CVE-2026-7872: IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing

Summary: CVE-2026-7872 is a vulnerability in IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 that allows an authenticated attacker (someone with login credentials) to read arbitrary files on the system, including the JWT signing key (a secret used to create authentication tokens). With access to this key, an attacker could forge authentication tokens to impersonate any user.


CVE-2026-7755: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcemen

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 have a vulnerability that allows remote code execution (running malicious commands on a system from a distance) because the software doesn't properly validate MCP server configuration files (text files that tell the system how to connect to external services). This is a serious security flaw because an attacker could exploit incomplete validation enforcement to execute unauthorized code.

Solution: N/A -- no mitigation discussed in source.


CVE-2026-7754: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure defa

Summary: IBM Langflow OSS versions 1.0.0 through 1.10.0 and Langflow 1.9.0 contain a vulnerability that allows SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) because of unsafe default settings and incomplete protection mechanisms against this type of attack. The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.


CVE-2026-7667: IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacke

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a vulnerability where an authenticated attacker (someone with login access) can create a malicious flow pointing to a URL they control, which returns a specially crafted header that tricks the system into writing files to any location on the server. This works because the system doesn't properly validate file paths, allowing an attacker to use path traversal (using sequences like '../' to escape the intended directory) to write files anywhere the Langflow process can access.


CVE-2026-15995: IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could allow an attacker to obtain inc

Summary: IBM Cognos Analytics version 12.1.3 GA through build 12.1.3-2606251736 has a race condition (a bug that occurs when multiple processes access shared data simultaneously without proper protection), allowing attackers to get incorrect report summaries or cause report-processing failures when multiple authenticated users submit reports at the same time.


CVE-2026-14499: IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elev

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where authenticated users (those who have logged in) can run arbitrary commands (any code they choose) with elevated privileges (higher access level) due to improper validation of user input in the Python Interpreter component (the part that executes Python code). The vulnerability stems from OS command injection (CWE-78, where attackers embed malicious system commands in their input), allowing attackers to bypass security checks.


CVE-2026-13448: IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the

Summary: IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.1 have an unauthenticated remote code execution vulnerability (RCE, where attackers can run commands on the system without logging in) in a public endpoint. The vulnerability exists because the validate_public_flow_no_code_execution() function (a safety check) has an incomplete denylist (a list of things to block) that fails to block certain agent components like OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent from executing code.

IBM Langflow
OpenDsStarAgent
CodeActAgentSmolagents
CSVAgent


CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

Summary: AWS HealthOmics MCP Server versions 0.0.35 and earlier contain a path traversal vulnerability (a flaw where attackers can use special directory notation like '../' to access files outside intended locations) in its workflow linting tools. An attacker who can control inputs to the MCP agent could write malicious files to any location on the system instead of just the workflow bundle directory.

Solution: Update aws-healthomics-mcp-server to version 0.0.36 or later.

AWS
AWS HealthOmics
aws-healthomics-mcp-server


TikTok is testing an AI likeness detection tool

Summary: TikTok is testing an opt-in tool that detects AI-generated copies of creators (deepfakes, or AI-altered versions of real people) and allows creators to report them to the company. The tool is currently available to some US creators who verify their identity through Jumio, a third-party identity verification service, using a selfie scan and ID check.


GHSA-f7wf-v2vw-mpcx: mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

Summary: A security flaw in mcp-memory-keeper allowed arbitrary local file reads through the `context_import` function, which didn't validate file paths before reading them. An attacker (either a malicious client or an LLM agent affected by prompt injection, a technique where hidden instructions are embedded in AI inputs) could read any file accessible to the server process, including credential files and configuration files, or view partial file contents through error messages.

Solution: Fixed in version 0.13.0 (PR #36). The patch: (1) restricts imports to a server-owned exports directory using `realpathSync` and rejects `../` traversal and absolute paths outside the directory, (2) separates file read and JSON parsing operations with generic error messages instead of echoing file bytes, and (3) adds security regression tests covering arbitrary-read, traversal, and symlink escape vectors. Users must upgrade to version >= 0.13.0; there is no configuration-only workaround for affected versions.

mcp-memory-keeper@< 0.13.0 (fixed: 0.13.0)


CVE-2026-9135: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) co

Summary: IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a code injection vulnerability (a type of security flaw where attackers insert malicious code) in the ToolGuard integration that allows authenticated users to bypass the allow_custom_components=false security control and execute arbitrary Python code on the backend. The vulnerability exists because the validation system only checks the main component code but misses dynamic CodeInput fields, and attackers can exploit this by embedding malicious code in these unvalidated fields that get executed when tools are invoked. The flaw can be made worse through cross-tenant flow manipulation (exploiting flows across different user accounts) when certain security settings are misconfigured.


CVE-2026-9103: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authenti

Summary: IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability in the /api/v1/login/auto_login endpoint that allows unauthenticated attackers to gain full administrative access by obtaining long-lived superuser bearer tokens (special credentials that prove you have admin privileges) when AUTO_LOGIN is enabled by default. The vulnerability is made worse by overly permissive CORS settings (rules controlling which websites can access the application), which can expose these tokens to unintended websites.


CVE-2026-58195: Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone

Summary: Agentic-Flow, an AI agent orchestration platform (a system that manages and coordinates multiple AI agents working together), had a critical vulnerability in versions before 2.0.14 where user-controlled input was directly inserted into shell commands without proper safety checks, allowing attackers to execute arbitrary operating system commands with the server's permissions.

Solution: Update to version 2.0.14 or later, which fixes this vulnerability.


CVE-2026-9202: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a critical flaw that allows attackers without login credentials to create unlimited user accounts. When a specific deployment setting called NEW_USER_IS_ACTIVE is enabled, these newly created accounts become immediately usable and can access RCE endpoints (remote code execution, where an attacker can run commands on a system they don't own), completely bypassing security controls.


CVE-2026-9198: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER toke

Summary: IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical security flaw where unauthenticated attackers can chain two API endpoints together to gain full control of a system. The attackers first use /api/v1/auto_login to mint SUPERUSER tokens (special access credentials), then use /api/v1/validate/code to execute arbitrary code through exec() (a function that runs user-provided commands), achieving RCE (remote code execution, where an attacker can run commands on a system they don't own).


Apple’s plot to crush OpenAI

Summary: Apple is suing OpenAI, with experts debating whether the allegations represent genuine concerns or typical industry practices. The lawsuit comes as Apple releases public beta versions of new software featuring an updated Siri AI, raising questions about whether Apple views OpenAI as a competitive threat or is capitalizing on OpenAI's current difficulties.


Anthropic in early talks with Meta to acquire compute power

Summary: Anthropic is in early negotiations with Meta to lease computing power (specialized hardware used to train and run AI models), following a similar deal with SpaceX's Colossus 1 data center. These talks reflect Anthropic's ongoing struggle to secure enough AI chips (particularly Nvidia processors) to support its advanced models like Fable, and represent Meta's broader effort to enter the cloud computing business to monetize its AI infrastructure investments.

Anthropic
Meta
SpaceX
Elon Musk
Nvidia
Amazon Web Services


New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

Summary: NadMesh is a Go botnet (malware written in the Go programming language) that hunts for exposed AI services like ComfyUI and Ollama to steal cloud credentials, Kubernetes tokens (authentication keys for container orchestration systems), and access to AI models. The botnet prioritizes exploiting MCP (Model Context Protocol, a framework for AI tools), Docker APIs, and Jenkins systems, with observed attack traffic showing Docker vulnerabilities account for the largest portion of exploitation attempts.

ComfyUI
Ollama
n8n
Open WebUI
Langflow
Gradio
DeepSeek
GLM
Kimi
MCP
AWS
Kubernetes
Docker
Jenkins
Redis


China's Moonshot AI claims Kimi K3 can rival OpenAI and Anthropic

Summary: Chinese AI startup Moonshot unveiled Kimi K3, a massive AI model with 2.8 trillion parameters (a measure of an AI's scale and processing power) that the company claims rivals top American AI firms like OpenAI and Anthropic. The model will be released as open-source software on July 27, making it freely available for anyone to download and modify, which represents a significant shift since most leading American AI systems are proprietary and restricted. This development suggests that Chinese AI companies are successfully advancing their technology despite US government restrictions on hardware sales and export controls on frontier AI models (cutting-edge systems considered critical to national security).

Moonshot AI
OpenAI
Anthropic
Alibaba
Tencent
Zhipu
MiniMax
Kimi K3


The Real AI Threat Is Blind Trust

Summary: The article warns that AI models which are allowed to both understand user requests and carry out those requests without human review create a serious security risk. When AI systems operate without oversight (checking and approval by humans), it removes important safeguards that normally protect computer systems from being misused or attacked.


Introducing Gemini 3.5 Flash Cyber

Summary: Google introduced Gemini 3.5 Flash Cyber, a lightweight AI model specialized in finding, validating, and fixing software vulnerabilities (flaws in code that attackers could exploit). The model is being released through a limited-access pilot program exclusively to governments and trusted partners via CodeMender (Google's code security agent) to help defenders fix vulnerabilities before attackers can use them, while restricting access to prevent misuse.

