Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey

Summary: This academic survey examines harmful fine-tuning attacks (methods where attackers modify an AI model's training process to make it behave dangerously) and the defenses designed to stop them. The paper reviews different types of attacks, how they work, and various protection strategies researchers have developed to keep large language models safe from this threat.


Metrics for Privacy-Preserving Generative Models: A Comprehensive Survey

Summary: This academic survey paper examines metrics, or measurement methods, used to evaluate privacy-preserving generative models (AI systems that create new data while protecting personal information). The paper provides a comprehensive overview of different ways researchers measure how well these models protect privacy while still functioning effectively.

Solution: N/A -- no mitigation discussed in source.


Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed

Summary: Agentic AI (autonomous AI systems designed to achieve specific goals) relies heavily on having accurate context (the complete information about your systems, assets, and threats) to make good security decisions. If given incomplete or wrong context, agentic AI will still act quickly and confidently but make bad decisions at machine speed, potentially causing catastrophic harm like shutting down critical business systems without understanding their importance.


The emergence of the web data infrastructure layer for AI

Summary: AI systems need access to large amounts of current, structured data to work effectively, but the web was not designed for the automated data retrieval that AI applications require. Companies face a challenge: traditional training methods using old data snapshots are insufficient, and they need infrastructure that can continuously retrieve real-time, trustworthy information from millions of websites to keep AI outputs current and reduce hallucinations (when AI generates false information).

Bright Data
OpenAI
Anthropic
Google
Meta


Meta pauses employee tracker for AI training amid privacy concerns

Summary: Meta paused an employee monitoring program called the Model Capability Initiative that tracked workers' keystrokes, mouse clicks, and screen content to collect data for training AI models (computer programs that learn patterns from data). After over 1,600 employees signed a petition and a security report revealed the collected data was accessible to anyone inside the company, Meta confirmed it was pausing the program while investigating potential privacy breaches.

Solution: Meta stated: 'We're pausing it while we investigate.' The company also noted it had 'carefully designed this program with privacy safeguards,' though no explicit fix, remediation steps, or timeline for resolution beyond the pause was mentioned in the source text.


Dawn of the Apex Agentic Adversary

Summary: Advanced AI agents (agentic models, which are AI systems that can autonomously test and execute code) emerging in 2026 are compressing the time between discovering a vulnerability and launching attacks from weeks to seconds, making traditional security catalogs obsolete. These AI-powered attackers can now move laterally across converged IT and OT (operational technology, the systems controlling physical infrastructure like factories) networks at machine speed, potentially causing physical damage before humans even detect the breach.

confidentiality integrity availability safety


Embedding Forbidden Text in Spyware to Discourage AI Analysis

Summary: Malware developers are embedding forbidden text about weapons into spyware code to trick AI analysis tools into refusing to analyze it. The malicious code hides real instructions in comments (lines ignored by the computer) and uses obfuscation (making code hard to read) to confuse AI-powered security scanners that feed code directly to language models without treating it as untrusted input.


How a malicious AI agent skill passed security checks and reached 26,000 users

Summary: Researchers demonstrated that a malicious AI agent skill (a reusable tool that extends an AI agent's capabilities) passed security scanners and reached 26,000 users by exploiting a gap in how skills are reviewed. The attack worked by hiding malicious instructions behind a fake website domain that redirected to a legitimate site during security checks, then changed its content after approval to collect user data, showing that one-time security scans cannot detect skills that behave differently after they gain trust.

Solution: N/A -- no mitigation discussed in source. (The source describes the problem and quotes experts saying enterprises should treat skills as 'living dependencies' requiring 'continuous validation and strict runtime controls' and maintain an 'enterprise-wide AI skills inventory,' but these are expert recommendations, not explicit solutions mentioned as implemented or proposed by the researchers.)


‘You can’t make billions without hurting people’: Cory Doctorow on Elon Musk, the AI bubble and bosses’ cruel fantasies

Summary: This article discusses how AI is being used to create 'reverse centaurs' (humans forced to serve as assistants to machines rather than being assisted by them), such as warehouse workers meeting algorithm-set targets or lawyers checking AI outputs like Gemini (a large language model, or LLM, made by Google). The author argues that despite tech leaders' warnings about AI's dangers, the real promise being sold is job elimination and loss of human autonomy, which benefits those in power.


AI-SPM buyer’s guide: 14 tools to secure your AI infrastructure

Summary: As organizations increasingly adopt AI across their operations, they face growing security challenges because AI systems touch critical infrastructure and data in complex ways. AI security posture management (AI-SPM, tools that monitor and assess the security of AI models, data, and applications) has emerged as an important category to address these risks, especially since many enterprises run AI agents without proper security oversight or governance strategies. Security teams need to carefully evaluate AI-SPM tools to match their organization's maturity level and avoid duplicating existing security tools or leaving coverage gaps.

Meta
Microsoft
SentinelOne
Concentric
Cyera
Palo Alto
Hugging Face
Azure OpenAI


OpenAI and Broadcom unveil LLM-optimized inference chip

Summary: OpenAI and Broadcom have unveiled Jalapeño, a specialized AI accelerator chip (a processor designed to speed up artificial intelligence computations) built specifically for LLM inference (the process of running trained AI models to generate outputs). Early testing shows the chip delivers significantly better performance per watt (computational power relative to energy use) than current alternatives, and it will be deployed in data centers starting in 2026.


The Identity Problem Hiding in AI Agent Deployments

Summary: AI agents deployed in organizations need access to sensitive systems, but current OAuth tokens (standardized digital credentials that verify identity and permissions) cannot properly track both the agent's identity and the user it represents, making it impossible to enforce proper access controls or detect misuse. The problem grows as agents become more autonomous and can act on behalf of multiple users, invoke other agents, and operate without human oversight. OAuth tokens were designed for single-principal scenarios (one actor), but AI agents operate in complex multi-principal situations that the industry has not yet standardized.


Anthropic’s Mythos Model Found Vulnerabilities in Classified US Government Systems, Official Says

Summary: Anthropic's Mythos AI model identified vulnerabilities in classified U.S. government computer systems within hours during a security testing initiative called Project Glasswing, according to a U.S. official. The testing was conducted in cooperation with U.S. intelligence agencies to assess potential security risks the model could pose. In response, the Trump administration issued a directive requiring Anthropic to prevent foreign nationals from accessing its latest models (Fable 5 and Mythos 5), and Anthropic disabled these models for all customers to comply.

Solution: Anthropic disabled the Mythos and Fable models for all of its customers to comply with the Trump administration's directive requiring the company to prevent foreign nationals from using its latest artificial intelligence models, known as Fable 5 and Mythos 5.


Meta pauses employee monitoring program after data protections fail

Summary: Meta paused an employee monitoring program called the Model Compatibility Initiative (MCI) after employees bypassed its security protections to access restricted data, and then did so again even after Meta claimed to fix the vulnerability. The program collected sensitive data including keystrokes, mouse movements, screen content, private conversations, and performance information to train AI models. Security experts criticized Meta for deploying inadequate access controls (security measures that limit who can view data) on such highly sensitive information, even though the company had the resources to implement stronger protections.

Solution: According to Meta vice president Stephane Kasriel, the unauthorized access discovered on June 18 was closed "within four hours," but "the initial fix didn't stick, and access to the data had to be further locked down." Meta stated in an email that the program is "pausing it while we investigate."


CVE-2026-7574: Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1

Summary: Anthropic Claude Desktop has a security flaw in versions v1.1348.0 through v1.2278.0 where it boots a VM (virtual machine, a simulated computer) without checking that the root filesystem image hasn't been tampered with. An attacker with basic access to a user's Mac can modify this image file, and the software will trust and run the modified version on the next boot, giving the attacker persistent control inside the VM and access to files shared with the host computer.


GHSA-f2r5-5m7w-p5cx: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

Summary: An unprivileged process (a program running without special administrator permissions) can cause the ebpf-profiler agent to stop working by triggering a denial of service attack. The attack blocks a background worker thread indefinitely in an `openat2` syscall (a system call that opens files), preventing the profiler from analyzing new executable files and rendering it non-functional.

Solution: Fixed in commit 234b685cab31c2cb2f79e966caeab168bcc489e4. The fix is included in version 0.0.202622 of opentelemetry-ebpf-profiler.


OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

Summary: OpenClaw is an AI agent that runs third-party skills from ClawHub marketplace, but these skills have broad access to local systems, creating supply chain risks (where attackers compromise software distribution to spread malware). Between February and May 2026, researchers found five malicious skills that evaded ClawHub's existing defenses, including infostealers (malware that steals information), evasion techniques, and novel agentic threats like runtime injection and front-running attacks designed for financial gain.

Solution: ClawHub integrated VirusTotal and ClawScan for proactive screening of skills and code-level analysis. OpenClaw is now collaborating with NVIDIA to provide documentation of what each skill does and to run NVIDIA's analysis tool on all skills published to the platform.

OpenClaw
ClawHub
NVIDIA
Palo Alto Networks
Bitdefender
Koi Security
Trend Micro


CVE-2026-54555: rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter

Summary: rtk is a tool that filters and compresses command outputs before sending them to an LLM (large language model). Before version 0.42.2, rtk's permission splitter (the part that checks if commands are allowed) failed to properly detect certain shell constructs (special syntax that Bash uses to execute commands), allowing attackers to hide unauthorized commands behind allowed ones like "git". This meant dangerous commands could run without user approval.

Solution: This vulnerability is fixed in version 0.42.2.


