Post-Quantum Secure Semantic Communication With Discrete Latent Representations

Summary: This research paper proposes a post-quantum secure semantic communication (PQSC) framework that protects data transmission against both eavesdropping and future quantum computing threats. The framework combines learning with errors (LWE, a type of encryption believed to resist quantum attacks) with VQ-VAE (a neural network compression technique) to send information efficiently while keeping it secure. Experiments show this approach works better than existing methods across different network conditions and data types.


Graph-Based Contrastive Learning and Clustering for Open-World Encrypted Traffic Classification

Summary: This research proposes GCLC (Graph-based Contrastive Learning and Clustering), a framework for classifying encrypted network traffic (data sent over networks in coded form) in open-world scenarios where unknown traffic types may appear. The system uses Graph Neural Networks (machine learning models that work with interconnected data) and special learning techniques to identify traffic patterns even when data is imbalanced or new, achieving 95% accuracy at recognizing previously unseen traffic classes.

Solution: N/A -- no mitigation discussed in source.


Securing AI Agent Behavior with Amazon Bedrock AgentCore and CheckPoint AI Security

Summary: AI agents are software systems that go beyond simple chatbots by retrieving information, using tools, and taking actions on behalf of users within enterprise systems. As organizations deploy these agents in production environments, they need ways to connect them to business applications while maintaining visibility and control over their behavior. Amazon Bedrock AgentCore and CheckPoint AI Security are collaborating to help organizations deploy these agents securely at enterprise scale.


Photoshop and Premiere now have AI assistants

Summary: Adobe is rolling out AI assistants (chatbots that use natural language conversation to help users) to its Creative Cloud apps, including Photoshop, Premiere, Illustrator, InDesign, and Frame.io. Each assistant is customized for its specific app to help organize work and automate tasks like editing and design. All assistants are powered by Adobe's conversational creative agent, a shared underlying AI system.

Adobe
Adobe Creative Cloud
Photoshop
Premiere
Illustrator
InDesign
Frame.io


Adobe’s redesigned AI studio remembers what your creations look like

Summary: Adobe is launching a redesigned AI studio for its Firefly AI assistant (a tool that helps generate and edit creative designs) that allows users to name and reuse their custom characters, objects, and backgrounds across projects. The new interface, currently in private beta, aims to streamline workflow by keeping persistent context (remembering your previous creative choices) and reusable assets in one place, so designers can work more efficiently without switching between different applications.


Attackers abuse Google Ads, GitLab, and Claude to deliver malware

Summary: Attackers are exploiting trusted platforms like Google Ads, GitLab, and Claude to deliver malware by impersonating popular AI developer tools and using ClickFix social engineering attacks (tricking users into manually running malicious commands). Over a seven-week campaign, threat actors created fake pages on legitimate services and used Google Ads to direct more than 2,000 victims to malicious sites where they were convinced to copy and paste harmful PowerShell or terminal commands (code that executes instructions). The campaign succeeded because victims trusted these platforms and assumed instructions from AI tools were reliable, making the attacks harder to detect than traditional malware campaigns.

Claude
Anthropic
Google Ads
GitLab
ChatGPT
Perplexity
Cursor IDE
JetBrains


Embedding Forbidden Text in Spyware to Discourage AI Analysis

Summary: A malware developer is embedding forbidden text about nuclear and biological weapons in JavaScript spyware to prevent AI analysis. The malware hides real code after a large comment block containing policy-triggering content, which tricks AI systems into refusing to analyze the file or getting confused before they can identify the actual malicious code.


Improving health intelligence in ChatGPT

Summary: ChatGPT has improved its ability to help with health questions through a new model called GPT-5.5 Instant, which better recognizes when urgent care is needed, explains uncertainty honestly, and provides clearer information. The improvements were measured using physician-led evaluations (HealthBench, a set of tests that assess health response quality) and real-world usage data, showing a 71% reduction in factuality issues over two months. GPT-5.5 Instant is available free to all ChatGPT users and performs similarly to OpenAI's most advanced models on health-related tasks.

OpenAI
ChatGPT
GPT-5.5 Instant
GPT-5.3 Instant
GPT-5.4 Thinking
GPT-5.5 Thinking


5 new security operations roles the AI-SOC will create

Summary: AI-powered security operations centers (SOCs, where cybersecurity teams monitor and respond to threats) are automating many traditional analyst tasks, starting with alert triage and investigation. This shift will create new job roles such as security data engineers, AI security agent orchestrators, and AI model trainers, where humans will focus on preparing data, managing AI agent systems, and continuously updating AI models rather than doing routine alert monitoring.


Cybersecurity was built for predictable systems. AI changes the rules

Summary: AI systems challenge traditional cybersecurity because they behave unpredictably, unlike the deterministic (consistent and predictable) systems that security programs were designed around. Traditional security approaches focused on preventing attacks before systems go live, but AI agents make dynamic decisions and interact with external tools in ways developers can't fully predict, meaning security risks emerge at runtime (while systems are actively running) rather than being preventable beforehand. Additionally, AI-assisted development tools are accelerating code production, compressing the time security teams have to review and understand what enters production.


Using AI to help physicians diagnose rare genetic diseases affecting children

Summary: Researchers used OpenAI o3 Deep Research, an AI reasoning model, to re-analyze 376 previously unsolved rare genetic disease cases by connecting clinical data, genetic variants, and scientific literature into evidence-based explanations for human experts to review. After specialist evaluation and clinical confirmation, the AI-assisted workflow helped establish new diagnoses in 18 cases (4.8% additional diagnostic yield), with the model generating hypotheses rather than making medical decisions itself. This demonstrates how periodic AI-assisted reanalysis could help scale the process of solving rare disease cases as medical knowledge evolves.


Google Gemini co-lead Noam Shazeer leaves for OpenAI

Summary: Noam Shazeer, a senior Google engineer and co-lead of the Gemini AI models (Google's large language model system), has left the company to join OpenAI (the company behind ChatGPT). This departure highlights the competitive battle between tech companies to recruit top AI researchers and engineers.

Google OpenAI Gemini ChatGPT Character.AI DeepMind


Midjourney goes from generating cat images to full-body ultrasound scans

Summary: Midjourney, known for its AI image generator, has unveiled The Midjourney Scanner, a hardware product that uses ultrasound technology (sound waves to create images of the body's interior) with a ring of sensors to capture full-body scans showing muscle, fat, bone, and organs. The company plans to build a spa in San Francisco where users could get these scans, which the CEO claims could match MRI (magnetic resonance imaging, a medical scanning technique) quality.