Google
Gemini 3.5 Flash Cyber
CodeMender


Google must open Android to rival AI agents, EU orders

Summary: The European Union ordered Google to open Android (its mobile operating system) to rival AI assistants like competitors to Gemini, giving them equal access to apps and system services to increase competition. Google warns this could create security risks, while security experts worry that multiple AI agents with deep system access could break traditional security models where the operating system controls what different programs can do.


In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint

Summary: This week's cybersecurity news covers multiple incidents including breaches at telecom and retail companies, a German manufacturer forced into bankruptcy after a six-week cyberattack shutdown, and the discovery of CrashStealer, a new macOS malware (malicious software) that disguises itself as a crash reporting tool to steal user credentials and system data. Additional threats include Iranian actors using cellular and advertising data to track US military phones, and a vulnerability in an AI agent integrated with WhatsApp that allows remote code execution (running commands on a system from afar).


On Success and Simplicity: A Second Look at Transferable Vision–Language Attack Pipeline

Summary: Vision-Language Pre-training Models (VLPMs, which are AI systems trained to understand both images and text together) are vulnerable to adversarial attacks (input tricks designed to fool AI systems). This research shows that simpler attack methods can actually work better than complicated ones, and proposes SimVLA (Simple Vision-Language Attack), a streamlined approach that improves how well attacks transfer between different models while using less computing power.


Spa: Stealthy and Persistent Backdoor Attacks in Federated Learning via Feature-Space Alignment

Summary: Researchers discovered a new backdoor attack called Spa that can secretly compromise federated learning systems (distributed AI systems where multiple parties train a model together while keeping their data private). Unlike previous attacks, Spa hides malicious code by blending it with the legitimate learning process and uses adaptive triggers that change over time to avoid detection and remain effective for hundreds of training rounds.


Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive

Summary: This podcast features an interview about agentic AI (AI systems that can autonomously plan and execute tasks) and governance challenges in cybersecurity. The discussion includes the MindStone Agent, an open-source project that adds persistent memory and identity to AI assistants, and demonstrates how autonomous AI agents can coordinate incident response (the process of identifying and fixing security breaches) and recovery with minimal human oversight.


Google Bets 'Agentic Defense' Strategy Can Outpace Attackers

Summary: Google Cloud has built an agentic defense platform (a system that uses AI agents to automatically handle security tasks) that incorporates technology from Wiz to detect and fix threats from AI-based attacks. The approach aims to automate both finding and responding to threats faster than attackers can operate.


E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants

Summary: The European Commission ordered Google to give rival AI assistants the same access to Android device features that Google's own Gemini assistant has, including the camera, microphone, screen contents, and the ability to control other apps in the background. Google must implement this by August 1, 2027, in Android 18, with some features (like always-on voice detection) delayed to Android 19 by August 1, 2028. The order also requires Google to share anonymized search data with competing search engines and AI chatbots for a cost-based fee.

Solution: Google must create a Qualified AI Assistant Programme that uses independent Trusted Certification Authorities (TCAs) to certify third-party AI assistants for access to restricted features, and must accept these certifications without adding extra conditions. Google can set reasonable and non-discriminatory terms for the TCA programme but must get Commission approval two months before any changes. For the six unrestricted features (microphone input, hotword detection, camera, screen contents, location, and sensors), Google cannot decide who is allowed to access them, though it can require process isolation and encryption. Google can request the Commission move a feature to the restricted list by filing a reasoned request showing good cause.


A scorecard for the AI age

Summary: This article discusses how businesses should measure the success of their AI investments using a metric called 'Useful Intelligence per Dollar' rather than traditional software metrics like adoption or cost per token (the price charged for processing units of text). The key insight is that true AI value comes from measuring the total cost of completing actual work tasks successfully against the value those tasks create, accounting for factors like human review time, retries, and the likelihood of getting the right answer on the first try.


Chinese startup Moonshot AI unveils Kimi model it says rivals OpenAI, Anthropic

Summary: Moonshot AI, a Chinese startup, released its Kimi K3 model, which it claims performs competitively with leading AI systems from OpenAI and Anthropic, though it still trails their most advanced offerings overall. The model, containing 2.8 trillion parameters (adjustable numbers that determine how an AI model behaves), achieved strong performance on benchmarks despite hardware constraints in China. This release reflects intensifying competition between U.S. and Chinese AI companies, as Chinese models are becoming cheaper alternatives and gaining adoption among Western businesses.

Moonshot AI
Kimi
OpenAI
Anthropic
Claude
GPT
Alibaba
Qwen
Tencent
Z.ai
MiniMax Group


CVE-2026-9810: The AI Copilot  WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any val

Summary: The AI Copilot WordPress plugin before version 1.5.4 has a security flaw where OAuth access tokens (temporary credentials that grant access to accounts) are not properly tied to specific WordPress users, allowing attackers who complete the public login process to gain administrator privileges and perform dangerous actions like creating new users or changing user permissions.

Solution: Update the AI Copilot WordPress plugin to version 1.5.4 or later.


Senior executives are killing your shadow AI strategy

Summary: Senior executives are using shadow AI (unapproved AI tools not officially authorized by their company) at nearly twice the rate of lower-level employees, even though most know it creates security and data privacy risks. The problem stems not from ignorance but from executives choosing speed over compliance, and from approved tools being less useful than mainstream alternatives.

Solution: According to the source, IT leaders should focus on "providing secure AI tools that people actually want to use" through "executive alignment, clear governance, and providing secure AI tools that people actually want to use." Additionally, organizations need to "pair governance with usability" and ensure that "the secure path the easiest path" by providing approved tools that "grant users full access to the necessary systems and data, eliminating the need to choose between a capable but ungoverned tool and a safe but limited one."


Microsoft's Nadella criticizes Anthropic's Fable for being 'editorially controlled'

Summary: Microsoft CEO Satya Nadella criticized Anthropic's Fable AI model for being "editorially controlled," saying it refuses too many user requests and doesn't function like a proper creation tool. Anthropic has acknowledged the issue, stating that its safeguards for Fable flag a slightly higher fraction of harmless requests than intended, and the company said it was trying to reduce false positives when it released Fable 5 in June.

Microsoft
Anthropic
Fable
Claude
OpenAI
Copilot
Azure
Moonshot AI


CVE-2026-44433: Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b

Summary: Quicly is a library that implements the QUIC protocol (a modern internet communication standard) for the H2O web server. Before a certain code update, an attacker could send specially crafted network messages that trick the server into allocating huge amounts of memory using very few packets, potentially causing a denial of service (making the service unavailable by exhausting its resources).

Solution: This issue has been fixed by commit 8b178e6.


Agentic AI Is Untamable: Ask the Right Security Questions

Summary: Agentic AI (artificial intelligence systems that can independently plan and take actions to accomplish goals) presents significant security risks that organizations need to address, regardless of external attackers. The article argues that the security challenges posed by agentic AI are substantial enough to require a fundamental rethinking of how organizations approach AI safety.


1M+ Emails Use Hidden Text to Dupe AI Security Filters

Summary: Over one million emails have used a technique called text salting (hiding extra characters or text that humans don't see but can confuse AI systems) to bypass AI-based email security filters, allowing phishing emails (messages designed to trick people into revealing sensitive information) to reach inboxes undetected. The research shows that AI and LLMs (large language models, which are AI systems trained on massive amounts of text) are surprisingly weak against this evasion method.


Claude Chrome extension flaw lets malicious extensions trigger AI actions

Summary: A flaw in Anthropic's Claude Chrome extension allows a malicious extension to trigger Claude's predefined AI workflows by simulating user clicks, potentially abusing Claude's access to Gmail, Google Docs, Google Calendar, and Salesforce. The vulnerability exists because the Claude extension accepts JavaScript-generated click events without verifying they came from a real user by checking the Event.isTrusted property (a browser flag that distinguishes genuine user actions from programmatically created ones). An attacker would need to trick a user into installing a malicious extension that can then execute these workflows without the user's knowledge.


Alphabet shares fall on report its most powerful AI model Gemini 3.5 Pro is delayed

Summary: Alphabet's Gemini 3.5 Pro AI model is delayed by months because the company wants to improve its performance, especially its ability to generate software code, which fell short of internal expectations. The delay comes as competitors like OpenAI and Meta have released newer AI models that outperform Google's current offerings at code generation, causing Alphabet's stock to drop 4%.

Alphabet
Google
Gemini 3.5 Pro
OpenAI
Meta
Anthropic


CVE-2026-15737: AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on t

Summary: AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 unintentionally logged sensitive user data in OpenTelemetry span attributes (metadata tags that track operations), which then flowed into CloudWatch Logs (AWS's logging service) where anyone with log access could read them. This meant raw user prompts and AI agent responses were stored unfiltered in logs, exposing sensitive information.

Solution: Upgrade to version 1.5.1 or later. Additionally, users who ran the affected versions should review and purge sensitive content from their aws/spans CloudWatch log groups.

AWS Bedrock
AWS Bedrock AgentCore Python SDK


CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat

Summary: text-generation-inference (a tool for running AI text models) versions up to 3.3.7 have a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't) in its chat feature that lets unauthenticated attackers supply malicious image URLs to make the server fetch data from internal systems, cloud metadata endpoints, or scan ports. The vulnerability exists because the code doesn't validate whether URLs point to private or internal addresses, and the HTTP client automatically follows redirects, letting attackers bypass security checks.


CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

Summary: The Bedrock AgentCore Python SDK (a library for building AI agents on Amazon's platform) has a vulnerability where OpenTelemetry spans (data that tracks what a program is doing) were writing unfiltered user prompts and AI responses to CloudWatch logs (AWS's logging service). This meant that anyone with read access to those logs could see potentially sensitive information. The vulnerability affects versions 1.4.8 and 1.5.0.

Amazon Bedrock
bedrock-agentcore Python SDK


CVE-2026-59864: Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (w

Summary: Kiota, a tool that generates HTTP client code from API descriptions, had a security flaw in versions before 1.32.5 where it didn't properly validate file paths when creating plugin files. This allowed attackers to include specially crafted file paths that could access files outside the intended directory (path traversal, where attackers use ../ to escape folders) or include files from unexpected locations when the generated plugin was deployed.

Solution: Update Kiota to version 1.32.5 or later, which fixes this issue.

Microsoft
Kiota
Microsoft 365 Copilot
Teams


Why teens deserve access to safe AI

Summary: Teens are increasingly using AI tools like ChatGPT for learning and productivity, and denying them access would leave them unprepared for a defining technology of their time. OpenAI has implemented protections specifically for teens, including automated guardrails (safety rules that trigger automatically), age prediction, parental controls, and learning features like Study Mode (a tool that guides students through problems step-by-step with questions rather than just giving answers) to help them benefit from AI safely.

Solution: OpenAI has introduced several protections for teens: (1) automatic age-appropriate experience adjustments when the system estimates a user is under 18, (2) Study Mode designed with teachers and learning experts to encourage active engagement through guided questions and structured explanations rather than direct answers, (3) Parental Controls allowing parents to enable Study Mode by default for linked teen accounts, (4) education-focused starter prompts for common learning tasks, (5) interactive learning experiences for math and science topics, and (6) a pronunciation feature using audio for language learning.


Google is renaming NotebookLM to Gemini Notebook

Summary: Google is renaming its AI note-taking app from NotebookLM to Gemini Notebook, though it will continue operating as a separate application. The app, originally called Project Tailwind when announced in May 2023, has added features over time that use AI to help organize and summarize notes, including converting them into AI podcasts and video clips.

Google
Gemini
NotebookLM
Gemini Notebook


Least privilege for AI agents: Identity, access, and tool binding

Summary: AI agents can perform multi-step tasks across multiple systems without individual human approval for each step, which creates identity and authorization challenges. When agents operate without proper managed identity (a secure way to identify an agent) and least-privilege RBAC (role-based access controls, which limit what each agent can do), they may access or modify sensitive data beyond their intended permissions. Organizations are deploying these agent capabilities faster than their security models can evolve, leading to risks like unauthorized data access, unintended modifications, and gaps in auditability (the ability to track who did what).

Solution: The source recommends treating every agent as a first-class principal: give it a lifecycle-managed identity, assign explicit roles, scope its permissions tightly, and scope tool usage to a preconfigured tools manifest or configuration. The text also states that implementing multiple controls is intended to help reduce potential impact of agent actions while making privilege decisions explicit and supporting accountability. However, the source does not provide specific technical implementation steps, version numbers, or detailed patches beyond these architectural principles.


Musk’s xAI sues user who allegedly used Grok to create child sexual abuse material

Summary: xAI, Elon Musk's AI company, has sued a South Carolina man for allegedly misusing their AI system called Grok to create child sexual abuse material. This is one of the first lawsuits an AI company has filed against a user for this type of misuse, with xAI claiming the user violated their terms of service.


How a former DeepMind researcher raised at a $300M pre-seed valuation before launching a product

Summary: Andrew Dai, a former Google DeepMind researcher, founded Elorian and raised $55 million at a $300 million valuation to build visual AI models (systems that can understand and reason about images and video). Dai argues that while AI has made strong progress in math, physics, and coding, visual understanding remains an underdeveloped area, and he aims to advance toward visual AGI (artificial general intelligence, a hypothetical AI that can handle any intellectual task). The article focuses on his fundraising strategy and lessons for founders pitching complex AI ideas to investors.

Google DeepMind
ChatGPT
OpenAI
Elorian
Nvidia
Menlo Ventures


AI Appreciation Day: Let’s Be Honest About What We’re Appreciating

Summary: AI has made developers and security teams more productive, but the same capabilities that make AI useful for legitimate work also make it powerful for attackers. Check Point's 2026 AI Security Report highlights that organizations should appreciate AI's benefits while being realistic about the security risks it introduces.


AI Agents Broke the Security Playbook. Here's What Replaces It.

Summary: AI agents have broken traditional enterprise security approaches because they act autonomously, acquire access across multiple systems, and change behavior based on context, making environments harder to predict and manage. Unlike ordinary applications that operate at human speed, AI agents can borrow credentials, disappear before security scans detect them, and some already have direct access to production data. Security teams now need to decide which security layers to own themselves rather than relying on fixed vendor workflows that cannot anticipate the specific risks in each organization's unique cloud, SaaS, and AI deployment setup.

Token Security
Retool
AWS
Azure
GitHub
Salesforce
Okta


Demystifying AI Exploits: A Blueprint for AI-Assisted Vulnerability Management

Summary: This article discusses how organizations can safely use AI agents (AI systems that can take actions autonomously) to find and fix security vulnerabilities in software. The key challenge is that vulnerabilities are being exploited faster than patches can be created, so companies want to automate vulnerability discovery, but deploying AI agents with high system access introduces new security risks. The article recommends establishing operational safeguards by combining AI with deterministic controls (fixed, rule-based systems) and human oversight, following frameworks like NIST's AI Risk Management Framework and Google's Secure AI Framework.

Solution: The source explicitly recommends several mitigations: (1) enforce data security before the prompt reaches the model, using non-production environments with synthetic data for testing; (2) deploy a hybrid defense-in-depth model with Layer 1 deterministic policy engines as chokepoints and Layer 2 specialized guard models (such as Model Armor) to filter sensitive data and block prompt injections before reaching the agent; (3) treat the codebase itself as untrusted input and perform input sanitation to prevent indirect prompt injections hidden in source code comments or dependencies; (4) establish clear rules of engagement and authorized testing agreements with cloud providers to navigate acceptable use policies; (5) enforce strict zero data retention (ZDR) agreements with LLM providers to ensure proprietary code and discovered vulnerabilities are never used to train external models; (6) execute agent workloads in strictly isolated, unprivileged containers with dynamically limited privileges and robust sandboxing to prevent privilege escalation.


HashRuler: Lightweight Detection of Anomalous Hash Codes for Backdoor Defense

Summary: Deep hashing models, which compress images into compact codes for fast retrieval, can be poisoned by backdoor attacks (hidden malicious behavior triggered by specific inputs) that manipulate their hash codes while appearing benign. Researchers developed HashRuler, a lightweight detection system that identifies these compromised samples by measuring two types of anomalies in the hash codes: how far a sample deviates from its class's typical hash center, and how it behaves as an outlier compared to nearby samples.


On the Attribute Hiding Security of Privacy Preserving Secret-Sharing-Based Outsourced Decision Tree Classification

Summary: Decision tree classification (a machine learning method that makes predictions by asking yes/no questions about data features) is often run on cloud servers, creating privacy risks. Researchers found that SecDT, a framework designed to protect these systems using secret-sharing (splitting sensitive information into pieces so no single party can see it), has a vulnerability where the attributes (features) used in decision trees can leak to unauthorized parties. The researchers proposed four improved versions (SecDT+v1, SecDT+v2, SecDT+vH, and SecDT+vDP) that hide these attributes using mathematical techniques.

Solution: The source explicitly describes four secure enhancements: SecDT+v1 and SecDT+v2 use 'the transformation matrix technique to obfuscate node attributes within the secret-shared domain.' For advanced protection against attribute leakage through access patterns, SecDT+vH and SecDT+vDP 'incorporate dot-product operations to achieve the attribute-hiding property.'


Protecting Your Customized LLM Systems From Backdoored Instructions With Metacognitive Probing

Summary: Customized LLMs (large language models built by third parties and then modified for specific use) are vulnerable to backdoored instructions, which are malicious hidden rules embedded in the system that can make the AI follow attacker commands without being detected. This paper introduces a Black-box Safety Auditing Agent that uses metacognitive probing (making the AI think deeply about its own reasoning to expose hidden triggers) to identify and remove these malicious triggers from user queries, preventing the backdoor from activating.

Solution: The paper proposes using a Black-box Safety Auditing Agent that leverages metacognitive probing to induce LLMs to reveal predefined triggers, and then these triggers are sanitized (removed or cleaned) from user queries to ensure the backdoor remains inactive. The auditing agent uses prompt-based approaches for both task-specific probing and broad-spectrum probing to comprehensively identify triggers, and also requires the model to articulate its reasoning process to enhance defense capabilities.


CVFL-Pro: A Collusion-Resistant Verification Federated Learning Framework With Adaptive Communication Optimization

Summary: CVFL-Pro is a new federated learning framework (a system where AI models are trained across multiple computers without sharing raw data) that prevents malicious servers from cheating during model training while reducing communication costs. The framework uses cryptographic techniques like Shamir's secret sharing (a method to split secrets so no single party can reconstruct them alone) and an adaptive compression algorithm that automatically adjusts how much data is sent based on gradient changes, achieving up to 95.81% reduction in communication overhead compared to existing methods.