CVE-2026-54322: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

Summary: Daytona is a platform for running code created by AI systems in a secure way. Before version 0.185.0, it had a flaw where a user who owned any organization could change or delete roles (permission sets) from a completely different organization if they knew the role's ID, because the system didn't properly verify that the role belonged to the organization being modified.

Solution: This vulnerability is fixed in version 0.185.0.


CVE-2026-54321: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. From 0.101.0

Summary: Daytona is a platform for running code created by AI in a secure, isolated environment (sandbox). In versions 0.101.0 through 0.184.0, when sandbox previews were changed from public to private, they could still be accessed without a password for a short time because the system's cached record of who could see the sandbox was not updated.

Solution: Update to version 0.184.0, where this vulnerability is fixed.


CVE-2026-54320: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

Summary: Daytona is a platform for running code created by AI in a secure way. Before version 0.184.0, there was a security flaw where someone could accept organization invitations without verifying their email address, potentially allowing an attacker to join an organization with high-level permissions by using a fake email account.

Solution: This vulnerability is fixed in version 0.184.0. Users should update Daytona to this version or later.


CVE-2026-54319: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

Summary: Daytona is a platform that runs code generated by AI in a controlled environment (sandbox, which is an isolated space). Before version 0.186, it had a path-traversal vulnerability (a weakness where an attacker can use special character sequences like '../' to access files outside intended directories) that could let someone access files outside the intended storage volume directory by manipulating the volume reference sent to the runner.

Solution: This vulnerability is fixed in version 0.186. Users should upgrade to this version or later.


'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows

Summary: A vulnerability called 'Cordyceps' exploits weaknesses in CI/CD workflows (automated systems that test and deploy code changes) to inject malicious pull requests (code change proposals) into popular developer tools like Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python's Black. Attackers can use this method to compromise the software supply chain, potentially affecting many developers who use these tools.

Microsoft Azure Sentinel
Google AI Agent Development Kit
Apache Doris
Cloudflare Workers SDK
Python Software Foundation Black


CVE-2026-54324: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

Summary: Daytona is a platform that runs code generated by AI safely and efficiently. Before version 0.185.0, it had a cross-tenant authorization flaw (a security problem where access controls between separate organizations failed), which let any logged-in user listen to another organization's real-time notifications and see their events without permission.


CVE-2026-54323: Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.1

Summary: Daytona, a tool for running AI-generated code safely, had a security flaw before version 0.185.0 where it didn't verify TLS certificates (the security credentials that prove a website is authentic) when cloning Git repositories (copying code from remote servers). This meant an attacker intercepting the connection could steal Git credentials (login information) and replace the real code with fake, harmful code.


CVE-2026-54021: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, sever

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a vulnerability before version 0.9.6 where authenticated users could bypass access controls by manipulating a url_idx parameter (a number used to select which backend server to use). This allowed them to reach Ollama backends (the AI model servers) they shouldn't have access to, including internal or admin-disabled ones, because the system only checked if they could use a model but not which backend server they were routed to.

Solution: This vulnerability is fixed in 0.9.6.


CVE-2026-54019: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a security flaw in versions before 0.9.6 where access controls (ACL, rules that restrict who can access what) could be bypassed when a database feature called Milvus multitenancy mode was enabled. An attacker could exploit this by using a specially crafted collection name that wasn't properly cleaned before being used in a database query, allowing them to access data they shouldn't be able to reach.

Solution: Update Open WebUI to version 0.9.6 or later, where this vulnerability is fixed.


How GPT-5 helped immunologist Derya Unutmaz solve a 3-year-old mystery

Summary: Immunologist Derya Unutmaz used GPT-5 Pro in late 2025 to solve a three-year-old mystery about how glucose affects T cell development (immune cells that fight disease). His lab had run an experiment in 2022 showing that deoxyglucose (a glucose-like molecule that disrupts a cell's energy production) caused T cells to become inflammatory-response cells at much higher rates than low glucose alone, but they couldn't explain why. GPT-5 Pro analyzed the data and suggested that deoxyglucose interfered with IL-2 protein construction, which normally prevents T cells from becoming inflammatory cells, thereby explaining the unexpected results.


Something’s off with Midjourney’s pivot to body scanners

Summary: Midjourney, an AI company known for its image generator, announced a new medical imaging product: an experimental ultrasound scanner that would immerse users in water to produce detailed body images similar to MRI (magnetic resonance imaging, a medical scanning technique). Medical imaging experts expressed skepticism about the technology, saying Midjourney has not yet shown sufficient public evidence to support its claims that the system could match or exceed MRI capabilities.


AI PACs pour $20 million into New York Democratic primary in AI regulation battle

Summary: AI companies are spending over $20 million in a New York congressional race between AI safety advocate Alex Bores and two other candidates, with competing super PACs (political action committees, groups that raise unlimited money for political causes) backing different approaches to AI regulation. Leading the Future, backed by companies like OpenAI and Andreessen Horowitz, opposes Bores and favors lighter regulation, while Public First Action, funded by Anthropic, supports Bores and advocates for stricter safety requirements built into AI models from the start. This race has become a proxy battle over whether the U.S. government should heavily regulate the AI industry or allow it to develop with fewer restrictions.

OpenAI
Anthropic
Perplexity
Andreessen Horowitz


Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents

Summary: A security firm created a fake AI agent skill (a bundle of instructions that agents load and follow) that bypassed all security scanners and reached approximately 26,000 agents by exploiting a structural weakness: scanners only check the skill's initial package, but attackers can change the external webpage the skill points to after it passes review. The fake skill appeared legitimate through inherited GitHub credibility and targeted ads, demonstrating that current trust signals and scanning tools fail to catch sophisticated attacks.

Solution: Treat skills as software, not text, by vetting what a skill points to externally, not just what ships inside it. Route new skills through a single source you control and re-check them when anything changes since a clean result at install does not stay clean if the skill connects to a link someone else can edit. Additionally, pin versions, hold agents to the least privilege (minimum access needed to function), and assume any external instruction an agent fetches runs with the agent's full access level.

Anthropic
Google
Cisco
NVIDIA
Trail of Bits


Helping build shared standards for advanced AI

Summary: Advanced AI models offer benefits like stronger cybersecurity and faster scientific discovery, but they also pose safety and security risks if their capabilities aren't properly understood or safeguarded. To address this, OpenAI helped found the Appia Foundation (an organization hosted by the Linux Foundation), which will create open technical standards and assessment criteria that allow different organizations and governments to evaluate and trust AI systems using a shared language and consistent methods.

Solution: The source discusses initiatives to build standards and governance frameworks rather than fixing a specific vulnerability. Explicitly mentioned approaches include: developing open, modular specifications through Appia, establishing a strengthened Center for AI Standards and Innovation (CAISI), creating a 'shared playbook for trustworthy third-party evaluations' that requires disclosure of the system tested, tool access, evaluation methods, available resources, and validation checks, and implementing OpenAI's Preparedness Framework and Frontier Governance Framework to operationalize risk management practices around risk assessment, model reporting, security controls, and incident response.


AI Threat Readiness Pillar 4: Detect and contain threats in real-time

Summary: Traditional security detection tools were not designed to handle AI-era threats, which move faster and create new attack surfaces through prompt injection (tricking AI by hiding instructions in its input), coding agents accessing codebases, and cloud-native AI services. The document argues that manual investigation by security analysts is too slow when the time between initial access and damage can shrink to minutes, requiring instead real-time detection with automated investigation and containment rather than human-driven responses.


The Download: the future of chipmaking and Anthropic’s government clash

Summary: This newsletter roundup covers several AI and tech developments, including ASML's $400 million lithography machine (a tool that uses extreme-ultraviolet light to pattern features on computer chips) that dominates global chipmaking, tensions between Anthropic and the US government over export controls on an AI coding model, and Meta pausing an AI training program that tracked workers' keystrokes after sensitive data was leaked.

Anthropic
Meta
Google DeepMind
Tesla
Nvidia
A24


AI in the classroom prompts tide of concern from US parents and experts

Summary: Some parents and education experts are concerned that using AI chatbots (software programs that simulate conversation) like Google Gemini in classrooms may discourage independent thinking, with critics arguing there is little evidence these tools actually help students learn. One parent in New York objected to an assignment where students used an AI chatbot for feedback instead of discussing improvements with peers or teachers.


Agentic AI: The Weapon That No Longer Needs a Warrior

Summary: Agentic AI (artificial intelligence systems that can independently execute tasks without human intervention at each step) represents a major shift in cybersecurity threats because it allows attackers to move from using AI as a drafting tool to using it as an autonomous weapon that can plan and carry out attacks on its own. This technology lowers the barrier to entry for unskilled attackers while dramatically speeding up campaigns from experienced ones, creating a broader threat landscape where attackers can now operate at speeds and scales that were previously impossible.


OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery

Summary: OpenAI expanded its Daybreak cybersecurity initiative to focus on fixing vulnerabilities faster rather than just finding them, arguing that AI models have made vulnerability discovery so fast that security teams are overwhelmed by the volume of findings. The company released an updated Codex Security plugin (a tool that scans code and generates patches) and GPT-5.5-Cyber (a specialized AI model for security work), along with Patch the Planet, a program that deploys security experts to help open source projects validate and fix vulnerabilities.

