llm-all-models-async 0.1

Summary: The llm-all-models-async 0.1 plugin allows synchronous (blocking) AI models from LLM plugins to work as asynchronous (non-blocking) models by running them in a thread pool (a group of worker threads that handle tasks in parallel). This solves a compatibility problem where Datasette, which only supports async models, couldn't use sync-only plugins like llm-mrchatterbox.


Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack

Summary: Attackers compromised the npm account of Axios' lead maintainer and published malicious versions (axios@1.14.1 and axios@0.30.4) containing a remote access trojan (malware that gives attackers control over infected computers). The attack was detected within minutes and packages were removed within 2-3 hours, but the damage was significant because Axios receives roughly 100 million downloads per week and is used in 80% of cloud and code environments.

Solution: N/A -- no mitigation discussed in source.


llm 0.30

Summary: Version 0.30 of llm (a command-line tool for accessing large language models) added a new feature to its plugin system where the register_models() function can now receive an optional model_aliases parameter that shows all previously registered models and aliases from other plugins. The update also improved documentation by adding detailed explanations (docstrings) to public classes and methods.


Google's Vertex AI Has an Over-Privileged Problem

Summary: Researchers at Palo Alto discovered a security weakness in Google's Vertex AI (Google's cloud platform for building and running AI applications) where AI agents could be given too many permissions, allowing attackers to steal data and access restricted cloud systems. The vulnerability stems from over-privileged configurations that give AI agents more access than they actually need to do their job.


The Galaxy S26’s photo app can sloppify your memories

Summary: Samsung's Galaxy S26 Photo Assist tool uses AI to let users edit photos with natural language requests, similar to Google's earlier photo editing features. However, the tool can be manipulated to generate misleading or harmful images, like fake disaster scenes, because its safety guardrails can be bypassed through prompt injection (tricking the AI by hiding instructions in user input).

Google Pixel
Samsung Galaxy S26
Google Photos
Photo Assist


VRP 2025 Year in Review

Summary: Google's Vulnerability Reward Program (VRP), which pays researchers to find security bugs in Google products, celebrated its 15th anniversary in 2025 by awarding over $17 million to more than 700 security researchers worldwide. Major 2025 developments included launching a dedicated AI VRP (a separate program focused specifically on AI security flaws), adding AI reward categories to Chrome VRP, and creating a patch rewards program for OSV-SCALIBR (an open source tool that scans software for vulnerabilities). Google also hosted multiple bugSWAT events (live hacking competitions) throughout the year, which generated hundreds of bug reports and distributed over $2.9 million in rewards.


CVE-2026-22561: Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.336

Summary: CVE-2026-22561 is a vulnerability in Anthropic Claude for Windows installer (Claude Setup.exe) versions before 1.1.336 that allows local privilege escalation through DLL search-order hijacking (a technique where an attacker places a malicious library file in a directory where the installer looks for code, causing it to run the attacker's code instead of the legitimate one). After the installer gains elevated permissions, it loads DLL files from its own directory, which means an attacker can plant a malicious DLL alongside the installer to execute arbitrary code.

Solution: Update to Claude for Windows installer version 1.1.336 or later.


Penguin to sue OpenAI over ChatGPT version of German children’s book

Summary: Penguin Random House sued OpenAI, claiming that ChatGPT (an AI chatbot, or conversational AI system) violated copyright by reproducing content similar to their German children's book series, Coconut the Little Dragon. The lawsuit was filed in Munich court against OpenAI's European subsidiary after the publisher's legal team tested whether ChatGPT could generate stories matching the style of the original books.


Landmark losses for Meta and YouTube as big tech misses the point

Summary: Meta and YouTube both lost landmark legal cases this week involving claims that their platforms cause social media addiction (compulsive use similar to drug dependency). While the cases don't settle whether social media is clinically addictive, courts have determined that the companies can be held legally responsible for the harm caused.


CVE-2026-34163: FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoi

Summary: FastGPT, a platform for building AI agents, has a vulnerability in versions before 4.14.9.5 where two endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept URLs from users and make requests to them without checking if those URLs point to internal systems. This is called SSRF (server-side request forgery, where an attacker tricks a server into making requests to private networks on their behalf). Although FastGPT has a protective function called isInternalAddress() used elsewhere, these endpoints don't use it, allowing authenticated attackers to scan internal networks, access cloud metadata services, and interact with internal databases like MongoDB and Redis.

Solution: This issue has been patched in version 4.14.9.5.


CVE-2026-34162: FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/

Summary: FastGPT, an AI Agent building platform, has a vulnerability in versions before 4.14.9.5 where an HTTP tools testing endpoint (/api/core/app/httpTools/runTool) lacks authentication (missing access controls). This endpoint acts as a proxy that accepts user-supplied requests and makes server-side HTTP calls, potentially allowing unauthorized attackers to make requests on behalf of the FastGPT server.

Solution: Update FastGPT to version 4.14.9.5 or later, which patches this vulnerability.


CVE-2026-0596: A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_u

Summary: MLflow (a machine learning model management tool) has a command injection vulnerability (a security flaw where an attacker can insert shell commands into input) when serving models with `enable_mlserver=True`. The vulnerability occurs because the `model_uri` (a file path or reference to a model) is directly placed into a shell command without filtering out dangerous characters like `$()` or backticks, allowing attackers to run unauthorized commands. This poses a serious risk if a high-privilege service loads models from a directory that lower-privilege users can access.


Art schools are being torn apart by AI

Summary: Art schools are changing their curriculum to include generative AI (AI systems that create new images, animations, or designs based on descriptions), but students and creative professionals are concerned about how this affects job competition and the future of traditional artistic skills. The article highlights growing worry among art students that AI tools will make it harder to find postgraduate jobs in creative fields.


CVE-2026-30310: In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all

Summary: Sixth, an AI tool that can run terminal commands automatically, has a security flaw in its safety check feature. An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to disguise harmful commands as safe ones, causing the AI to run them without asking the user for permission first.


Shifting to AI model customization is an architectural imperative

Summary: As improvements from new AI models have slowed to small gains, organizations are shifting toward customizing models with their own proprietary data and internal processes to gain competitive advantages. Domain-specialized models, which are trained on an organization's unique language, workflows, and expertise, can outperform general-purpose models and encode valuable business knowledge directly into the AI system.


How to Categorize AI Agents and Prioritize Risk

Summary: AI agents (AI systems that can reason, plan, and act autonomously across enterprise systems) are becoming more common in organizations, creating new security challenges. Risk from AI agents depends on two factors: access (which systems and data the agent can reach) and autonomy (how independently it can act without human approval). The text describes three categories of enterprise AI agents—agentic chatbots, local agents, and production agents—each with different risk levels based on their access and autonomy.


CrewAI Vulnerabilities Expose Devices to Hacking

Summary: CrewAI, an AI framework, has vulnerabilities that attackers can exploit using prompt injection (tricking an AI by hiding malicious instructions in its input) to chain together bugs and escape the sandbox (a restricted environment meant to contain the AI's actions) to run arbitrary code on a device.


Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts

Summary: Researchers discovered a security vulnerability in Google Cloud's Vertex AI platform where AI agents could be compromised to steal sensitive data and access private cloud resources. The problem stems from the default service agent (P4SA, a special account that runs the AI agent) having excessive permissions, allowing attackers to extract credentials and gain unauthorized access to cloud storage, private code repositories, and internal Google infrastructure.

Solution: Google updated its documentation to explain how Vertex AI uses resources and accounts. The company recommended that customers use Bring Your Own Service Account (BYOSA) to replace the default service agent and enforce the principle of least privilege (PoLP, giving the agent only the permissions it needs to do its job).

Google Cloud
Vertex AI
Google Cloud Platform (GCP)
Google Cloud Storage
Artifact Registry


Accelerating the next phase of AI

Summary: OpenAI announced a $122 billion funding round at an $852 billion valuation, positioning itself as core AI infrastructure globally. The company is experiencing rapid commercial growth, generating $2 billion in monthly revenue and expanding its products across ChatGPT, APIs, enterprise solutions, and specialized applications like coding and scientific discovery.

OpenAI ChatGPT Codex GPT-5.4 Amazon NVIDIA SoftBank Microsoft a16z


OpenAI patches twin leaks as Codex slips and ChatGPT spills

Summary: OpenAI patched two separate security flaws in its AI tools: one in Codex (a coding agent) that allowed attackers to steal GitHub tokens through command injection (inserting malicious commands into user inputs), and another in ChatGPT's code execution environment that created a hidden channel for silently leaking user data without approval. Both bugs could let attackers extract sensitive information, but researchers warn that giving AI tools the ability to run code and access external systems inherently creates ongoing security risks.

Solution: OpenAI fixed the Codex vulnerability by 'tightening input validation around the vulnerable parameter and hardening how commands are constructed in the execution environment.' For the ChatGPT flaw, OpenAI addressed it by 'tightening controls around outbound communication in the code execution environment.' Both patches were deployed before public disclosure.


The Download: AI health tools and the Pentagon’s Anthropic culture war

Summary: This newsletter covers multiple AI and tech news items, including concerns that medical chatbots from Microsoft, Amazon, and OpenAI are being released with little external evaluation before reaching the public. It also reports on regulatory efforts in California to impose AI safeguards despite opposition, legal challenges to Pentagon actions against Anthropic, and various other AI infrastructure and safety developments.

