel version, disk encryption status, Secure Boot state, endpoint protection status) in under 250 milliseconds, records the complete process ancestry with binary hashes, ties the session to a verified human identity signed with a hardware-bound cryptographic key, and creates a complete audit record accessible through the Ceros admin console showing all Claude Code sessions by user, device, and time.

Anthropic
Claude Code
Beyond Identity
Ceros


5 key priorities for your RSAC 2026 agenda

Summary: RSA Conference 2026 is fundamentally organized around AI security, with 40% of sessions focused on how AI affects cybersecurity across all tracks. CISOs face a dual challenge: adopting AI quickly to stay competitive while simultaneously securing enterprise systems against new threats that AI itself creates. The conference prioritizes five learning areas: securing the AI stack (including RAG workflows, LLM data pipelines, and prompt injection attacks), AI governance and regulatory compliance, managing non-human identities (AI agents and service accounts that now outnumber human users), addressing shadow AI risks (unsanctioned tools and AI-generated code), and implementing autonomous security operations.

Solution: N/A -- no mitigation discussed in source.


How we monitor internal coding agents for misalignment

Summary: OpenAI has built a monitoring system for coding agents (AI systems that can autonomously write and execute code) used internally to detect misalignment, which occurs when an AI's behavior doesn't match its intended purpose. The system uses GPT-5.4 Thinking to review agent interactions within 30 minutes, flag suspicious actions, and alert teams so they can quickly respond to potential security issues.

Solution: OpenAI's explicit mitigation involves deploying a low-latency internal monitoring system powered by GPT-5.4 Thinking at maximum reasoning effort that reviews agent interactions and automatically alerts for actions inconsistent with user intent or violating internal security or compliance policies. The source states the monitor currently reviews interactions within 30 minutes of completion and that 'as the latency decreases towards near real-time review, the security benefits increase significantly,' with the eventual goal of evaluating coding agent actions before they are taken. The source also recommends that 'similar safeguards should be standard for internal coding agent deployments across the industry.'


Anthropic ban heralds new era of supply chain risk — with no clear playbook

Summary: The Trump administration has banned AI company Anthropic from Pentagon systems as a "supply chain risk," requiring government contractors to remove the company's technology within 180 days. However, most organizations lack complete visibility into where and how AI systems are used across their networks, making it extremely difficult to identify and remove Anthropic technology when it may be embedded in applications, APIs (application programming interfaces, which allow software to communicate), developer tools, or third-party services.


Secure Homegrown AI Agents with CrowdStrike Falcon AIDR and NVIDIA NeMo Guardrails

Summary: AI agents (autonomous programs that perform tasks without constant human input) face security risks when deployed in business environments, as a compromised agent could expose customer data or execute unauthorized actions. CrowdStrike Falcon AIDR (AI Detection and Response, a security monitoring system) now supports NVIDIA NeMo Guardrails (an open-source library that adds safety constraints to AI systems) as of version 0.20.0, enabling developers to add security controls like blocking prompt injection attacks (tricking an AI by hiding instructions in its input), redacting sensitive data, and moderating restricted topics.

Solution: Organizations should use CrowdStrike Falcon AIDR with NVIDIA NeMo Guardrails to implement security controls. Specifically: start with monitoring mode to understand threats, then progressively enforce blocks and redactions as agents move from development to production. The solution includes over 75 built-in classification rules and support for custom data classification to block prompt injection attacks, redact sensitive data like account numbers and SSNs, detect hardcoded secrets, block code injection attempts, and moderate unwanted topics to ensure compliance.

CrowdStrike
NVIDIA
CrowdStrike Falcon AIDR
NVIDIA NeMo Guardrails


OpenAI to acquire Astral

Summary: OpenAI is acquiring Astral, a company that builds popular open source Python development tools like uv (for managing code dependencies), Ruff (for checking code quality), and ty (for type safety). After the acquisition closes, OpenAI plans to integrate these tools with Codex (its AI system for code generation) so that AI can work alongside the tools developers already use throughout their entire workflow, from planning changes to maintaining software over time.


Autoresearching Apple's "LLM in a Flash" to run Qwen 397B locally

Summary: Researchers successfully ran a very large AI model (Qwen 397B, a Mixture-of-Experts model where each response only uses a subset of the total weights) on a MacBook Pro by using Apple's "LLM in a Flash" technique, which stores model data on the fast SSD storage and pulls it into RAM as needed rather than keeping everything in memory at once. They used Claude to run 90 experiments and generate optimized code that achieved 5.5+ tokens per second (response speed) by quantizing (reducing precision of) the expert weights to 2-bit while keeping other parts at full precision. The final setup used only 5.5GB of constant memory while streaming the remaining 120GB of compressed model weights from disk on demand.

Apple
Qwen
Claude
MLX
Meta (Andrej Karpathy's work context)


CVE-2025-15031: A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar a

Summary: MLflow, a machine learning platform, has a vulnerability (CVE-2025-15031) in how it extracts model files from compressed archives. The issue is that the software uses `tarfile.extractall` (a Python function that unpacks compressed tar files) without checking whether file paths are safe, allowing attackers to use specially crafted archives with `..` (parent directory references) or absolute paths to write files outside the intended folder. This could let attackers overwrite files or execute malicious code, especially in shared environments or when processing untrusted model files.


Navigating Security Tradeoffs of AI Agents

Summary: AI agents, like the open-source Clawdbot, are becoming more powerful and autonomous but introduce serious security risks because attackers can compromise them through the open-source supply chain. Two major attack types threaten AI systems: model file attacks (where malicious code is hidden in AI model files uploaded to trusted repositories) and rug pull attacks (where attackers compromise MCP servers, which are tools that give AI agents capabilities, to perform malicious actions). The article notes that traditional security methods don't yet exist for protecting AI agents, and a single corrupted component can spread threats across many teams.

Solution: The source explicitly recommends: 'Teams must scan model files with tools that can parse machine learning formats, and load models in isolated containers, virtual machines or browser sandboxes.' For rug pull attacks specifically, the article states that 'the alternative is to use remote MCP servers whose code is maintained by trusted organizations' like GitHub, which 'reduces the risk of an MCP rug pull attack' (though it does not prevent malicious actions from the tools themselves).


GHSA-gjgx-rvqr-6w6v: Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

Summary: Mesop contains a critical vulnerability in its testing module where a `/exec-py` route accepts Python code without any authentication checks and executes it directly on the server. This allows anyone who can send an HTTP request to the endpoint to run arbitrary commands on the machine hosting the application, a flaw known as unauthenticated remote code execution (RCE, where an attacker runs commands on a system they don't own).


GHSA-8qvf-mr4w-9x2c: Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Summary: Mesop has a path traversal vulnerability (a technique where an attacker uses sequences like `../` to escape intended directory boundaries) in its file-based session backend that allows attackers to read, write, or delete arbitrary files on the server by crafting malicious `state_token` values in messages sent to the `/ui` endpoint. This can crash the application or give attackers unauthorized access to system files.


ChatGPT did not cure a dog’s cancer

Summary: A story claimed that ChatGPT helped cure an Australian entrepreneur's dog of cancer, generating widespread attention as evidence that AI could revolutionize medicine. However, the article suggests this narrative is more complicated than the promoted version, implying the reality behind the claim differs from what was publicly reported.


GHSA-22cc-p3c6-wpvm: h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Summary: The h3 library has a vulnerability in its Server-Sent Events (SSE, a protocol for pushing real-time messages from a server to connected clients) implementation where newline characters in message fields are not removed before being sent. An attacker who controls any message field (id, event, data, or comment) can inject newline characters to break the SSE format and trick clients into receiving fake events, potentially forcing aggressive reconnections or manipulating which past events are replayed.


'Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft

Summary: Researchers discovered three connected flaws in Claude (an AI assistant) that can work together to steal user data, starting with a prompt injection attack (tricking the AI by hiding malicious instructions in its input) combined with a Google search vulnerability. This attack chain could potentially compromise enterprise networks that rely on Claude.


Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches

Summary: Shadow AI refers to AI systems hidden within SaaS applications (software services accessed online) that operate without proper oversight, creating security risks that can lead to major data breaches. The article emphasizes that organizations lack visibility into these autonomous AI systems and calls for better monitoring and control mechanisms to manage agentic AI (AI that can independently take actions to achieve goals).


A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Models

Summary: Diffusion models (AI systems that generate images and other content by gradually removing noise from random data) are vulnerable to backdoor attacks, where hidden triggers cause the model to produce harmful outputs. Researchers created PureDiffusion, a framework that can both defend against these attacks by detecting and inverting the hidden triggers, and amplify attacks by making existing backdoors more effective.


N Truths and a Lie: Consistency-Based Backdoor Defense for Vertical Federated Learning

Summary: This paper addresses backdoor attacks (where attackers secretly poison AI models to make them behave maliciously) in vertical federated learning (VFL, a setup where different organizations train an AI together on their own private data). The researchers propose a defense using a latent masked autoencoder (LMAE, a type of neural network that detects patterns and missing information) to identify when one participant is submitting suspicious, inconsistent data compared to honest participants, allowing the system to reject malicious contributions.

Solution: The paper proposes a novel defense mechanism using a latent masked autoencoder (LMAE) to assess the semantic consistency of embeddings (learned data representations) from different participants. The authors developed an algorithm based on the LMAE that identifies attackers and enables backdoor-resistant predictions. The defense was tested on multiple datasets and backdoor attack types and demonstrated effectiveness at identifying attackers while maintaining high prediction accuracy.