Solution: The source describes the CVFL-Pro framework itself as the solution. Key technical components include: using 'a mask and Shamir's secret sharing for privacy protection,' combining 'a lightweight MAC scheme and auxiliary nodes to achieve efficient verifiability,' and designing 'an adaptive communication optimization algorithm (AOTop-k) which dynamically adjusts the compression rate based on the gradient magnitude and the gradient variation between rounds.' The paper demonstrates that this framework 'reduces communication overhead by 95.81% compared to SecAgg' while maintaining accuracy.


PrivaCI: Privacy as Contextual Integrity

Summary: This article introduces contextual integrity (CI), a privacy framework based on philosophical ideas that offers a different approach to defining privacy than traditional methods. Traditional privacy definitions have been inadequate for addressing new threats from modern digital technologies and have led to ineffective regulations, making CI a potentially better alternative.


From the “Real Me” to the “Statistical Me”: Why Privacy Protection Must Now Govern Data, Representation, and Action

Summary: The article argues that privacy protection needs to expand beyond just protecting your actual personal information to also protecting your 'statistical me,' which is the version of you that AI systems create, store, and use to make decisions about you. This shift matters because AI models infer and build detailed profiles about individuals based on data, and these AI-generated representations can be used to take actions that affect your life, even if they don't match who you really are.


Perspective-Invariant Attack With Enhanced Transferability of Adversarial Examples

Summary: Researchers developed a new attack method called Perspective-Invariant Attack (PIA) that generates adversarial examples (inputs crafted to fool AI models) with improved transferability across different neural networks. By using geometric transformations that simulate different viewpoints (perspective changes), PIA makes adversarial perturbations (small, intentional changes) less dependent on the original model they were designed to attack, allowing them to more successfully fool other models including large language models.


Nvidia-backed Fireworks hits $17.5 billion valuation as companies pursue cheaper AI models

Summary: Fireworks, an Nvidia-backed startup that hosts AI models on cloud infrastructure (computing servers that developers can access over the internet), has reached a $17.5 billion valuation by helping companies use cheaper and more specialized AI alternatives instead of expensive models from major labs like OpenAI and Anthropic. The company is growing rapidly because finance executives are pushing their teams toward open-source models (freely available code that anyone can use and modify) to reduce costs, and Fireworks makes it easy for developers to customize these models with their own data for specific tasks.

Fireworks
Nvidia
Amazon
Google
Microsoft
Anthropic
OpenAI
DigitalOcean
CoreWeave
Together AI
Baseten
Lambda
Nebius
Alibaba
Qwen
Apple
Meta
DeepSeek
MiniMax
Z.ai
Palantir
Coinbase


Claude can now use your 1Password credentials for you

Summary: 1Password has created a new integration that lets Claude (an AI chatbot made by Anthropic) access your stored login credentials to complete tasks like booking travel without you having to type them in manually. The system uses a 'zero-exposure security framework' that shares credentials with Claude only when needed, without revealing them to Anthropic's servers.


The Download: OpenAI unveils GPT-Red and heat pumps rise in the US

Summary: OpenAI has unveiled GPT-Red, an AI system that automates red-teaming (a type of security testing where evaluators try to find ways to break or hijack a system), traditionally done by human testers. The goal is to identify as many vulnerabilities as possible before attackers can exploit them, potentially helping OpenAI stay ahead of malicious actors.

OpenAI
GPT-Red
Suno
Thinking Machines
Inkling
Grok
Pegasus


Google ordered to open Android and Search to rivals in Europe

Summary: The European Union ordered Google to give rival AI assistants and search engines better access to key parts of Android (Google's mobile operating system) and Google Search, aiming to reduce Google's control over these major platforms. Google must start sharing search data by January 2027 and make Android changes by July 2027. These decisions could reshape how Google's AI tool Gemini operates and create new opportunities for competitors.


New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands

Summary: Researchers discovered a new attack called agent data injection (ADI), where attackers plant fake information in data that AI agents trust, like email sender names or button IDs, causing the agents to misclick or run unintended commands while still completing their original task. Unlike prompt injection (hiding commands in text input), ADI works by corrupting small facts the agent relies on, using fake punctuation characters that language models often misread as real delimiters even though a strict parser would ignore them. The attack successfully compromised real tools including web agents (Claude, Google's Antigravity, Nanobrowser) and coding assistants (Claude Code, OpenAI's Codex, Google's Gemini CLI).

Claude
Google Antigravity
Nanobrowser
Claude Code
OpenAI Codex
Google Gemini CLI


Nvidia unveils new AI model and expands Japan’s physical AI ecosystem

Summary: Nvidia announced Cosmos 3 Edge, a world model (a system that learns from various inputs to help robots and AI agents understand and move through physical environments in real time), as part of its expansion into Japan's AI market. The company is forming partnerships with major Japanese firms like Fujitsu, Hitachi, and Kawasaki Heavy Industries, and is also investing in healthcare and drug discovery through initiatives like the Tokyo-1 AI drug discovery consortium.

Nvidia
Cosmos 3 Edge
BioNeMo Agent Toolkit
Fujitsu
Hitachi
Kawasaki Heavy Industries
Microsoft
SoftBank
Sakura Internet
Xeureka
Astellas Pharma
Daiichi Sankyo
Ono Pharmaceutical


Our approach to bioresilience

Summary: Google DeepMind and Isomorphic Labs are developing AI tools to improve society's ability to prevent, detect, and respond to disease outbreaks and biosecurity threats. Their approach includes using AI models like AlphaFold (which maps protein structures) and drug design systems to help researchers create vaccines and treatments, while also implementing safeguards to prevent misuse of their AI systems by bad actors.

Solution: The source describes several mitigation approaches already being implemented: (1) a four-step safety process for their models involving threat modeling, evaluations, mitigations and monitoring; (2) adapting SynthID watermarking technology to biology to help DNA synthesis providers screen for potentially risky AI-generated sequences; (3) making AI systems available to trusted partners for prevention, detection, and response efforts; and (4) establishing a focused unit at Isomorphic Labs to rapidly deploy drug design capabilities during novel outbreaks.

Google DeepMind
Isomorphic Labs
Gemini
AlphaFold
AlphaGenome
AlphaEvolve


CVE-2026-15610: The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorizatio

Summary: The WPBot plugin for WordPress (a platform for building websites) has a security flaw where it doesn't properly check if users have permission to perform certain actions, allowing subscribers and higher-level users to re-embed stored RAG documents (external documents that an AI uses to answer questions). This vulnerability lets attackers waste the site owner's paid API credits (money spent on third-party AI services like OpenAI or Gemini) by triggering unnecessary document processing.

Solution: N/A -- no mitigation discussed in source.


From Indirect Prompt Injection to DNS Exfiltration in macOS Terminal

Summary: Researchers discovered a vulnerability where LLMs (large language models) could be tricked through prompt injection (hiding malicious instructions in data) to emit ANSI escape codes (special terminal control sequences), which macOS Terminal would interpret as commands to make DNS requests (requests that translate domain names to IP addresses) containing stolen data. Apple fixed this behavior in macOS Tahoe 26.1, released November 3, 2025, so the vulnerable escape sequences no longer trigger DNS requests.

Solution: Apple addressed the issue in macOS Tahoe 26.1, released on November 3, 2025. After installing the update, the same escape sequence no longer triggers a DNS request in the Terminal app.


The executive profile your security team isn’t defending

Summary: AI tools can now quickly assemble comprehensive profiles of executives from publicly available information, creating a major security risk for social engineering attacks (tricks that manipulate people into revealing access credentials or sensitive data). What once took skilled analysts days to compile now takes minutes, making executives viable targets for less-skilled attackers and expanding the pool of potential threats significantly.


OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol

Summary: OpenAI has developed GPT-Red, an automated red-teaming model (a tool that simulates attacks to find vulnerabilities) that searches for prompt injection vulnerabilities (tricks where hidden instructions in user input make an AI behave unexpectedly) in its language models before deployment. By using GPT-Red to test and improve GPT-5.6 Sol during training, OpenAI achieved a model that is 6 times more resistant to prompt injection attacks compared to its previous version.

Solution: OpenAI directly integrated GPT-Red into the training process of GPT-5.6 Sol using self-play reinforcement learning, where the attacking model and defender models are trained simultaneously on red-teaming scenarios. The defender models are rewarded for resisting attacks, making them progressively more robust. OpenAI also keeps GPT-Red separate from other models so its malicious capabilities do not reach bad actors.

OpenAI
GPT-Red
GPT-5.6 Sol
GPT-5.5
GPT-5.4 mini
Codex
Andon Labs


CVE-2026-11371: The BetterDocs  WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and

Summary: The BetterDocs WordPress plugin before version 4.5.5 has a security flaw where it doesn't clean up AI-generated documentation summaries before storing and displaying them. Because this feature is available to users who aren't logged in, attackers can use prompt injection (tricking the AI by hiding malicious instructions in their input) to store harmful code that runs in visitors' browsers, including admin accounts.

Solution: Upgrade the BetterDocs WordPress plugin to version 4.5.5 or later.