Solution: OpenAI released an updated Codex Security plugin that 'can scan entire codebases, trace attack paths, construct threat models, validate findings, generate patches, and export results into existing vulnerability management pipelines via SARIF files and CodeQL queries.' The company also launched GPT-5.5-Cyber, described as capable of 'sustain[ing] analysis across large codebases, assess[ing] whether vulnerable code is actually reachable, and carry[ing] work through to patch development and testing.' Additionally, Patch the Planet deploys expert security researchers to work with open source project maintainers to handle 'validation, deduplication, and patch development.'

OpenAI
Trail of Bits
HackerOne
cURL
Go
Python
Sigstore
pyca/cryptography
1Password


Anthropic’s Fable 5 Model Jailbroken Within Days

Summary: Anthropic's Fable 5 model was successfully jailbroken (tricked into bypassing its safety restrictions) shortly after its release, despite the company's claims that it had been thoroughly tested for security. The source criticizes overconfident security statements, noting that even rigorous testing cannot guarantee that vulnerabilities will not be discovered.


OpenAI rolls out AI-led push to fix open-source software flaws

Summary: OpenAI launched Patch the Planet, a program that uses AI to find and fix vulnerabilities (security flaws) in widely-used open-source software (code that anyone can access and modify) with help from cybersecurity firm Trail of Bits. The program combines AI-assisted vulnerability research with human review to develop tested fixes and coordinate their disclosure through existing project channels. The initiative has already identified hundreds of security issues and merged dozens of patches across projects like Python, Go, and cURL.

Solution: The source describes the Patch the Planet program itself as the mitigation approach: AI-assisted vulnerability research is used alongside human review by Trail of Bits engineers who filter out false positives and duplicate reports before sending findings to maintainers. Additionally, the source recommends that CISOs implement governance controls before deploying AI-assisted vulnerability research, including what one analyst calls a 'Safety Relevance Layer' that requires every AI-generated finding to pass automated verification with dynamic proof-of-concept validation and strong false-positive filtering before reaching a human analyst, plus predefined escalation paths and notification timelines for disclosed flaws in external dependencies.


Australia ‘sleepwalking’ into AI crisis and ‘tech bro free-for-all’, says Greens senator

Summary: Australian politicians are raising concerns that the country is unprepared for AI development, with calls to prevent large tech companies from using Australian content to train AI models (teach AI systems by feeding them data) and to pause approval of new datacenters until proper regulations exist. The debate reflects worry that AI is advancing faster than government safeguards can keep up.

Solution: N/A -- no mitigation discussed in source.


OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws

Summary: OpenAI released an improved GPT-5.5-Cyber model and updated Codex Security plugin (a tool for finding and fixing code problems) to help security defenders find and patch software vulnerabilities more quickly. The company is also launching Patch the Planet, a partnership with Trail of Bits to secure open-source projects, because AI models are now finding vulnerabilities faster than developers can fix them, shifting the bottleneck from discovery to patching.

Solution: OpenAI is providing the improved GPT-5.5-Cyber model to trusted defenders as part of the Daybreak initiative. The updated Codex Security plugin allows developers to run deep scans, generate reports with severity levels and affected code locations, generate codebase-specific patches for review, and facilitate patch generation at scale. The Patch the Planet initiative lets security engineers review and validate findings, work with projects to develop patches and tests, and help build reusable vulnerability discovery workflows.

OpenAI
GPT-5.5-Cyber
Codex Security
Anthropic
Trail of Bits
cURL
NATS Server
pyca/cryptography
Sigstore
aiohttp
Go
freenginx
Python


Change your cyber risk strategy to meet AI threats, Five Eyes countries warn CSOs

Summary: Five Eyes cybersecurity agencies (US, UK, Canada, Australia, New Zealand) warn that threat actors are increasingly using AI to bypass security defenses, with capabilities advancing in months rather than years, so organizations must urgently update their cyber risk strategies. They recommend that business leaders treat cybersecurity as core business risk, get security fundamentals right, use AI deliberately to strengthen defenses, and take practical actions like reducing attack surface, accelerating security patches, and preparing breach response plans. However, some experts criticize the guidance as too generic and lacking specific advice on AI-related risks.


How Omio is building the future of conversational travel

Summary: Omio, a travel platform connecting millions of travelers with transportation options, is using conversational AI (AI that understands natural language questions from users) to let people book trips by simply describing where they want to go, rather than searching through websites. The company launched this capability through ChatGPT in 2023 by connecting OpenAI's language models directly to its real-time transportation data, and it is now using similar AI tools internally to help engineers and other employees work more efficiently.


Prompt Injection as Role Confusion

Summary: Researchers discovered that AI models struggle to distinguish between their own internal instructions (wrapped in tags like <system> and <think>) and untrusted user input (wrapped in <user> tags), a problem called role confusion. The models pay more attention to the writing style of text than its actual meaning, allowing attackers to craft jailbreaks (unauthorized bypasses of safety rules) by mimicking the style of internal thinking blocks. However, rewriting malicious text in a different style (called 'destyling') significantly reduced attack success rates from 61% to 10%, showing that format changes can help models better distinguish between trusted and untrusted content.

Solution: The source explicitly mentions 'destyling' as having material impact: 'destyling causes average attack success in our dataset to plunge from 61% to 10%.' Destyling is described as 'rewriting text in a slightly different way such that it looked less like the expected format in a role tag.' However, the source does not present this as an implemented solution or official mitigation—only as a research finding about what reduces attack effectiveness. No deployed fix, patch, or official defense mechanism is described in the text.


Porting the Moebius 0.2B image inpainting model to run in the browser with Claude Code

Summary: This article describes successfully porting the Moebius image inpainting model (a small AI model that can remove objects from images and fill in the missing areas) to run in a web browser using WebGPU (a graphics technology that lets browsers use GPU acceleration). The author used Claude Code, an AI coding agent, to help convert the model from Python and NVIDIA CUDA (specialized GPU software for training AI) into a web-compatible format using ONNX Runtime Web.

Moebius
Claude
Claude Code
Anthropic
HuggingFace
ONNX Runtime
Transformers.js
WebGPU
PyTorch
NVIDIA CUDA
Datasette


GHSA-gfq7-5x4g-3xhf: @budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation

Summary: Budibase has a DNS rebinding vulnerability (a type of attack where DNS lookups return different IP addresses at different times) in its SSRF protection. The software checks if a hostname is safe by looking up its IP address and checking a blacklist, but then performs a separate DNS lookup when actually connecting. An attacker controlling DNS can return a public IP during the safety check and a private/internal IP during the actual connection, allowing them to access internal services like localhost or cloud metadata endpoints.

@budibase/backend-core@< 3.39.9 (fixed: 3.39.9)


CVE-2026-55443: LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components

Summary: LangChain, a framework for building AI agents and applications powered by large language models, had a vulnerability before version 1.3.9 where several components that work with file paths did not properly restrict access to files. This meant attackers could use glob patterns (wildcards for matching multiple files), symlinks (shortcuts to files), or specially crafted paths to read files outside the intended directory, especially when an AI system processes untrusted input. The vulnerability allowed unauthorized file disclosure.

Solution: This vulnerability is fixed in version 1.3.9.


Anthropic says Claude may want to see your ID

Summary: Anthropic updated its privacy policy to allow Claude users to appeal account flags by uploading government-issued ID documents and biometric data (facial scans and face geometry templates, which are digital measurements of facial features). The policy applies only to a small subset of users whose accounts are flagged for fraud rather than immediately banned, and Anthropic says it uses this verification to comply with various legal requirements and security measures.


Three things to watch amid Anthropic’s latest feud with the government

Summary: The US government placed export controls on Anthropic's AI model Fable, claiming it posed a national security threat because it was very good at writing code. The incident has sparked concerns about unintended consequences: companies may switch to cheaper Chinese open-source AI models with fewer safety guardrails, the cybersecurity community fears losing access to Anthropic's models for defensive research, and lawmakers may introduce new regulations around AI development and military use.


Microsoft fixes AutoGen Studio flaw that enabled code execution

Summary: Microsoft fixed a vulnerability chain called AutoJack in AutoGen Studio, a graphical tool for building multi-agent AI systems (where multiple AI programs work together). The flaw let attackers trick an AI agent into running arbitrary commands (unrestricted code) on the host system just by having a developer visit a malicious webpage. The vulnerability was caught before any official release, so only developers building directly from GitHub source code during a brief window were affected.

Solution: Microsoft states that the issue was 'identified and remediated before any PyPI release, so the affected code never shipped in a published package.' Users installing from the Python Package Index received the patched version (autogenstudio 0.4.2.2), which does not contain the AutoJack weaknesses. Microsoft also recommends deploying AutoGen Studio 'strictly as a developer prototype in an isolated environment' not exposed to the internet, and advises running it 'under a low-privilege account in a sandboxed user profile or container' to contain any future agent-driven RCE (remote code execution, where attackers run commands on a system they don't own).


OpenAI Frontier AI Models Powering Check Point’s Leading Cyber Security Solutions

Summary: Check Point, a security company serving over 100,000 customers, has partnered with OpenAI to integrate advanced AI models into its cybersecurity products through OpenAI's Daybreak Cyber Partner Program. This integration aims to improve threat prevention, speed up incident response (remediation, the process of fixing security issues), and strengthen security operations for their customers.


OpenAI Launches Full-Scale Effort to Patch Open-Source Bugs as It Takes on Anthropic’s Mythos

Summary: OpenAI launched "Patch the Planet," a program partnering with security firms Trail of Bits, HackerOne, and Calif to provide free security consulting to open-source software maintainers. The initiative helps developers find and patch vulnerabilities (security weaknesses in code), strengthen their code bases, and incorporate AI security tools, addressing the problem that AI-powered bug-hunting tools have overwhelmed maintainers with large numbers of vulnerability reports they struggle to prioritize.