GHSA-3xm7-qw7j-qc8v: SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

Summary: The @aborruso/ckan-mcp-server tool allows attackers to make HTTP requests to any address by controlling the `base_url` parameter, which has no validation or filtering. An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to make the tool scan internal networks or steal cloud credentials, but exploitation requires the victim's AI assistant to have this server connected.

Solution: The source explicitly recommends: (1) Validate `base_url` against a configurable allowlist of permitted CKAN portals, (2) Block private IP ranges (RFC 1918, link-local addresses like 169.254.x.x), (3) Block cloud metadata endpoints (169.254.169.254), (4) Sanitize SQL input for datastore queries, and (5) Implement a SPARQL endpoint allowlist.

@aborruso/ckan-mcp-server@< 0.4.85 (fixed: 0.4.85)


GHSA-rf6x-r45m-xv3w: Langflow is Missing Ownership Verification in API Key Deletion (IDOR)

Summary: Langflow has a security flaw called IDOR (insecure direct object reference, where an attacker can access or modify resources belonging to other users) in its API key deletion feature. An authenticated attacker can delete other users' API keys by guessing their IDs, because the deletion endpoint doesn't verify that the API key belongs to the person making the request. This could allow attackers to disable other users' integrations or take over their accounts.

Solution: Modify the delete_api_key endpoint and function by: (1) passing current_user to the delete function; (2) adding a verification check in delete_api_key() that confirms api_key.user_id == current_user.id before deletion; (3) returning a 403 Forbidden error if the user doesn't own the key. Example code provided: 'if api_key.user_id != user_id: raise HTTPException(status_code=403, detail="Unauthorized")'


The Download: The Pentagon’s new AI plans, and next-gen nuclear reactors

Summary: The Pentagon is planning to create secure environments where AI companies can train their models on classified military data, which would embed sensitive intelligence like surveillance reports into the AI systems themselves and bring these companies closer to classified information than before. This represents a major shift from current use of AI models like Claude in classified settings, but introduces unique security risks by allowing models to learn from rather than just access classified data.

Anthropic Claude OpenAI DeepSeek Nvidia Microsoft Meta


DLSS 5: Has Nvidia’s AI graphics technology gone too far?

Summary: Nvidia has released DLSS 5, a new 3D guided neural rendering model (an AI system that generates realistic graphics in real-time) that can alter a game's lighting and materials during gameplay. Many gamers have criticized the technology for changing how games look in ways they didn't expect, with complaints that it distorts character appearances and doesn't respect the original artists' creative vision.


Reco targets AI agent blind spots with new security capability

Summary: Reco, a SaaS security platform, launched "Reco AI Agent Security" on March 18 to address "agent sprawl," the problem of autonomous AI agents (like Copilot and ChatGPT integrations) accessing sensitive data and taking actions across multiple systems without human oversight. The new tool gives security teams visibility and control over these AI agents by using behavior-based detection (analyzing API call patterns and workflow signatures) instead of traditional connection-based methods, identifying risks like agents with excessive permissions or misconfigured access to customer data.

Solution: Reco AI Agent Security is explicitly designed as the mitigation. According to the source, the offering provides: (1) AI agent discovery through multi-layered detection that analyzes API call patterns and service account activity to identify autonomous behavior; (2) risk analysis by correlating activity across applications and recognizing workflow signatures of automation tools like n8n, Zapier, and Make; and (3) governance and control over all AI agents operating in the SaaS ecosystem. The platform tracks OAuth connections, analyzes decision-making patterns that indicate autonomous action, and monitors cross-application activity to identify agents that traditional SSPM tools miss.

Reco
Microsoft Copilot
ChatGPT
Salesforce Agentforce
n8n
Zapier
Make
Airtable
NetSuite
GitHub


Claude Code Security and Magecart: Getting the Threat Model Right

Summary: Magecart attacks (malicious code injected into e-commerce sites to steal payment data) often hide in third-party resources like images or scripts that never enter a company's code repository, making them invisible to static analysis tools like Claude Code Security. Claude Code Security is designed to scan code you own, so it cannot detect malicious code injected at runtime through compromised external libraries, CDNs (content delivery networks that distribute files globally), or data hidden in binary files like favicons, which means repository-based scanning has a fundamental blind spot for this attack class.


We asked experts about the most responsible ways to use AI tools – here’s what they said

Summary: The article discusses expert advice on responsible AI tool use, emphasizing that people should use AI as a brainstorming partner and for organizing information, but should not let it replace their own decision-making. A 2025 survey shows that one-third of US adults use ChatGPT, with particularly high adoption among people under 30.


Can you prove the person on the other side is real?

Summary: Synthetic identity fraud, where criminals create fake people using AI-generated documents and deepfakes (realistic fake videos or audio), is becoming a major threat in estate and identity verification work. Traditional security checks that look at device fingerprints or typing patterns are no longer reliable because AI can now imitate these signals. The text explains that the real challenge by 2026 will be distinguishing legitimate people from manufactured personas, especially in high-stakes situations involving inheritance and family claims.

Solution: The source suggests moving from asking "Who is this?" to a more forensic approach: "How did this identity—and its digital footprint—come to exist?" This shift means prioritizing provenance (where the identity originated), issuer verification (confirming documents are real), and cross-channel consistency (checking if the person's presence makes sense across multiple systems) over accepting surface-level plausibility. However, the text does not provide specific technical implementations or detailed steps for executing this approach.


China’s ‘AI tigers’ see shares surge after Nvidia CEO touts OpenClaw as ‘next ChatGPT’

Summary: Chinese AI companies saw significant stock gains after Nvidia CEO Jensen Huang praised OpenClaw, an open-source AI agent (a program that can perform tasks independently), as "the next ChatGPT." Companies like MiniMax and Zhipu, which are among China's leading AI developers building large language models (AI systems trained on huge amounts of text to understand and generate language), have integrated OpenClaw into their products and are launching their own versions based on it.

OpenAI
Anthropic
Google
NVIDIA
MiniMax
Zhipu
Knowledge Atlas Technology
SenseTime
UCloud Technology
SK Hynix
Samsung Electronics


CISOs rethink their data protection strategies

Summary: CISOs (Chief Information Security Officers, the top security leaders at companies) are updating their data protection strategies because employees are rapidly sharing company data with AI tools, including public models like ChatGPT, creating new security risks. A CISO at a law firm added a new protection layer that classifies data based on whether it can be safely used with AI and invested in new monitoring tools, while also regularly evaluating new technologies to ensure controls keep pace with AI innovations.

Solution: The source describes one organization's approach: add a protection layer that classifies and tags data based on whether it could be used with AI and in what circumstances, invest in new tools to support that layer, monitor the vendor landscape for emerging capabilities, and evaluate new technologies being deployed to determine whether new controls are needed for them. However, no specific technical solutions, patches, or vendor recommendations are explicitly named in the source text.


Meta's Manus launches desktop app to bring its AI agent onto personal devices amid OpenClaw craze

Summary: Meta-owned Manus launched a desktop application with a feature called 'My Computer' that allows its AI agent (a program that can complete complex, multi-step tasks automatically) to access and control files, tools, and applications directly on a user's computer, rather than only working in the cloud. This move competes with OpenClaw, a free, open-source AI agent that similarly runs on local devices. Experts have raised security and privacy concerns about giving AI agents local device access, but Manus addressed this by requiring explicit user approval before the agent executes tasks.

Solution: Manus's mitigation for security and privacy risks includes a control mechanism requiring explicit user approval before task execution. According to Manus, users can choose "Allow Once" for individual review of each action or "Always Allow" for trusted, recurring actions, keeping users "firmly in control."


OWASP GenAI Security Project Expands AI Security Frameworks Ahead of RSA 2026, Celebrates Continued Sponsor Support

Summary: The OWASP GenAI Security Project, an open-source community focused on AI security, announced expansion of its resources and frameworks with over 25,000 members contributing practical guidance and tools. The project is being highlighted at the RSA 2026 conference, indicating growing industry adoption of AI security best practices.


Survey on Learning-based Dynamic Fault Localization: From Traditional Machine Learning to Large Language Models

Summary: This survey examines methods for automatically finding bugs in software code by using machine learning and AI models, tracing the evolution from traditional machine learning techniques to modern large language models (LLMs, which are AI systems trained on vast amounts of text data). The research covers how these AI-based approaches learn patterns to pinpoint where faults occur in code, making debugging faster and more efficient than manual inspection.


Nvidia CEO Jensen Huang says OpenClaw is 'definitely the next ChatGPT'

Summary: Nvidia CEO Jensen Huang highlighted OpenClaw, an open-source autonomous AI agent platform (a system that can complete tasks and make decisions with minimal human input, unlike traditional chatbots), calling it "the next ChatGPT" and a major breakthrough in AI interaction. Nvidia launched NemoClaw, an enterprise version of OpenClaw that adds security, scalability, and oversight tools to make these autonomous agents safe for real-world business use, addressing concerns about security, privacy, and control as these systems gain the ability to act independently.

Solution: Nvidia addressed risks with NemoClaw by building "guardrails, including privacy protections, oversight tools, and enterprise-grade security to ensure these agents can be deployed safely at scale."


The Pentagon is planning for AI companies to train on classified data, defense official says

Summary: The Pentagon is planning to let AI companies train their models on classified military data in secure facilities, which would allow the AI to learn from and embed sensitive intelligence like surveillance reports. While this could make AI systems more accurate for military tasks, experts warn it creates risks: classified information that the AI learns could accidentally be shared with people or military departments that shouldn't have access to it, potentially endangering operatives or exposing secrets.