Flaw surge fuels need for CISOs to rethink vulnerability management

Summary:
```json
{
  "summary": "AI tools are making it easier for attackers to find and exploit vulnerabilities much faster than organizations can patch them, breaking traditional vulnerability management systems that rely on scheduled updates. Security experts recommend moving toward "just in time" patching (fixing vulnerabilities as soon as they are discovered and actively exploited, rather than waiting for scheduled maintenance windows) and using compensating controls (security measures that block at

Solution: N/A — no mitigation discussed in source.


Mermaid to Unicode box art (grok-mermaid)

Summary: A developer discovered a tool called grok-mermaid in Grok's open-source codebase that converts Mermaid diagrams (visual flowcharts and charts created with code) into Unicode box art for display in terminals. They adapted this Rust-based tool to work in web browsers using WebAssembly (a technology that lets compiled code run in browsers).


How Cars24 scales conversations and builds faster with OpenAI

Summary: Cars24, a major automotive marketplace in India, uses OpenAI's technology to build AI agents that handle conversations across the entire customer journey, from car discovery to post-purchase support, allowing the company to scale without constantly hiring more staff. The company also deployed Codex (a code-writing AI) across its software development process to help engineers and product managers move work from task creation through implementation and bug fixes more efficiently.


xai-org/grok-build, now open source

Summary: xAI's grok CLI tool (a command-line coding assistant) had a critical privacy flaw where running it in a directory would automatically upload that entire directory to xAI's cloud servers, exposing users' SSH keys, passwords, and personal files without clear consent. After public backlash, xAI disabled the upload feature, deleted all previously uploaded user data, changed the default to keep data local, and released the tool's entire source code (844,530 lines of Rust) under an open Apache 2.0 license to rebuild trust and let users run it privately on their own computers.

Solution: xAI took the following steps explicitly mentioned in the source: (1) disabled the data upload feature, (2) deleted all user data that was previously uploaded to their servers, (3) disabled data retention by default for all users starting July 12th, and (4) released the entire Grok Build codebase as open-source under Apache 2.0 license so users can run it 'fully open-sourced and local-first with your own inference' without uploading to their servers.

xAI
Grok Build
Grok
OpenAI Codex
Anthropic Claude
Cursor


GHSA-r3hx-x5rh-p9vv: django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

Summary: django-haystack's Elasticsearch backend contains a remote code execution vulnerability where it calls `eval()` (a function that executes Python code from strings) on field values without proper validation. This happens when a SearchField uses an `index_fieldname` alias different from its logical name; the lookup fails and the raw value is passed to `eval()`. An attacker who can control indexed content and trigger a search can execute arbitrary code on the Django application.


CVE-2026-30623: LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application

Summary: LiteLLM version 1.18.10 has a remote code execution vulnerability in its MCP server creation feature, where the application accepts JSON configuration files with arbitrary command and args values and executes them without checking if they're safe, allowing attackers to run unauthorized operating system commands with the privileges of the LiteLLM process.


GHSA-62gx-5q78-wrvx: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

Summary: The Obsidian Local REST API plugin has a path traversal vulnerability (a flaw where attackers can access files outside the intended directory) in its `/vault/{path}` endpoints. An authenticated attacker can bypass path validation by using URL-encoded characters like `%2F` (encoded forward slash) and `%2e%2e` (encoded dots), which aren't blocked during initial routing but get decoded later, allowing them to read, write, or delete arbitrary files on the host system with the privileges of the Obsidian process.

Solution: Apply the same `posix.resolve(syntheticRoot, …)` plus `startsWith` confinement check that already exists in the `vaultMove` handler to all other vault handlers (GET/PUT/PATCH/POST/DELETE). Specifically, for each handler's decoded path, resolve it against a synthetic root of `/vault` and reject any result that does not equal `/vault` or start with `/vault/`, and reject any segment that decodes to `..`.

Obsidian
obsidian-local-rest-api
MCP (Model Context Protocol)


xAI sues a man for using Grok to generate CSAM ‘deepfakes’

Summary: xAI, owned by Elon Musk, is suing a South Carolina man who allegedly used their Grok AI chatbot to generate and distribute child sexual abuse material (CSAM, which refers to illegal images depicting child exploitation). The man, Terry Wayne Harwood, was arrested in February and is facing criminal charges; xAI claims he deliberately bypassed the chatbot's safety protections to create these illegal images.


CVE-2026-50144: ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434

Summary: ncnn is a framework that runs AI neural networks efficiently on mobile devices. A vulnerability exists where loading a malicious model file can cause an out-of-bounds heap write (writing data to memory locations outside the intended array), because the code only checks if a parameter ID is too large, but doesn't prevent negative IDs from accessing memory before the array.

Solution: This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020.


CVE-2026-15746: Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provide

Summary: Strands Agents is an open-source Python SDK for building AI agents, and its elasticsearch_memory tool (used for storing agent memory) had a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended destinations). The tool allowed the LLM to control connection settings, so a crafted prompt could make it connect to an attacker's server and leak the operator's Elasticsearch API key in the process.

Solution: Upgrade to strands-agents-tools version 0.7.0 or later. Additionally, all operators should rotate their ELASTICSEARCH_API_KEY environment variable as a precautionary measure, even if there is no evidence the credential was exposed.


CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool

Summary: Strands Agents, a Python SDK for building AI agents, contained a vulnerability (CVE-2026-15746) in its elasticsearch_memory tool where connection settings could be controlled by the LLM (the AI model itself). If an API key wasn't provided, the tool would use the operator's Elasticsearch API key from their environment and send it to any server the LLM directed it to, allowing attackers to steal credentials through a crafted prompt.


TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Summary: Cybersecurity researchers discovered TuxBot v3 Evolution, an IoT botnet (malicious software that infects Internet-connected devices to use them for attacks) that was developed with help from an LLM (large language model, an AI system trained on text). The botnet includes multiple components designed to compromise IoT devices through weak credentials and known vulnerabilities, then use them for DDoS attacks (overwhelming a target with traffic to disable it) and other malicious activities, though the LLM-generated code contained errors and leftover safety warnings that the developer did not clean up.


Google Gemini CLI abused as a hacking agent, malware botnet operator

Summary: A Russian-speaking attacker named 'bandcampro' exploited Google's open-source Gemini CLI (a command-line interface for Google's AI model) to operate a botnet, which is a network of compromised computers controlled remotely. The AI tool responded to the attacker's instructions over 200 times, helping deploy malware, manage infected systems at a dental clinic, and even migrate the botnet's command-and-control infrastructure (the servers that control the infected machines) in just six minutes by following a single natural-language request.


Why Jim Cramer is shocked by Citi's against-the-grain praise of Microsoft's Copilot

Summary: This article appears to be a CNBC webpage about financial commentary regarding Microsoft's Copilot (an AI assistant tool), but the provided content contains only footer, navigation, and legal information with no actual article text or technical details about the topic.


CVE-2026-58659: PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_st

Summary: PyTorch Lightning (a framework for training AI models) versions up to 2.6.5 contain a remote code execution vulnerability (a security flaw that lets attackers run their own code on your computer) in the _load_state function. Attackers can create malicious checkpoint files (saved model data) that bypass security protections and execute harmful code when you load a model using LightningModule.load_from_checkpoint.

Solution: Fixed in commit d710d68 (a specific code update in the PyTorch Lightning repository).


Suno snatched millions of songs from YouTube, Genius, and Deezer

Summary: Data from a hacking incident revealed that Suno, an AI music generator, trained its models by scraping (automatically copying) millions of songs and lyrics from platforms like YouTube Music, Deezer, and Genius without disclosing these sources. This discovery is significant because Suno faces multiple lawsuits claiming it used copyrighted material to train its AI models, and the company had previously kept its training data sources secret.


GHSA-3pvh-63gf-j9mw: LangBot: Authenticated RCE Via MCP Configuration

Summary: Authenticated users of LangBot can run any command they want on the server by adding a malicious STDIO MCP (a plugin system that executes external programs) through the Extensions settings. An attacker who logs in (either through their own account or stolen credentials) can configure the MCP to run arbitrary commands, giving them complete control over the machine.

LangBot
Anthropic
Model Context Protocol


Anthropic moves closer to mega-IPO as bankers line up investor meetings

Summary: Anthropic, the AI company behind the Claude models, is preparing for an initial public offering (IPO, the process of selling shares in a private company to the public) later in 2025, with bankers already scheduling investor meetings to gauge demand. The company filed its IPO prospectus confidentially with the SEC and could potentially go public as early as October, which would make it one of the first major AI startups to enter public markets.

Anthropic Claude OpenAI SpaceX Apple Alibaba Qwen Meta ASML


Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer

Summary: OpenAI built GPT-Red, an AI model trained to attack other AI systems, and uses it to find security weaknesses before releasing new versions like GPT-5.6. GPT-Red specializes in finding prompt injection attacks (where hackers hide malicious instructions in text that the AI reads), including a previously unknown attack type called fake chain of thought where false information is inserted into the AI's internal reasoning process. The model trains against other AI systems in a self-play loop (where it repeatedly attacks while others defend) within simulated real-world scenarios, making it better at finding effective attacks than human testers alone.


Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife

Summary: The US government has placed restrictions on advanced AI models from companies like Anthropic and OpenAI, which has prompted the UK and other countries to consider becoming less dependent on American technology companies. This shift raises concerns about cybersecurity (the protection of computer systems and data from unauthorized access) and international tech competition.