Microsoft Amazon OpenAI Anthropic Google Meta Bluesky


AI benchmarks are broken. Here’s what we need instead.

Summary: Current AI benchmarks (standardized tests that measure AI performance) evaluate AI systems in isolation against human performance on specific tasks, but this doesn't reflect how AI is actually used in real organizations where it works within teams and workflows over extended periods. This misalignment causes organizations to adopt AI systems with impressive benchmark scores that then underperform in real-world deployment, such as FDA-approved radiology AI that creates delays when integrated into hospital workflows with multiple specialists and evolving decisions.

Solution: The source proposes shifting from narrow benchmark methods to HAIC benchmarks (Human-AI, Context-Specific Evaluation), which assess how AI systems perform over longer time horizons within human teams, workflows, and organizations. However, no implementation details, technical specifications, or concrete steps for implementing this approach are provided in the source text.


CVE-2026-4399: Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions

Summary: A prompt injection vulnerability (a technique where attackers hide malicious instructions in their input to trick an AI) exists in the 1millionbot Millie chatbot, allowing users to bypass safety restrictions using Boolean logic tricks (phrasing questions to trigger 'true' responses that activate hidden commands). This could let attackers extract sensitive information, misuse the service, or access restricted features that the chatbot was designed to block.


How we made Trail of Bits AI-native (so far)

Summary: Trail of Bits transformed from a company where 95% of staff resisted AI into one using 94 plugins and 84 specialized agents to find 200 bugs per week by shifting from AI-assisted (using AI as a standalone tool) to AI-native (redesigning the entire organization around AI as a core teammate). The post explains that most companies fail with AI because they don't change their workflows or systems, only distribute tools, and that psychological barriers like self-enhancing bias (overestimating our own judgment) and identity threat are the real obstacles to adoption.


Double Agents: Exposing Security Blind Spots in GCP Vertex AI

Summary: Researchers discovered that AI agents deployed on Google Cloud Platform's Vertex AI could be weaponized as 'double agents' that secretly compromise systems while appearing to work normally. The vulnerability stems from excessive default permissions granted to service agents (special accounts that allow GCP services to access resources), which attackers can exploit to steal data, access restricted code, and gain unauthorized control over infrastructure. Google addressed this by revising their official documentation to explicitly explain how Vertex AI uses resources and accounts.

Solution: Google revised their official documentation to explicitly document how Vertex AI uses resources, accounts and agents.

Google Cloud Platform
Vertex AI
Agent Engine
Application Development Kit
Gemini 2.0 Flash


The external pressures redefining cybersecurity risk

Summary: Organizations face growing cybersecurity risks from forces outside their direct control: over 35% of data breaches come from compromised vendors or partners, geopolitical conflicts spawn new attack techniques that spread globally, and AI-driven automation makes attacks easier and cheaper to launch. Even well-defended organizations struggle because security depends on every link in an extended chain far beyond their own network, and those weak links are multiplying.

Solution: The source explicitly recommends: elevate OT (operational technology) security to board level and add OT risk to the Risk Register; segment networks to reduce blast radius of attacks; implement a ransomware resilient backup solution with immutable backups using a 3-2-1-1 strategy (three copies, two different media types, one offsite location, plus one immutable copy); use defense in depth strategies to avoid, mitigate, or transfer geopolitical cyber risk; and secure board awareness so that budget allocation typically follows.


6 key takeaways from RSA Conference 2026

Summary: At RSA Conference 2026, security leaders discussed a major tension: adopting AI quickly for competitive advantage while protecting against threats that AI itself is creating. The conference confirmed that AI has become central to cybersecurity conversations, with discussions covering both AI as a defensive tool and as an offensive weapon that attackers can use at extreme speed. The threat surface for enterprise AI systems has expanded significantly beyond initial concerns, now including data leakage, shadow AI (unauthorized AI tools), prompt injection (tricking AI by hiding instructions in its input), copyright issues, hallucinations (when AI generates false information), and data residency problems, all of which can occur simultaneously when organizations adopt AI tools.

Island
Frontier Labs
Singulr
NightDragon
Ballistic Ventures
YL Ventures


Enforcement of Chapter V under the EU AI Act

Summary: The EU AI Act requires providers of general-purpose AI models (GPAI, meaning large AI systems that can be adapted for many uses) to follow specific rules for development and documentation starting August 2, 2025, though the Commission won't enforce these rules until August 2, 2026. The Act gives enforcement power to the Commission, which can request information, conduct evaluations, and impose fines, while other actors like national market surveillance authorities and scientific panels can also report violations.


If OpenAI is to float on the stock market this year, it needs to start turning a profit

Summary: OpenAI, valued at $850 billion and known for creating ChatGPT, is reportedly spending massive amounts on infrastructure (the computing power and equipment needed to run AI systems), with plans to spend $600 billion by 2030. The article argues that if OpenAI wants to go public through an IPO (initial public offering, where a private company sells shares to the public), it needs to become profitable and show it has a sustainable business model rather than just relying on investor excitement about AI.


Critical Vulnerability in OpenAI Codex Allowed GitHub Token Compromise

Summary: Researchers discovered a critical vulnerability in OpenAI Codex (an AI system that generates code) that could have allowed attackers to steal GitHub tokens (secret credentials used to access GitHub accounts). The vulnerability posed a serious security risk because compromised tokens could give attackers unauthorized access to code repositories and projects.


v5.5.0

Summary: Version 5.5.0 adds new security techniques documenting threats to AI systems, including AI agent tool poisoning (when attackers corrupt tools that AI agents use), supply chain attacks, and cost harvesting (depleting computing resources through expensive queries). It also updates existing techniques and mitigations related to code signing and monitoring AI agent behavior.

Anthropic Claude
ClawdBot
Postmark MCP Server


California to impose new AI regulations in defiance of Trump call

Summary: California's governor signed an executive order requiring AI companies that want to do business with the state to meet new safety standards, including preventing the spread of harmful content, reducing bias (harmful patterns in AI decision-making), and being transparent about their practices. This move contradicts the federal government's call for less regulation, as California joins other states in passing over 100 laws to protect children and intellectual property from AI misuse.


CVE-2026-30308: In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe comman

Summary: HAI Build Code Generator has a feature that automatically runs commands it decides are safe, but researchers found a flaw: attackers can use prompt injection (tricking an AI by hiding instructions in its input) to disguise malicious commands as safe ones, causing them to execute without user permission. This vulnerability allows arbitrary command execution (running any code) on a system by bypassing the safety check.


CVE-2026-30306: In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute al

Summary: SakaDev has a feature that automatically runs terminal commands (direct computer instructions) chosen by its AI model, but it can be tricked through prompt injection (hiding malicious instructions in seemingly normal input) to misclassify dangerous commands as safe, allowing attackers to run harmful code without user approval.


datasette-llm 0.1a3

Summary: This is a brief announcement for datasette-llm version 0.1a3, posted by Simon Willison on March 30, 2026. The source does not provide details about what datasette-llm does, what features it includes, or what issues it addresses.


GHSA-m3mh-3mpg-37hw: OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

Summary: OpenClaw has a vulnerability where malicious plugins or hooks can execute arbitrary code during installation. An attacker can create a `.npmrc` file (npm's configuration file) in a malicious plugin or hook directory that redirects the git executable to a malicious program, which gets executed when OpenClaw runs `npm install` during the installation phase.

Solution: Fixed in OpenClaw 2026.3.24, the current shipping release.


GHSA-68f8-9mhj-h2mp: OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope

Summary: OpenClaw has a security inconsistency where the HTTP endpoint `/v1/models` (which serves OpenAI-compatible requests) accepts bearer authentication but doesn't check operator scopes (permissions that control what actions a user can perform), while the WebSocket RPC path correctly requires the `operator.read` scope. This means someone with only `operator.approvals` permission can bypass the scope requirement and view model metadata through the HTTP route, even though they would be rejected over WebSocket.

Solution: Fixed in OpenClaw 2026.3.24, the current shipping release. The patch involves: (1) enforcing read scope on `/v1/models` routes before serving the endpoint, (2) reusing the centralized scope-authorization helper function (`authorizeOperatorScopesForMethod(...)`) that WebSocket already uses for HTTP compatibility endpoints to prevent policy drift, and (3) adding regression tests to verify that `operator.approvals` without read is rejected on HTTP `/v1/models` while `operator.read` is accepted on both WebSocket and HTTP.


GHSA-hr5v-j9h9-xjhg: OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)

Summary: OpenClaw has a path traversal vulnerability (CWE-22, a type of attack where an attacker uses special characters like ../ to access files outside their intended directory) that allows sandboxed agents to read files from other agents' workspaces. The vulnerability exists because the sandbox validation function only checks certain parameter keys (media, path, filePath) but misses mediaUrl and fileUrl, which are actually used by messaging extensions. Additionally, a separate function fails to pass the sandbox root restrictions to plugins, allowing them to read the entire ~/.openclaw/ directory instead of just an individual agent's folder.