OpenAI preps for IPO by end of year, tells employees ChatGPT must be 'productivity tool'

Summary: OpenAI is preparing for an initial public offering (IPO, where a private company sells shares to the public) potentially by the end of 2024, with leadership telling employees that ChatGPT must focus on being a productivity tool for businesses. The company is shifting strategy to convert its 900 million weekly users into enterprise customers and has scaled back its infrastructure spending targets from $1.4 trillion to $600 billion by 2030 to present a more realistic financial picture to investors.


GHSA-2cpp-j2fc-qhp7: AWS API MCP File Access Restriction Bypass

Summary: The AWS API MCP Server (a tool that lets AI assistants interact with AWS services) has a vulnerability in versions 0.2.14 through 1.3.8 where attackers can bypass file access restrictions and read files they shouldn't be able to access, even when the server is configured to block file operations or limit them to a specific directory.

Solution: Upgrade to version 1.3.9 or later.


GHSA-vwmf-pq79-vjvx: Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Summary: Langflow has an unauthenticated remote code execution vulnerability in its public flow build endpoint. The endpoint is designed to be public but incorrectly accepts attacker-supplied flow data containing arbitrary Python code, which gets executed without sandboxing when the flow is built. An attacker only needs to know a public flow's ID and can exploit this to run any code on the server.


GPT-5.4 mini and GPT-5.4 nano, which can describe 76,000 photos for $52

Summary: OpenAI released two new smaller AI models, GPT-5.4 mini and GPT-5.4 nano, that are cheaper and faster than previous versions. GPT-5.4 nano is particularly affordable at $0.20 per million input tokens, making it economical for tasks like image description, where describing 76,000 photos would cost around $52.

OpenAI
GPT-5.4
GPT-5.4 mini
GPT-5.4 nano
Claude Opus 4.6
Claude Sonnet 4.6
Gemini 3.1 Pro
Claude Haiku 4.5
Gemini 3.1 Flash-Lite


Nvidia NemoClaw promises to run OpenClaw agents securely

Summary: OpenClaw, a framework for running AI agents (autonomous programs that can take actions) locally on devices rather than in the cloud, has faced security concerns since its rapid rise in early 2026. Nvidia announced NemoClaw, which addresses these vulnerabilities by using OpenShell, a security layer that includes kernel-level sandboxing (isolating programs from the core system) and a privacy router that monitors and blocks unauthorized data transfers by OpenClaw.

Solution: NemoClaw's OpenShell runtime isolates OpenClaw using kernel-level sandboxing and a 'privacy router' that monitors OpenClaw's behavior and communication with other systems, stepping in to block actions if it detects OpenClaw sending sensitive data somewhere it shouldn't. OpenShell is fully open source.

NVIDIA
NemoClaw
OpenClaw
OpenAI
DeepSeek
Microsoft AutoGen
Google Vertex AI


llm 0.29

Summary: This is a monthly briefing about LLM (large language model) developments from March 2026, curated by Simon Willison. The content appears to be a sponsorship announcement for a paid email digest service rather than a discussion of a specific AI issue or vulnerability.


Arbitrary code execution via crafted project files in Kiro IDE

Summary: Kiro IDE, an AI-powered development environment for building autonomous software agents, has a vulnerability (CVE-2026-4295) that allows arbitrary code execution (running unintended commands on a system) when users open malicious project files. The flaw exists in versions before 0.8.0 due to improper trust boundary enforcement (failing to verify that data comes from a safe source).


What the EU AI Act Means for Staffing Businesses

Summary: The EU AI Act, effective August 2, 2026, classifies AI systems used in hiring and employment decisions (such as candidate screening, ranking, and performance monitoring) as high-risk and requires businesses that deploy them to conduct risk assessments, perform bias testing, maintain human oversight, and provide transparency disclosures. Staffing companies, recruitment platforms, and workforce intermediaries are responsible for compliance even if they did not build the technology, and this obligation applies globally if the AI system affects anyone in the EU.


AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

Summary: Researchers discovered that Amazon Bedrock AgentCore Code Interpreter allows outbound DNS queries (the system that translates website names to IP addresses) even when configured with no network access, letting attackers steal data and run commands by using DNS as a secret communication channel. Amazon says this is intended functionality and recommends users switch to VPC mode (a virtual private network configuration) instead of sandbox mode for better isolation. Separately, a flaw in LangSmith (a tool for managing AI language model workflows) allows attackers to steal user login tokens through URL parameter injection (inserting malicious data into web addresses).

Solution: For Amazon Bedrock: migrate from Sandbox mode to VPC mode, implement a DNS firewall to filter outbound DNS traffic, audit IAM roles to follow the principle of least privilege (giving services only the minimum permissions they need), and use strict security groups and network ACLs. For LangSmith: update to version 0.12.71 or later (released December 2025), which addresses the token theft vulnerability.

Amazon Bedrock
AgentCore Code Interpreter
LangSmith
SGLang
AWS
Sectigo


Now everyone in the US is getting Google’s personalized Gemini AI

Summary: Google has expanded access to its Personal Intelligence feature, which connects various Google apps (like YouTube, Gmail, and Google Photos) to give Gemini (Google's AI assistant) more context for better responses. Previously available only to paid subscribers, this feature is now accessible to free-tier users in the US through Search, Chrome, and the Gemini app, though it remains limited to personal accounts and not business or education accounts.


Tech Giants Invest $12.5 Million in Open Source Security

Summary: Five major technology companies (Anthropic, AWS, Google, Microsoft, and OpenAI) have collectively invested $12.5 million into the Linux Foundation (a nonprofit organization that maintains critical open source software) to support long-term security improvements in open source projects. This funding aims to strengthen the security of widely-used software that many other programs depend on.

Anthropic Amazon Google Microsoft OpenAI


Microsoft shakes up Copilot AI leadership team, freeing up Suleyman to build new models

Summary: Microsoft is reorganizing its AI leadership, moving Jacob Andreou into a new executive role overseeing both consumer and commercial Copilot assistants, while freeing up Mustafa Suleyman to focus on building new AI models as part of Microsoft's superintelligence (advanced AI systems aiming toward human-level reasoning) efforts. This restructuring comes as Microsoft's Copilot adoption lags significantly behind competitors like ChatGPT and Gemini, and as investors pressure the company to show returns on its AI investments.

Microsoft Copilot DeepMind Google Inflection Anthropic OpenAI ChatGPT Gemini Bing


Microsoft appoints a new Copilot boss after AI leadership shake-up

Summary: Microsoft is reorganizing its leadership to unify its Copilot assistant (an AI tool that helps users with tasks) across consumer and business products, which have been developed separately. The AI CEO Mustafa Suleyman will now focus on building Microsoft's own AI models rather than directly managing Copilot's features for individual users.


The future of code is exciting and terrifying

Summary: AI coding tools like Claude Code are changing how software development works, with more people able to write code and experienced developers spending less time writing code themselves and more time managing AI agents (programs that can act somewhat autonomously) and projects. The article explores what these rapid changes mean for both the code being produced and the people who create it.


Surf AI Raises $57 Million for Agentic Security Operations Platform

Summary: Surf AI, a company building an agentic security operations platform (software that uses AI agents, or autonomous programs that take actions without human intervention, to handle security tasks), has announced its launch with $57 million in funding from major investors. The article focuses on the company's funding announcement rather than a specific security issue or problem.


Top 5 Things CISOs Need to Do Today to Secure AI Agents

Summary: AI agents are autonomous software systems that can plan, decide, and act independently across connected systems, often without human oversight, creating significant security risks that traditional guardrails (like prompt filtering) cannot adequately address. The article argues that identity-based access control, rather than prompt restrictions or network controls, is the foundation for securing AI agents. CISOs must treat AI agents as first-class identities, shift from guardrails to strict access control, and eliminate shadow AI (unauthorized agents) through continuous discovery and visibility of agent identities.


New font-rendering trick hides malicious commands from AI tools

Summary: Researchers discovered a font-rendering attack that hides malicious commands from AI assistants by using custom fonts and CSS styling to display one message to users while keeping harmless text visible to AI tools analyzing the webpage's HTML. The attack successfully tricked multiple popular AI assistants (like ChatGPT, Claude, and Copilot) into giving false safety assessments, exploiting the gap between what an AI reads in code and what a user actually sees rendered in their browser.

Solution: Microsoft was the only vendor that fully accepted and addressed the issue. LayerX recommends that AI assistants should analyze both the rendered visual page and the underlying code together and compare them to better evaluate safety. Additional recommendations to AI vendors include treating fonts as a potential attack surface, extending code parsers to scan for foreground/background color matches, near-zero opacity text, and abnormally small fonts.

ChatGPT Claude Copilot Gemini Leo Grok Perplexity Sigma Dia Fellou Genspark


Microsoft stops force-installing the Microsoft 365 Copilot app

Summary: Microsoft has temporarily stopped automatically installing the Microsoft 365 Copilot app (an AI assistant integrated with productivity software like Word and Excel) on Windows devices outside the European Economic Area, though the company has not explained why the rollout was halted. When the automatic installation resumes, IT administrators will be able to disable it through the Microsoft 365 Apps admin center by unchecking the automatic installation setting.

Solution: According to the source, when automatic installation resumes, IT administrators can opt out by: signing into the Microsoft 365 Apps admin center, navigating to Customization > Device Configuration > Modern App Settings, selecting the Microsoft 365 Copilot app, and clearing the 'Enable automatic installation of Microsoft 365 Copilot app' checkbox. Additionally, the source mentions that Microsoft is testing a new policy called RemoveMicrosoftCopilotApp that would allow IT admins to uninstall Copilot from devices managed via Microsoft Intune or System Center Configuration Manager (SCCM, software for managing large numbers of computers).