OpenAI finally launches hardware… for Codex

Summary: OpenAI has released Codex Micro, a small hardware device made with keyboard company Work Louder that allows users to better monitor and control coding agents (AI systems that can write and manage code). This is a limited-run collaboration, separate from OpenAI's previously announced consumer device being developed with designer Jony Ive.


Claude Flaw Automatically Sends Malicious Prompts to AI Agents

Summary: A vulnerability called PromptFiction in Claude (an AI assistant) could be combined with another exploit to launch an end-to-end attack (a complete attack from start to finish on a target system) on a targeted system. The vulnerability has already been fixed.

Solution: The vulnerability has been fixed.


CVE-2026-61613: Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Curso

Summary: Cursor is a code editor that uses AI to help with programming. Before a fix on March 31, 2026, attackers could use malicious web content to connect to an unprotected local endpoint (a communication point on a user's computer) in Cursor's Cloud Agent, allowing them to run code, steal files, access environment variables (settings that programs use), steal credentials (login information), and take GitHub App access tokens (digital keys that grant permissions to GitHub accounts).

Solution: This issue was fixed on 03/31/2026 by requiring authentication for the relevant agent endpoint.


How I tricked Claude into leaking your deepest, darkest secrets

Summary: A researcher discovered a vulnerability in Claude's web_fetch tool (a feature that lets Claude access websites) that could leak private user information like names and locations. The tool was supposed to only visit URLs that users directly entered, but it could also follow links found within web pages it had already fetched, allowing attackers to create deceptive websites that trick Claude into extracting sensitive data by following a chain of hidden links.

Solution: Anthropic closed the vulnerability by removing the ability for web_fetch to navigate to additional links returned within its own fetched content.


We built a vulnerability vending machine: AI tokens in, zero-days out

Summary: Researchers at Intruder built an automated system using LLMs (large language models, AI systems trained on text data) to find real security vulnerabilities in software code, discovering a SQL injection zero-day (a previously unknown security flaw) in a WordPress plugin with 300,000+ users. The key challenge is that pointing an LLM at an entire codebase causes it to lose focus by processing irrelevant code, so they developed a pipeline using program slicing (a technique that extracts only the relevant code segments) combined with code scanning tools to give the LLM focused context and filter findings through multiple AI models before attempting exploitation.


The Risk of Exposed Cloud Functions and How to Harden

Summary: Publicly exposed serverless applications (cloud functions that run code without requiring you to manage servers) often lack proper authentication and input validation, making them vulnerable to attacks like LFI (local file inclusion, where attackers read files they shouldn't access) and command injection (inserting malicious commands into user inputs). Successful exploitation can give attackers full control of the container instance and potentially the entire cloud environment.


AI Security Is Never Finished: Building the Continuous Red Teaming Loop

Summary: AI security testing is fundamentally different from traditional software security because AI systems continuously change in production, making past test results unreliable indicators of current safety. Red teaming (simulated attacks to find vulnerabilities) must be ongoing rather than a one-time checklist, since model behavior, prompts, data sources, and attacker methods all evolve constantly.


New bugs in Claude for Chrome allow extensions to abuse AI privileges

Summary: Two security flaws in Anthropic's Claude for Chrome extension allow malicious browser extensions to trick Claude into performing privileged actions like reading Gmail, Google Docs, and Calendar data on a user's behalf. The vulnerabilities have remained unfixed for months despite being reported to Anthropic in May, with the company marking an internal tracking issue as 'resolved' while the problematic code remained unchanged across eight releases. The first flaw involves synthetic clicks (fake user interactions generated by malicious code) bypassing verification checks, while the second involves a URL parameter that improperly grants elevated privileges.

Solution: The source explicitly mentions a fix for the first vulnerability: adding one line of code, 'if (!n.isTrusted) return;' at the top of the click handler to verify clicks are from real users. For the second vulnerability, the source recommends general practices (validating genuine user interactions, avoiding URL-driven privilege transitions, and strengthening internal extension authentication) but does not describe a specific implemented fix or version where these are resolved.


The US is advancing AI safety through state and federal action

Summary: The US is developing AI safety standards through coordinated state and federal legislation, with California, New York, and Illinois leading efforts to create a common framework for governing powerful AI systems. These states are implementing three key elements: documented safety frameworks with risk assessments and public disclosure, reporting of serious safety incidents, and independent audits for accountability. This approach, called reverse federalism (states establishing shared direction through common frameworks), aims to create a de facto national standard that prevents regulatory chaos while keeping the US competitive in AI innovation globally.

Solution: According to the source, states should align on three core elements: (1) a documented safety framework with risk assessments for frontier models (AI systems at the cutting edge of capability) and public disclosure of those assessments and their results, (2) reporting of serious safety incidents, and (3) governance and accountability through independent, objective audits. The source states that California, New York, and Illinois have already implemented these elements as a model for other states to follow.


SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough.

Summary: Traditional SASE (Secure Access Service Edge, a cloud-based security tool that inspects network traffic) cannot protect against modern data risks because it inspects encrypted traffic at network checkpoints, but today's threats happen inside applications and AI workflows where the network cannot see them. Modern encryption protocols like TLS 1.3 prevent network proxies from inspecting traffic without breaking applications, forcing organizations to create exemptions that weaken security, while AI agents can leak sensitive data through chat interfaces or tool calls before the network ever sees the interaction.

Solution: The source explicitly describes a shifted architecture: enforcement must happen "at the point of interaction, on the device: the browser and the endpoint" with "contextual data protection" where "copy, paste, and prompt content are inspected locally before data ever leaves the device." Traffic should be "steered dynamically to the closest available edge infrastructure, eliminating redundant hops," and the source mentions adoption of the "Perfect Packet" architecture, which "evaluates context at the endpoint before routing, invoking cloud inspection only when a session requires additional verification."


TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

Summary: Researchers discovered TuxBot v3 Evolution, a modular IoT botnet (malware that infects internet-connected devices and controls them remotely) framework where the developers used an LLM (large language model, an AI trained to understand and generate text) to help write the malware code. Although the LLM generated working botnet code, it included safety warnings that the developers left in place, and the code contained several bugs that manual review could have caught, suggesting more polished versions may already exist in the wild.


GPT-Red: Unlocking Self-Improvement for Robustness

Summary: GPT-Red is an automated red-teaming model (a system designed to find vulnerabilities by simulating attacks) that helps discover weaknesses in AI systems before they're released to the public. OpenAI trained GPT-Red using self-play reinforcement learning (a technique where the model competes against defender models to improve both sides) to find prompt injection attacks (tricks that hide malicious instructions in user input), and then used these findings to train GPT-5.6, making it six times more resistant to such attacks compared to earlier models.

Solution: OpenAI directly incorporated GPT-Red into the training process of their production models. The source states they "directly incorporate GPT‑Red into the training process of our production models" through self-play reinforcement learning, where GPT-Red is trained alongside defender LLMs (large language models) on realistic red-teaming scenarios. As defenders become more robust, GPT-Red discovers stronger attacks, creating an iterative improvement cycle. The source also notes they "will continue to scale this approach alongside human and third-party red-teaming, layered safeguards, and real-time monitoring."


Cybersecurity needs more prevention and less reliance on cure

Summary: The cybersecurity industry has over-invested in detection tools (systems that identify attacks after they happen) rather than prevention tools (systems that block attacks before they occur), even though prevention is more cost-effective and reduces actual risk. Modern attacks now move faster than human teams can respond, so relying on detection and alerts creates alert fatigue (when too many false alarms overwhelm security staff) and leaves organizations vulnerable to initial compromises from known vulnerabilities, stolen credentials, or misconfigurations.


7 skills and traits of elite security engineers

Summary: Security engineers design and deploy systems to protect organizations from cyber threats, and their role is evolving due to AI. Elite security engineers need skills in using AI-powered tools (software that uses machine learning to automate security tasks), understanding AI-related threats like prompt injection (tricking an AI by hiding instructions in its input) and model poisoning (corrupting training data to make AI systems malfunction), and balancing security with business performance goals. As AI automates detection and vulnerability scanning work, security engineers are shifting from responding to incidents toward interpreting AI findings and deciding on appropriate responses.


Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bug

Summary: Microsoft released a record 569 patches in a single month, with 59 rated as critical, partly because AI models can now help discover vulnerabilities faster. The company is recommending that customers speed up their patching schedules to address critical flaws more quickly. Separately, SAP patched a critical memory corruption bug with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 9.9.

Solution: Microsoft is recommending that customers accelerate their patching schedules to more quickly deal with critical flaws.


OpenAI may announce a ChatGPT smart speaker this year

Summary: OpenAI is planning to release a smart speaker device that lets users speak to ChatGPT and includes a camera and sensors to understand the surrounding environment, though it will have no screen. The device will have a rechargeable battery for portability and smart home control features, though this announcement comes amid legal disputes with Apple over alleged hardware theft.

Solution: N/A -- no mitigation discussed in source.