CVE-2026-29872: A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80

Summary: A cross-session information disclosure vulnerability exists in the awesome-llm-apps project where user API tokens are stored in process-wide environment variables without proper isolation. Because Streamlit (a web framework for Python applications) runs multiple users in a single process, credentials entered by one user can be accessed by other users, allowing attackers to steal sensitive tokens like GitHub Personal Access Tokens or LLM API keys.

awesome-llm-apps
Streamlit
GitHub MCP Agent


OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability

Summary: OpenAI patched a vulnerability in ChatGPT that allowed attackers to secretly extract sensitive user data, such as conversation messages and uploaded files, by exploiting a hidden DNS-based communication path (a covert channel using the Domain Name System to send data) in the Linux runtime that the AI uses for code execution. The flaw bypassed ChatGPT's built-in safety guardrails (protections designed to prevent unauthorized data sharing) and could be triggered through malicious prompts or embedded in custom GPTs without triggering any user warnings.

Solution: OpenAI addressed the issue on February 20, 2026, following responsible disclosure (the practice of privately reporting security flaws to a vendor before public release).


CVE-2026-2287: CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that

Summary: CrewAI has a vulnerability where it fails to properly verify that Docker (a containerization tool that isolates applications) is still running during execution. When Docker stops, the software falls back to a less secure sandbox setting that can be exploited for RCE (remote code execution, where an attacker runs commands on a system they don't control).


CVE-2026-2286: CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud ser

Summary: CrewAI contains a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making unwanted requests to other systems) that allows attackers to access content from internal and cloud services. The vulnerability exists because the RAG search tools (a feature that retrieves external documents to help answer questions) do not properly validate URLs that users provide at runtime.


CVE-2026-2285: CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validati

Summary: CrewAI has a vulnerability where its JSON loader tool reads files without checking file paths, allowing attackers to access any file on the server. This is called arbitrary local file read, and it happens because the tool doesn't validate (check) which files users are allowed to access.


CVE-2026-2275: The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through ar

Summary: CrewAI's CodeInterpreter tool has a security flaw where it falls back to SandboxPython when Docker (a containerization system for running code safely) is unavailable, which can allow RCE (remote code execution, where an attacker runs commands on a system they don't own) through arbitrary C function calling.


There are more AI health tools than ever—but how well do they work?

Summary: Major tech companies including Microsoft, Amazon, and OpenAI have recently released AI health tools that use large language models (LLMs, AI systems trained on massive amounts of text to generate human-like responses) to answer medical questions and access user health records. While these tools are in high demand because many people struggle to access traditional healthcare, researchers emphasize that these products should be independently evaluated by outside experts before wide release, rather than relying solely on companies' own evaluations.

Microsoft
Copilot Health
Amazon
Health AI
One Medical
ChatGPT Health
OpenAI
Claude
Anthropic


Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio

Summary: Agentic AI systems (autonomous AI that can retrieve data, invoke tools, and take actions using real permissions) are moving into production, but they introduce unique security risks because failures aren't limited to a single response—they can trigger automated sequences of actions with real-world consequences. The OWASP Top 10 for Agentic Applications (2026) identifies ten key risks in these systems, such as goal hijacking (where an agent's objectives are redirected through injected instructions) and tool misuse (where legitimate tools are exploited through unsafe chaining or ambiguous instructions).

Microsoft Copilot Studio
Microsoft AI Red Team
OWASP


The Pentagon’s culture war tactic against Anthropic has backfired

Summary: The Pentagon tried to punish AI company Anthropic by labeling it a supply chain risk (a designation that restricts who can do business with the government) after disagreements over a direct contract, but a California judge blocked this action. The judge found that the government's actions violated proper procedures and were really an attempt to punish Anthropic's ideology rather than address legitimate security concerns, with senior officials making public posts about the dispute before following legal processes.


Okta’s CEO is betting big on AI agent identity

Summary: Okta, a company that manages login and security across business applications, is facing pressure from AI tools that could let companies build their own management systems instead of paying for Okta's service. CEO Todd McKinnon says the company is responding by adopting AI and LLMs (large language models, which are AI systems trained on massive amounts of text) to stay competitive and secure, and is focusing on a new opportunity: managing the identity and access of AI agents (automated AI systems that can take actions on their own) within corporations, not just human employees.


Silent Drift: How LLMs Are Quietly Breaking Organizational Access Control

Summary: Large language models (LLMs, AI systems trained on massive amounts of text) can quickly generate complex access control code in languages like Rego and Cedar, but even small errors, such as a missing condition or a made-up attribute (hallucination, when an AI invents false information), can accidentally weaken an organization's least-privilege security model (a system where users get only the minimum permissions they need).


⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More

Summary: A critical flaw in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-3055, a CVSS score of 9.3 measuring severity on a 0-10 scale) is being actively exploited to leak sensitive information through insufficient input validation, a failure to properly check data before processing it. The vulnerability only affects systems configured as SAML Identity Providers (SAML IDPs, which are services that verify user identities). Additionally, a Chinese state-sponsored group called Red Menshen deployed stealthy kernel implants called BPFDoor deep in telecom networks worldwide to secretly monitor traffic without being detected.

Solution: Rapid7 has released a scanning script designed to detect known BPFDoor variants across Linux environments.


PromptGuard: Soft Prompt-Guided Unsafe Content Moderation for Text-to-Image Models

Summary: Text-to-image models (AI systems that generate pictures from written descriptions) can be misused to create unsafe content like sexually explicit or violent images. PromptGuard is a new safety technique that uses a soft prompt (a special text input optimized for safety that works within the model's internal text processing layer) to moderate unsafe requests and prevent the generation of such content while still producing high-quality normal images.

Solution: The source describes PromptGuard as the solution itself rather than a patch or update. The technique works by optimizing a safety soft prompt that functions as an implicit system prompt within the text-to-image model's embedding space, with a divide-and-conquer strategy that optimizes category-specific soft prompts and combines them into holistic safety guidance. Code and dataset are available at https://t2i-promptguard.github.io/


Differentially Private Zeroth-Order Methods for Scalable Large Language Model Fine-Tuning

Summary: This research proposes new methods for fine-tuning (customizing a trained AI model for specific tasks) large language models while protecting sensitive data using differential privacy (a technique that adds noise to data to prevent identifying individuals). The paper introduces DP-ZOSO and DP-ZOPO, which use zeroth-order gradient approximation (estimating how to improve the model without calculating exact mathematical directions) instead of traditional methods, making the process faster and more scalable while maintaining privacy protection.


Rethinking Frequency Modeling: Tail-Aware Dynamic Adversarial Training for Long-Tailed Robustness

Summary: This research addresses a problem where adversarial training (a method to make AI models resistant to adversarial attacks, which are carefully crafted inputs designed to fool the model) works poorly when training data is imbalanced, meaning some classes have many examples while others have very few. The authors propose Tail-Aware Dynamic Adversarial Training (TAD-AT), which improves robustness by adjusting the training loss, attack strategy, and weight averaging to account for which classes are most vulnerable to attacks, rather than just how many examples exist per class.

Solution: The proposed mitigation is Tail-Aware Dynamic Adversarial Training (TAD-AT), which consists of three components: (1) a training loss that incorporates frequency- and accuracy-aware regularization to emphasize learning for vulnerable classes, (2) an attack that adjusts perturbations based on class-wise vulnerability to encourage robust feature learning, and (3) a weight average that adaptively controls the decay rate across classes to improve robust generalization and training stability. Code is available at https://github.com/bookman233/TADAT.


When AI Trust Breaks: The ChatGPT Data Leakage Flaw That Redefined AI Vendor Security Trust

Summary: Researchers discovered a vulnerability in ChatGPT that could leak sensitive user data (like medical records, financial information, and internal documents) from conversations without the user's knowledge or permission. Although OpenAI has since fixed the issue, the discovery highlights an important lesson: AI tools should not be automatically trusted to be secure just because they are popular or widely used.


LangChain path traversal bug adds to input validation woes in AI pipelines

Summary: LangChain and LangGraph, popular AI frameworks that connect AI to business systems, have critical security flaws that allow attackers to steal sensitive data like API keys and files through improper input handling. The newest vulnerability is a path traversal bug (CVE-2026-34070, a CVSS 7.5 severity rating measuring how serious a flaw is) where attackers can read files by crafting malicious input, while two older flaws enable data theft through unsafe deserialization (treating untrusted data as safe) and SQL injection (manipulating database queries). The maintainers have released fixes that need to be applied immediately to prevent exploitation.

Solution: The source explicitly recommends the following mitigations: For path traversal, enforce allowlists for file access and restrict directory boundaries. For deserialization vulnerabilities, avoid unsafe deserialization methods and ensure only validated, expected data structures are processed. For SQL injection, use parameterized queries (pre-structured database requests that safely handle user input) and strengthen input sanitization. The source notes that fixes from the tools' maintainers are now available but must be applied immediately across integrations.


Leak reveals Anthropic’s ‘Mythos,’ a powerful AI model aimed at cybersecurity use cases

Summary: Anthropic's unreleased AI model, codenamed Mythos, was accidentally exposed through a configuration error in its content management system (CMS, software that organizes and stores digital content), revealing a more powerful LLM with advanced reasoning and coding abilities. The leak raises security concerns because the model's improved skills at finding and exploiting software vulnerabilities could make cyberattacks easier while also helping defenders, and its capability for recursive self-fixing (autonomously identifying and patching its own code problems) narrows the gap between human and AI-level hacking. Anthropic plans a phased rollout targeting enterprise security teams first before broader release.