FORCE: Byzantine-Resilient Decentralized Federated Learning via Game-Theoretic Contribution Aggregation

Summary: Decentralized Federated Learning (DFL, a way for multiple computers to train AI models together without a central server) is vulnerable to Byzantine attacks (when malicious participants send bad data to sabotage the learning process). The paper proposes FORCE, a new method that uses game theory concepts (mathematical models of strategy and fairness) to identify and exclude malicious clients by checking their model loss (how well their models perform) instead of checking gradients (the direction to improve), making DFL more resistant to these attacks.


Boosting Active Defense Persistence: A Two-Stage Defense Framework Combining Interruption and Poisoning Against Deepfake

Summary: This research addresses a weakness in active defense systems against deepfakes (AI-generated fake videos or images): these defenses often fail when attackers retrain their models on protected samples. The authors propose a Two-Stage Defense Framework (TSDF) that uses dual-function adversarial perturbations (carefully designed noise patterns that disrupt both the deepfake output and the attacker's retraining process) to make defenses more persistent by poisoning the data (corrupting the training information) that attackers would use to adapt their models.

Solution: The source describes the proposed defense framework (TSDF) as the solution but does not mention an existing patch, update, or mitigation for current systems. The paper presents the framework as a research contribution rather than a fix for deployed software. N/A -- no mitigation for existing systems discussed in source.


The Download: OpenAI’s US military deal, and Grok’s CSAM lawsuit

Summary: This newsletter roundup covers multiple AI-related developments, including OpenAI's partnership with the US military (potentially for applications like selecting strike targets), xAI's Grok facing a lawsuit over generating non-consensual intimate images (deepfakes, or synthetic media created to impersonate real people), and China approving the world's first commercial brain chip (a BCI, or brain-computer interface that reads signals from the brain) for medical use. The piece also highlights concerns from AI safety experts, including OpenAI's own wellbeing team opposing a new 'adult mode' feature.

Solution: N/A -- no mitigation discussed in source.

OpenAI xAI Grok Anthropic Nvidia ChatGPT


AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch

Summary: Researchers discovered that AWS Bedrock's Sandbox mode for AI agents isn't as isolated as promised because it allows outbound DNS queries (requests to translate domain names into IP addresses), which attackers can exploit to secretly communicate with external servers, steal data, or run remote commands. AWS acknowledged the issue but decided not to patch it, calling DNS resolution an 'intended functionality' needed for the system to work properly, and instead updated their documentation to clarify this behavior.

Solution: AWS updated documentation to clarify that Sandbox mode permits DNS resolution. Security teams should inventory all active AgentCore Code Interpreter instances and migrate to VPC mode (a more restricted network environment).


Alibaba launches agentic AI tool for businesses with Slack, Teams integration plans

Summary: Alibaba released Wukong, a new agentic AI tool (software that can take proactive actions on company systems, not just respond to questions) designed to help businesses manage multiple AI agents through a single interface with planned integration into messaging apps like Slack and Microsoft Teams. The platform handles tasks such as document editing, approvals, and meeting transcription, though the company acknowledges that giving AI agents broad access to company data raises privacy and security concerns.

Alibaba
Wukong
DingTalk
Qwen
Tongyi Laboratory
OpenClaw
Zhipu AI
Tencent
OpenAI


Open, Closed and Broken: Prompt Fuzzing Finds LLMs Still Fragile Across Open and Closed Models

Summary: Researchers created a genetic algorithm-inspired prompt fuzzing method (automatically generating variations of harmful requests while keeping their meaning) that found significant weaknesses in guardrails (safety systems protecting LLMs) across multiple AI models, with evasion rates ranging from low to high depending on the model and keywords used. The key risk is that while individual jailbreak attempts (tricking an AI to ignore its safety rules) may have low success rates, attackers can automate this process at scale to reliably bypass protections. This matters because LLMs are increasingly used in customer support and internal tools, so guardrail failures can lead to safety incidents and compliance problems.

Solution: The source recommends five mitigation strategies: treating LLMs as non-security boundaries, defining scope, applying layered controls, validating outputs, and continuously testing GenAI with adversarial fuzzing (automated testing with malicious inputs) and red-teaming (simulated attacks to find weaknesses). Palo Alto Networks customers can use Prisma AIRS and the Unit 42 AI Security Assessment products for additional protection.

OpenAI
Microsoft
Azure
Palo Alto Networks


Introducing GPT-5.4 mini and nano

Summary: OpenAI released GPT-5.4 mini and nano, smaller and faster versions of their GPT-5.4 model designed for high-volume tasks where response speed matters. GPT-5.4 mini runs more than 2x faster than GPT-5 mini while approaching the performance of the full GPT-5.4 model on coding and reasoning tasks, while GPT-5.4 nano is the smallest and cheapest option for simpler jobs like classification and data extraction. These models work best in applications like coding assistants, AI subagents (specialized AI components that handle specific subtasks), and systems that interpret screenshots, where being fast and cost-effective is more important than raw capability.

OpenAI
GPT-5.4 mini
GPT-5.4 nano
ChatGPT
Codex


OpenAI Japan announces Japan Teen Safety Blueprint to put teen safety first

Summary: OpenAI Japan announced the Japan Teen Safety Blueprint, a framework to help teenagers use generative AI (systems that create text, images, or other content based on patterns) safely by reducing risks like misinformation and inappropriate content. The blueprint includes age-aware protections, stronger safety policies for users under 18, expanded parental controls, and research-based design improvements developed with child safety experts.

Solution: OpenAI will implement: (1) privacy-conscious, risk-based age estimation to distinguish teens from adults with appeals processes for incorrect determinations; (2) strengthened safety policies preventing AI from depicting self-harm, generating explicit content, or encouraging dangerous behavior; (3) expanded parental controls including account linking, privacy settings, usage-time management, and alerts; (4) research-based design features such as break reminders and pathways to real-world support; and (5) continuation of existing safeguards including in-product break reminders, self-harm detection systems, multi-layered safety systems, and abuse monitoring.


A novel android malware detection method based on CWInFs and MPTACF optimization

Summary: Android malware is a major security threat because the Android operating system's open app ecosystem allows unverified applications to be installed, making it easier for malicious software to spread and steal data, perform unauthorized financial transactions, or remotely control devices. Researchers are using machine learning (algorithms that learn patterns from data) to detect malware by analyzing features of Android application packages (APK files, the file format for Android apps), with recent research focusing on three main approaches: selecting the most important features to analyze, combining multiple detection models together, and handling datasets where malicious apps are much rarer than legitimate ones.


Runtime: The new frontier of AI agent security

Summary: AI agents (autonomous software programs that can perform tasks independently) are now operating inside company networks with real access to systems, sometimes causing expensive mistakes like deleting inboxes or taking services offline. Traditional security approaches focus on preventing problems before deployment, but security leaders increasingly argue that runtime security (continuously monitoring what software actually does while it's running) is equally critical because agents can bypass normal security checkpoints and make mistakes at high speed. The challenge is that agents operate through API calls and other direct connections that traditional security tools don't intercept, generate enormous volumes of activity, and often don't create detailed logs that security teams can review.

Meta Amazon AWS Uber Cloudflare Facebook


A photo of Iran’s bombed schoolgirl graveyard went around the world. Was it real, or AI?

Summary: Multiple fake images and unreliable responses from AI systems like Gemini and Grok have spread widely during coverage of the Iran conflict, making it difficult to verify whether widely-shared photos, such as one purporting to show a mass grave for schoolgirls, are real or AI-generated. The article highlights how AI-generated misinformation (often called "AI slop," low-quality AI-produced content) is flooding news coverage of the war.


Agent Commander: Promptware-Powered Command and Control

Summary: Promptware-powered command and control (C2, a system attackers use to remotely control compromised devices) refers to using prompt injection (tricking an AI by hiding instructions in its input) attacks against AI tools like ChatGPT to create a malicious control channel. Researchers have demonstrated that by combining features like browsing and memory capabilities in AI systems, attackers can build complex, malware-like prompt injection payloads that function similarly to traditional malware for remote control purposes.


AI firm Anthropic seeks weapons expert to stop users from 'misuse'

Summary: Anthropic, a US AI company, is hiring a weapons expert to prevent its AI tools from being misused to create chemical, biological, or radioactive weapons. The article notes that other AI firms like OpenAI are doing the same, but some experts worry this approach is risky because it requires exposing AI systems to sensitive weapons information, even if the systems are instructed not to use it.


Equipping workers with insights about compensation

Summary: Workers are using ChatGPT to find wage information, sending nearly 3 million messages per day in the US asking about compensation, especially in fields where pay is hard to find or varies widely like creative work, management, and healthcare. The article describes how AI can help close the wage information gap by synthesizing pay data across multiple sources, which matters because better wage information helps workers make informed decisions about job applications, negotiations, and career moves. OpenAI introduced WorkerBench, a new benchmark tool, to evaluate how accurately ChatGPT provides labor market wage information compared to official government data.


Introducing Mistral Small 4

Summary: Mistral released Mistral Small 4, a new 119-billion parameter model (Mixture-of-Experts, a technique where only some parts of the model activate for each task) that combines reasoning, image understanding, and coding capabilities into one system. The model supports two reasoning modes and is available through the Mistral API, though the reasoning effort setting was not yet documented in their API at the time of writing.

Mistral
Mistral Small 4
Magistral
Pixtral
Devstral
Leanstral
HuggingFace


Child abuse material ‘systemic’ on Elon Musk’s X amid Grok scandal, Australian online safety regulator warned

Summary: Australia's online safety regulator warned Elon Musk's X platform that child abuse material was unusually widespread on the service after Grok, a chatbot (an AI designed to have conversations), was used to create sexualized images of women and children. The regulator's letter, sent in January following the incident, pointed out that such harmful content was more accessible on X than on other major social media platforms.