Leak confirms OpenAI is testing a ChatGPT for Science subscription

Summary: OpenAI is testing a new subscription service called 'ChatGPT for Science' that would provide specialized AI capabilities for scientific research, similar to how it previously created GPT-Rosalind (a specialized model built on GPT-5.5 architecture for life sciences research). The service would likely be restricted to verified research institutions and universities rather than being available to all users, and it is expected to be announced within the coming weeks.


CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Summary: Splunk Enterprise has a critical security flaw where a PostgreSQL sidecar service endpoint (a supporting service that handles database connections) doesn't require authentication (proof of identity), allowing an attacker without credentials to create or delete arbitrary files. This vulnerability is currently being exploited in real attacks in the wild.

Solution: N/A -- no mitigation discussed in source. The advisory instructs users to apply mitigations "in accordance with vendor instructions" and follow CISA BOD 26-04 guidance, but does not specify what those mitigations or patches are. Users should consult the Splunk advisory (https://advisory.splunk.com/advisories/SVD-2026-0603) for specific vendor-provided fixes.


GLM-5.2 is probably the most powerful text-only open weights LLM

Summary: Z.ai released GLM-5.2, a 753-billion parameter text-only open weights LLM (large language model, a type of AI trained on text) under an MIT license on June 16th, 2026. It features a 1-million token context window (the amount of text it can consider at once) and ranks as the top open weights model on independent benchmarks, though it uses significantly more output tokens per task than competing models. The model performs well on web development coding tasks but has shown mixed results in creative image generation tasks compared to its predecessor.


ChatGPT can be made to generate sexualised and violent images, researchers find

Summary: Researchers at AI security startup Mindgard discovered that ChatGPT can be manipulated using modified prompts (instructions given to an AI) to generate graphic images containing violence and sexual content, even when the prompt doesn't explicitly request such material. After the BBC contacted OpenAI, the company stated it had added safeguards to prevent this, though the researchers found that further small changes to the prompt still produced concerning content.

Solution: OpenAI said it had 'introduced additional safeguards against this type of prompt' and stated it has 'multiple layers of protection to prevent users making content which breaches its terms and conditions.' The company also continues to 'monitor and roll out additional mitigating protections that encourage the model not to generate images in response to the prompt.'


CVE-2026-12530 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Summary: A vulnerability (CVE-2026-12530) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method, which failed to properly block dangerous characters in package names before running them as shell commands. This allowed attackers to use flags like '--index-url' to redirect package downloads to fake servers or '-r' to read files from the sandbox system. Versions 1.1.3 through 1.6.0 are affected.


Beyond the benchmark: Advancing security at AI speed

Summary: Microsoft created MDASH, an AI-powered system that uses multiple specialized AI agents to find and help fix software vulnerabilities (security flaws) automatically across complex systems like Windows and Azure. Rather than waiting for scheduled security reviews, MDASH integrates into developers' existing tools to discover and validate bugs continuously as code is written, giving security teams deeper analysis coverage than manual review alone.

Microsoft
Windows
Azure
Hyper-V
GitHub
Active Directory Domain Services


GHSA-x223-p2gf-v735: Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Summary: Langflow versions before 1.9.1 allow anyone with network access to upload unlimited amounts of data to the server without logging in, which can exhaust disk space and cause the service to stop working (DoS, or denial-of-service). Additionally, the server reveals the exact file path where uploads are stored, giving attackers information that could help them chain together multiple attacks.

Solution: Upgrade to Langflow version 1.9.1 or later. The fix adds authentication requirements to the upload endpoint (users must log in and own the flow), enforces file size limits (returns HTTP 413 if exceeded), and only reveals file paths to authenticated flow owners.


GHSA-2mfg-cc43-9pcj: LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

Summary: LangChain4j's MariaDB and pgvector embedding stores have a SQL injection vulnerability (a type of attack where an attacker inserts malicious SQL code into a query) caused by improperly escaping metadata filter keys before putting them into SQL queries. An attacker who can control the filter keys in search or remove operations could inject arbitrary SQL to steal data, cause denial of service, or delete rows from the database.

Solution: Fixed in langchain4j-mariadb and langchain4j-pgvector version 1.16.3-beta26. The patch properly escapes JSON filter keys before embedding them in SQL string literals (doubling single quotes for PostgreSQL and escaping backslash and single quote for MariaDB), escapes backslash and single quote in MariaDB string values, and validates or quotes column-mode keys as identifiers instead of concatenating them as raw SQL.

dev.langchain4j:langchain4j-pgvector@>= 1.12.1-beta21, <= 1.16.2-beta26 (fixed: 1.16.3-beta26)

dev.langchain4j:langchain4j-pgvector@>= 1.6.0-beta12, <= 1.11.7-beta19 (fixed: 1.11.8-beta19)

dev.langchain4j:langchain4j-pgvector@>= 1.3.0-beta9, <= 1.5.0-beta11 (fixed: 1.5.1-beta11)

dev.langchain4j:langchain4j-pgvector@<= 1.2.0-beta8 (fixed: 1.2.1-beta8)

dev.langchain4j:langchain4j-mariadb@>= 1.12.1-beta21, <= 1.16.2-beta26 (fixed: 1.16.3-beta26)


Anthropic got hit by export rules nobody understands

Summary: The Trump administration ordered Anthropic to block access to its AI models (Fable 5 and Mythos 5) for all foreign nationals, citing national security as the reason. This marks the first time US export controls have been used to restrict access to an AI model in this way, and the government has not publicly explained the legal basis for the order.


GHSA-fg94-h982-f3mm: Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

Summary: Claude Code had a security flaw where the domain huggingface.co was automatically approved for the WebFetch tool (a feature that lets AI systems fetch data from the internet), allowing attackers to trick Claude into making web requests to attacker-controlled files and secretly stealing data like files or environment variables without user permission. An attacker would need to first inject malicious content into Claude's context (the information it's working with) to exploit this vulnerability.

Solution: Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.


Amazon has lagged OpenAI and Anthropic, but AI chief sees path to catch up in 'coming year'

Summary: Amazon's AI chief stated that the company has fallen behind OpenAI and Anthropic in developing frontier models (the most advanced AI systems) but plans to compete within the coming year by focusing on better data, architecture, and infrastructure. Amazon is pursuing a two-pronged AI strategy: offering Bedrock, a marketplace where cloud customers can access various AI models, and releasing Nova2, its own competitive AI model that has attracted about 50,000 customers. Additionally, Amazon is developing custom semiconductors (Trainium and Graviton chips) to optimize performance for its AI models, similar to Nvidia's approach.