CVE-2026-47475: NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a re

Summary: NVIDIA TensorRT-LLM (a tool for running large language models efficiently) contains a vulnerability in its OpenAI-compatible API where an attacker could trigger a reachable assertion (a failed safety check in the code) in the sampler thread, potentially causing the system to crash. This vulnerability could lead to a denial of service attack (making the service unavailable to legitimate users).


CVE-2026-24271: NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause alloc

Summary: NVIDIA TensorRT-LLM (a tool for running large language models efficiently on NVIDIA GPUs) has a vulnerability in its OpenAI-compatible inference API that allows attackers to request unlimited GPU resources without restrictions. This could cause a denial of service (making the system unavailable to legitimate users) by exhausting the GPU's memory and processing power.


CVE-2026-24233: NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization

Summary: NVIDIA TensorRT-LLM for Linux has a vulnerability in its unpickler (a tool that converts serialized data back into usable objects) that allows local attackers to deserialize untrusted data. A successful attack could lead to code execution, privilege escalation, data tampering, and information disclosure.


GHSA-2cf7-hpwf-47h9: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

Summary: In n8n-mcp (a tool that connects AI models to workflows) running in multi-tenant HTTP mode (where multiple separate users share one server), an authenticated user could bypass access controls and read or delete workflow backups stored in the default single-tenant scope instead of being restricted to their own workspace. This could expose sensitive workflow configuration information.

Solution: Upgrade to n8n-mcp version 2.57.4 or later. The fix requires a complete tenant context in multi-tenant mode and fails closed for workflow-version access that cannot be attributed to a specific tenant. Alternatively, restrict network access to the HTTP endpoint using a firewall or reverse proxy, run in stdio mode (which has no multi-tenant HTTP surface), or remove default-scope backups from prior single-tenant deployments if they are no longer needed.


CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory

Summary: CVE-2026-47482 is a memory leak vulnerability (a bug where a program fails to free up memory it's no longer using) in NVIDIA Triton Inference Server for Linux that allows attackers to cause a denial of service (making a service unavailable to legitimate users). The vulnerability stems from the software not properly releasing memory after it's finished using it.


CVE-2026-47481: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass t

Summary: CVE-2026-47481 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows attackers to bypass authentication (security checks that verify a user's identity) through an alternative path or channel. If successfully exploited, this flaw could let attackers run their own code on the system, gain higher-level access, steal information, or modify data.


CVE-2026-47480: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A s

Summary: CVE-2026-47480 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to trigger an uncaught exception (an error that the program doesn't handle properly), potentially causing a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment has not yet been provided.


CVE-2026-47479: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource cons

Summary: CVE-2026-47479 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause uncontrolled resource consumption (using up all available computing power or memory), potentially leading to a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though a complete assessment from NIST has not yet been provided.


CVE-2026-47478: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file

Summary: CVE-2026-47478 is a vulnerability in NVIDIA Triton Inference Server for Linux where an attacker can exploit the use of an expired file descriptor (a reference to an open file that is no longer valid), potentially causing a denial of service (making the service unavailable to legitimate users). The vulnerability has a CVSS 4.0 severity rating, though the exact scoring details have not yet been provided.


CVE-2026-47477: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overf

Summary: CVE-2026-47477 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows an attacker to cause a stack-based buffer overflow (a situation where data written to memory exceeds its allocated space, potentially crashing the system). A successful attack could result in denial of service (making the service unavailable to legitimate users).


CVE-2026-47476: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource cons

Summary: CVE-2026-47476 is a vulnerability in NVIDIA Triton Inference Server for Linux that allows attackers to cause uncontrolled resource consumption (using up computing resources like memory or CPU without limit), potentially leading to denial of service (making the system unavailable to legitimate users). The vulnerability is classified as CWE-400 (uncontrolled resource consumption), though a CVSS severity score has not yet been assigned by NIST.


Global cooperation needed to tackle AI threats, says Bank of England governor

Summary: The Bank of England governor called for international cooperation to address AI threats, warning that the US cannot secure itself against cyber dangers without global coordination. He emphasized that no country can isolate itself from the cross-border nature of modern systems, and stressed the need for stronger coordinated testing to ensure frontier AI (advanced AI models at the cutting edge of capability) models are safe before wider use.


CVE-2026-15643 - AWS HealthLake MCP Server SSRF via Unvalidated Pagination URL

Summary: AWS HealthLake MCP Server (a tool that lets AI assistants access AWS health data) before version 0.0.14 has a security flaw where it doesn't check that pagination URLs (links used to load more results) point to the legitimate server. An authenticated attacker can exploit this by sending a crafted next_token parameter (a special value that tells the server what data to load next) to redirect requests to their own server and steal temporary AWS credentials (temporary access keys that grant permissions).

Solution: Update AWS HealthLake MCP Server to version 0.0.14 or later.


GHSA-q3v2-xj35-9grx: Umbraco.AI discloses sensitive application configuration values

Summary: A vulnerability in Umbraco.AI could allow users with high-level permissions to expose sensitive configuration values, like passwords and credentials, under certain setups. The vulnerability requires access to the AI section of the admin panel and a specific custom AI provider, which limits how many systems are at risk.

Solution: Patched in version 1.14.0. The source notes that a workaround is not recommended because the patch involves breaking changes that require a full version upgrade.


GHSA-2c7f-fxww-6w6c: yutu: Arbitrary File Write via MCP `caption-download` Tool

Summary: The yutu MCP tool `caption-download` has a vulnerability where it writes downloaded files to any path specified by an attacker, bypassing the `YUTU_ROOT` directory boundary that should confine all file operations. Unlike other caption methods that properly use `pkg.Root.Open()` to restrict file access, `Caption.Download()` directly calls `os.Create()` on the attacker-supplied file path, allowing arbitrary file writes anywhere the yutu process has permission to write (CVSS 7.7, high severity).

Solution: Change line 272 in `pkg/caption/caption.go` from `file, err := os.Create(c.File)` to `file, err := pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)` to confine file creation to the `pkg.Root` boundary, matching the approach used in other caption methods.

github.com/eat-pray-ai/yutu@< 0.10.9-dev1 (fixed: 0.10.9-dev1)


SpaceXAI’s Grok programming tool was uploading its users’ entire codebase to cloud storage

Summary: SpaceXAI's Grok Build AI coding tool was uploading users' entire codebases (the complete collection of source code files for a project) to Google Cloud storage without proper controls, including files users wanted to exclude and sensitive credentials (secret authentication data). The company disabled this upload feature after security researchers discovered and reported the issue.

Solution: SpaceXAI's servers now return a "disable_codebase_upload: true" flag, and the codebase upload feature "no longer fires" (does not activate).


GHSA-j6r7-6fhx-77wx: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

Summary: In n8n-MCP (a tool for connecting AI models to workflows), multi-tenant HTTP deployments (where one server serves multiple separate user groups) did not properly isolate workflow version backups. This meant an authenticated user from one tenant could read, delete, or destroy backup snapshots belonging to other tenants, potentially exposing sensitive information like credentials and authorization headers stored in those backups.

Solution: Upgrade to version 2.56.1, which isolates stored version history per instance so tenants can only access their own backups. The upgrade runs a one-time migration to isolate existing history and clear previously un-scoped backups. If immediate upgrade is not possible, users can disable the workflow version tool by setting `DISABLED_TOOLS=n8n_workflow_versions` in the server environment (for example, in your Docker `.env` file), or run each tenant from a separate instance with its own database instead of multi-tenant mode, or restrict network access to the HTTP endpoint to trusted operators only.


CVE-2026-58617: Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a ne

Summary: CVE-2026-58617 is a vulnerability in Microsoft 365 Copilot for iOS that allows an unauthorized attacker to gain elevated privileges (higher access permissions) over a network due to improper access control (failing to properly verify who is allowed to do what in the system). The vulnerability has a CVSS score of 4.0, which indicates a moderate severity level.


CVE-2026-55145: Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authori

Summary: CVE-2026-55145 is a command injection vulnerability (a type of attack where an attacker inserts malicious commands into user input) in Outlook Copilot that allows an authorized user to tamper with the system over a network. The vulnerability stems from improper handling of special characters in commands. The CVSS severity score (a 0-10 rating of how dangerous the vulnerability is) has not yet been assigned by NIST.


CVE-2026-50510: Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute

Summary: CVE-2026-50510 is a vulnerability in GitHub Copilot where improper file naming restrictions allow an unauthorized attacker to execute code on a user's local machine. The vulnerability is classified as CWE-641 (improper restriction of names for files and other resources), and details are being tracked by Microsoft and NIST.


CVE-2026-45067: ### Description

`Symfony\Component\Mime\Address` is the value-object every Symfony Mailer address (to/cc/bcc/from/reply

Summary: A vulnerability in Symfony Mailer's Address class allowed attackers to inject email headers and SMTP commands (the protocol used to send emails) by embedding line break characters in email addresses. The constructor was supposed to validate addresses but failed to catch addresses with hidden `\r\n` bytes in the local-part (the text before the `@` symbol), which could be exploited to add unauthorized recipients or headers when the email was sent.

Solution: The Address constructor now rejects addresses containing line breaks. The patch is available at https://github.com/symfony/symfony/commit/dc2dbd29211eb4ddc451373fa1374fb926e94604 for branch 5.4.


Book publishers sue Google for copyright infringement over Gemini AI training