Teens sue Elon Musk’s xAI over Grok’s AI-generated CSAM

Summary: Three Tennessee teens are suing Elon Musk's xAI company, claiming that Grok, an AI chatbot, generated sexualized images and videos of them as minors. The lawsuit alleges that xAI leaders knew the chatbot's "spicy mode" (a less-restricted version of the AI) would produce CSAM (child sexual abuse material, illegal content depicting minors in sexual situations) when they launched it last year.


Quoting A member of Anthropic’s alignment-science team

Summary: An Anthropic alignment researcher explains that their team conducted a blackmail exercise to demonstrate misalignment risk (when an AI system's goals don't match what humans intend) in a way that would convince policymakers. The goal was to create compelling, concrete evidence that would make the potential dangers of misaligned AI feel real to people who hadn't previously considered the issue.


Alignment of Diffusion Models: Fundamentals, Challenges, and Future

Summary: This is an academic survey paper published in ACM Computing Surveys that examines alignment of diffusion models (AI systems trained to generate images or other content by gradually removing noise from random data). The paper covers fundamental concepts, current challenges in making these models behave as intended, and directions for future research in this area.


Machine Learning for Cybersecurity: A Comprehensive Literature Review

Summary: This is a literature review article published in an academic journal that surveys how machine learning (algorithms that learn patterns from data to make predictions) is being applied to cybersecurity problems. The article covers research across the field but does not describe a specific security vulnerability or incident requiring a fix.


Selective Forgetting in Machine Learning and Beyond: A Survey

Summary: This is a survey article that reviews research on selective forgetting in machine learning, which is the ability to remove or reduce specific information from a trained AI model without completely retraining it from scratch. The article covers methods and applications of this technique across various AI systems and domains. The survey appears to be an academic overview of current knowledge in this area rather than describing a specific problem or vulnerability.


A Systematic Review on Human Roles, Solutions, and Methodological Approaches to Address Bias in AI

Summary: This academic review examines how bias (systematic unfairness in AI decision-making) occurs in AI systems and explores the human roles, solutions, and research methods used to identify and reduce it. The paper surveys existing approaches to addressing bias rather than proposing a single new solution.


Responsible AI Question Bank for Risk Assessment

Summary: This is an academic survey article published in ACM Computing Surveys that discusses a question bank designed to help assess risks in AI systems responsibly. The article appears to be a comprehensive review of how organizations can evaluate potential harms and safety concerns when developing or deploying AI, rather than describing a specific vulnerability or problem.


Building Trust in Artificial Intelligence: A Systematic Review through the Lens of Trust Theory

Summary: This academic paper is a systematic review published in ACM Computing Surveys that examines how trust works in artificial intelligence systems using established trust theory frameworks. The article analyzes trust in AI through theoretical lenses rather than addressing a specific technical vulnerability or problem.


Detecting Training Data For Large Language Models: A Survey

Summary: This survey article reviews methods for detecting training data used to build large language models (LLMs, which are AI systems trained on massive amounts of text to generate human-like responses). The paper examines various techniques that researchers have developed to identify and extract information about what data was used to train these models, which is important for understanding model behavior and potential privacy concerns.


Bias-Free? An Empirical Study on Ethnicity, Gender, and Age Fairness in Deepfake Detection

Summary: This research paper studies whether deepfake detection systems (AI tools that identify fake videos made to look real) are fair across different groups of people based on ethnicity, gender, and age. The study found that these detection systems often perform differently depending on the person's background, meaning they work better for some groups than others. The paper highlights that bias in deepfake detection is an important fairness problem that needs attention.


Adaptive Real-Time Financial Fraud Detection with Explainable AI Tools

Summary: This academic paper discusses using explainable AI (AI systems that can show their reasoning for decisions) to detect financial fraud as it happens in real time. The research focuses on making fraud detection systems that adapt to new fraud patterns while also being transparent about why they flag transactions as suspicious.


Enhancing Digital Security: A Novel Dual-Paradigm Approach for Robust Deepfake Detection Using Pre and Post Quantum-Trained Neural Networks

Summary: This research paper proposes a new method for detecting deepfakes (AI-generated fake videos or images) by using neural networks (computer systems loosely modeled on how brains learn) trained with both current and quantum computing approaches. The dual approach aims to make deepfake detection more reliable and harder for attackers to bypass.


Hybrid Machine Learning–Based Trust Management Approach to Secure the Mobile Crowdsourcing

Summary: This research article proposes a hybrid machine learning approach to improve trust management and security in mobile crowdsourcing (a system where mobile users contribute data or complete tasks for a distributed project). The study combines multiple machine learning techniques to identify trustworthy participants and protect against malicious actors in crowdsourcing environments.


Teens sue Musk's xAI over Grok's pornographic images of them

Summary: Teenagers are suing xAI (Elon Musk's artificial intelligence company) because Grok, their chatbot, allowed users to create sexually explicit images of the teens without their permission. The lawsuit focuses on a feature called 'spicy mode' that was released last year, which could generate fake nude or sexual images of real people, including minors, and was shared on platforms like Discord and Telegram.

Solution: By mid-January, X said that it would implement 'technological measures' to stop Grok's ability to undress people in photos. Additionally, regulatory investigations were launched by UK watchdog Ofcom, the European Commission, and California into the feature's ability to create sexualized images of real people, particularly children.


Benjamin Netanyahu is struggling to prove he’s not an AI clone

Summary: Social media is spreading conspiracy theories that Israeli Prime Minister Benjamin Netanyahu has been replaced by deepfakes (AI-generated fake videos or images that look real), pointing to supposed errors like extra fingers in videos as evidence. While there is little credible evidence Netanyahu is actually dead or injured, the ability of AI to convincingly create fake images, videos, and audio of real people makes it harder to definitively prove these rumors false.


AGentVLM: Access control policy generation and verification framework with language models

Summary: AGentVLM is a framework that uses small language models (AI systems trained on text) to automatically convert written organizational rules into access control policies (rules defining who can access what resources). The system avoids using large third-party AI services, keeping data private, and can handle complex requirements like purposes and conditions while verifying that generated policies are accurate before they're put into use.


AMF-CFL: Anomaly model filtering based on clustering in federated learning

Summary: Federated learning (a system where multiple participants train a shared AI model without sharing their raw data) is vulnerable to attacks from malicious clients who send harmful model updates. This paper proposes AMF-CFL, a defense method that uses multi-k means clustering (a technique for grouping similar data points) and z-score statistical analysis (a way to identify unusual values) to filter out malicious updates and protect the global model, even when clients have non-i.i.d. data distributions (when each participant's data differs significantly in type and quantity).

Solution: AMF-CFL reduces the influence of malicious updates through a two-step filtering strategy: it first applies multi-k means clustering to identify anomalous update patterns, followed by z-score-based statistical analysis to refine the selection of benign updates.


Explainable android malware detection and malicious code localization using graph attention

Summary: This research paper presents XAIDroid, a framework that uses graph neural networks (GNNs, machine learning models that analyze relationships between connected pieces of data) and graph attention mechanisms to automatically identify and locate malicious code within Android apps. The system represents app code as API call graphs (visual maps of how different functions communicate) and assigns importance scores to pinpoint which specific code sections are malicious, achieving high accuracy rates of 97.27% recall at the class level.


Fed-Adapt: A Federated Learning Framework for Adaptive Topology Reconfiguration Against Multi-Rate DDoS and Database Flooding Attacks

Summary: Fed-Adapt is a federated learning framework (a system where multiple computers learn together while keeping their data private) designed to defend networks against DDoS attacks (floods of traffic meant to overwhelm servers) and database flooding attacks (requests that exhaust database resources). The framework addresses the challenge of detecting and responding to these sophisticated attacks in real-time while protecting data privacy across distributed networks, which existing federated learning approaches struggle to do effectively.


Large language model (LLM) for software security: Code analysis, malware analysis, reverse engineering

Summary: This is a review article examining how Large Language Models (LLMs, AI systems trained on vast amounts of text to understand and generate language) are being used in cybersecurity to analyze malware (harmful software designed to damage systems). The article surveys recent research on using LLMs for malware detection, understanding malicious code structure, reverse engineering (the process of analyzing compiled software to understand how it works), and identifying patterns of malicious behavior.


VFEFL: Privacy-preserving federated learning against malicious clients via verifiable functional encryption

Summary: Federated learning (a system where multiple computers train AI models together without sharing their raw data) faces two major security problems: attackers can steal information from the local models that clients upload, and malicious clients can sabotage the training by sending bad models. This paper proposes VFEFL, a new federated learning scheme that uses verifiable functional encryption (a type of encryption that lets you check if calculations on encrypted data are correct without decrypting it) to protect client data privacy while detecting and defending against attacks from dishonest participants.

Solution: The paper proposes VFEFL (a privacy-preserving federated learning scheme based on verifiable functional encryption) as the solution. According to the source, VFEFL 'employ[s] a verifiable functional encryption scheme to encrypt local models in the federated learning, ensuring data privacy and correctness during encryption and decryption' and 'enables verifiable client-side aggregated weights and can be integrated into standard federated learning architectures to enhance trust.' The source states that 'experimental results demonstrate that VFEFL effectively defends against such attacks while preserving model privacy' under both targeted and untargeted poisoning attacks.


Towards few-shot malware classification with fine-grained and pattern-aware multi-prototype network

Summary: This research paper proposes FIPAPNet, a machine learning system designed to classify malware when only a few samples are available, which is important because new malware variants often appear with limited examples. The system uses few-shot learning (a technique where AI learns from minimal training data) combined with dynamic features like system call sequences to achieve 93% accuracy in early-stage malware detection. This approach helps security defenders respond quickly to zero-day attacks (new, previously unknown malware) without needing hundreds of samples to retrain their detection models.