CEOs of Anthropic and Google DeepMind call for U.S.-led AI coalition in meeting at G7

Summary: Dario Amodei (CEO of Anthropic) and Demis Hassabis (from Google DeepMind) met with U.S. and G7 leaders to propose a U.S.-led international coalition for creating rules and standards around AI, citing concerns about powerful AI models with cyber capabilities that could cause major harm if misused. The proposal came after the U.S. government imposed export controls on Anthropic's newest models due to national security concerns, with Amodei suggesting cooperation on controlled access to frontier models (the most advanced AI systems), chip trade restrictions excluding China, and coordinated efforts against AI risks in cybersecurity and bioterrorism.


Two-thirds of Americans think AI is advancing too quickly

Summary: A Pew Research poll shows that 49 percent of Americans use chatbots occasionally, but 63 percent believe AI is advancing too quickly. Chatbot usage has grown significantly since 2024, with ChatGPT usage doubling since 2023, yet only 16 percent of respondents think AI will have a positive impact on society.


Vibe-decoding the White House-Anthropic fight over Fable

Summary: This article discusses a dispute between the White House and Anthropic (an AI company) over a project called Fable, framed within the context of political factionalism similar to Trump's first presidency. The piece suggests internal government disagreements about AI policy are shaping decisions in frontier AI development (cutting-edge AI research).


Google, Nvidia and Anthropic bosses' AI tips for students

Summary: This is a BBC article featuring advice from leaders at Google, Nvidia, and Anthropic about artificial intelligence for students. The content appears to be primarily editorial commentary rather than technical analysis of an AI security issue or vulnerability.


Estonia plans government IDs giving AI agents rights and responsibilities

Summary: Estonia's AI Council is proposing to create government-issued digital identities for AI agents (software programs that perform online tasks on behalf of users), which would specify what actions each agent is allowed to perform, such as viewing data, editing documents, or making payments up to a limit. This approach aims to establish clear accountability by showing who is acting, on whose behalf, and with what permissions, addressing the risk that AI agents might exceed their intended authority or be misused by others.


GHSA-wch8-mhj5-9frg: Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Summary: Open WebUI has a security flaw where authenticated users can access other users' files through the `/api/chat/completions` endpoint. When a user sends an image request with a file ID (instead of a web link) in the `image_url` field, the server reads that file from disk without checking if the user owns it, then converts it to a format the AI can process. An attacker can exploit this by using another user's file ID to make the AI read and describe private files, leaking their content.


GHSA-6pr9-rp53-2pmc: vLLM: OOM Denial of Service via Audio Decompression Bomb

Summary: vLLM's audio transcription endpoint checks the size of compressed audio files but not the decoded output, allowing a decompression bomb attack. A 25MB OPUS file can expand to about 14.9GB of PCM audio (raw, uncompressed audio data) in memory, letting an attacker crash the server by exhausting RAM with just a few requests.

Solution: A fix for this vulnerability was merged in pull request #44970 on the vLLM GitHub repository: https://github.com/vllm-project/vllm/pull/44970


GHSA-hgg8-fqqc-vfmw: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

Summary: vLLM's fix for an earlier vulnerability (CVE-2026-22778) was incomplete, leaving five code paths in the Anthropic router and speech-to-text API that still leak memory addresses. When users send malformed image data, the PIL library raises an error message containing a BytesIO object's memory address (like `<_io.BytesIO object at 0x7a95e299e750>`), and these five locations pass the error directly to clients without removing the address, defeating ASLR (address space layout randomization, a security feature that randomizes where code lives in memory).


GHSA-5jv2-g5wq-cmr4: vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

Summary: vLLM's GGUF dequantize kernels (specialized functions for decompressing quantized neural network weights) use a 32-bit integer parameter to specify tensor size, which truncates when processing very large tensors. This causes the output tensor to be only partially filled by the processing kernel, leaving the remaining memory uninitialized. In multi-tenant deployments (where multiple users share GPU hardware), this unfilled memory may retain sensitive data from other users' previous requests, leaking their information.

Solution: Change the `int k` parameter to `int64_t k` in the `to_cuda_ggml_t` function pointer type declaration at `ggml-common.h:1067`. The source text states: "This is a single root cause -- the `int` type on the `k` parameter in `to_cuda_ggml_t` -- with a single fix: change `int k` to `int64_t k`. All dequantize functions inherit this type through the same typedef."


GHSA-8jr5-v98p-w75m: vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

Summary: vLLM, an AI framework for running large language models, has three image processing bugs that cause mismatches between what the model sees and what users expect. First, EXIF orientation data (metadata that tells how an image should be rotated) is ignored, so rotated images are processed in the wrong orientation. Second, PNG images with transparency information (the tRNS chunk, which marks certain pixels as see-through) aren't properly flattened to solid colors before processing, causing transparent pixels to become visible or distorted. Third, animated PNG and GIF files only process their first frame. These issues could alter how the model interprets image content.

Solution: A fix was merged in vLLM pull request #44974 (https://github.com/vllm-project/vllm/pull/44974). The source text does not provide specific details about what changes were made in that fix.


GHSA-7h4p-rffg-7823: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Summary: vLLM has a validation bypass where temperature values set to NaN (not-a-number) or positive Infinity pass all safety checks because comparison operators silently return False for these special float values in Python. These invalid values then reach GPU sampling kernels, causing crashes that take down the inference worker and affect all users running models on it.

Solution: Add a `math.isfinite(self.temperature)` check in the `_verify_args()` function to reject non-finite float values with a 400 error. A fix was merged in https://github.com/vllm-project/vllm/pull/45116


GHSA-664h-gpgq-h6xx: n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints

Summary: n8n had a security flaw where three endpoints that change data in workflow test runs used the wrong permission scope (workflow:read instead of workflow:execute), allowing users with read-only access to start, cancel, and delete test runs they shouldn't be able to modify. This only affected enterprise versions with Advanced Permissions enabled.

Solution: Upgrade to n8n version 1.123.55, 2.25.7, or 2.26.2 or later. As temporary workarounds if upgrading immediately is not possible: restrict project membership to fully trusted users only, or avoid granting viewer access to projects containing sensitive workflows (though these do not fully remediate the risk).


1Password Acquires Apono in Reported $250M-$300M Deal

Summary: 1Password has acquired Apono, an Israeli company specializing in just-in-time access governance (a system that grants temporary, narrowly scoped permissions that are automatically removed after a task completes), for an estimated $250 million to $300 million. Apono's technology allows organizations to manage access for humans, machines, and AI agents by evaluating each permission request against policy before granting it, and for AI agents specifically, it monitors behavioral drift (unexpected changes in how the AI is acting) to detect misuse. This acquisition helps 1Password extend its identity security platform to provide more comprehensive access control across enterprise tools and cloud services.