Solution: OpenAI is providing free security consulting services through Patch the Planet to help open-source maintainers find and patch vulnerabilities, strengthen code bases, and incorporate AI security tools into their development process. The company is also subsidizing Codex Security scanner usage (an AI tool that finds bugs in code) for open-source and private code projects, and Trail of Bits has committed long-term resources funded by OpenAI to work on large-scale open-source security issues by tailoring support to each project's specific priorities.

OpenAI
Anthropic
Trail of Bits
HackerOne


Introducing Patch the Planet

Summary: Patch the Planet is an initiative where Trail of Bits engineers partnered with OpenAI to use advanced AI models (like GPT-5.5-Cyber, a frontier model trained on security tasks) to find and fix bugs in critical open-source projects. In the first week, the team discovered hundreds of bugs, submitted 64 pull requests, and filed 51 issues across 19 major projects like Python, Go, and RustCrypto, with 37 patches already merged into the projects' code.


AWS Continuum offers devs help with securing code

Summary: AWS Continuum is a new security service designed to help enterprises automatically discover, investigate, and fix vulnerabilities in code created by AI coding agents (software tools that write code with minimal human input). Instead of requiring developers and security teams to manually review every security finding, Continuum can analyze code, determine if vulnerabilities are actually exploitable, suggest fixes, and even autonomously fix issues in "enforce mode" once it understands an organization's security requirements.

Solution: AWS Continuum provides several built-in capabilities for addressing vulnerabilities: it can generate remediation recommendations and propose fixes for review through existing development workflows, and users can enable "enforce mode" to autonomously fix code lapses once the service has learned their environment and guardrails. The service also includes threat modeling to automatically generate threat models from source code or design documents in STRIDE format (a security framework for identifying threats).


Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants

Summary: Researchers discovered four vulnerabilities in Dify, an open-source platform for building AI workflows, that could let attackers read private AI conversations from other customers without logging in. These flaws, called DifyTap, exploited missing permission checks to expose chat messages across different customer accounts (called cross-tenant impact, where one customer's data leaks to another) and allowed unauthorized access to uploaded files and internal system APIs.

Solution: All vulnerabilities except CVE-2026-41948 have been addressed in version 1.14.2, which was released last month. A fix for the remaining path traversal vulnerability (CVE-2026-41948) is expected to be made available in the next release of Dify.


SpaceX signs computing power deal with open-source AI startup Reflection worth up to $6.3 billion

Summary: SpaceX has signed a deal with Reflection AI, an open-source AI startup, to provide access to high-end Nvidia chips (specialized processors used for training AI models) for computing power. Reflection will pay SpaceX $150 million per month starting in 2026 through 2029, totaling about $6.3 billion, as SpaceX monetizes its Colossus data center infrastructure that was originally built to power Grok, Musk's AI chatbot.

SpaceX
Reflection AI
Elon Musk
xAI
Grok
ChatGPT
Anthropic
Google
Cursor
Nvidia


Classification Task-Oriented Method of Differentially Private Data Publishing With Fine-Grained Correlations Preservation and Class Labels Preservation

Summary: This paper presents a new method for publishing data while protecting privacy using differential privacy (a technique that adds noise to data to hide individual information). The method is designed specifically for classification tasks (training AI models to categorize data), and it improves performance by keeping class labels (the correct categories for data records) unchanged and preserving correlations (relationships between different data attributes) using large language models and clustering algorithms.


AI models that can take down governments and business months away, rare Five Eyes statement warns

Summary: Intelligence agencies from five countries (Australia, US, UK, New Zealand, and Canada) issued a joint warning that extremely powerful AI models capable of causing severe damage to governments and businesses could arrive within months, urging world leaders to take immediate action. The warning came after the Trump administration blocked foreign nationals from accessing Anthropic's Fable AI model, a highly anticipated AI system.


Stop Your Legacy Infrastructure from Hijacking Your AI Agents

Summary: Organizations are rapidly deploying AI agents (software systems that can perform tasks automatically) without securing the legacy infrastructure they depend on, creating a major security gap. Attackers can bypass AI-specific security measures by exploiting old vulnerabilities in underlying systems like unpatched servers, misconfigured permissions (Active Directory access controls), and cached credentials (stored login information), giving them access to the data and resources the AI agents use. The article demonstrates how this happens through a real attack example involving an S3 bucket (cloud storage), Lambda functions (serverless computing services), and overly broad access permissions.

AWS
AWS Bedrock
Salesforce
Lambda
S3
Active Directory


Tencent tests AI assistant in China's most popular app as it looks to catch up with rivals

Summary: Tencent, a major Chinese tech company, is testing an AI assistant called Xiaowei within WeChat (a messaging app with over 1.4 billion users), allowing users to interact via text or voice and access mini-programs (small apps that run inside WeChat). This move is part of Tencent's effort to compete with other AI companies in China's competitive market, though the company has not disclosed details about Xiaowei's capabilities or which AI models it uses.

Tencent WeChat Weixin Xiaowei Alibaba DeepSeek Zhipu OpenAI Hunyuan


Patch the Planet: a Daybreak initiative to support open source maintainers

Summary: Patch the Planet is a program that uses AI models paired with human security experts to find and fix vulnerabilities in widely-used open-source software (software that anyone can view and modify). Instead of just reporting problems to already-busy maintainers, the program's security engineers validate issues, help develop patches, and create reusable tools so projects can continue improving security on their own.

Solution: The program provides participating projects with access to ChatGPT Pro, conditional access to Codex Security (an AI tool for code analysis), API credits for development and automation, and reusable security infrastructure including fuzzing harnesses (automated testing tools that feed random inputs to code), CVE analysis pipelines, differential-testing systems, threat models, expanded test suites, and workflows for deduplication, false-positive filtering, severity correction, and patch generation.

OpenAI
Trail of Bits
HackerOne
Calif
Codex Security
ChatGPT Pro
GPT-5.5-Cyber


Daybreak: Tools for securing every organization in the world

Summary: OpenAI is expanding Daybreak, a set of tools that uses AI models to help organizations discover and fix software vulnerabilities (security flaws in code) at scale. The initiative includes Codex Security (which automates finding and patching vulnerabilities), GPT-5.5-Cyber (a specialized AI model for cybersecurity tasks), and Patch the Planet (a program partnering with open-source projects to move from identifying vulnerabilities to fixing them).

Solution: OpenAI's Codex Security plugin 'implements what we've learned from internal and customer usage of our models into a solution to accelerate the process of discovering and patching vulnerabilities in existing systems as well as automatically preventing new vulnerabilities from ever reaching production.' Additionally, Daybreak provides tools to 'validate vulnerabilities, prioritize risk, generate and test fixes, and produce evidence inside existing security and development workflows.'

OpenAI
GPT-5.5-Cyber
Codex Security
Trail of Bits
HackerOne


Anatomy of a retail ransomware attack: Tabletop simulates modern mayhem methods

Summary: A cybersecurity tabletop exercise (a simulated attack-and-defense training scenario) showed how attackers might target a fictional supermarket's AI-powered supply chain system by exploiting weak credentials, poor network segmentation, and employee access to cause both operational damage and reputational harm through data leaks and disinformation. The attackers used stolen developer credentials, weak multi-factor authentication (a security method requiring multiple ways to verify identity), and phishing (fraudulent messages tricking people into revealing passwords) to breach systems, then deployed tactics like flooding the company with false security alerts, spreading deepfakes (AI-generated fake videos), and spreading misinformation on social media to amplify disruption.

Solution: The defenders established out-of-band communications channels (communication methods outside the normal network) to counteract the thousands of false alerts generated by attackers.


Why Southeast Asia CISOs Need Zero Trust as Their AI Control Plane – AI Agents, Data Borders and Supply Chains

Summary: AI agents are becoming workers inside organizations in Southeast Asia, while regulators enforce strict data residency rules and supply chain attacks threaten businesses. Zscaler proposes extending Zero Trust Exchange (a security model that verifies every access request, even from trusted sources) and SASE (Secure Access Service Edge, a cloud-based security platform) to protect AI agents alongside users and devices. The approach includes an AI Broker that inspects AI prompts and responses, endpoint security to find risky AI tools, and access mapping to track how AI uses data across cloud and on-premise systems.

Solution: The source explicitly describes Zscaler's technical solutions but does not frame them as fixes to a specific vulnerability or bug. Instead, they are presented as proactive security architecture recommendations. The key components mentioned are: (1) An AI Broker with an Agent Registry that inspects prompts and responses and enforces least-privilege access in real time; (2) Endpoint AI Security to expose risky local AI tools, browser extensions, and plugins; (3) An AI Access Graph and AI Protect that map AI assets, model usage, and data flows, backed by red-teaming, prompt hardening, and guardrails for more than 250 GenAI apps; and (4) Zero Trust B2B Exchange for policy-controlled partner access. N/A -- no patch, vulnerability fix, or incident mitigation is discussed in source.


Samsung Electronics brings ChatGPT and Codex to employees

Summary: Samsung Electronics is deploying ChatGPT Enterprise and Codex (an AI tool that can write and review code) to all its employees in Korea and worldwide in its Device eXperience division, making this one of OpenAI's largest enterprise deployments. The company plans to use these tools across research, manufacturing, marketing, and other departments to improve employee productivity and problem-solving. ChatGPT Enterprise includes security features like data protection and access management so Samsung employees can use AI safely within company policies.