Vuln2Action: An LLM-based framework for generating vulnerability reproduction steps and mapping exploits

Summary: Vuln2Action is an LLM-based framework designed to help security testers reproduce vulnerabilities and map exploits more systematically. The paper addresses a key challenge in penetration testing (controlled simulations of cyberattacks to find security weaknesses): vulnerability reproduction is time-consuming and relies heavily on manual expertise, yet publicly available exploits exist for less than 1% of known vulnerabilities. While LLMs show promise for analyzing large amounts of threat data, the authors found that current models often refuse to provide exploit-related guidance due to built-in safety restrictions.


Multi-modal malware classification with hierarchical consistency and saliency-constrained adversarial training

Summary: This paper discusses the growing challenge of malware (malicious software designed to exploit computer system vulnerabilities) detection, noting that over 450,000 new malware samples are detected daily as of 2024. Traditional detection methods like signature-based detection (matching known byte patterns against a database) and behavior-based detection (running malware in isolated test environments to observe its actions) have limitations: signature-based methods fail against new or disguised malware, while behavior-based methods are computationally expensive and can be evaded by malware that detects virtual environments. The paper proposes using machine learning and deep learning approaches trained on features from both static and dynamic analysis to better classify files as malicious or benign.


Personalized differential privacy for high-dimensional data: A random sampling and pruning privacy tree approach

Summary: This paper discusses differential privacy (DP, a mathematical method that adds noise to data to protect individual privacy while keeping data useful), which is stronger than traditional anonymization techniques like generalization and suppression. The authors address a key challenge: existing DP methods struggle with high-dimensional data (datasets with many features) and treat all data features equally, even though real-world data has varying privacy needs, such as medical records where disease diagnoses need more protection than age.


v0.14.18

Summary: LlamaIndex v0.14.18 is a release that deprecates Python 3.9 (stops supporting an older version of the Python programming language) across multiple packages and includes several bug fixes, such as preserving chat history during incomplete data streaming and preventing division-by-zero errors. The update also adds features like improved text filtering across different database backends and maintains dependencies across 51 directories.


CVE-2026-4269 - Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

Summary: The Bedrock AgentCore Starter Toolkit (a tool for building AI agents on AWS) before version v0.1.13 has a vulnerability where it doesn't properly verify S3 ownership (S3 is AWS's cloud storage service). This missing check could allow an attacker to inject malicious code during the build process (when the software is being compiled), potentially leading to code execution in the running application. The vulnerability only affects users who built the toolkit after September 24, 2025.

Solution: Update to Bedrock AgentCore Starter Toolkit version v0.1.13 or later.

AWS
Bedrock
Bedrock AgentCore Starter Toolkit


Where OpenAI’s technology could show up in Iran

Summary: OpenAI has agreed to allow the Pentagon to use its AI technology in classified military environments, raising questions about potential applications in the escalating conflict with Iran. The article describes how OpenAI's generative AI (AI that can produce text, images, or other outputs based on patterns) could be used to help analyze potential military targets and prioritize strikes, as well as through a partnership with Anduril to defend against drone attacks, marking the first serious military testing of generative AI for real-time combat decisions.


Encyclopedia Britannica is suing OpenAI for allegedly ‘memorizing’ its content with ChatGPT

Summary: Encyclopedia Britannica and Merriam-Webster sued OpenAI, claiming it used their copyrighted content to train ChatGPT without permission and that GPT-4 (OpenAI's AI model) now outputs text that closely matches their original material. The publishers allege that OpenAI 'memorized' their content during training, meaning the AI absorbed and can reproduce substantial portions of their work.


CVE-2026-4270 - AWS API MCP File Access Restriction Bypass

Summary: A vulnerability (CVE-2026-4270) exists in AWS API MCP Server versions 0.2.14 through 1.3.8, which is software that lets AI assistants interact with AWS services. The bug allows attackers to bypass file access restrictions (the security controls that limit which files an AI can read) and potentially read any file on the system, even when those restrictions are supposed to be enabled.


GHSA-hqmj-h5c6-369m: ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Summary: ONNX's onnx.hub.load() function has a security flaw where the silent=True parameter completely disables warnings and user confirmations when loading models from untrusted repositories (sources not officially verified). This means an attacker could trick an application into silently downloading and running malicious models from their own GitHub repository without the user knowing, potentially allowing theft of sensitive files like SSH keys or cloud credentials.


CVE-2026-26133: AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Summary: CVE-2026-26133 is a vulnerability in Microsoft 365 Copilot where an attacker can use AI command injection (tricking the AI system by embedding hidden commands in normal-looking input) to access and disclose information over a network without authorization. The vulnerability has a CVSS score (a 0-10 rating of how severe a security flaw is) of 4.0, indicating moderate severity.


CVE-2026-25083: GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logg

Summary: CVE-2026-25083 is a missing authorization vulnerability in GROWI (a collaboration platform) affecting version 7.4.5 and earlier. A logged-in user who knows the identifier of a shared AI assistant can view and modify other users' conversation threads and messages without permission, because the API endpoints don't properly verify whether the user should have access. This is rated as HIGH severity with a CVSS score (a 0-10 scale measuring vulnerability severity) of 8.7.


CVE-2025-15060: claude-hovercraft executeClaudeCode Command Injection Remote Code Execution Vulnerability. This vulnerability allows rem

Summary: CVE-2025-15060 is a remote code execution vulnerability in claude-hovercraft that allows attackers to run arbitrary code without needing to log in. The flaw exists in the executeClaudeCode method, which fails to properly validate user input before using it in a system call (a request to run operating system commands), allowing attackers to inject malicious commands.


CVE-2025-14287: A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/

Summary: MLflow versions before v3.7.0 contain a command injection vulnerability (a flaw where attackers insert malicious commands into input that gets executed) in the sagemaker module. An attacker can exploit this by passing a malicious container image name through the `--container` parameter, which the software unsafely inserts into shell commands and runs, allowing arbitrary command execution on affected systems.

Solution: Update MLflow to version v3.7.0 or later.


⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More

Summary: This week's security news includes Google patching two actively exploited Chrome vulnerabilities in the graphics and JavaScript engines that could allow code execution, Meta discontinuing encrypted messaging on Instagram, and law enforcement disrupting botnets (malware networks that hijack routers) like SocksEscort and KadNap that were being used for fraud and illegal proxy services. A threat actor also exploited a compromised npm package (a JavaScript code library) to breach an AWS cloud environment and steal data.

Solution: Google addressed the Chrome vulnerabilities in versions 146.0.7680.75/76 for Windows and macOS, and 146.0.7680.75 for Linux.


Shadow AI is everywhere. Here’s how to find and secure it.

Summary: Shadow AI refers to AI tools used throughout an organization without IT oversight or approval, creating security and governance challenges. The source describes Nudge Security as a platform that addresses this by providing continuous discovery of AI apps and user accounts, monitoring for sensitive data sharing in AI conversations, and tracking which AI tools have access to company data through integrations.

Solution: According to the source, Nudge Security delivers mitigation through: (1) a lightweight IdP (identity provider, the system that manages user identities) integration with Microsoft 365 or Google Workspace that takes less than 5 minutes to enable, which analyzes machine-generated emails to detect new AI accounts and tool adoption; (2) a browser extension for real-time monitoring of risky behaviors and alerts when sensitive data (PII, secrets, financial info) is shared with AI tools; (3) tracking of SaaS-to-AI integrations and their access scopes; and (4) configurable alerts for new AI tools or policy violations.

ChatGPT
Gemini
Dropbox
Microsoft 365
Google Workspace
Slack
Microsoft Copilot


FauForensics: Boosting Audio-Visual Deepfake Detection With Facial Action Units

Summary: Deepfakes (fake videos created with AI that look and sound realistic) are becoming harder to detect, especially when they manipulate both audio and visual elements together. Researchers created FauForensics, a new detection system that uses facial action units (FAUs, quantitative measurements of facial muscle movements linked to emotions) to identify these manipulated videos more reliably across different datasets.


From Promise to Peril: Rethinking Cybersecurity Red and Blue Teaming in the Age of LLMs

Summary: This article examines how large language models (AI systems trained on huge amounts of text data) can be used in cybersecurity red teaming (simulated attacks to test defenses) and blue teaming (defensive security work), mapping their abilities to established security frameworks. However, LLMs struggle in difficult, real-world situations because they have limitations like hallucinations (generating false information confidently), poor memory of long conversations, and gaps in logical reasoning.


Nurturing agentic AI beyond the toddler stage

Summary: Autonomous AI agents (AI systems that operate independently to complete complex tasks with minimal human oversight) have advanced rapidly, creating new governance challenges because they can operate at machine speed without humans in the loop to approve each decision. Unlike traditional chatbots where humans reviewed outputs before consequential actions, agents now directly modify enterprise systems and data, making organizations legally liable for any harm caused (similar to how parents are responsible for their children's actions). Without building governance rules directly into the code that controls these agents' permissions and actions, organizations face significant risks from drift (where agents behave differently than intended) and unauthorized access to critical systems.


Why Security Validation Is Becoming Agentic

Summary: Organizations typically use separate security tools (BAS tools, pentesting products, vulnerability scanners) that don't communicate with each other, creating blind spots because attackers chain multiple vulnerabilities together in coordinated operations. The article proposes that agentic AI (autonomous AI agents that can plan, execute, and reason through complex tasks without human direction at each step) should be applied to security validation to create a unified, continuous system that combines adversarial perspective (how attackers get in), defensive perspective (whether defenses stop them), and risk perspective (which exposures actually matter).