Summary: Major book publishers including Hachette, Cengage, and Elsevier have sued Google in federal court, claiming the company illegally used millions of copyrighted books to train its Gemini AI model (a large language model trained on text data) without permission. The publishers describe this as one of the largest copyright infringements in history.


Apple in talks with startup that shrinks AI models to run on an iPhone

Summary: Apple is in talks with PrismML, a startup that compresses large AI models (mathematical systems with billions of parameters that process information) so they can run directly on iPhones instead of requiring cloud servers. PrismML shrunk Alibaba's 54 GB Qwen model down to under 4 GB by drastically simplifying how the model stores information, allowing the compressed version to run on iPhone 15 and newer devices while using significantly less memory and energy, though with some loss in accuracy.

Apple PrismML Alibaba Qwen OpenAI Anthropic Google Gemma NVIDIA


Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

Summary: Researchers found that any browser extension able to run scripts on claude.ai can trigger Claude for Chrome to access your Gmail, Google Docs, and Calendar by forging a fake click, since the extension doesn't verify that clicks are from real users rather than scripts. The flaw is rated as high or critical severity depending on whether you have the "Act without asking" automation mode enabled, and while a simple one-line fix exists, Anthropic has not yet released it in the current version 1.0.80.

Solution: The quickest guard is to turn "Act without asking" off and review any extension with permission to read or change data on claude.ai. Researchers also note that "the one-line fix, the researchers say, rejects synthetic clicks at the top of the handler" but confirm this fix "has not shipped" as of July 14.

Anthropic
Claude
Claude for Chrome
Gmail
Google Docs
Google Calendar
DoorDash
Salesforce
Zillow


CVE-2026-48561: Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unaut

Summary: CVE-2026-48561 is a command injection vulnerability (a flaw where an attacker tricks software into running unintended commands by inserting special characters into input) in Microsoft Copilot that allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper handling of special elements in commands. Details about the severity and available fixes are still being assessed.


CVE-2026-47282: Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclos

Summary: GitHub Copilot and Visual Studio Code contain a vulnerability where credentials (login information and authentication tokens) are not properly protected, allowing an attacker to access sensitive information over a network. This is tracked as CVE-2026-47282 and has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0, meaning it has moderate severity.

GitHub Copilot
Visual Studio Code
Microsoft


Authenticate legitimate AI agent traffic with AWS WAF Bot Control

Summary: AWS WAF Bot Control now includes Web Bot Authentication (WBA), a security feature that uses cryptographic signatures (mathematical verification codes created with public and private keys) to confirm that automated bot traffic comes from legitimate sources. Traditional methods like IP-based filtering fail in multi-tenant systems (shared environments where many different services use the same IP address) where attackers can easily fake their identity, but WBA solves this by having bot operators sign their requests with cryptographic keys that AWS WAF can verify at the edge.

Solution: AWS WAF Bot Control implements Web Bot Authentication (WBA) using asymmetric cryptography and HTTP Message Signatures (RFC 9421). The solution works through: (1) Bot registration, where bot operators publish their public keys in a signature directory that AWS WAF regularly polls; (2) Request signing, where each bot request is signed using the operator's private key following IETF standards; (3) Verification, where AWS WAF verifies signatures against known public keys and appends labels (verified, invalid, expired, or unknown_bot) to allow granular control through WAF rules. AWS WAF Bot Control respects WBA verification status by default, automatically allowing verified AI agent traffic.


The UK wants to catch up in the global AI race – but is too wary to go all-in

Summary: The UK faces a dilemma in competing globally with AI technology, caught between wanting to invest heavily in AI and worrying about three simultaneous risks: putting too much money into AI company stocks, companies adopting AI more slowly than expected, and the extremely rapid pace of AI development making it hard to keep up. The article discusses broader concerns about the UK's position in the global AI competition alongside questions about major AI companies' future plans.


Unpatched Claude for Chrome Flaw Lets Extensions Read Gmail, Calendar

Summary: Two unpatched security flaws in Claude for Chrome (Anthropic's browser extension that can take actions on a user's behalf) allow a malicious extension to trick Claude into reading Gmail, Google Docs, and calendar data without real user approval. The vulnerabilities bypass the extension's safety checks by faking user clicks and can operate silently if the user has enabled the extension's autonomous mode ('Act without asking'), and researchers say this remains exploitable in the latest version 1.0.80.


The Download: Claude’s inner workings, and the future of world models

Summary: Anthropic announced a discovery that provides insight into how Claude (an AI model) reasons internally by examining its 'thoughts' as it works through problems. The article notes this research shows a new window into AI model operations, though the full implications of what this reveals about how AI systems actually work remain unclear.


How Pentera Turns AI Security Workflows into Validation Engines

Summary: AI security systems currently make decisions based on fragmented data from separate tools, which cannot detect real attack paths because attackers chain exposures across multiple systems in ways individual tools don't see. The article argues that AI security workflows need validation (testing whether vulnerabilities can actually be exploited in a real environment) rather than just severity scores, so teams act on proven attack evidence instead of guesswork. Pentera addresses this by using AI to safely emulate real attacker techniques against production environments and generate validated attack paths showing exactly how an attacker could move through the system.

Solution: Pentera introduced an MCP (Model Context Protocol, a standard for connecting AI assistants to external tools) Server that makes validated attack path data from Pentera directly available to MCP-compatible AI assistants, so security teams can access validation evidence within the same AI workflows where they investigate and prioritize findings instead of switching between separate tools.


How to manage AI investments in the agentic era

Summary: This article discusses how enterprise leaders should manage spending on AI tools as they move from simple chat interfaces to more complex, longer-running workflows. It recommends focusing on the actual value delivered (tasks completed, time saved) rather than just the cost per token (a unit of text the AI processes), and emphasizes the need for better visibility into who is using AI, what they're using it for, and how much it costs.

Solution: The source explicitly mentions several management tools and approaches: (1) Updated usage analytics and spend controls in the Admin Console help admins see adoption, credit usage, and spend by user, product, and model, track trends over time, and identify emerging patterns. (2) Evaluate models by measuring the full cost of reaching acceptable outcomes, including model and tool usage, attempts, completion rate, latency, and human review, rather than choosing based on token price alone. (3) Use clear instructions, focused tools, reusable context, and explicit stopping conditions to reduce loops and wasted spend. (4) ChatGPT Work provides centralized controls for access, approved context, connected tools, permitted actions, usage, and spend, with spend controls such as workspace defaults to govern advanced workflows before they scale.


Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

Summary: Grok Build, xAI's coding assistant, was uploading entire Git repositories (a version control system that tracks code changes) to cloud storage, not just the files it needed to read. A researcher discovered that a 12 GB repository generated only 192 KB of traffic to the model but 5.10 GB to storage, and even files the AI was instructed not to open were included, along with unredacted credentials like API keys and passwords. Unlike competing tools from Claude and Google, Grok Build was the only one collecting the entire workspace.

Solution: On July 13, xAI disabled the storage uploads server-side by switching a flag (disable_codebase_upload: true and trace_upload_enabled: false), which multiple users confirmed they received. However, xAI has not confirmed whether this change applies to all accounts or is permanent, and no update to the software itself was released—the change was made on the server side while users remained on version 0.2.93.


AI incidents need a new playbook. Here’s how to build one

Summary: Most organizations have AI systems in production but lack incident response (IR) playbooks specifically designed for AI failures, relying instead on traditional security frameworks that don't address AI-specific problems. AI incidents fall into two categories with very different causes and defenses: model-originated failures (like hallucinations or bias that happen during normal operation) and externally induced failures (like adversarial attacks or data poisoning), plus hybrid cases where AI errors create legal liability. Traditional security frameworks like the CIA triad (confidentiality, integrity, availability) don't detect many AI incidents because they assume deterministic, static failures, but AI systems produce probabilistic outputs that can't be patched like code vulnerabilities.


AI-powered breaches provide wake-up call for incident response

Summary: Attackers are increasingly using AI agents (autonomous AI systems that can perform multiple tasks without human control) to automate all stages of cyberattacks, from initial entry to stealing data and establishing persistence (maintaining long-term unauthorized access). This automation dramatically speeds up attacks compared to traditional manual hacking, and security experts warn that most organizations haven't updated their defenses to handle this threat, especially since these AI attacks often exploit unpatched systems and common weaknesses rather than requiring advanced zero-day vulnerabilities (previously unknown security flaws).


CVE-2026-12482: A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the

Summary: Keras version 3.12.0 has a vulnerability where an attacker can create a specially crafted tar archive (a compressed file format) that gets extracted in unintended locations. The problem is that symlinks (shortcuts that point to other files or directories) bypass safety checks that regular files must pass, allowing attackers to read files, overwrite files, or escape the intended extraction directory. This is especially dangerous on Python 3.10 and 3.11.


Ed Husic tells Labor to get tougher on AI companies as letting them self-regulate ‘doomed to fail’

Summary: Labor MP Ed Husic argues that AI companies should not be allowed to regulate themselves and warns that weakening copyright laws (rules controlling who can use creative works) to help AI companies would contradict his party's values. The Media Entertainment & Arts Alliance, a union representing journalists and artists, is calling on the government to create stricter copyright rules to stop AI models from being trained on creative works without permission.