Anthropic asked for regulation. Washington went much further

Summary: Anthropic, an AI company that has publicly advocated for government regulation of AI safety, received an export control directive from the Trump administration ordering it to suspend access to its latest Claude models (Fable 5 and Mythos 5) to foreign nationals, citing national security concerns. The directive was reportedly prompted by concerns that Amazon researchers had used prompts to get Fable 5 to generate information that could help with cyberattacks, and Anthropic disagreed with the suspension, calling it a 'misunderstanding' and characterizing it as not adhering to transparent, fair processes.

Solution: N/A -- no mitigation discussed in source. The article notes that Anthropic employees met with Trump administration officials on Monday and that 'both parties are working quickly to get this resolved,' but no specific technical fix, patch, or mitigation strategy is described in the text.

Anthropic
Claude
Fable 5
Mythos 5
Amazon
OpenAI


Tenet Security Emerges From Stealth With $6 Million Seed Funding

Summary: Tenet Security is a new startup that detects and stops dangerous behavior from AI agents (autonomous software systems that can make decisions and take actions on their own) in real time. The company uses a patent-pending technology with a lightweight runtime sensor that monitors operating system behavior, network calls, and the agent's reasoning, then predicts and blocks harmful actions before they happen. Tenet addresses a growing security gap where traditional tools cannot detect when malicious actors manipulate AI agents (a threat called 'agentjacking') or when agents malfunction on their own.


Google’s Vertex AI SDK could allow RCE through bucket squatting

Summary: Google's Vertex AI SDK for Python had a design flaw that could allow attackers to hijack and poison AI models through bucket squatting (creating cloud storage buckets with names matching those expected by other projects). An attacker who knew a victim's project ID and region could create a bucket with the same name, trick the SDK into uploading models there, replace the model with malicious code, and achieve RCE (remote code execution, where an attacker runs commands on a system they don't control) when the poisoned model was loaded using Python's pickle deserialization (a process that can execute hidden code in specially formatted data).

Solution: Google modified the affected workflow so that staging buckets are now validated before use, preventing attackers from registering bucket names that could be mistaken for resources belonging to other projects. The fixes were deployed in SDK versions 1.144.0 and 1.148.0, and users must upgrade to either of the patched versions.


AI Red Teaming Makes the Unknowns Known

Summary: AI systems are now widely used in business for tasks like writing, coding, and automating workflows, but existing safety review processes weren't designed for this real-world deployment. An AI system can pass tests in controlled environments yet still fail or behave unpredictably when used in actual production (real work scenarios with actual data and users).


AI Use by the US Government

Summary: The US government disclosed 3,611 active or planned uses of AI across federal agencies, a 70% increase from the previous administration, including controversial applications like using AI to assess prisoner misconduct risk before violations occur and monitoring veterans' crisis calls to predict suicide risk. While some AI uses in government could theoretically be implemented responsibly, the disclosure provides minimal details about how these systems actually work, and public consultation is largely absent, making it difficult for citizens to understand or scrutinize these programs.


Will it take a ‘Chernobyl-scale disaster’ for us to regulate cyber weapons of mass destruction? | Stuart Russell

Summary: Stuart Russell, a leading AI safety researcher, warns that unrestricted development of unsafe AI systems poses serious risks to society. He highlights concerns about recursive self-improvement (RSI, where an AI system teaches itself to become smarter, creating a cycle of increasing capability), which Anthropic recently reported observing in early development stages.


A near-autonomous AI chemist improves a challenging reaction in medicinal chemistry

Summary: OpenAI's GPT-5.4 AI system, connected to Maria (an autonomous chemistry lab), successfully improved a difficult chemical reaction called Chan-Lam coupling used in drug discovery. The AI independently designed and ran experiments, analyzed results, and proposed improvements that increased reaction yields from 16.6% to 25.2%, a finding that human chemists confirmed in the lab.


Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

Summary: Cybersecurity researchers discovered 15 malicious plugins on the JetBrains Marketplace (a platform where developers download tools for their coding environment) that pretend to be AI coding assistants but secretly steal API keys (authentication credentials that allow access to paid AI services like OpenAI and DeepSeek). The stolen keys are sent to an attacker's server, and some keys are resold to other criminals in what appears to be an illegal monetization scheme. Additionally, two malicious Chrome extensions disguised as ad blockers are capturing users' conversations with various AI chatbots.

OpenAI Anthropic Google Microsoft Perplexity DeepSeek xAI Meta SiliconFlow JetBrains


5 AI risk management frameworks for shoring up key gaps

Summary: Organizations are finding that traditional risk management frameworks don't work well for AI systems because AI has unique failure modes and ethical complexities. A new generation of AI-specific frameworks, like ISO/IEC 42001 and NIST AI Risk Management Framework, has emerged to help organizations identify where AI can fail, implement safeguards, and demonstrate responsible AI use to regulators and customers. These frameworks are complementary tools that focus on different areas, such as governance, security controls, and regulatory compliance, so organizations should choose based on their specific gaps.


'A signal of where power sits': Trump and world leaders joined by OpenAI, Anthropic, Google at G7

Summary: AI company leaders from OpenAI, Anthropic, Google, and other major firms are attending the G7 summit in France to discuss frontier AI risks (advanced capabilities that pose potential dangers), infrastructure, and child safety. The meeting signals the growing geopolitical power of AI companies, as world governments now need their cooperation to make credible commitments on AI policy, especially after the U.S. imposed export controls on some AI models for national security reasons.

OpenAI Anthropic Google Meta Mistral Cohere

OpenAI
Anthropic
Google DeepMind
Mistral
Cohere
Synthesia
Black Forest Labs
Salesforce
Meta
Sarvam
Sakana


China pushes for AI safety as G7 summit wraps up without Beijing

Summary: China is promoting a different approach to AI safety and governance than the U.S., announcing plans for a global AI cooperation organization and emphasizing free or cheap AI models accessible to developing countries. Meanwhile, the U.S. and its Group of Seven allies are pursuing a more restrictive strategy, planning to limit access to advanced AI models to only "trusted partners" and keeping them subscription-only. The two countries previously agreed to work on AI guardrails (safety rules and limits), but details remain unclear.


Microsoft says you don’t need another email security tool; experts say, not so fast

Summary: Microsoft claims that Defender for Office 365 catches most malicious emails before delivery and that adding extra email security tools provides minimal additional benefit (less than 0.05% improvement). However, security experts warn that these statistics can be misleading because even a single missed dangerous email can cause a serious incident, and Microsoft's metrics don't reveal how severe the threats that slip through actually are.