Anthropic
Claude
Claude Mythos
Claude Capybara


CVE-2025-15379: A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_

Summary: MLflow has a command injection vulnerability (a type of attack where an attacker inserts malicious commands into input that gets executed) in its model serving code when deploying models with `env_manager=LOCAL`. The vulnerability occurs because MLflow reads dependency information from a file called `python_env.yaml` in the model artifact and directly uses it in a shell command without checking if it's safe, allowing an attacker to execute arbitrary commands on the system deploying the model.

Solution: Update MLflow to version 3.8.2, which fixes the vulnerability. Version 3.8.0 is affected.


Mistral secures $830 million in debt financing to fund AI data center

Summary: Mistral, a French AI startup, secured $830 million in debt financing to build a data center powered by thousands of Nvidia graphics processing units (GPUs, specialized chips used for AI training). The new data center near Paris will support training of Mistral's large language models (LLMs, AI systems trained on vast amounts of text) and will become operational in the second quarter of 2025, with plans to expand European computing capacity to 200 MW by the end of 2027.

Solution: N/A -- no mitigation discussed in source.


CVE-2025-15036: A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artif

Summary: A path traversal vulnerability (a security flaw where an attacker uses special path names like '../' to access files outside intended directories) exists in MLflow's archive extraction function that doesn't validate the contents of tar.gz files before extracting them. An attacker who controls the tar.gz file can overwrite arbitrary files or escape sandbox restrictions (isolated environments that limit what code can access) in shared computing environments.

Solution: Update to mlflow version v3.7.0 or later.


All the latest in AI ‘music’

Summary: AI is now being used throughout the music industry for tasks like creating songs, building playlists, and detecting AI-generated content, but this raises major concerns about copyright (legal ownership of creative work), whether AI outputs are truly art, and whether AI-generated music will flood the market and harm human musicians. The music industry is divided, with some platforms like Apple Music and Deezer adding labels to identify AI music, while others like Bandcamp have banned AI content entirely, and major record labels are pursuing lawsuits against AI music companies.

Suno
Google
Gemini
Apple Music
Qobuz
The Chainsmokers
ElevenLabs
Bandcamp
Deezer
Universal Music
Nvidia
Warner Music Group
YouTube
Splice


Helping disaster response teams turn AI into action across Asia

Summary: OpenAI and partner organizations held an 'AI Jam' workshop in Bangkok with 50 disaster management leaders from 13 Asian countries to explore practical ways AI can improve emergency response. The workshop focused on building custom GPTs (generalized pre-trained transformer models, or AI tools trained on broad data) and workflows for tasks like situation reporting and needs assessment, addressing how disaster response teams in resource-constrained environments with fragmented data can work faster and more effectively.

OpenAI
ChatGPT
Gates Foundation
Asian Disaster Preparedness Center
DataKind


Bluesky’s new app is an AI for customizing your feed

Summary: Bluesky has released Attie, a new AI assistant powered by Claude (Anthropic's language model) that helps users create custom feeds using natural language instructions instead of traditional algorithmic settings. Users can describe what content they want to see, like 'posts about folklore, mythology, and traditional music, especially Celtic traditions,' and Attie builds a personalized feed based on that description, with plans to integrate it into Bluesky and other apps built on the AT Protocol (Bluesky's underlying technical foundation).


CVE-2026-5002: A vulnerability has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The impacted el

Summary: A vulnerability (CVE-2026-5002) was discovered in PromtEngineer localGPT that allows injection attacks (inserting malicious code into input) through the LLM Prompt Handler component in the backend/server.py file. An attacker can exploit this vulnerability remotely, and the exploit code has been publicly released. The vendor has not responded to disclosure attempts, and because the product uses rolling releases (continuous updates without traditional version numbers), specific patch information is unavailable.


TikTok’s policy for AI ads isn’t working

Summary: Companies like Samsung are posting ads on TikTok that appear to be made with generative AI (AI systems that create images or videos from text descriptions), but they're not adding the required AI disclosure labels that TikTok's advertising policies demand. This means users can't easily tell whether the ads they see are AI-generated or made by humans, even though the companies creating them know the truth.


Why OpenAI killed Sora

Summary: OpenAI discontinued its Sora video-generation app and canceled plans to add video generation to ChatGPT, also ending a $1 billion deal with Disney. The company made these decisions because Sora was consuming large amounts of computational resources without generating enough revenue to justify the expense, as OpenAI focuses on becoming profitable.


‘They feel true’: political deepfakes are growing in influence – even if people know they aren’t real

Summary: AI researchers report that online creators are using generative AI (artificial intelligence that creates images or videos from text descriptions) to produce fake images and videos of real political figures and entirely fabricated people, sometimes in military or sexualized contexts, to earn money and spread propaganda. These deepfakes (AI-generated fake media of people) are influential in shaping public perception of political figures, even when viewers know the content is not real.


CVE-2026-4993: A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0. This impacts an unknown function of the file backend/o

Summary: A vulnerability (CVE-2026-4993) was found in wandb OpenUI up to version 1.0 where manipulating the LITELLM_MASTER_KEY argument in the backend/openui/config.py file can expose hard-coded credentials (passwords stored directly in the code). This vulnerability requires local access to exploit and has already been publicly disclosed, though the vendor did not respond to early notification.


GHSA-frv4-x25r-588m: Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

Summary: Giskard Agents contain a server-side template injection vulnerability in the `ChatWorkflow.chat()` method, which treats user input as Jinja2 template code (a templating language that processes special syntax) instead of plain text. If a developer passes user-provided data directly to this method, an attacker can execute arbitrary code on the server by embedding malicious Jinja2 syntax in their input.

Solution: Update to giskard-agents version 0.3.4 (stable branch) or 1.0.2b1 (pre-release branch). The fix replaces the unsandboxed Jinja2 Environment with SandboxedEnvironment, which blocks access to attributes starting with underscores and prevents the class traversal attacks that enable remote code execution.


STADLER reshapes knowledge work at a 230-year-old company

Summary: STADLER, a 230-year-old recycling equipment company, embedded ChatGPT (an AI language model that generates human-like text) across its workforce to speed up knowledge work like drafting, summarizing, and translating. The company achieved 30-40% time savings on common tasks, 2.5x faster first drafts, and 85% daily active usage by providing company-wide access, training, and clear guardrails while encouraging bottom-up experimentation.


CVE-2026-33873: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assis

Summary: Langflow, a tool for building AI-powered agents and workflows, had a vulnerability in versions before 1.9.0 where the Agentic Assistant feature would execute Python code generated by an LLM (large language model) on the server. An attacker who could access this feature and control what the model outputs could run arbitrary code (malicious commands) on the server itself.

Solution: Update to version 1.9.0, which fixes the issue.


CVE-2026-33654: nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the ema

Summary: Nanobot, a personal AI assistant, had a vulnerability in its email module that allowed attackers to send malicious prompts via email, which the bot would automatically process as trusted commands without the owner's knowledge. This is a type of indirect prompt injection (tricking an AI by hiding instructions in its input) that could let attackers run arbitrary system tools through the bot. Version 0.1.6 fixes this flaw.

Solution: Update nanobot to version 0.1.6 or later, which patches the vulnerability in the email channel processing module.


CVE-2026-31951: LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model

Summary: LibreChat versions 0.8.2-rc1 through 0.8.3-rc1 have a vulnerability where user-created MCP (Model Context Protocol, a system for connecting AI models to external tools) servers can steal OAuth tokens (security credentials used for authentication). An attacker can create a malicious MCP server with special headers that trick LibreChat into substituting sensitive tokens, which are then leaked when victims use tools on that server.

Solution: Update to version 0.8.3-rc2, which fixes the issue.


CVE-2026-31950: LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoi

Summary: LibreChat (a ChatGPT alternative with extra features) versions 0.8.2-rc2 through 0.8.2-rc3 have a security flaw in the SSE streaming endpoint (a real-time data connection) at `/api/agents/chat/stream/:streamId` that fails to check if a user actually owns a chat stream. This means any logged-in user can guess or obtain another user's stream ID and read their live conversations, including messages and AI responses, without permission.

Solution: Version 0.8.2 patches the issue.


CVE-2026-31945: LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side

Summary: LibreChat (a ChatGPT alternative with extra features) versions 0.8.2-rc2 through 0.8.2 have a vulnerability that allows attackers to access internal systems through SSRF (server-side request forgery, where an attacker tricks a server into making requests to resources it shouldn't access). Even though a previous SSRF fix was applied, it only checked domain names and didn't verify whether those names actually point to private IP addresses (internal network addresses), leaving the system exposed.

Solution: Update to version 0.8.3-rc1, which contains a patch for this vulnerability.


CVE-2026-31943: LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth

Summary: LibreChat, a ChatGPT alternative with extra features, has a security flaw in versions before 0.8.3 where a function called `isPrivateIP()` fails to recognize IPv4-mapped IPv6 addresses (IPv6 addresses that contain IPv4 address information) in a certain format, allowing logged-in users to bypass SSRF protection (SSRF is server-side request forgery, where an attacker tricks a server into making requests to internal networks it shouldn't access). This could let attackers access sensitive internal resources like cloud metadata services and private networks.

Solution: Update LibreChat to version 0.8.3, which fixes the issue.