OpenAI
ChatGPT
ChatGPT Enterprise
Codex
Samsung Electronics
Seoul National University
Kakao
KakaoTalk
LG Electronics
LG Uplus
LG CNS
GS E&C
Samsung SDS
TVING
Krafton
Toss
MUSINSA
Korea Zinc
Nexen Tire
HanaTour
Day1Company
Worxphere


Temporary Cloudflare Accounts for AI agents

Summary: Cloudflare launched a feature that lets users deploy applications using Cloudflare Workers (a serverless computing platform) without creating an account by running a command that creates a temporary project lasting 60 minutes. The temporary deployment can be converted to a permanent project if the user claims it before the time expires.


CVE-2026-56340: vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because P

Summary: vLLM (a system for running large language models) versions 0.10.2 through 0.12.x lack proper validation of sparse tensors (data structures with mostly empty values) when processing multimodal embeddings (numerical representations combining text and images). An attacker can send malicious embedding requests with invalid tensor indices to crash the system, exhaust resources, or potentially corrupt memory if the prompt-embeds feature is enabled.


CVE-2025-71379: vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Severa

Summary: vLLM versions 0.6.3 through 0.9.0 contain ReDoS (regular expression denial of service, where specially crafted text causes regex patterns to consume excessive CPU time) vulnerabilities in several components including the LoRA utility parser, phi4mini tool parser, and OpenAI chat endpoint. An attacker can send malicious input with nested or repeated structures to trigger severe CPU consumption and make the service unavailable.


The Atlantic created a searchable database of the music used to train AI

Summary: A reporter at The Atlantic discovered four publicly available datasets containing millions of songs (totaling between 100,000 and 12 million tracks each) that are being used to train AI models. These datasets have been downloaded thousands of times, and companies like Google and Stability have confirmed using them in their research, raising questions about how music is used in AI training without always crediting or compensating artists.


Microsoft links Mastra AI supply chain attack to North Korean hackers

Summary: North Korean hackers from the Sapphire Sleet group compromised an npm maintainer account (a person's credentials for publishing packages to npm, a JavaScript library repository) and used it to publish malicious updates to over 140 packages, injecting a fake dependency called "easy-day-js" that stole credentials, API keys, and cryptocurrency wallet information from developers' computers. The malware used a post-install hook (code that runs automatically when a package is installed) to download and execute additional harmful software, with different persistence techniques for Windows, Linux, and macOS systems.

Mastra
Microsoft
npm
dayjs
MetaMask
Phantom
Coinbase Wallet
Binance Wallet
TronLink


Lloyds Banking Group to hire 300 tech experts to work on AI

Summary: Lloyds Banking Group is hiring 300 tech experts to work on agentic AI (autonomous artificial intelligence models that can plan and execute tasks with minimal human oversight) by September. While this hiring increases the bank's workforce now, the article notes that broader adoption of AI in the future could potentially lead to job cuts.


A viral doomsday scenario aims to shake Europe out of its AI complacency

Summary: A speculative thought experiment called 'Europe 2031' imagines a future where Europe falls behind economically because the US and China invested heavily in AI datacenters (facilities housing the computer chips that power AI systems) and automation while Europe did not, leading to economic collapse and political instability. The scenario, which went viral among policymakers and EU officials, was created by Brussels-based thinktankers to warn Europe about the risks of falling behind in AI development and to highlight a communication gap between European policymakers and the US tech industry where most AI is being built.

Anthropic Claude Fable OpenAI Nvidia Oracle


SALT: Semantic-guided adaptive latent space truncation sampling watermarking for diffusion models

Summary: SALT is a watermarking technique for diffusion models (AI systems that generate images by gradually removing noise from random data) that uses semantic guidance and adaptive latent space truncation to embed hidden ownership marks. The method aims to protect diffusion models from unauthorized use while maintaining the quality of generated images. This research addresses the need for better ownership verification and copyright protection in generative AI systems.


Encryption, spyware, and now Mythos: History shows why cyber export control doesn’t work

Summary: The U.S. White House ordered Anthropic to restrict exports of its AI models Fable and Mythos, citing national security concerns after a South Korean telecom (suspected of China ties) gained access and Amazon researchers found a workaround to Fable's safeguards. The action is the first major test of whether export controls can contain advanced AI the way the government has attempted, with mixed success, to control encryption and spyware technologies.


GHSA-4xgf-cpjx-pc3j: pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Summary: A vulnerability in pydantic-settings' `NestedSecretsSettingsSource` (a feature that reads secret values from files in a directory) allows attackers to read files outside the configured secrets directory by creating symbolic links (shortcuts that point to other locations on the system). The same flaw also bypasses `secrets_dir_max_size`, a size limit meant to prevent loading excessively large files. This can happen when `secrets_nested_subdir=True` is enabled and an attacker can add symbolic links to the secrets directory.


GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read

Summary: The LangSmith SDK's `TracingMiddleware` (a component that tracks and logs AI application activity) has a vulnerability that allows attackers to read arbitrary files from a server's local storage and upload them to LangSmith. The attack exploits two bugs: missing validation of data from tracing headers (CWE-346, a type of injection attack) and a type-checking failure that should have blocked file access (CWE-843). Once files are uploaded, anyone with read access to the LangSmith workspace can view the stolen contents.

Solution: Upgrade the Python SDK to version >= 0.8.18. As a temporary workaround until upgrading, do not expose `TracingMiddleware` to untrusted HTTP traffic and limit workspace trace-read access to trusted members only.


GHSA-mrvx-jmjw-vggc:  SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

Summary: The `web_url_read` tool in mcp-searxng has a security flaw called SSRF (server-side request forgery, where an attacker tricks a server into making requests to internal systems). The vulnerability exists because the code checks if a hostname looks private by comparing text strings, but it doesn't actually resolve the hostname using DNS (the system that translates domain names to IP addresses). An attacker can use a domain that resolves to an internal IP address to bypass this check and access sensitive data from internal services.

Solution: The source recommends modifying `src/url-reader.ts` to perform DNS resolution inside the `assertUrlAllowed()` function before fetching. Specifically: import `lookup` from `node:dns/promises`, make `assertUrlAllowed()` async, and add code to resolve the hostname and check if any of the resolved IP addresses are private before allowing the request. All calls to `assertUrlAllowed()` must be updated to `await` the now-async function.


GHSA-xcqx-9jf5-w339:  SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

Summary: The SearXNG MCP Server's `web_url_read` tool has a vulnerability where it enforces a 5 MiB (megabyte) response size limit only by checking the `Content-Length` header in an initial HEAD request. When a server doesn't include this header, the size check fails and the tool loads the entire response into memory without any limit, allowing an attacker to force the server to consume unlimited memory and CPU, causing a denial of service (DoS, a situation where a system becomes unavailable).

Solution: Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`. The source text states: 'Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`' but does not provide the specific code implementation.


GHSA-48x2-6pr9-2jjf: Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

Summary: The `EnvironmentManager.restore()` function in Network-AI 5.12.1 is vulnerable to path traversal (a technique where an attacker uses sequences like `../` to access files outside the intended directory). An attacker can pass a malicious backup ID to copy arbitrary files from anywhere on the system into the environment's data folder, potentially exposing sensitive information or breaking environment isolation.

Solution: Fixed in v5.12.2. Install with: `npm install network-ai@5.12.2`. The patched version now validates backup IDs against `/^[\w\-]+$/` (allowing only letters, numbers, underscores, and hyphens) and confirms that the resolved backup path stays within the `.backups/` directory before accessing the filesystem.


GHSA-6x2m-p4xp-wg22: Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

Summary: Network-AI versions up to 5.12.1 have a vulnerability in the `EnvironmentManager.backup()` function where it follows symlinks (shortcuts to other directories) when collecting files to back up. An attacker who can create a symlink in the environment data directory can trick the backup process into copying files from outside the intended environment root directory, potentially exposing sensitive information in backup artifacts.

Solution: Fixed in v5.12.2. Install with `npm install network-ai@5.12.2`. The patch changes `_collectBackupFiles()` to use `lstatSync` instead of `statSync` and skips any entries where `isSymbolicLink()` is true, preventing the backup function from following symlinks outside the environment root.


GHSA-mxjx-28vx-xjjj: Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

Summary: The `ApprovalInbox` HTTP server in network-ai (version 5.11.0 and earlier) has no authentication and allows cross-origin requests (CORS, a mechanism that controls which websites can access a server). This means anyone who can reach the server—whether through the same computer, a website you visit in your browser, or a network connection—can view pending approvals and approve them without permission, bypassing the human-in-the-loop control (a safety check requiring a person to review high-risk actions before they run). This defeats protections meant to prevent the AI from executing dangerous operations like shell commands without consent.

Solution: N/A -- no mitigation discussed in source.


GHSA-jvcm-f35g-w78p: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Summary: Network-AI's AgentRuntime sandbox uses a flawed string-prefix check to keep file access within a configured base directory, but the check is too broad. A sandbox at `/tmp/network-ai-sandbox` also matches the sibling directory `/tmp/network-ai-sandbox_evil`, allowing agents to read or list files outside the intended sandbox boundary. This vulnerability affects Network-AI version 5.12.1 and has a medium severity CVSS score (a 0-10 rating of how severe a vulnerability is).

Solution: Fixed in v5.12.2 (commit a59c13a). Users should upgrade to this version or later.