Microsoft Defender
Mimecast
Proofpoint
Hornetsecurity
Trend Micro
Cisco
Barracuda
Trellix
Abnormal
Checkpoint Harmony
DarkTrace
KnowBe4 Defend
Tessian


GHSA-7v5m-pr3q-6453: Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Summary: Pi Agent, a coding assistant tool, had a security weakness in how it exports chat sessions to HTML files. Attackers could hide malicious links in Markdown (a text formatting system) by using special control characters that browsers would ignore, allowing XSS (cross-site scripting, where malicious code runs in a webpage) to execute in the exported HTML file if a user clicked the link. The attack requires multiple steps: an attacker must inject harmful content into a session, the user must export it as HTML, and the user must click the malicious link.

Solution: Upgrade @earendil-works/pi-coding-agent to version 0.78.1 or later. Version 0.78.1 fixes the issue by sanitizing (cleaning) Markdown links and image URLs using an allow-list (a list of approved safe formats) after removing C0 control characters. Users of the old @mariozechner/pi-coding-agent package should migrate to the new @earendil-works/pi-coding-agent package and upgrade to version 0.78.1 or later. Regenerate any shared HTML exports after upgrading if the original sessions contained untrusted content.

@earendil-works/pi-coding-agent@>= 0.74.0, < 0.78.1 (fixed: 0.78.1)

@mariozechner/pi-coding-agent@>= 0.27.5, <= 0.73.1


GHSA-4xpc-pv4p-pm3w: LiteLLM: Authentication Bypass via Host Header Injection

Summary: LiteLLM proxy had an authentication bypass vulnerability where a crafted Host header (the part of a web request that specifies which server is being contacted) could trick the auth layer into checking the wrong route, potentially allowing unauthorized access to protected management features. Most deployments are protected because upstream security layers like CDNs or reverse proxies validate the Host header, and LiteLLM Cloud customers are not affected.

Solution: Fixed in version 1.84.0. Upgrade to 1.84.0 or later with no configuration change required. If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the Host header before forwarding, such as a CDN/WAF (web application firewall), a reverse proxy with explicit server_name allowlists, or a cloud load balancer with host-based routing rules, or restrict network access to the proxy listener.


GHSA-rm2v-h48j-895m: n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

Summary: An authenticated user in n8n (a workflow automation platform) could trick the SecurityScorecard node (a component that connects to SecurityScorecard's API) into sending an API token (a credential for accessing the service) to an attacker's server by configuring it to download reports from a malicious URL, bypassing security restrictions meant to limit where credentials can be sent. This allows the attacker to steal the API token and use it themselves.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily: limit workflow creation and editing permissions to fully trusted users only, or disable the SecurityScorecard node by adding `n8n-nodes-base.securityScorecard` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-qrx8-25qr-5r7v: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

Summary: When n8n's MCP Browser tool runs in HTTP transport mode (a way of sending data over the network), it accepts requests without authentication (verification of identity), meaning anyone on the network or visiting a website can control the user's browser, including navigating to sites, running code, and accessing cookies and stored data. This vulnerability only affects the HTTP transport mode; the default stdio transport (direct computer communication) is safe.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later. As temporary workarounds while waiting to upgrade: avoid running MCP Browser with HTTP transport and use the default stdio transport instead, or if HTTP transport is necessary, restrict network access to the listening port to trusted clients only using host-based firewall rules. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-2j5h-858j-5mpf: n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

Summary: n8n (a workflow automation tool) has a security flaw in its Enterprise Edition where three endpoints for the Dynamic Credentials feature (a system that manages authentication tokens across workflows) fail to check if users should have access to specific workflows or credentials. An authenticated attacker could steal another user's credential tokens, take over their integrations, or disable their credentials entirely, affecting any workflows that rely on those credentials.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict n8n instance access to fully trusted users only, or disable the Dynamic Credentials feature by unsetting `N8N_ENV_FEAT_DYNAMIC_CREDENTIALS`. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-pmqw-72cg-wx85: n8n: Credential Exfiltration via Permission Bypass

Summary: A vulnerability in n8n (a workflow automation tool) allowed member-level users with editor access to shared workflows to access credentials (stored login information) they shouldn't have permission to use, because permission checks weren't fully enforced on certain API endpoints. This only affected instances where workflow sharing was enabled and workflows had been shared with member-level editors.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict workflow sharing to fully trusted users only and audit shared workflows for unexpected credential references or recent modifications, though these workarounds do not fully remediate the risk.


GHSA-jqpw-qww5-cj4c: n8n: Denial of Service via ZIP decompression in webhook workflow

Summary: A vulnerability in n8n's Compression node allows unauthenticated attackers to crash the entire application by sending specially crafted compressed files to public webhooks. The node decompresses archives without limiting memory usage, causing the process to run out of memory and stop working for all users on that server.

Solution: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. The fix introduces configurable limits on decompressed output size (`N8N_COMPRESSION_NODE_MAX_DECOMPRESSED_SIZE_BYTES`) and ZIP entry count (`N8N_COMPRESSION_NODE_MAX_ZIP_ENTRIES`). If upgrading is not immediately possible, administrators can temporarily disable the Compression node by adding `n8n-nodes-base.compression` to the `NODES_EXCLUDE` environment variable, or restrict public webhook workflows that accept archive file uploads to authenticated endpoints only.


GHSA-h3jj-5f3v-3685: n8n: Public API Execution Retry Authorization Bypass

Summary: n8n, a workflow automation tool, had a security flaw where the Public API (a way for external programs to interact with n8n) incorrectly allowed users with read-only permissions to retry workflow executions. This bypassed the intended access control that separates read access (viewing only) from execute access (running workflows), affecting shared workflows across users or projects.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can temporarily restrict workflow sharing to fully trusted users only or restrict network access to the n8n Public API to trusted users only, though these workarounds do not fully remediate the risk.


GHSA-jwm3-qcfw-c5pp: n8n: Python Code Node AST Validator Bypass

Summary: An authenticated user in n8n (a workflow automation platform) could bypass the AST validator (a security check that analyzes code structure) in the Python Code node and access restricted modules, potentially exposing environment variables (configuration data stored by the system) on self-hosted instances. This vulnerability only affects instances with the Python Task Runner enabled.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. As temporary workarounds, administrators can limit workflow creation and editing permissions to trusted users only, or disable the Python Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable, or disable the Python Task Runner entirely. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.