Open VSX extensions hijacked: GlassWorm malware spreads via dependency abuse

Summary: Threat actors are spreading GlassWorm malware through Open VSX extensions (add-ons for the VS Code editor) by abusing dependency relationships, a feature that automatically installs other extensions when one is installed. Instead of hiding malware in every extension, attackers create legitimate-looking extensions that gain user trust, then update them to depend on separate extensions containing the malware loader, making the attack harder to detect.

Solution: As of March 13, Open VSX has removed the majority of the transitively malicious extensions. Socket researchers recommend treating extension dependencies with the same scrutiny typically applied to software packages, monitoring extension updates, auditing dependency relationships, and restricting installation to trusted publishers where possible.

Visual Studio Code
Open VSX
Claude
Codex
ESLint
Prettier
Angular
Flutter
Python
Vue


OpenAI’s adult mode will reportedly be smutty, not pornographic

Summary: OpenAI is developing an "adult mode" for ChatGPT that will allow users to generate text conversations with adult themes, described as "smut" rather than pornography. The feature will initially support only text and will not generate images, voice, or video content. OpenAI claims to have reduced "serious mental health issues" in its AI model enough to safely relax safety restrictions (the guardrails that prevent the AI from producing certain types of content) for this feature.


GenAI-Security als Checkliste

Summary: OWASP, a nonprofit cybersecurity organization, has published a checklist to help companies secure their use of generative AI and LLMs (large language models, which are AI systems trained on massive amounts of text to understand and generate human language). The checklist covers six key areas: understanding competitive and adversarial risks, threat modeling (identifying how attackers might exploit AI systems), maintaining an inventory of AI tools and assets, and ensuring proper governance and security controls are in place.


OpenAI says ChatGPT ads are not rolling out globally for now

Summary: OpenAI confirmed that ChatGPT ads are currently only available in the United States, despite privacy policy updates that mentioned ads leading some users to speculate about a global rollout. The company is taking a deliberate, phased approach to expand ads gradually and learn from real-world use before rolling out more widely. ChatGPT ads are personalized based on user queries, appear only to logged-in Free and Go plan users in the US, and are not shown to users under 18 or those who request to opt out.


What is agentic engineering?

Summary: Agentic engineering is the practice of developing software with the help of coding agents, which are AI tools that can write and execute code in a loop to achieve a goal. Rather than replacing human engineers, these agents handle code generation while humans focus on the higher-level work: defining problems clearly, choosing among different solutions, and verifying that the results are correct and robust. To get good results from coding agents, engineers need to provide them with proper tools, specify problems in sufficient detail, and deliberately update instructions based on what they learn from each iteration.

Claude
OpenAI Codex
Gemini CLI
GPT-5
Gemini
Claude


AI companies want to harvest improv actors’ skills to train AI on human emotion

Summary: AI companies are hiring improv actors through data-labeling companies like Handshake to create training data that teaches AI models to recognize and generate human emotions and character voices. This represents a strategy by major AI labs to gather specialized training data (the information used to teach AI systems) from skilled performers rather than relying solely on existing text or video sources.


My fireside chat about agentic engineering at the Pragmatic Summit

Summary: This talk covers how software developers are adopting AI coding agents, from simple question-asking with ChatGPT to agents writing entire programs. The speaker emphasizes that trusting AI output (like Claude Opus) requires pairing it with test-driven development (TDD, a practice where you write tests before the actual code) and manual testing, since automated tests alone don't guarantee the software will actually run correctly.

Anthropic
Claude Opus 4.5
ChatGPT
StrongDM


OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration

Summary: OpenClaw, an open-source AI agent, has critical security flaws that could let attackers trick it into leaking sensitive data through prompt injection (embedding malicious instructions in web content to manipulate the AI). The platform's weak default security settings and high system privileges create additional risks, including accidental data deletion, malicious code installation through skill repositories, and exploitation of known vulnerabilities that could compromise entire business systems.

Solution: To counter these risks, users and organizations are advised to: strengthen network controls, prevent exposure of OpenClaw's default management port to the internet, isolate the service in a container, avoid storing credentials in plaintext, download skills only from trusted channels, disable automatic updates for skills, and keep the agent up-to-date.

confidentiality integrity availability safety


Invisible datacentres and capricious chips: is UK’s AI bubble about to burst?

Summary: Major AI infrastructure projects like OpenAI's Stargate datacentre (a massive computing facility where AI systems run) are facing financial and timeline challenges, with OpenAI backing away from parts of a planned $500 billion expansion in Texas. The article suggests that massive investments in datacentres and AI chips represent a significant economic gamble, with the UK potentially at particular risk if this 'AI bubble' deflates.


Microsoft’s Copilot AI assistant is coming to current-gen Xbox consoles this year

Summary: Microsoft is planning to release Gaming Copilot, an AI assistant that helps players when they get stuck in games, on current-generation Xbox consoles later this year. The assistant, which responds to voice commands, has already been tested in beta versions on Xbox's mobile app, Windows 11, and Xbox Ally handhelds, and Microsoft plans to expand it to additional gaming services.


CVE-2026-31949: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exist

Summary: LibreChat, a ChatGPT alternative with extra features, has a vulnerability in versions before 0.8.3-rc1 where an authenticated attacker can crash the server by sending malformed requests to a specific endpoint. The bug occurs because the code tries to extract data from a request without checking if it exists first, causing an unhandled error (a TypeError, which is a type of programming mistake) that shuts down the entire Node.js server process.

Solution: Update LibreChat to version 0.8.3-rc1 or later, where this vulnerability is fixed.


CVE-2026-31944: LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth c

Summary: LibreChat versions 0.8.2 to 0.8.2-rc3 have a security flaw in the MCP (Model Context Protocol, a system for connecting AI models to external services) OAuth callback endpoint that fails to verify the user's identity. An attacker can trick a victim into completing an authorization flow, which stores the victim's OAuth tokens (credentials that grant access to services) on the attacker's account, allowing the attacker to take over the victim's connected services like Atlassian or Outlook.

Solution: Update to LibreChat version 0.8.3-rc1, where this vulnerability is fixed.


Nvidia's GTC will mark an AI chip pivot. Here's why the CPU is taking center stage

Summary: Nvidia is shifting focus toward CPUs (central processing units, the main general-purpose chips in computers) alongside its famous GPUs (graphics processing units) because agentic AI (AI systems that autonomously complete tasks by orchestrating multiple agents working together) requires significant general computing power to move data and coordinate workflows. The company is unveiling new CPU details at its GTC conference, with demand from major partners like Meta driving a predicted doubling of the CPU market from $27 billion in 2025 to $60 billion by 2030.


1M context is now generally available for Opus 4.6 and Sonnet 4.6

Summary: Anthropic has made 1M context (the ability to process 1 million tokens, which are small units of text that AI models break language into) generally available for its Opus 4.6 and Sonnet 4.6 models at standard pricing, with no additional charge for using the full window. This differs from competitors like OpenAI and Gemini, which charge premium rates when token usage exceeds certain thresholds (200,000 tokens for Gemini 3.1 Pro and 272,000 for GPT-5.4).

Anthropic
Claude
Opus 4.6
Sonnet 4.6
OpenAI
GPT-5.4
Google
Gemini 3.1 Pro


AI agents could easily send college grad unemployment over 30%, ServiceNow CEO says

Summary: ServiceNow's CEO warns that AI agents (software programs that can perform tasks independently) automating work could push college graduate unemployment into the mid-30s within a few years, making it harder for entry-level workers to stand out. Multiple major tech companies are already using AI to cut jobs and reduce hiring costs, affecting both technical roles like coding and white-collar positions across industries.

ServiceNow Block Atlassian Palantir Amazon OpenAI Adobe Anthropic


AI Safety Newsletter #69: Department of War, Anthropic, and National Security

Summary: The US Department of War designated Anthropic as a 'supply chain risk' (a classification that prevents a company from being used in government contracts) after the company refused to remove safety restrictions on its AI model Claude, specifically rejecting military demands to enable fully autonomous weapons and domestic mass surveillance. Anthropic is challenging this designation in court, and legal experts question whether the Department of War has the authority to impose such restrictions outside of actual contract disputes.


The Download: how AI is used for military targeting, and the Pentagon’s war on Claude

Summary: The US military is considering using generative AI systems (AI models that can create text and analyze data) to help rank military targets and recommend which ones to strike, with human officials making final decisions. The Pentagon is also favoring OpenAI's ChatGPT and xAI's Grok for these high-stakes military applications, while facing criticism from officials who claim that Anthropic's Claude would negatively affect the defense supply chain.

OpenAI ChatGPT xAI Grok Anthropic Claude Google Meta


Academia and the “AI Brain Drain”

Summary: Major technology companies are offering extremely high salaries to attract top AI researchers, causing many academics to leave universities for industry jobs. This "AI brain drain" is particularly affecting young, highly-cited researchers and threatens academia's ability to conduct research driven by curiosity rather than profit, as well as its role in providing independent ethical review. However, research shows that scientific breakthroughs actually come from large collaborative teams rather than individual geniuses, making the tech industry's focus on poaching individual top talent misguided.

Google
Amazon
Microsoft
Meta
ChatGPT
Gemini 3 Pro


Anthropic-Pentagon battle shows how big tech has reversed course on AI and war

Summary: Anthropic, an AI company, is in a legal dispute with the Pentagon over restrictions on how its AI models can be used, specifically trying to prevent deployment in domestic mass surveillance or fully autonomous lethal weapons (AI systems that make kill decisions without human control). The conflict highlights a shift in the tech industry's approach to military AI, with companies like Google previously refusing military partnerships, but now facing pressure to work with the Pentagon under the Trump administration.