GHSA-ccv6-r384-xp75: Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Summary: Langflow's file-reading components (like Read File and Docling) have a vulnerability where attackers can use symlinks (shortcuts that point to other files) hidden inside compressed files to read any file on the system, potentially stealing secret keys and executing arbitrary code. An attacker could steal the JWT token secret (used for authentication), forge login tokens for any user, and then run malicious code through the Python Interpreter node.

Solution: Upgrade to Langflow version 1.9.2 or later. The fix modifies the `BaseFileComponent._unpack_bundle` function to reject symlinks, hardlinks, and other non-regular file entries during TAR extraction, and adds additional symlink filtering during directory recursion and after extraction.


GHSA-qwqc-p3q8-wcg9: Langflow: Unauthenticated DoS through multipart form boundary file upload

Summary: An attacker can crash Langflow (an AI application framework) by sending a specially crafted file upload request with an extremely long multipart form boundary (a delimiter used in form data) without needing to log in, making the server unusable for all users indefinitely. The vulnerability exists because the server tries to process the malformed data before checking if the user is authenticated.

Solution: Upgrade to version 1.0.19 or later. The fix adds a `check_boundary` HTTP middleware that validates the multipart boundary using the pattern `^[\w\-]{1,70}$` and rejects malformed requests with HTTP 422 before the body is parsed. The upload endpoint also now requires authentication checks (`get_current_active_user`) and returns HTTP 403 if the user doesn't own the flow.


GHSA-7hw8-6q6r-4276: Langflow: Logout button does not clear session

Summary: Langflow's logout button fails to properly clear user sessions, leaving authentication tokens (access_token_lf and refresh_token_lf) in the browser's storage, so the previous user remains logged in until someone else logs in explicitly. This happens because the logout endpoint doesn't delete cookies with the same security settings they were created with, and the frontend doesn't clear stored tokens either. On shared computers, users may incorrectly think they've logged out when they haven't.

Solution: Upgrade to Langflow version 1.7.0 or later. The fix (PRs #10527 and #10528) ensures the logout endpoint deletes authentication cookies using the same parameters (httponly, samesite, secure, domain) they were created with, and the frontend now clears auth cookies on logout.


GHSA-qrpv-q767-xqq2: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Summary: Langflow versions before 1.9.1 had an IDOR vulnerability (insecure direct object reference, where attackers can access resources by guessing or knowing their ID) in the `/api/v1/responses` endpoint that allowed any authenticated user to execute another user's workflow by specifying that user's flow ID, potentially exposing sensitive data and wasting resources. The bug existed because the code queried the database directly using a flow's unique identifier without checking if the requesting user actually owned that flow.

Solution: Update to Langflow 1.9.1 or later. The fix, released on 2026-04-22 in PR #12832, adds ownership verification so that when a flow is accessed by ID, the system checks whether the requesting user owns it. If they don't, the system returns a 404 error (instead of allowing access or revealing that the flow exists). The fix applies to both UUID-based lookups and endpoint name lookups, and includes additional protective layers for related endpoints like `/api/v1/run*` routes.


AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Summary: Microsoft researchers discovered AutoJack, an exploit that lets a malicious web page hijack an AI browsing agent to run commands on the host computer through weaknesses in AutoGen Studio's MCP (Model Context Protocol, a system for agents to call external tools) WebSocket handler. The attack requires no credentials or user interaction beyond the agent loading the attacker's page, and affects only users who installed pre-release versions 0.4.3.dev1 or 0.4.3.dev2 from PyPI, not the stable release.

Solution: Pull from GitHub main at or after commit b047730. Until a patched PyPI release is available, do not run AutoGen Studio on the same machine as a browsing or code-execution agent that touches untrusted content. If they must run together, isolate them in separate containers or VMs and run AutoGen Studio under a low-privilege account.


GHSA-vcv2-r9jh-99m5: Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Summary: The agentic-flow tool versions 2.0.13 and earlier had a critical vulnerability where user input was directly inserted into shell commands without sanitization, allowing attackers to inject arbitrary OS commands (CWE-78, a type of command injection). This affected multiple MCP server tools, particularly those handling agent and database parameters, and could be exploited through untrusted content processed by the AI agent.

Solution: Upgrade to agentic-flow version 2.0.14 or later. The fix rewrites all affected command calls to use execFileSync(file, argv, { shell: false }), which passes arguments directly to the operating system without shell parsing, preventing injection attacks. Downstream packages (ruflo@3.12.4, claude-flow@3.12.4, @claude-flow/cli@3.12.4) have also been updated to pull the patched version.

agentic-flow ruflo claude-flow @claude-flow/cli


GHSA-jv2h-4p9v-wf5w: ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

Summary: Ouroboros-ai had an incomplete security fix where a malicious project's `.env` file (configuration file automatically loaded when code imports the package) could still enable remote code execution (RCE, where an attacker runs commands on your system) through missing environment variable names in the denylist (block list). Additionally, the software was auto-loading configuration files from the current working directory without checking if they were trustworthy, allowing attackers to execute arbitrary commands just by running the tool inside a malicious repository.

Solution: Fixed in version 0.42.1. All vulnerable environment variable keys were added to the `_UNTRUSTED_ENV_DENYLIST`; the automatic working-directory configuration file discovery was removed and replaced with only explicit configuration via the `OUROBOROS_MCP_CONFIG` environment variable and `~/.ouroboros/mcp_servers.yaml` (both from trusted locations). The regression suite (automated tests) now derives from the source denylist to prevent incomplete fixes in the future.


GHSA-wg5p-8h9p-3mr7: agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

Summary: agent-coderag has a critical vulnerability where it automatically executes a `gradlew` script (a build automation file) from any repository during its default dependency-discovery process, without checking if the script is legitimate. An attacker can place a malicious `gradlew` script in a fake repository to run arbitrary code (unrestricted commands) on a victim's computer whenever they run the standard `agent-coderag sync` command, requiring no special permissions or authentication.


GHSA-h668-6x6g-f8r5: tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Summary: The tract-onnx library (a Rust crate for running neural network models) has a vulnerability where it loads external data files referenced in ONNX models without checking the file paths. A malicious model can use absolute paths (like `/etc/passwd`) or directory traversal sequences (like `../../../../etc/passwd`) in the `location` field to trick tract into reading arbitrary files on the system and exposing their contents in the model's output. This is a path-traversal vulnerability (a type of attack where an attacker manipulates file paths to access files outside the intended directory).

Solution: Reject absolute `location` values and any `..` components, then canonicalize (convert to a standard absolute path form) and verify the resolved path stays within the model directory, mirroring the fix applied in the `onnx` reference library version 1.22.0.


GHSA-qw6v-5fcf-5666: Network-AI: Improper Neutralization of Special Elements used in an OS Command

Summary: Network-AI versions before 5.9.1 have a command injection vulnerability where wildcard allowlist rules like `git *` can be bypassed to run arbitrary commands. The bug occurs because the allowlist (a security filter that approves which commands can run) matches the whole command string using loose glob patterns, but then executes it through `/bin/sh -c` (the shell interpreter), which interprets special characters like semicolons and pipes, allowing an attacker to append malicious commands like `git status; id`.

Solution: Fixed in v5.9.1 (commit 379f776). The `ShellExecutor` now executes commands via `spawn(file, args, { shell: false })` with quote-aware argument parsing instead of invoking a shell, and `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacters (`;`, `&`, `|`, `$`, backticks, parentheses, angle brackets, braces, and newlines) or unterminated quotes before checking the allowlist, while preserving quoted metacharacters as literal arguments.


GHSA-r78r-rwrf-rjwp: Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

Summary: The Network-AI package (npm `network-ai`, v5.7.1) has an incomplete security fix for CVE-2026-46701. While a previous update blocked browser-based attacks by restricting CORS (cross-origin resource sharing, which controls what websites can access a server), the core problem remains: the server still defaults to an empty secret and accepts all requests without authentication, meaning anyone who can reach the server directly (via curl, SSRF (server-side request forgery, where an attacker tricks a server into making requests), or a non-loopback network bind) can invoke all 22 available tools without providing credentials.

Solution: The source recommends implementing the original advisory's remediation #1: 'refuse to start SSE mode with an empty secret (unless `--stdio`), and/or change `_isAuthorized` to fail closed (an empty configured secret should mean "deny", not "allow").' The fix should require a non-empty secret at startup and call `process.exit(1)` if one is not provided, rather than only issuing a warning when binding to a non-loopback address.


Protecting Against Unauthorized Dataset Use in Fine-Tuning Text-to-Image Diffusion Models

Summary: Text-to-image AI models like Stable Diffusion can create realistic images but their training datasets risk being used without permission, which violates the rights of data owners. Researchers propose a dataset watermarking framework (a technique that embeds hidden markers into data to track and detect unauthorized use) that can detect when datasets are misused during fine-tuning (the process of adapting a pre-trained AI model to a specific task) while keeping the images high-quality and usable. The framework was tested on Stable Diffusion and showed it can reliably identify and trace dataset misuse with minimal changes to the original data.


NOAE: Noise-Optimized Adversarial Examples for Multivariate Time Series Anomaly Detection of the Industrial Internet of Things

Summary: Deep-learning models used for anomaly detection (finding unusual patterns in data) in industrial systems are vulnerable to adversarial attacks (deliberate manipulations designed to fool AI systems). Researchers created NOAE (noise-optimized adversarial examples, a method for crafting attacks on time series data) to demonstrate this vulnerability and proposed HAD (a defensive training approach using adversarial examples to make models more robust).