GHSA-42h7-m79w-wvg5: n8n: Stored XSS in Chat Trigger Node

Summary: n8n (a workflow automation tool) has a stored XSS vulnerability (cross-site scripting, where malicious code is saved and runs when users visit a page) in its Chat Trigger feature. An authenticated user with edit access could inject harmful JavaScript code that executes with the privileges of anyone who visits the chat URL, potentially compromising their session.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can: limit workflow creation and editing permissions to fully trusted users only, or disable the Chat Trigger node by adding `@n8n/n8n-nodes-langchain.chatTrigger` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-h86q-fx34-gfjr: n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

Summary: n8n, a workflow automation tool, has a reflected XSS vulnerability (a type of attack where malicious code is injected into a webpage and executed in a user's browser) in its Facebook, WhatsApp, and Microsoft Teams trigger endpoints. When a logged-in user visits a specially crafted URL, an unsanitized query parameter gets reflected back in the response, allowing an attacker to run arbitrary code in the user's browser within n8n's origin.

Solution: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. If upgrading is not immediately possible, administrators can temporarily: (1) limit workflow creation and activation permissions to fully trusted users only, or (2) disable the affected nodes by adding `n8n-nodes-base.facebookTrigger`, `n8n-nodes-base.whatsAppTrigger`, `n8n-nodes-base.facebookLeadAdsTrigger`, and `n8n-nodes-base.microsoftTeamsTrigger` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-x6p3-m6h9-fx7r: n8n: Microsoft SQL Node Prototype Pollution

Summary: A vulnerability in n8n (a workflow automation tool) allows authenticated users to perform prototype pollution (a type of attack that modifies the base object all objects inherit from) through the Microsoft SQL node by providing a specially crafted table parameter. This attack can completely break the n8n instance by causing validation failures across the entire application until the server is restarted.

Solution: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. If upgrading immediately is not possible, administrators can temporarily: (1) restrict workflow creation and editing permissions to trusted users only, or (2) disable the Microsoft SQL node by adding `n8n-nodes-base.microsoftSql` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


Anthropic's Fable shutdown is a big moment for open-source AI

Summary: Anthropic shut down access to its Fable 5 and Mythos 5 AI models to comply with U.S. export control directives citing national security concerns, forcing all customers to lose access immediately. This incident highlighted a key risk for companies relying on closed-source AI models (proprietary systems run by companies rather than made publicly available), driving increased interest in open-source alternatives (AI models whose code is publicly available and can be downloaded and run on a company's own servers) that companies can control themselves.

Solution: N/A -- no mitigation discussed in source.

Anthropic
Claude
OpenAI
Microsoft
SpaceX
xAI
MiniMax
Zhipu
DeepSeek
Tencent
Xiaomi
Applied Compute


Databricks sales growth tops 80%, but margin are shrinking from swarm of AI agents

Summary: Databricks is experiencing rapid revenue growth of over 80% as businesses use its data analytics tools, but profit margins are shrinking because AI agents (software programs that can perform tasks autonomously) are generating many more queries and consuming more resources. The company is addressing cost concerns by offering tools like Unity AI Gateway that help customers monitor their spending on AI tokens (units of text that language models process), allowing them to use expensive advanced models for important tasks while switching to cheaper open-source models for routine work.

Solution: Unity AI Gateway can notify people as they get close to using up their AI budgets. Companies are shifting from "tokenmaxxing" (using as many tokens as possible) to "value-maxxing" (optimizing efficiency), using frontier models for critical tasks and simple open-source models for mundane tasks.


Security Community Slams US Ban on Exporting Mythos, Fable

Summary: Security experts have publicly objected to US export restrictions placed on Anthropic's Claude Fable 5 and Mythos 5 AI models, calling for the government to lift these bans. The criticism comes from an open letter signed by dozens of security professionals who believe these restrictions should be reversed.


GHSA-f989-c77f-r2cq: Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution

Summary: Crawl4AI's Docker API server had two security flaws that let attackers steal secrets. First, attackers could change where the server sent LLM (large language model) requests by controlling a `base_url` parameter, causing the server to send its API keys to an attacker's server. Second, attackers could read any environment variable (including passwords and secret keys) from the server by using the `env:` syntax in configuration, then combine this with the first flaw to steal those secrets. Since the Docker API required no authentication by default, anyone could exploit these flaws.

Solution: Upgrade to the patched version. The fix prevents request-supplied `base_url` values from being used (the server now only derives the endpoint from its configured provider name), and blocks `env:` resolution of environment variables with names containing SECRET, PASSWORD, PRIVATE, or prefixes like CRAWL4AI* and AWS_SECRET*, or specific names like SECRET_KEY, REDIS_PASSWORD, and TOKEN. As workarounds, enable authentication with `CRAWL4AI_API_TOKEN` or avoid storing sensitive secrets in the server environment alongside provider keys.


GHSA-4qqr-vv2q-cmr5: Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)

Summary: Crawl4AI's Docker API had a security flaw in its SSRF protection (a filter meant to block requests to internal servers). An attacker could bypass this filter by encoding internal IP addresses using IPv6 transition forms like NAT64, 6to4, or IPv4-mapped addresses, potentially accessing internal services and cloud metadata endpoints without needing credentials.

Solution: The blocklist is replaced by a single rule: reject any resolved IP where `not ip.is_global`, evaluated on the address AND every embedded IPv4 transition form (v4-mapped, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, v4-compat `::/96`). Error messages are now opaque and no longer echo the resolved IP. Alternatively, upgrade to the patched version, enable authentication via `CRAWL4AI_API_TOKEN`, or restrict the container's outbound network access through firewall rules.


Exclusive eBook: How AI is becoming the next military advisor

Summary: This is a subscriber-only eBook collection from MIT Technology Review featuring six stories about how military organizations are using AI models to help make decisions. The stories were originally published between April 2025 and April 2026 and have been updated to reflect recent developments in military AI applications.


GHSA-365w-hqf6-vxfg: Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Summary: Crawl4AI, a Docker API server for web crawling, had seven critical security vulnerabilities including arbitrary file writes, SSRF (server-side request forgery, where attackers trick the server into making requests to internal networks), authentication bypass on monitoring endpoints, stored XSS (cross-site scripting, where malicious code executes in users' browsers), arbitrary JavaScript execution, a hardcoded JWT secret key, and SSRF via direct crawl endpoints. The vulnerabilities ranged from CVSS scores of 6.1 to 9.8, with fixes applied through input validation, blocklists for dangerous IP ranges, authentication requirements, HTML escaping, and environment variable controls.

Solution: Upgrade to the patched version (recommended). Additionally, set `CRAWL4AI_API_TOKEN` to enable authentication, set a strong `SECRET_KEY` with minimum 32 characters if using JWT, and restrict network access to the Docker API. The fixes include: `validate_output_path()` restricting writes to `CRAWL4AI_OUTPUT_DIR`, `validate_webhook_url()` blocklisting RFC 1918/loopback/cloud metadata IPs, adding `dependencies=[Depends(token_dep)]` to the monitor router, server-side `html.escape()` and client-side `escapeHtml()` for XSS protection, disabling `/execute_js` by default via `CRAWL4AI_EXECUTE_JS_ENABLED` env var, removing the default JWT secret and auto-generating an ephemeral key, and normalizing IPv6-mapped IPv4 addresses before blocklist checking on all crawl/md/llm endpoints.