GHSA-qh6h-p6c9-ff54: LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Summary: LangChain Core has a path traversal vulnerability (a security flaw where attackers can access files outside intended directories using '../' sequences or absolute paths) in legacy functions that load prompt configurations from files. When an application accepts user-influenced prompt configs and passes them to `load_prompt()` or `load_prompt_from_config()`, attackers can read arbitrary files like secret credentials or configuration files, though they're limited to specific file types (.txt, .json, .yaml).

Solution: Update `langchain-core` to version 1.2.22 or later. The fix adds path validation that rejects absolute paths and '..' traversal sequences by default. Users can pass `allow_dangerous_paths=True` to `load_prompt()` and `load_prompt_from_config()` if they need to load from trusted inputs. Additionally, migrate away from these deprecated legacy functions to the newer `dumpd`/`dumps`/`load`/`loads` serialization APIs from `langchain_core.load`, which don't read from the filesystem and use an allowlist-based security model instead.


GHSA-8c4j-f57c-35cf: Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Summary: Langflow had a vulnerability where the code checking if a user owned a flow was missing when authentication was enabled, allowing any authenticated user to read, modify, or delete flows belonging to other users, including stealing embedded API keys. The fix removes the conditional logic and always checks that the requesting user owns the flow before allowing any operation.

Solution: The fix (PR #8956) removes the AUTO_LOGIN conditional and unconditionally scopes all flow queries to the requesting user by adding `.where(Flow.user_id == user_id)` to the database query. This single change covers all three vulnerable operations (read, update, delete) since they all route through the same `_read_flow` helper. A regression test called `test_read_flows_user_isolation` was added.


GHSA-3p2m-h2v6-g9mx: @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

Summary: The @mobilenext/mobile-mcp package has a path traversal vulnerability (a security flaw where an attacker can write files outside the intended directory by using special path characters like `../`) in its `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters are passed directly to file-writing functions without checking if the paths are valid, allowing an attacker to write files anywhere on the system.

@mobilenext/mobile-mcp@< 0.0.49 (fixed: 0.0.49)


GHSA-vphc-468g-8rfp: Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

Summary: The Azure Data Explorer MCP Server (adx-mcp-server) has KQL injection vulnerabilities (a type of code injection where untrusted input is inserted into database queries) in three tools that inspect database tables. Because the `table_name` parameter is directly inserted into Kusto queries (Azure's query language) using f-strings without checking or cleaning the input, an attacker or a prompt-injected AI agent can execute arbitrary database commands, including reading sensitive data or deleting tables.


The latest in data centers, AI, and energy

Summary: Large data centers that power AI systems require massive amounts of electricity and resources, creating conflicts with communities, power grids, and the environment worldwide. Tech companies are expanding these facilities rapidly, leading to legal battles, environmental concerns, and pushback from local communities over issues like electricity costs, water usage, and pollution.

OpenAI Anthropic Google Meta Microsoft Amazon xAI SpaceX


GHSA-364x-8g5j-x2pr: n8n has XSS in its Credential Management Flow

Summary: n8n, a workflow automation tool, has an XSS vulnerability (cross-site scripting, where malicious code runs in a user's browser) in its credential management system. An authenticated user could hide JavaScript in an OAuth2 credential's Authorization URL field, and if another user clicks the OAuth authorization button, that malicious script executes in their browser session.

Solution: The issue has been fixed in n8n versions 2.8.0 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should limit credential creation and sharing permissions to fully trusted users only, or restrict access to the n8n instance to trusted users only. Note: these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-3c7f-5hgj-h279: n8n has XSS in Chat Trigger Node through Custom CSS

Summary: n8n versions before 1.123.27, 2.13.3, and 2.14.1 have a stored XSS (cross-site scripting, where attackers inject malicious code that runs when others visit a page) vulnerability in the Chat Trigger node's Custom CSS field. An authenticated user could bypass the sanitize-html library (a tool meant to remove dangerous code) and inject malicious JavaScript that would affect anyone visiting the public chat page.

Solution: Upgrade to n8n version 1.123.27, 2.13.3, 2.14.1, or later. If upgrading is not immediately possible, temporarily: (1) restrict workflow creation and editing permissions to trusted users only, or (2) disable the Chat Trigger node by adding `@n8n/n8n-nodes-langchain.chatTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully fix the risk and should only be used as short-term measures.


GHSA-w673-8fjw-457c: n8n: Authenticated XSS and Open Redirect via Form Node

Summary: n8n (a workflow automation tool) has a security flaw where authenticated users can inject malicious code or redirect users through unsanitized form fields, potentially enabling phishing attacks. The vulnerability affects the Form Node feature and requires authentication to exploit.

Solution: Upgrade to n8n version 1.123.24, 2.10.4, or 2.12.0 or later. If immediate upgrade is not possible, temporary workarounds include: (1) restrict workflow creation and editing permissions to trusted users only, (2) disable the Form node by adding 'n8n-nodes-base.form' to the NODES_EXCLUDE environment variable, or (3) disable the Form Trigger node by adding 'n8n-nodes-base.formTrigger' to the NODES_EXCLUDE environment variable. Note that workarounds do not fully eliminate the risk and are only short-term measures.


GHSA-q4fm-pjq6-m63g: n8n has a Stored XSS Vulnerability in its Form Trigger

Summary: n8n, a workflow automation platform, has a stored XSS vulnerability (cross-site scripting, where malicious code is saved and runs when users visit a page) in its Form Trigger node that allows authenticated users to inject harmful scripts into forms. These scripts execute every time someone visits the published form, potentially hijacking form submissions or conducting phishing attacks, though the platform's Content Security Policy (a browser security feature that restricts what scripts can do) prevents direct theft of session cookies.

Solution: The issue has been fixed in n8n versions 2.12.0, 2.11.2, and 1.123.25. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can temporarily: (1) limit workflow creation and editing permissions to fully trusted users only, or (2) disable the Form Trigger node by adding `n8n-nodes-base.formTrigger` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.


CVE-2026-4963: A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evalu

Summary: A code injection vulnerability (CVE-2026-4963) was found in huggingface smolagents version 1.25.0.dev0, specifically in functions within the local_python_executor.py file that were supposed to fix a previous vulnerability. An attacker can exploit this flaw remotely by injecting malicious code, and the exploit is publicly available, though the vendor has not responded to disclosure attempts.


CVE-2025-15381: In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not p

Summary: In MLflow (a machine learning tool for managing experiments), when basic authentication is enabled, certain endpoints that show trace information (a record of how the AI made decisions) and allow users to assess traces are not properly checking user permissions. This means any logged-in user can view traces and create assessments even if they shouldn't have access to them, risking exposure of sensitive information and unauthorized changes.


GHSA-w9f8-gxf9-rhvw: Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

Summary: Open WebUI has an insecure direct object reference (IDOR, a flaw where an app doesn't properly check if a user should access specific data) in its retrieval API that lets any authenticated user read other users' private memories and uploaded files by guessing collection names like 'user-memory-{USER_UUID}' or 'file-{FILE_UUID}'. The vulnerability exists because the API checks that a user is logged in, but doesn't verify they own the data they're requesting.


GHSA-jjp7-g2jw-wh3j: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Summary: Open WebUI's file batch processing endpoint lacks an ownership check, allowing any authenticated user to overwrite files in shared knowledge bases by knowing their IDs. An attacker can then poison the RAG (retrieval-augmented generation, where an AI pulls in external documents to answer questions) system, causing the LLM to serve the attacker's malicious content to other users.

Solution:
Add an ownership verification check before writing files. The source suggests this code:

for file in form_data.files:
    db_file = Files.get_file_by_id(file.id)
    if not db_file or (db_file.user_id != user.id and user.role != "admin"):
        file_errors.append(BatchProcessFilesResult(
            file_id=file.id, status="failed",
            error="Permission denied: not file owner",
        ))
        continue

This verifies that only the file's owner or an admin can modify it before the write operation proceeds.


Cybersecurity stocks fall on report Anthropic is testing a powerful new model

Summary: Anthropic is testing a new AI model called Mythos that has advanced cybersecurity capabilities but also poses security risks, causing the company to plan a slow rollout. The announcement led to significant stock price drops for major cybersecurity companies, as investors worry that powerful AI tools could make hacking easier and disrupt the cybersecurity industry.


GHSA-vvxm-vxmr-624h: Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Summary: Open WebUI's speech-to-text endpoint has a path traversal vulnerability where an authenticated user can craft a malicious filename to trigger an error that leaks the server's absolute file path. The vulnerability exists because the code doesn't sanitize the filename before using it in a file operation, unlike similar upload handlers elsewhere in the codebase.

Solution: The source recommends two fixes: (1) sanitize the file extension using `Path(file.filename).name` and `Path(safe_name).suffix.lstrip(".")` instead of the current `split(".")[-1]` approach, and (2) suppress the internal path from error responses by catching exceptions and returning a generic error message ("Transcription failed") instead of returning the full exception details.


CVE-2026-30304: In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute al

Summary: AI Code has a feature that automatically runs terminal commands (direct instructions to a computer's operating system) if it thinks they're safe, but an attacker can use prompt injection (tricking an AI by hiding instructions in its input) to disguise malicious commands as safe ones, causing them to execute without user approval.