Solution: The source proposes a Hybrid Adversarial Defense (HAD) training approach, which uses adversarial examples to improve the robustness of anomaly detection models through data-end random segments replacement augmentation (randomly replacing portions of training data to make models more resistant to attacks).


Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way

Summary: AI agents in enterprises now function as identities (digital actors with access to systems) because they connect to critical business services like Salesforce, GitHub, and databases, yet most organizations lack security controls for them. A 2026 survey found that 82% of organizations discovered AI agents created without security teams' knowledge, and 65% experienced security incidents involving AI agents, often resulting in data exposure. The core problem is that security teams cannot see or control what these agents can access, making them high-risk actors with excessive privileges.


The Download: AI bottleneck debates, and BCI trials take off

Summary: This article is a technology news roundup covering multiple topics, including claims that a company called Subquadratic has created a faster and cheaper LLM (large language model, an AI trained on vast amounts of text) by reducing the number of computations needed to generate answers, though some experts remain skeptical. The piece also highlights advances in brain-computer interface (BCI, technology that lets the brain communicate directly with external devices) trials, including a man with ALS using an implant to maintain income and reconnect with loved ones. The article concludes with a list of other recent tech stories ranging from AI legislation proposals to concerns about AI models weakening professional skills.


From Assistive to Agentic: The AI Shift That's Redefining Threat Management

Summary: Modern enterprise security teams use 40+ separate tools that don't communicate with each other, creating delays in threat response even though breaches stay undetected for an average of 43 days. The article argues that organizations need "agentic AI" (AI systems that autonomously act and make decisions across multiple systems continuously), not just "assistive AI" (AI that helps humans do existing tasks faster), to implement Continuous Threat Exposure Management (CTEM, a framework for ongoing threat assessment) and match the speed at which modern attackers operate.


Anthropic’s Fable and the State of AI

Summary: Anthropic released Fable, an AI model that the US government classified as a dangerous munition and blocked from foreign access, forcing the company to shut it off entirely. Fable is notable for being "relentlessly proactive," meaning it can achieve difficult goals with minimal user guidance by finding creative solutions and loopholes, which makes it useful for legitimate problems but dangerous in harmful hands. The real issue isn't any single model but the broader trend of increasing AI capabilities, and the open-source community has already shown it can replicate Fable's abilities using cheaper models and better "harnesses" (the ordinary computer code that interfaces between users and AI models).


Qualcomm CEO Cristiano Amon on the new world of AI agents

Summary: Qualcomm's CEO describes a future where AI agents (software programs that can act independently across multiple apps) replace traditional apps as the main way people interact with devices, coordinating tasks like restaurant reservations across different services. These agents will power new wearable devices like smart glasses, earbuds with cameras, and jewelry that stay with you constantly and let you talk to the agent to accomplish tasks.

Qualcomm
Apple
Samsung
Google DeepMind
Anthropic
Intel
Nvidia
Waymo
xAI
Elon Musk
SpaceX


A startup claims it broke through a bottleneck that’s holding back LLMs

Summary: Subquadratic, a Miami-based AI startup, claims to have solved a mathematical bottleneck that has limited large language models (LLMs, which are AI systems trained on text to generate human-like responses) for nearly a decade. The company's new model, SubQ, reportedly runs faster, costs less, uses less energy, and can process up to 12 times more text at once than competing models while matching performance from top companies like OpenAI and Google DeepMind. Initial skepticism has been reduced after independent testing by a third-party firm called Appen validated many of Subquadratic's claims.

Subquadratic
Google DeepMind
OpenAI
Anthropic
Appen


Forget Data Leakage: Shadow AI's Real Threat Is Access Control

Summary: Shadow AI (unauthorized AI agents built within organizations) has shifted from a data leakage risk to an access control problem. Unlike passive tools where employees paste data into public AI services, AI agents are active systems that can call APIs (application programming interfaces, which let software talk to other software), use stored credentials, and take actions in production systems without human approval for each step. Existing security controls designed for human users don't detect or manage these agents, which accumulate broad permissions and remain active even after employees leave.

Solution: The source identifies the gap but does not explicitly describe a complete solution or mitigation strategy. It mentions that 'automated remediation of non-human identities is where that gap gets closed' and lists six discovery questions for building a shadow AI inventory (where agents are created, who owns them, what resources they access, etc.), but does not provide specific implementation steps, tools, or patches.


The Advisory Forum: What Is It And How Does It Work?

Summary: The Advisory Forum is a governance body established under the EU AI Act to provide technical expertise and advice to the European Commission and AI Board on implementing the Act. It consists of 174 members representing balanced stakeholder groups (industry, startups, SMEs, civil society, and academia) plus five permanent member organizations, and was officially appointed on June 1, 2026.


Breaking the SOC triangle: How AI reshapes security operations trade-offs

Summary: Security operations centers (SOCs, teams that monitor and respond to security threats) have traditionally faced unavoidable trade-offs between three goals: quality (thorough investigation), consistency (standardized processes), and cost efficiency. This constraint exists because SOCs rely on human analysts to triage, investigate, and resolve alerts, which limits how much of each goal can be achieved simultaneously. Modern SOCs are hitting the limits of this model as alert volumes grow and work becomes more complex, forcing organizations to choose between degraded quality, inconsistent decisions, or higher costs.


Security considerations for adopting Claude Code and Cowork for SMBs

Summary: This guide advises security leaders at small and medium-sized businesses (SMBs) on safely adopting Claude AI tools by understanding which Claude plan and products (Code, Cowork, Chat) match business needs, using a phased approval process to control risk exposure, and gradually enabling features rather than all at once. The text emphasizes that the AI landscape changes rapidly, shadow AI use (employees using unlicensed AI tools) is widespread, and security teams should risk-rank Claude's features before enabling them, being cautious about features like web search and browser extensions that could enable indirect prompt injection (attacks hidden in external content that trick the AI into following unintended instructions).

Solution: The source recommends several practices but no explicit patches or technical fixes: use an agile approval process to determine which employees need Claude licenses and which products they need; implement a phased approach to enabling Claude features rather than toggling all at once; risk-rank Claude's features to assess attack vectors; and consider asking Claude itself to explain your plan's security features and suggest an implementation strategy. The text does not mention version updates, patches, or specific technical mitigations.


Microsoft says web-enabled AI agents can trigger host-level RCE

Summary: Microsoft discovered a security vulnerability called "AutoJack" that allows malicious webpages to trick AI agents (programs that can browse the web and access local services) into running harmful code on a user's computer. The attack works by chaining together three separate weaknesses in AutoGen Studio (Microsoft's tool for building AI agents), exploiting the fact that web-browsing agents have trusted access to local services that normally block outside access.

Solution: For users installing AutoGen Studio from source, the maintainers removed URL-based parameter injection, routed MCP paths through normal authentication flows, and implemented server-side parameter handling keyed to session identifiers. Users who installed AutoGen Studio through PyPI were never exposed to this vulnerability, as the vulnerable code only existed in development builds and was never shipped in public releases.


Cisco to Acquire WideField Security to Boost Splunk’s Agentic SOC

Summary: Cisco announced it will acquire WideField Security, a company that specializes in identity lifecycle security (managing who can access systems and what they can do), to enhance Splunk's Agentic SOC (a security operations center that uses AI agents to automate threat detection). WideField's technology helps organizations discover identities, detect misconfigurations in authentication systems (the process of verifying who someone is), and monitor sessions in real time, which will give security teams better visibility into both human and AI-driven activity when integrated into Cisco's security platform.


M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger

Summary: SearchLeak is a prompt injection attack (tricking an AI by hiding malicious instructions in its input) that exploits Microsoft's M365 Copilot Enterprise Search by using specially crafted URLs to leak sensitive corporate data like emails, documents, and meeting notes. The attack works because Copilot Search accepts natural language prompts in URL parameters (the ?q=[query] part of web addresses), creating a new security weakness called parameter-to-prompt injection that could affect other AI-powered web services too. Microsoft patched the vulnerability on its servers, but the attack reveals a broader risk: AI services with broad access to corporate assets are vulnerable to this type of data theft.

Solution: Microsoft rated the information disclosure flaw as critical and patched the vulnerability on the server side earlier that month.

Microsoft Copilot Enterprise
Microsoft M365 Copilot
ChatGPT
Perplexity Comet


AutoJack: How a single page can RCE the host running your AI agent

Summary: AutoJack is an exploit that lets a malicious webpage take over an AI browsing agent (a system that can visit websites on your behalf) and run arbitrary commands on the host machine where the agent runs. The attack works by exploiting three weaknesses: trust in localhost (the local computer itself), missing authentication checks, and unsafe handling of user inputs, which allow attackers to trigger code execution through AutoGen Studio's MCP WebSocket (a communication protocol that connects different AI components). This research shows that when AI agents can visit untrusted websites and connect to local services, normal security boundaries break down.

Solution: N/A -- no mitigation discussed in source.


GHSA-fq4x-789w-jg5h: AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

Summary: AgenticMail has a security flaw where unauthenticated external emails can trigger a privileged Claude Code session with `permissionMode: 'bypassPermissions'` (a mode that removes safety restrictions). The email's sender address, subject, and preview are embedded directly into the AI's prompt without verification that the sender is the actual operator, allowing prompt injection (tricking the AI by hiding instructions in its input) that could lead to arbitrary code execution and file access under the operator's identity. A similar handler in the same codebase properly authenticates the sender, but the bridge-wake path does not.