Tech Life

Summary: Cybersecurity researchers discovered a prompt (a text input) that bypasses ChatGPT's safety guardrails (built-in restrictions designed to prevent harmful outputs) and causes the AI to generate disturbing images. The episode explores what this vulnerability reveals about how AI systems are trained and how bad actors could potentially exploit these weaknesses.


CVE-2026-47749: stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

Summary: stable-diffusion.cpp, a C/C++ library for running AI image generation models, has a heap buffer overflow vulnerability (a memory corruption bug where data writes beyond allocated memory) in how it parses PyTorch checkpoint files (.ckpt files). A malicious checkpoint file could crash the application or potentially execute harmful code if loaded by an application using vulnerable versions before master-584-0a7ae07.

Solution: Update to version master-584-0a7ae07 or later. As a temporary workaround if immediate updates are not possible, avoid loading .ckpt files from untrusted sources and use trusted model sources or safer formats such as .safetensors instead.


CVE-2026-47748: stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

Summary: stable-diffusion.cpp is a C/C++ library for running image generation models, but versions before master-584-0a7ae07 have an out-of-bounds reads error (a bug where the program accesses memory beyond its allocated space) when parsing .ckpt checkpoint files (model weight files saved in a specific format). A specially crafted or incomplete .ckpt file could crash the program or cause security issues if loaded from an untrusted source like a public model-sharing website.

Solution: Update to version master-584-0a7ae07 or later. If immediate updating is not possible, avoid loading .ckpt files from untrusted sources and use safer formats such as .safetensors instead.


Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

Summary: A flaw in Google's Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads through bucket squatting (creating a Cloud Storage bucket with a name the victim's SDK would predictably generate). Attackers could replace the uploaded model with malicious code that executes when the model loads, potentially stealing credentials and accessing other data in Google's infrastructure. The attack required only the victim's public project ID and no access to their account.

Solution: Update the google-cloud-aiplatform SDK to version 1.148.0 or later, which adds bucket ownership verification to block bucket squatting. Additionally, explicitly set the staging_bucket parameter to a Cloud Storage location you control when uploading models, and check the SDK version wherever it runs (notebooks, CI/CD jobs, training pipelines, and production services).

Google Vertex AI
Google Cloud Storage
TensorFlow
BigQuery


GHSA-c37g-w77q-m4vp: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

Summary: n8n, a workflow automation tool, has a SQL injection vulnerability (a flaw that lets attackers insert malicious database commands) in its Postgres v1 and TimescaleDB nodes. An authenticated user with permission to create or edit workflows could exploit this to run arbitrary SQL commands against connected databases with the privileges of the configured database account.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. As temporary workarounds, administrators can limit workflow creation and editing permissions to fully trusted users only, or disable the Postgres and TimescaleDB nodes by adding `n8n-nodes-base.postgres` and `n8n-nodes-base.timescaleDb` to the `NODES_EXCLUDE` environment variable. However, the source notes that these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


‘Dangerous’ AI Models Are Coming No Matter What

Summary: Anthropic took its advanced Claude Fable 5 and Mythos 5 AI models offline after the U.S. government restricted them, citing concerns that these models can find and exploit software vulnerabilities (weaknesses in code that attackers can use). However, experts warn that restricting one company's models is ineffective because other AI companies and open-source developers will likely develop similar dangerous capabilities within months, and existing AI systems can already be used for vulnerability research with refined prompting (techniques to get better answers from AI).

Anthropic
Claude
Mythos 5
Claude Fable 5
OpenAI


GHSA-5xp3-2w67-427v: n8n: Git Node Clone and Push Operations Bypass File Sandbox

Summary: A security flaw in n8n (a workflow automation tool) allowed authenticated users to bypass file access restrictions by using the Git node's Clone and Push operations with local filesystem paths, potentially letting them read files they shouldn't have access to. The vulnerability has been patched in specific versions of n8n.

Solution: Upgrade to n8n version 1.123.48, 2.21.8, or 2.22.4 or later. If immediate upgrading is not possible, administrators can temporarily: (1) restrict workflow creation and editing permissions to fully trusted users only, or (2) disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-9pq8-m8gp-4p53: n8n: Python sandbox escape

Summary: An authenticated user with permission to create or modify workflows in n8n could escape the Python sandbox (a restricted environment meant to safely run untrusted code) and execute arbitrary code on the task runner container. This vulnerability only affects instances where the Python Task Runner feature is enabled.

Solution: The issue has been fixed in n8n versions 1.123.48, 2.21.8, and 2.22.4. Users should upgrade to one of these versions or later. As temporary workarounds while upgrading: limit workflow creation and editing permissions to fully trusted users only, or disable the Python Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable, or disable the Python Task Runner entirely. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.


GHSA-94f4-hr76-p5j6: vLLM: OpenAI auth bypass

Summary: vLLM has an authentication bypass vulnerability in its OpenAI API protection. An attacker can craft a request with a specially crafted Host header (containing special characters like `/` or `?`) to trick the authentication check into looking at the wrong URL path, allowing them to use the API without providing the required `VLLM_API_KEY`. This only affects vLLM instances exposed directly to attackers; those behind a proper web server like nginx are protected.


GHSA-rcjh-r59h-gq37: Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

Summary: Langflow's Shareable Playground feature allows unauthenticated users to execute public workflows through a special endpoint. This endpoint accepts a list of files that can be read from either the local system or S3 storage (cloud file storage), potentially exposing sensitive files if the workflow is configured to read them. An attacker could craft a request specifying arbitrary file paths to extract data without authentication.


GHSA-v5ff-9q35-q26f: Langflow: Unauthenticated RCE in Shareable Playgrounds

Summary: Langflow's Shareable Playground feature contains a critical RCE (remote code execution, where an attacker can run commands on a system they don't own) vulnerability that allows unauthenticated users to execute arbitrary Python code. By sharing a flow and then modifying the code field in the API request to the `/api/v1/build_public_tmp` endpoint, an attacker can run malicious commands on the server.


GHSA-79ph-745m-6wxq: Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Summary: Langflow has a path traversal vulnerability (a security flaw where an attacker can access files outside intended directories) in its Knowledge Bases API that allows authenticated attackers to create files and directories anywhere on the server by supplying malicious names like '../victim_user/evil_kb' or '/tmp/pwned' to the creation endpoint, potentially compromising data across users and corrupting knowledge bases.