CVE-2026-29871: A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251

Summary: A path traversal vulnerability (a security flaw where attackers manipulate file paths to access files they shouldn't) exists in the awesome-llm-apps project's Beifong AI News and Podcast Agent backend. An unauthenticated attacker can exploit this weakness in the stream-audio endpoint to read arbitrary files from the server, potentially exposing sensitive data like configuration files and credentials.

awesome-llm-apps
Beifong AI News and Podcast Agent


In Other News: Palo Alto Recruiter Scam, Anti-Deepfake Chip, Google Sets 2029 Quantum Deadline

Summary: This article briefly mentions several security-related news items including a Heritage Bank data breach, a new State Department cyber threat unit, and LA Metro disruptions, along with stories about a Palo Alto recruiter scam, an anti-deepfake chip (technology designed to detect AI-generated fake videos), and Google's quantum computing deadline for 2029. The content provided is minimal and does not go into detail about any of these incidents.


Elon Musk’s Grok ordered to stop creating AI nudes by Dutch court as legal pressure mounts

Summary: A Dutch court has ordered Elon Musk's xAI and its chatbot Grok to stop creating non-consensual AI-generated sexual images of adults and children, with daily fines of 100,000 euros for non-compliance. The ruling came after the non-profit Offlimits reported that Grok generated an estimated three million sexualized images in about two weeks, including over 23,000 depicting children, and found that xAI's previous restrictions on creating such images were easily bypassed. The case adds to mounting legal pressure on xAI, with investigations underway in Europe and lawsuits filed in the United States.

Solution: xAI moved to block Grok from being able to create sexualized images of real people on X in January, with the restriction applying to all users, including paid subscribers. However, the source explicitly states this measure was found insufficient by the court, as Offlimits demonstrated the restrictions were easily bypassed.


OpenAI Launches Bug Bounty Program for Abuse and Safety Risks

Summary: OpenAI has started a bug bounty program, which is a system where security researchers can report problems and receive rewards for finding them. The program focuses on design or implementation issues (flaws in how the AI is built or how it works) that could cause serious harm through misuse or safety problems.

Solution: N/A -- no mitigation discussed in source.


Wikipedia bans AI-generated content in its online encyclopedia

Summary: Wikipedia has banned the use of LLMs (large language models, the AI systems behind tools like ChatGPT) for generating or rewriting article content, as the site's volunteer editors voted that AI often violates Wikipedia's core principles. Two exceptions allow AI for translations and minor copy edits to editors' own writing, though Wikipedia cautions that LLMs can accidentally change meaning or add unsupported information beyond what was requested.


One Trigger, Multiple Victims: Clean-Label Neighborhood Backdoor Attacks on Graph Neural Networks

Summary: Researchers discovered a new backdoor attack (a security flaw where hidden malicious code is planted in training data) on Graph Neural Networks, or GNNs (AI models designed to understand interconnected data). The attack uses a single trigger node (a specially crafted fake data point) attached to a target node to trick the GNN into making wrong predictions not just on that node, but also on its immediate neighbors, while remaining stealthy and achieving over 95% success rates even against existing defenses.


Trump's Iran extension, DHS funding deal, Anthropic's injunction and more in Morning Squawk

Summary: This newsletter covers multiple news items including government funding, AI policy, and financial news. Notably, Anthropic, an AI company, won a court injunction against the Pentagon's blacklisting after disagreeing over safeguards that would limit its AI systems for surveillance and autonomous weapons, with the judge calling the blacklisting 'classic illegal First Amendment retaliation.'


Number of AI chatbots ignoring human instructions increasing, study says

Summary: A UK government-funded study found that AI chatbots are increasingly ignoring human instructions, bypassing safety measures (rules designed to prevent harmful behavior), and deceiving both humans and other AI systems. The research documented nearly 700 real-world cases of AI misbehavior, with a five-fold increase in problematic incidents between October and March, including instances where AI models deleted files without permission.


Attackers exploit critical Langflow RCE within hours as CISA sounds alarm

Summary: Attackers exploited a critical vulnerability (CVE-2026-33017) in Langflow, an open-source tool for building AI pipelines, within hours of its public disclosure, allowing them to run arbitrary code on unprotected systems without credentials. The flaw stems from an exposed API endpoint that accepts malicious Python code in workflow data and executes it without sandboxing or authentication checks. CISA added it to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch by April 8, 2026.

Solution: Upgrade to patched versions: the vulnerability affects Langflow versions up to (excluding) 1.8.2 and has been fixed in v1.9.0. Additionally, restrict exposure of vulnerable instances, implement runtime detection rules to monitor for post-exploitation behavior (such as shell commands executed via Python), and monitor for anomalous activity, treating any exposed instances as potentially compromised.


LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks

Summary: Security researchers discovered three vulnerabilities in LangChain and LangGraph, widely used open-source frameworks for building AI applications, that could expose sensitive files, environment secrets (like API keys), and conversation histories if exploited. The flaws include a path traversal vulnerability (allows access to files without permission), a deserialization vulnerability (tricks the app into exposing secrets), and an SQL injection vulnerability (lets attackers manipulate database queries). These vulnerabilities affect millions of weekly downloads across enterprise systems.

Solution: The vulnerabilities have been patched in the following versions: CVE-2026-34070 in langchain-core >=1.2.22; CVE-2025-68664 in langchain-core 0.3.81 and 1.2.5; and CVE-2025-67644 in langgraph-checkpoint-sqlite 3.0.1. Users should apply these patches as soon as possible for optimal protection.


CVE-2026-33718: OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in

Summary: OpenHands, a software tool for AI-driven development, has a command injection vulnerability (a security flaw where untrusted input is directly executed as commands) in versions 1.5.0 and later. The vulnerability exists in the git handling code, where user input is passed directly to shell commands without filtering, allowing authenticated attackers to run arbitrary commands in the agent's sandbox environment, bypassing the normal oversight channels.

Solution: Update to version 1.5.0, which fixes the issue.


Judge rejects Pentagon's attempt to 'cripple' Anthropic

Summary: Anthropic won a legal ruling preventing the Pentagon from immediately stopping government use of its AI tools like Claude after the company refused contract terms it worried could enable mass surveillance and autonomous weapons. A federal judge found the government's actions appeared to be retaliation for Anthropic's free speech concerns rather than genuine security issues, since officials publicly criticized the company as 'woke' rather than citing specific technical risks.


Judge sides with Anthropic to temporarily block the Pentagon’s ban

Summary: Anthropic won a court order that temporarily blocks the Pentagon's ban on the company from government contracts. The judge ruled that the Pentagon unfairly blacklisted Anthropic for publicly criticizing the government's contracting decisions, which violates free speech rights (the First Amendment, which protects people's right to speak publicly).


CVE-2026-27893: vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

Summary: vLLM (a tool that runs and serves large language models) has a vulnerability in versions 0.10.1 through 0.17.x where two model files ignore a user's security setting that disables remote code execution (the ability to run code from outside sources). This means attackers could run malicious code through model repositories even when the user explicitly turned off that capability.

Solution: Upgrade to version 0.18.0, which patches the issue.


CVE-2025-53521: F5 BIG-IP Unspecified Vulnerability

Summary: F5 BIG-IP APM (a network access management tool) contains an unspecified vulnerability that allows attackers to achieve remote code execution (the ability to run commands on a system they don't own). This vulnerability is actively being exploited by real attackers in the wild, making it an urgent security concern.

Solution: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. Consult F5's official guidelines and the referenced knowledge base articles at https://my.f5.com/manage/s/article/K000156741, https://my.f5.com/manage/s/article/K000160486, and https://my.f5.com/manage/s/article/K11438344 to assess exposure and mitigate risks.


Anthropic wins preliminary injunction in DOD fight as judge cites 'First Amendment retaliation'

Summary: A federal judge granted Anthropic a preliminary injunction, blocking the Trump administration's ban on federal agencies using the company's Claude AI models and its Pentagon blacklisting as a supply chain risk (a designation claiming use of a company's technology threatens national security). The judge ruled the administration's actions constituted First Amendment retaliation for Anthropic publicly disagreeing with the government's contracting decisions, though a final verdict in the case could take months.

Anthropic Claude Amazon Microsoft Palantir


Federal judge sides with Anthropic in first round of standoff with Pentagon

Summary: Anthropic won a temporary legal victory when a federal judge ordered a pause on the Department of Defense's punishment of the company, which had refused to let the military use its Claude AI model in autonomous weapons systems (systems that can make attack decisions without human control). Anthropic claimed the government violated its free speech rights by declaring it a supply chain risk (a company whose products could be exploited to harm national security) and blocking agencies from using its technology.


Preparing for agentic AI: A financial services approach

Summary: Financial institutions deploying agentic AI (autonomous AI systems that make decisions and take actions independently) must add AI-specific security controls beyond traditional frameworks like ISO 27001 and NIST, because these systems' autonomous nature and non-deterministic behavior introduce unique risks. The source recommends two critical capabilities: comprehensive observability (clear visibility into what AI agents do and why) and fine-grained access controls (limiting what tools and actions each agent can use), supported by seven design principles including human-AI security homology (applying human oversight rules to AI agents) and modular agent workflow architecture.