Onyx Security Launches With $40 Million in Funding

Summary: Onyx Security, a new startup, has received $40 million in funding to build a control pane (a central dashboard for managing systems) that helps organizations monitor and manage autonomous AI agents (AI systems that can perform tasks independently without constant human direction) and speed up their adoption.


A defense official reveals how AI chatbots could be used for targeting decisions

Summary: The US military may use generative AI chatbots (AI systems trained on large amounts of text data to have conversations) to rank and prioritize target lists for human review, according to a Pentagon official. These systems, which could include OpenAI's ChatGPT or xAI's Grok, would work alongside existing military AI tools like Maven (a system using computer vision to analyze drone footage) to speed up targeting decisions. However, while generative AI outputs are easy to access, they are harder to verify than traditional military AI systems, raising concerns as the Pentagon faces scrutiny over recent military strikes.

OpenAI ChatGPT xAI Grok Anthropic Claude


Sam Altman faced 'serious questions' in meeting with lawmakers about OpenAI's defense work

Summary: OpenAI CEO Sam Altman met with lawmakers including Senator Mark Kelly to discuss the company's defense contract with the Department of Defense, particularly concerns about how AI systems could be used in warfare and surveillance. The meeting highlighted disagreements between AI companies and the military over safeguards, with Kelly stating that Congress plans to draft legislation creating guardrails (safety boundaries) around government AI contracts, since the technology is advancing faster than lawmakers can regulate it.


AI-generated Slopoly malware used in Interlock ransomware attack

Summary: Researchers discovered Slopoly, a backdoor malware (a hidden entry point into a system) likely created using an LLM (large language model, an AI trained on text data), that was deployed in ransomware attacks by the financially motivated group Hive0163. The malware uses a command-and-control framework (a central server that sends instructions to compromised systems) to steal data and maintain access, and its AI-generated code shows unusual features like detailed comments and clear variable names that are rare in human-written malware, suggesting that attackers are using AI tools to speed up custom malware creation.


GHSA-gg5m-55jj-8m5g: Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

Summary: Graphiti versions before 0.28.2 had a Cypher injection vulnerability (a type of attack where malicious code is hidden in user input to manipulate database queries) in its search filters for non-Kuzu database backends. Attackers could exploit this by providing crafted labels through SearchFilters.node_labels or, in MCP deployments (a system where an AI model can call external tools), through prompt injection (tricking an LLM into executing attacker-controlled commands) to execute arbitrary database operations like reading, modifying, or deleting data.

Solution: Upgrade to version 0.28.2 or later. Version 0.28.2 added validation of SearchFilters.node_labels, defense-in-depth label validation in shared search-filter constructors, validation of entity node labels in persistence query builders, and validation of group_ids in shared search fulltext helpers. If you cannot upgrade immediately, do not expose Graphiti MCP tools to untrusted users or LLM workflows processing untrusted prompts, avoid passing untrusted values into SearchFilters.node_labels or MCP entity_types, and restrict graph database credentials to minimum required privileges.


Microsoft top Office executive Rajesh Jha retiring after more than 35 years

Summary: Rajesh Jha, a top Microsoft executive who oversaw Office and has worked at the company for over 35 years, is retiring in July. His departure is significant because Microsoft is trying to integrate AI models from companies like OpenAI and Anthropic into products like 365 Copilot (an AI assistant add-on for Microsoft 365 business subscriptions), and his leadership will be split among four other executives reporting directly to CEO Satya Nadella.

Microsoft
Office
Microsoft 365
Copilot
Anthropic
OpenAI
LinkedIn
Surface
Windows
Exchange
SharePoint


Webflow buys AI content-generation platform Vidoso to bolster its marketing suite

Summary: Webflow, a website-building platform, has acquired Vidoso, an AI content-generation startup that uses large language models (AI systems trained on text data to generate new text) to help companies create marketing materials like images, videos, and blog posts. The acquisition aims to help Webflow expand its marketing capabilities and address a key problem: frontier models (AI systems trained on general internet data) create generic content without understanding a company's specific brand rules and approval workflows.


Gemini’s task automation is here and it’s wild

Summary: Google and Samsung announced that Gemini, their AI assistant, can now automate tasks by controlling apps on your behalf through a virtual interface, starting with food delivery and rideshare services. Users can give simple text prompts and Gemini will interact with these apps to complete actions like ordering food or booking rides, which is a capability AI assistants have long promised but rarely delivered.


Bumble introduces an AI dating assistant, ‘Bee’

Summary: Bumble, a dating app company, has introduced 'Bee,' a generative AI assistant (software that creates text and generates responses) that learns users' preferences, values, and relationship goals through private conversations to recommend better matches. The AI will power a new feature called 'Dates' that identifies compatible users and notify both parties, and Bumble plans to expand Bee's use to features like date suggestions and match feedback in the future.


Bumble to launch an AI dating assistant, ‘Bee’

Summary: Bumble is launching an AI assistant called 'Bee' that learns users' dating preferences, values, and communication styles through private conversations to recommend more compatible matches. The AI-powered feature is currently in beta testing and will initially power a new matching experience called 'Dates,' with plans to expand into other areas like date suggestions and feedback collection.


Anthropic’s Claude AI can respond with charts, diagrams, and other visuals now

Summary: Anthropic has updated Claude, its AI chatbot, to generate and display custom charts, diagrams, and other visual content directly in conversations when it determines visuals would be helpful. Examples include interactive visualizations like periodic tables or structural diagrams that users can click on for more details.


Gumloop lands $50M from Benchmark to turn every employee into an AI agent builder

Summary: Gumloop, a platform that lets non-technical employees build AI agents (autonomous programs that handle multi-step tasks without human intervention) to automate work, just raised $50 million in funding from investment firm Benchmark. The company competes with tools like Zapier and Anthropic's Claude Co-Work, and investors believe its easy-to-use interface and flexibility to work with different AI models will help it dominate enterprise automation.

Gumloop Anthropic OpenAI Google Shopify Ramp Gusto Samsara Instacart Opendoor Zapier n8n Dust


Palantir is still using Anthropic's Claude as Pentagon blacklist plays out, CEO Karp says

Summary: Palantir continues using Anthropic's Claude (a large language model, or LLM, which is AI software trained to understand and generate text) despite the Pentagon designating Anthropic a supply-chain risk (a company or product deemed potentially unreliable or unsafe for government use). The Department of Defense plans to phase out Anthropic's tools over six months, though exemptions may be granted for critical national security operations.

Solution: According to the source, the Department of Defense has set a six-month period for federal agencies to phase out Anthropic's products. An internal Pentagon memo states that exemptions will be considered for 'mission-critical activities' in rare circumstances where 'no viable alternative exists.' The DOD Chief Technology Officer noted that the government will transition to other large language models, but that 'you can't just rip out a system that's deeply embedded overnight.'

Anthropic
Claude
Palantir
Amazon Web Services
Lockheed Martin
Department of Defense


Microsoft backs AI firm Anthropic in legal battle against Pentagon

Summary: Microsoft and other major tech companies filed legal briefs supporting Anthropic's court challenge against a Pentagon designation that blocks the AI company from government work. Microsoft argued that the restriction would disrupt suppliers who use Anthropic's AI tools, including those providing systems to the US military.

Solution: N/A -- no mitigation discussed in source.

Anthropic Microsoft Google Amazon Apple OpenAI

Microsoft Anthropic Pentagon Google Amazon Apple OpenAI


GHSA-pf93-j98v-25pv: ha-mcp has XSS via Unescaped HTML in OAuth Consent Form

Summary: The ha-mcp OAuth consent form has a cross-site scripting (XSS) vulnerability, where user-controlled data is inserted into HTML without escaping (the process of converting special characters so they display as text rather than execute as code). An attacker could register a malicious application and trick the server operator into visiting a crafted authorization URL, allowing the attacker to run JavaScript in the operator's browser and steal sensitive tokens. This only affects users running the beta OAuth mode, not the standard setup.

Solution: Upgrade to version 7.0.0


Detecting and analyzing prompt abuse in AI tools

Summary: Prompt abuse occurs when attackers craft inputs to make AI systems perform unintended actions, such as revealing sensitive information or bypassing safety rules. Three main types exist: direct prompt override (forcing an AI to ignore its instructions), extractive abuse (extracting private data the user shouldn't access), and indirect prompt injection (hidden malicious instructions in documents or web pages that the AI interprets as legitimate input). The article emphasizes that detecting prompt abuse is difficult because it uses natural language manipulation that leaves no obvious trace, and without proper logging, attempts to access sensitive information can go unnoticed.

Solution: The source mentions that organizations can use an 'AI assistant prompt abuse detection playbook' and 'Microsoft security tools' to detect, investigate, and respond to prompt abuse by turning logged interactions into actionable insights. However, the source text does not provide specific details about what these tools are, how to implement them, or concrete technical steps for detection and mitigation. The full implementation details are referenced but not included in the provided content.


Anthropic doesn’t trust the Pentagon, and neither should you

Summary: Anthropic, maker of the AI assistant Claude, is in a legal dispute with the Pentagon after being designated a supply chain risk (a company that poses a security threat to government operations). The core issue involves disagreement over whether the U.S. government can be trusted to follow the law when using AI for surveillance, given a long history of government lawyers interpreting surveillance laws in ways that expand government monitoring far beyond what the plain language of those laws seems to allow.


Bespoke AI models are the next big thing in filmmaking

Summary: Current popular AI video models like Sora, Vevo, and Runway aren't very effective for making films and TV shows, despite hype suggesting AI could create entire productions automatically. AI companies are now developing custom models designed specifically for filmmakers' creative needs while trying to avoid copyright issues.