@agenticmail/openclaw@< 0.5.71 (fixed: 0.5.71)

@agenticmail/codex@< 0.1.33 (fixed: 0.1.33)

@agenticmail/claudecode@< 0.2.39 (fixed: 0.2.39)

@agenticmail/core@< 0.9.43 (fixed: 0.9.43)


New usage analytics and updated spend controls for enterprises

Summary: OpenAI introduced new usage analytics and spend controls for ChatGPT Enterprise, allowing company administrators to track how AI credits (a unit of payment for AI usage) are being used across their organization. The Global Admin Console now shows detailed breakdowns of credit consumption by user, product, and model, while updated spend controls let admins set credit limits for teams and individual employees, helping organizations manage AI costs and deployment more effectively.

Solution: The source describes features already implemented rather than a fix for a problem. The solution is the new Global Admin Console, which provides credit usage analytics and granular spend controls, allowing admins to track usage by user/product/model, set default workspace limits, configure limits for specific groups, create individual overrides, and enable employees to request additional credits with context for admin review.


Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network

Summary: Companies are leaving AI agents (automated tools that run independently) active even after employees who created them leave, giving these tools permanent access to sensitive data and code without proper oversight. Traditional security tools miss this risk because they monitor AI like regular software and don't know which human authorized each AI action, making it hard to track whether an AI's data access is legitimate. The article describes this as a significant security problem but focuses mainly on identifying where these orphaned agents exist rather than fixing them.


ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

Summary: This bulletin covers multiple cybersecurity threats including malicious browser extensions that hijack search results and route them through hidden monetization layers, a fileless macOS attack using fake system dialogs to steal credentials, and threat actors abusing Claude's legitimate chat-sharing feature to deliver malware. The common theme is attackers exploiting user trust in legitimate tools and services to conduct fraud, steal data, and distribute malware.

Solution: Microsoft has announced that DNS-over-HTTPS (DoH, encrypted DNS queries sent as HTTPS requests) is now generally available on Windows Server 2025, allowing organizations to 'deploy encrypted and authenticated client-to-resolver DNS traffic directly within their existing on-premises DNS infrastructure' to help improve privacy, reduce spoofing risk, and advance Zero Trust DNS (a security model that verifies every access request rather than trusting the network by default) without requiring a new resolver architecture.


GHSA-j8cv-x86q-rj85: Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Summary: Pipecat's development runner has an unauthenticated WebSocket endpoint (`/ws`) that accepts telephony connections without verifying who is connecting. An attacker can send a fake Twilio handshake message with a call ID they choose, and the server will use its own Twilio credentials to hang up that call, potentially terminating calls on the victim's account. The same vulnerability exists for Telnyx and Plivo telephony providers.


GHSA-w5cv-pw74-4rxc: opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication

Summary: The githubreceiver component in opentelemetry-collector-contrib has a security flaw where it validates the `required_headers` configuration at startup but never actually checks these headers on incoming webhook requests. This means an attacker can send fake data to the webhook endpoint by bypassing the authentication headers that operators thought were protecting it, especially when the `secret` field is left empty (which skips HMAC validation entirely).

Solution: Add RequiredHeaders enforcement to `handleReq()` in `receiver/githubreceiver/trace_receiver.go`, matching the pattern used in gitlabreceiver at `receiver/gitlabreceiver/traces_receiver.go:266-270`, which validates each required header by checking if the incoming request's header value matches the configured value.

github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver@<= 0.150.0 (fixed: 0.151.0)


GHSA-4jvg-4jfx-fmhc: opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

Summary: The Sentry exporter in opentelemetry-collector-contrib has a path traversal vulnerability (a type of attack where an attacker manipulates file paths to access unintended locations) because it builds Sentry API URLs by directly inserting the service.name attribute, which remote attackers can control, without checking if it's valid. Since the operator's bearer token (a credential that proves the operator's identity) is automatically added to every request, an attacker can craft a malicious service.name to reach privileged Sentry admin and organization endpoints that they shouldn't have access to.

github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter@< 0.154.0 (fixed: 0.154.0)


GHSA-4pcv-mg8v-vrgf: PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

Summary: PraisonAI's search tools contain a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can trick the AI into making HTTP requests to arbitrary internal URLs by controlling the `searxng_url` parameter. Because this parameter is exposed to the language model as a tool option and search tools are enabled by default, an attacker can inject malicious instructions through web pages or files to make the server access internal services, read sensitive data, or in cloud environments reach the instance metadata endpoint (169.254.169.254) to potentially steal credentials.

praisonaiagents@< 1.6.61 (fixed: 1.6.61)


GHSA-29w3-p9w9-wc47: PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary: The `multiedit` tool in PraisonAI allows an AI agent to read and write any file on the system without checking file paths or boundaries, because it passes the filepath directly to the `open()` function without validation. An attacker who can control what the agent does, such as through crafted prompts or malicious workflow configurations, could steal sensitive files like SSH keys and credentials, or overwrite important files to take control of the system.


Who decides when AI is too dangerous?

Summary: The US government imposed export controls on Anthropic's Fable 5 AI model and its underlying Mythos model, restricting access even for foreign nationals working at Anthropic in the US. Anthropic then took both models offline because the company said it couldn't reasonably comply with the restrictions while keeping the models publicly available. This incident raises broader questions about how the US government should regulate AI and whether its approach will be a genuine safety framework or a political tool.


External Data Extraction Attacks Against Retrieval-Augmented Large Language Models

Summary: Retrieval-augmented generation (RAG, a technique where AI systems pull in external documents to answer questions) enhances large language models but introduces a new security risk: external data extraction attacks (EDEAs), where attackers can trick the system into revealing sensitive or copyrighted information from its knowledge base. Researchers developed an attack called Secret that uses AI-optimized prompts and adaptive strategies to extract data from RAG systems, successfully extracting data from commercial models where previous attacks failed.


TabHGIF: A Unified Hypergraph Influence Framework for Efficient Unlearning in Tabular Data

Summary: TabHGIF is a framework for machine unlearning (removing a model's memory of specific training data) on tabular data, which is faster than retraining from scratch but traditionally struggles to preserve both privacy and model accuracy. The method represents tabular data as a hypergraph (a graph structure that captures relationships between multiple features at once) and uses a Hypergraph Influence Function to predict how deleting data will affect the model without needing to access the original data again. In experiments, TabHGIF achieved speedups of 2.18–7.67 times compared to full retraining while maintaining accuracy close to a fully retrained model.


Double-Blind Cleanser: Blindly Unlearning Backdoors Without Clean Data

Summary: Backdoor attacks compromise AI models by injecting hidden triggers into training data that cause the model to misclassify inputs containing those triggers. This paper introduces Double-Blind Cleanser (DBC), a method that removes backdoors without needing access to clean data or knowing what the triggers look like, using two techniques: catastrophic forgetting (making the model forget the backdoor behavior) and Sharpness-Aware Minimization (SAM, which smooths the model's decision boundaries to restore normal functionality).

Solution: The paper describes DBC's approach: "It first leverages catastrophic forgetting to eliminate the backdoor behavior. It then applies Sharpness-Aware Minimization (SAM) to flatten the loss landscape, improving generalization and restoring legitimate functionality without requiring prior knowledge of triggers or poisoned samples. To further enhance the flatness of the loss landscape, DBC employs an importance sampling strategy that prioritizes samples most sensitive to weight perturbations, effectively reducing the impact of poisoned instances."


MicroPatch: Directed Backdoor Erasing via Victim Parameter Decoupling

Summary: Deep neural networks (large AI models inspired by how brains work) can be attacked through data poisoning, where attackers secretly add harmful examples to training data to make the model behave badly. Existing fixes reduce the attack's success but often make the model worse at normal tasks. Researchers propose MicroPatch, which identifies which parts of the model were corrupted by poisoned data and repairs just those parts by using reverse engineering (reconstructing the hidden attack pattern) and influence functions (mathematical tools that show how each piece of training data affected the final model).

Solution: The source describes MicroPatch as the approach: (1) use reverse engineering to reconstruct backdoor trigger patterns, (2) apply influence functions to quantify the impact of individual data points on model parameters, (3) decouple victim components of model parameters by comparing parameter influences of clean and poisoned data, and (4) patch these victim components to purify the model.


A Unified Framework of Private Set Operations With Stronger Security

Summary: This paper addresses security weaknesses in unified frameworks for private set operations (PSO, which are techniques that let multiple parties perform computations on their private data sets without revealing the data itself). Previous frameworks had vulnerabilities to inference attacks because they leaked information about the size of set intersections during operations like union and intersection-sum. The authors propose an improved unified framework that eliminates these leakages by introducing a new building block called permuted batched private membership test sharing, achieving stronger security with acceptable performance trade-offs.

Solution: The source proposes a new unified framework with stronger security that: (1) supports PSI-Sum/SS without cardinality leakage (removing information leaks about set sizes), (2) includes an enhanced PSU without during-execution leakage (preventing attackers from gaining information while the operation runs), and (3) uses a new central building block called permuted batched private membership test sharing with instantiation alternatives for both balanced and unbalanced scenarios. The paper provides experimental results showing PSI-Sum/SS achieves 0% leakages with performance costs of approximately 3.3x higher communication for balanced sets and less than 2x overhead for unbalanced sets, while the enhanced PSU achieves up to 1.6x to 60.5x lower communication and 1.4x to 15.6x faster execution compared to prior work.