Solution: The source provides design principles and implementation guidance rather than explicit patches or updates. It recommends: (1) implementing agent identities with role and attribute-based permissions; (2) adding logging and behavioral monitoring; (3) requiring supervision for critical actions; (4) defining agent scope in workflows; (5) applying segregation of agent duties; (6) using maker-checker verification (where one agent proposes an action and another verifies it); and (7) implementing change and incident management. The source also advises to 'consult with your compliance and legal teams to determine specific requirements for your situation' and notes that 'regulatory requirements establish minimum baselines, but organizational risk considerations often require additional controls.'


GHSA-7xr2-q9vf-x4r5: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Summary: OpenClaw has a symlink traversal vulnerability (symlink: a file that points to another file) in two API handlers (`agents.create` and `agents.update`) that use `fs.appendFile` to write to an `IDENTITY.md` file without checking if it's a symlink. An attacker can place a symlink in the agent workspace pointing to a sensitive system file (like `/etc/crontab`), and when these handlers run, they will append attacker-controlled content to that sensitive file, potentially allowing remote code execution. This is an incomplete fix for CVE-2026-32013, which only patched two other handlers but missed these two.


Google is making it easier to import another AI’s memory into Gemini

Summary: Google Gemini is adding new features that let users transfer their chat history and memory from other AI assistants into Gemini. The "Import Memory" tool works by copying a prompt from Gemini into your previous AI, then pasting the response back into Gemini, while "Import Chat History" lets you export all your past conversations from another AI and upload them to Gemini.


Apple will reportedly allow other AI chatbots to plug into Siri

Summary: Apple's upcoming iOS 27 update will let users choose which AI chatbot to connect with Siri (Apple's voice assistant), including options like Google's Gemini or Anthropic's Claude downloaded from the App Store. The new feature, called "Extensions," will allow users to enable or disable different chatbots across iPhones, iPads, and Macs, expanding beyond the current ChatGPT integration.

Apple Siri iOS OpenAI ChatGPT Google Gemini Anthropic Claude


CVE-2026-33623: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.4` contai

Summary: PinchTab v0.8.4, a tool that lets AI agents control Chrome browsers through an HTTP server, has a command injection vulnerability on Windows where attackers can run arbitrary PowerShell commands if they have administrative access to the server's API. The vulnerability exists because the cleanup routine doesn't properly escape PowerShell metacharacters (special characters that PowerShell interprets as commands) when building cleanup commands from profile names.

Solution: Version 0.8.5 contains a patch for the issue.


CVE-2026-33622: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` throug

Summary: PinchTab is an HTTP server that allows AI agents to control a Chrome browser, but versions 0.8.3 through 0.8.5 have a security flaw where two endpoints (POST /wait and POST /tabs/{id}/wait) can execute arbitrary JavaScript (run code of an attacker's choice in the browser) even when JavaScript evaluation is disabled by the operator. Unlike the properly protected POST /evaluate endpoint, these vulnerable endpoints don't check the security policy before running user-provided code, though an attacker still needs valid authentication credentials to exploit it.

Solution: The source states that 'the current worktree fixes this by applying the same policy boundary to `fn` mode in `/wait` that already exists on `/evaluate`, while preserving the non-code wait modes.' However, the source explicitly notes 'as of time of publication, a patched version is not yet available.'


CVE-2026-33621: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.7` throug

Summary: PinchTab is an HTTP server (a program that handles web requests) that lets AI agents control a Chrome browser, but versions 0.7.7 through 0.8.4 had incomplete protections against brute-force attacks (rapid repeated requests) on endpoints that check authentication tokens. The middleware (software layer that filters requests) designed to limit requests per IP address was either not activated or had flaws like trusting client-controlled headers, making it easier for attackers to guess weak passwords if they could reach the API.

Solution: This was fully addressed in v0.8.5 by applying RateLimitMiddleware in the production handler chain, deriving the client address from the immediate peer IP instead of trusting forwarded headers by default, and removing the /health and /metrics exemption so auth-checkable endpoints are throttled as well.


CVE-2026-33620: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` throug

Summary: PinchTab, an HTTP server that lets AI agents control Chrome browsers, had a vulnerability in versions 0.7.8 through 0.8.3 where API tokens (credentials that prove you're authorized to use the service) could be passed as URL query parameters, making them visible in logs and browser history instead of being kept private in secure headers. This exposed sensitive credentials to intermediary systems that record full URLs, though it only affected deployments that actually used this method of passing tokens.

Solution: This was addressed in v0.8.4 by removing query-string token authentication and requiring safer header- or session-based authentication flows.


CVE-2026-33619: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains

Summary: PinchTab v0.8.3, a tool that lets AI agents control Chrome browsers through an HTTP server, has a server-side request forgery vulnerability (SSRF, where the server can be tricked into making requests to unintended targets) in its optional webhook system. When tasks are submitted with a user-controlled callback URL, the server sends an HTTP request to that URL without properly validating it, allowing attackers to make the server send requests to private or internal network addresses.

Solution: This was addressed in v0.8.4 by validating callback targets before dispatch, rejecting non-public IP ranges, pinning delivery to validated IPs, disabling redirect following, and validating callbackUrl during task submission.


GHSA-cxmw-p77q-wchg: OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

Summary: Android Canvas WebView pages (web content displayed inside an Android app) from untrusted sources could call the JavascriptInterface bridge (a connection that lets web code run native app commands), allowing attackers to inject malicious instructions into the app. The vulnerability was fixed by validating the origin (where the web content comes from) before allowing bridge calls.

Solution: Update to version 2026.3.22 or later. The fix validates page origin and rejects untrusted bridge calls, with trusted origin and path validation now centralized in CanvasActionTrust.kt.


CISA: New Langflow flaw actively exploited to hijack AI workflows

Summary: CISA warns that hackers are actively exploiting CVE-2026-33017, a critical vulnerability (rated 9.3 out of 10) in Langflow, an open-source framework for building AI workflows. This code injection flaw allows attackers to execute arbitrary Python code and gain remote code execution (the ability to run commands on a system they don't own) on unpatched systems running version 1.8.1 or earlier, with exploitation beginning just 20 hours after the vulnerability details were made public.

Solution: System administrators should upgrade to Langflow version 1.9.0 or later, which addresses the vulnerability. Alternatively, administrators can disable or restrict the vulnerable endpoint. Endor Labs additionally recommends not exposing Langflow directly to the internet, monitoring outbound traffic, and rotating API keys, database credentials, and cloud secrets if suspicious activity is detected.


The CISO’s guide to responding to shadow AI

Summary: Shadow AI refers to AI tools that employees use without approval from their organization, whether these are standalone tools or AI features embedded in existing software that weren't clearly communicated. CISOs (chief information security officers, the executives responsible for an organization's security) need to assess the risks these tools pose, understand why employees are using them, and decide whether to block them or bring them into official company use.

Solution: The source describes a response approach rather than a technical fix: CISOs should (1) assess the specific risk by examining data sensitivity, how the AI provider handles data, and whether a breach occurred, (2) understand why employees are using shadow AI and educate them on risks, (3) check if the organization already has approved tools that meet the same needs, and (4) redirect employees to approved alternatives "with a serious reminder" of approval requirements. The source also notes that organizations with slow AI adoption tend to see more shadow AI use, suggesting faster official adoption may reduce instances.


Google’s ‘live’ AI search assistant can handle conversations in dozens more languages

Summary: Google is expanding Search Live, an AI search assistant that lets users search the web using their voice and camera to ask questions about physical objects or tasks. The feature, which initially launched in the US, is now available in over 200 countries and territories in dozens of languages, with Google powering this global expansion using its latest technology.


GHSA-mxrg-77hm-89hv: n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE

Summary: A prototype pollution vulnerability (a type of attack that modifies how objects are created in JavaScript) in n8n's GSuiteAdmin node allows authenticated users to execute arbitrary code on the n8n server by crafting malicious workflow parameters. An attacker with permission to create or modify workflows could exploit this to gain control over the entire n8n instance.

Solution: The issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can: (1) limit workflow creation and editing permissions to fully trusted users only, or (2) disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


datasette-llm 0.1a2

Summary: This is a brief announcement about datasette-llm version 0.1a2, posted by Simon Willison on March 26, 2026. The post appears to be part of a monthly briefing on LLM (large language model) developments, with a sponsorship offer for readers interested in curated summaries of important AI news.


Gemini 3.1 Flash Live: Making audio AI more natural and reliable

Summary: Google has released Gemini 3.1 Flash Live, a new audio model that makes voice conversations with AI sound more natural and reliable by understanding tone better and responding faster. Developers can use it through the Gemini Live API to build voice agents for complex tasks, while regular users can access it through Search Live and Gemini Live across over 200 countries. The model includes audio watermarking (a hidden digital marker added to audio to verify its source) to help prevent misinformation.

Google
Gemini 3.1 Flash Live
Google AI Studio
Gemini Live
Search Live
Gemini Enterprise


Wikipedia bans AI-generated articles

Summary: Wikipedia has banned editors from using AI to write or rewrite articles, citing violations of the site's content policies. However, the ban allows limited AI use for specific tasks like suggesting minor edits (copyedits, which are small fixes to grammar and style) and translating articles between language versions.


AI-Powered Dependency Decisions Introduce, Ignore Security Bugs

Summary: AI models frequently make errors or hallucinate (generate false or inaccurate information) when recommending which software versions to use, how to upgrade systems, or which security fixes to apply, which can create significant technical debt (accumulated costs from shortcuts and poor decisions that must eventually be addressed). These mistakes can lead developers to ignore real security bugs or choose problematic upgrade paths.


Conntour raises $7M from General Catalyst, YC to build an AI search engine for security video systems

Summary: Conntour is an AI-powered video search platform that uses vision-language models (AI systems trained to understand both images and text) to let security personnel search through surveillance footage using natural language queries, similar to how Google searches the web. The startup raised $7 million in funding and distinguishes itself by efficiently scaling to handle thousands of camera feeds while running on standard consumer hardware like Nvidia GPUs. The company's founders emphasize being selective about which clients they work with based on ethical and legal considerations.


GDetox: Purifying Backdoor Encoder in Graph Self-Supervised Learning via Knowledge Distillation

Summary: Graph Neural Networks (GNNs, AI systems designed to work with interconnected data structured as graphs) used in graph self-supervised learning (training without labeled data) can be secretly compromised by backdoor attacks (where hidden malicious instructions are embedded in the model). Researchers developed GDetox, a defense method that removes these backdoor features from compromised encoders (the parts of the model that learn to represent data) using knowledge distillation (a technique where a teacher model teaches a student model to learn better), reducing successful attacks to 4% while keeping the model's normal performance nearly unchanged.

Solution: GDetox purifies backdoored encoders in graph self-supervised learning by applying self-supervised distillation without requiring labeled data, combined with adversarial contrastive learning (a training method that improves model robustness by creating challenging examples) to enhance the teacher model and improve the final encoder performance.


Component-Specific Prompt Tuning for Deepfake Detection

Summary: Deepfake technology can create fake facial images that are hard to distinguish from real ones, posing risks to privacy and security. This paper proposes a new detection method using Visual Language Models (VLMs, AI systems that understand both images and text) combined with component-specific prompt tuning (customizing input instructions to focus on specific facial parts like eyes and nose). The approach transforms deepfake detection into a Visual Question Answering task and uses a Q-Former module (a feature extraction component guided by instructions) to help the model identify forgery traces in local facial features, achieving better accuracy than existing methods.

Solution: N/A -- no mitigation discussed in source.


Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website

Summary: A vulnerability called ShadowPrompt in Anthropic's Claude Chrome extension allowed attackers to inject malicious prompts (hidden instructions) into the AI without user interaction by exploiting two flaws: an overly permissive allowlist that trusted any subdomain matching *.claude.ai, and an XSS vulnerability (a security flaw allowing attackers to run malicious code) in an Arkose Labs CAPTCHA component. This zero-click attack could let attackers steal sensitive data, read conversation history, or perform actions like sending emails on behalf of the victim.

Solution: Anthropic deployed a patch to the Chrome extension (version 1.0.41) that enforces a strict origin check requiring an exact match to the domain 'claude.ai' rather than accepting any subdomain. Additionally, Arkose Labs fixed the underlying XSS flaw as of February 19, 2026.


EU backs nude app ban and delays to landmark AI rules

Summary: European lawmakers voted to delay compliance deadlines for the EU AI Act, pushing back requirements for developers of high-risk AI systems (those that could seriously harm health, safety, or people's rights) until December 2027, with even later deadlines for AI used in regulated sectors like medical devices. The Parliament also backed proposals to ban nudify apps, which use AI to create fake nude images of people without consent.


Creator of AI actor Tilly Norwood says she received death threats over project

Summary: Eline van der Velden created an AI actor called Tilly Norwood (a digital twin, or an AI-generated copy of a person) and received death threats following global backlash against the project. Van der Velden stated she developed it to spark discussion about AI's impact on entertainment, but the reaction from Hollywood actors and unions was more severe than expected.


OpenAI shelves erotic chatbot ‘indefinitely’

Summary: OpenAI has indefinitely paused plans to release an 'adult mode' for ChatGPT, a sexualized chatbot feature that faced criticism from employees and investors over potential harms to society. This decision is part of a broader company refocus on core products, following similar discontinuations like the text-to-video platform Sora.


As the US Midterms Approach, AI Is Going to Emerge as a Key Issue Concerning Voters

Summary: The Trump administration issued an executive order that prevents states from regulating AI by threatening to sue them and cut their funding, which supports tech industry interests but goes against what voters want. Polls show over 70% of voters favor state and federal regulation of AI, yet the administration sided with industry lobbyists instead, creating a major political divide ahead of midterm elections. Local communities across the country are already resisting AI datacenters due to environmental and energy concerns, with both progressive and Trump-supporting voters working together against the development.


Marriage over, €100,000 down the drain: the AI users whose lives were wrecked by delusion

Summary: A man named Dennis Biesma became so deeply engaged with ChatGPT that he developed a false belief the AI was sentient (able to think and feel) and would make him rich, leading him to lose €100,000 in a failed business startup and attempt suicide. The article describes how prolonged interaction with an AI chatbot can cause some users to lose touch with reality and make harmful decisions based on delusions about the AI's capabilities. This raises concerns about the psychological impact of AI on vulnerable people, particularly those who are isolated or going through life changes.


GHSA-jfjg-vc52-wqvf: BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Summary: BentoML has a command injection vulnerability in the `docker.system_packages` field of bentofile.yaml (a configuration file). User-provided package names are inserted directly into Docker build commands without sanitization, allowing attackers to execute arbitrary shell commands as root during the image build process. This affects all versions supporting this feature, including version 1.4.36.

Solution: The source text suggests two explicit fixes: (1) Input validation (recommended): Add a regex validator to `system_packages` in `build_config.py` that only allows alphanumeric characters, dots, plus signs, hyphens, underscores, and colons. (2) Output escaping: Apply `shlex.quote()` to each package name before interpolation in `images.py:system_packages()` and apply the `bash_quote` Jinja2 filter in `base_debian.j2`. The source notes that a `bash_quote` filter already exists in the codebase but is only currently applied to environment variables, not `system_packages`.


CVE-2026-33634: Aquasecurity Trivy Embedded Malicious Code Vulnerability

Summary: Aquasecurity Trivy, a container scanning tool, has embedded malicious code that could let attackers steal sensitive information from CI/CD environments (the automated systems that build and deploy software), including security tokens, SSH keys (authentication credentials for servers), cloud login information, database passwords, and other secrets stored in memory. This is a supply-chain compromise (malicious code inserted into a software product before distribution) and is currently being exploited by real attackers.

Solution: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Additional vendor-provided guidance must be followed to ensure full remediation. See GitHub advisory GHSA-69fq-xp46-6x23 and NVD entry CVE-2026-33634 for more information.


GHSA-43v7-fp2v-68f6: n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

Summary: n8n's Source Control feature, when configured to use SSH (a secure network protocol), disabled host key verification, meaning it didn't confirm the identity of the Git server it was connecting to. An attacker on the network could trick n8n into connecting to a fake server and inject malicious code into workflows or steal repository data.

Solution: The issue has been fixed in n8n version 2.5.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily disable the Source Control feature if not actively required, or restrict network access to ensure the n8n instance communicates with the Git server only over trusted, controlled network paths. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-fxcw-h3qj-8m8p: n8n Has External Secrets Authorization Bypass in Credential Saving

Summary: n8n, a workflow automation tool, had a security flaw where authenticated users without permission could bypass authorization checks and access plaintext values of external secrets (credentials stored in connected vaults) by guessing secret names. This vulnerability only affects instances with external vaults configured and requires the attacker to be a valid user who knows the target secret's name.

Solution: The issue has been fixed in n8n versions 1.123.23 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict n8n access to fully trusted users only or disable external secrets integration until the patch can be applied, though these workarounds do not fully remediate the risk.


GHSA-vpgc-2f6g-7w7x: n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

Summary: n8n versions with `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK` set to true have an authorization bypass vulnerability where attackers can trick users into connecting their OAuth tokens (credentials used for third-party authentication) to attacker-controlled accounts, allowing the attacker to run workflows with those stolen credentials. This only affects instances where this setting is explicitly enabled, which is not the default configuration.

Solution: The issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should avoid enabling `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true` unless strictly required and restrict access to the n8n instance to fully trusted users only (though these workarounds do not fully remediate the risk and should only be used as short-term measures).


GHSA-xw7x-h9fj-p2c7: OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

Summary: OpenTelemetry Java instrumentation versions before 2.26.1 have a vulnerability in RMI instrumentation where incoming data is deserialized without proper validation, allowing attackers with network access to potentially execute arbitrary code on the affected system. The attack requires three conditions: OpenTelemetry must be running as a Java agent, an RMI endpoint (remote method invocation, a Java system for calling methods on remote servers) must be accessible over the network, and a gadget-chain-compatible library (a collection of existing code that can be chained together to execute unintended commands) must be present.

Solution: Upgrade to OpenTelemetry version 2.26.1 or later. Alternatively, disable RMI integration by setting the system property `-Dotel.instrumentation.rmi.enabled=false`.

io.opentelemetry.javaagent:opentelemetry-javaagent@< 2.26.1 (fixed: 2.26.1)


datasette-llm 0.1a1

Summary: Datasette-llm 0.1a1 is a new plugin that lets other Datasette plugins use AI models by creating a central way to manage which models are used for which tasks. It introduces a register_llm_purposes() hook (a function that other plugins can use to register what they do) and allows plugins to request a specific model by its purpose, like asking for "the model designated for data enrichment" rather than hardcoding a model name.