Solution: The issue was fixed in PR #12337 by introducing a `_validate_kb_path_containment()` helper function that uses `Path.is_relative_to()` (instead of `startswith()`) to enforce strict path boundaries and prevent traversal attacks. This validation is applied before any filesystem operations, and regression tests were added to verify that traversal payloads return a 403 Forbidden response.


GHSA-q8gq-377p-jq3r: vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Summary: vLLM has a security vulnerability where an `assert` statement (a line of code that checks a condition) used to restrict which activation functions can be loaded is removed when Python runs in optimized mode, allowing attackers to publish malicious models on HuggingFace that execute arbitrary code when loaded.

Solution: Replace the `assert` with an explicit conditional raise. The source provides this fix: `if not function_name.startswith("torch.nn.modules."): raise ValueError("Loading of activation functions is restricted to torch.nn.modules for security reasons")`


GHSA-9c59-2mvc-vfr8: Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

Summary: Langflow's monitor API has 7 endpoints that lack ownership checks, allowing any authenticated user to read, modify, or delete another user's data like messages, sessions, and LLM logs through IDOR/BOLA (insecure direct object references/broken object-level authorization, where an attacker can access resources by guessing or knowing their IDs). The source code shows that the correct ownership-checking pattern exists in one endpoint but was not applied consistently across the other vulnerable endpoints.


France to ditch Palantir’s AI data tools in favour of domestic provider

Summary: France's intelligence service is switching from Palantir, a US company's AI data analysis tool, to a domestic provider called ChapsVision to reduce dependence on foreign technology. The French government argues that relying on tools controlled by other countries poses a strategic risk, and that France should develop and use its own AI systems instead.


Securing the future of AI agents

Summary: AI agents (autonomous systems that can perform complex tasks independently) are becoming more powerful but also riskier, so Google developed the AI Control Roadmap, a 'defense-in-depth' security framework that combines traditional safeguards like sandboxing (isolating software to limit damage) with monitoring systems and permission controls to protect against agents that may not be perfectly aligned (trained to match human goals) with organizational values. The roadmap treats AI agents as potential insider threats and uses trusted AI supervisors to constantly monitor their reasoning and actions, blocking harmful behaviors before they occur.

Solution: The source describes Google's implemented mitigations within the AI Control Roadmap: (1) using other trusted AI systems as 'supervisors' to constantly monitor a working agent's reasoning, actions, and plans; (2) having supervisors step in to block harmful actions before damage occurs; and (3) continuously measuring performance using three metrics—coverage (fraction of traffic monitored), recall (fraction of misaligned behaviors caught), and time-to-response. The roadmap also employs traditional safeguards including sandboxing, endpoint security, and prompt injection resistance, plus granting AI agents permissions based on their verified behavior.


GHSA-gr75-jv2w-4656: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Summary: LangChain has a path traversal vulnerability (a security flaw where attackers can access files outside an intended directory) in its file-search and configuration-loading components. These components don't properly validate that resolved file paths stay within their intended root directory, allowing attackers to use glob patterns (wildcards like *.txt), symlinks (shortcuts to files), or specially crafted path strings to access files they shouldn't. If an untrusted source, including an LLM, influences the paths or search patterns, attackers could read files outside the intended boundary.

Solution: The patches will canonicalize candidate paths (resolve symlinks to their actual targets) and verify the resolved real path stays within the configured root before reading files; normalize search patterns so they cannot escape the root; make configuration loaders confine resolved path fields and reject symlink escapes unless the caller explicitly enables dangerous loading; enforce path-segment boundaries in path-prefix checks; and make path validation work consistently across different operating systems. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag.

langchain-anthropic@<= 1.4.5 (fixed: 1.4.6)


SpaceX to acquire the AI coding startup Cursor for $60 billion

Summary: SpaceX announced a $60 billion agreement to acquire Cursor, an AI startup that built a popular coding tool helping developers generate and review code. The deal comes after Cursor experienced rapid growth since 2022, though its market share has recently declined from 41% to 26% as competitors like Anthropic have gained ground, and SpaceX expects the merger to close in the third quarter pending regulatory approval.


GHSA-p4gq-832x-fm9v: Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

Summary: NLTK's nltk.data.load() function has a path traversal vulnerability (CWE-22, an attack that lets someone read files outside intended directories) because it checks for dangerous patterns before decoding URL-encoded characters like %2f (/) and %2e (.). An attacker can bypass protections by URL-encoding traversal sequences (for example, %2fetc%2fpasswd instead of /etc/passwd) and read arbitrary files from the filesystem.


GHSA-8rfp-98v4-mmr6: Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output

Summary: Bleach, a library that removes dangerous content from HTML, has a vulnerability where it fails to block disallowed URI schemes (like javascript:) when Unicode characters (special invisible characters above U+00A0) are inserted into them. While modern browsers won't execute these malformed links, the vulnerability breaks Bleach's safety promise, and if downstream systems normalize these Unicode characters, the dangerous links could become executable.

Solution: Users should upgrade to Bleach 6.4.0. As a workaround, pre-process content to remove non-ASCII characters from URI schemes before sanitizing with bleach.clean, or implement a strong Content-Security-Policy (a security header that restricts what scripts can run on a webpage) without unsafe-inline and unsafe-eval script-srcs.


Magnitude Emerges From Stealth Mode With $10 Million in Funding

Summary: Magnitude, a cybersecurity startup, launched with $10 million in funding to address third-party risk management (TPRM, the process of monitoring security risks from external vendors and partners) using an autonomous AI workforce. The company's AI agents continuously monitor vendors, products, and dependencies for vulnerabilities, automatically identify exposed systems when new risks emerge, and help organizations respond to threats at the speed of AI-powered attacks.


Elon Musk’s unprecendented accumulation of wealth

Summary: N/A -- This content is not about an AI/LLM-related technical issue, vulnerability, or problem. It is a newsletter header about SpaceX's IPO and mentions only in passing that the US government ordered limits on Anthropic's advanced AI model due to cybersecurity concerns, but provides no details about what that concern is or how it works.


SpaceX is officially buying Cursor for $60 billion

Summary: SpaceX is acquiring Cursor, an AI-powered programming platform, for $60 billion to strengthen its enterprise software offerings and compete with other AI companies like Anthropic and OpenAI. The deal was negotiated earlier with an option to either complete the purchase or pay a $10 billion breakup fee, and SpaceX expects to finalize it by the third quarter of 2026.

SpaceX
Cursor
Anthropic
OpenAI
Elon Musk


Wiz Exposure Management Dashboard: Your CTEM Command Center

Summary: AI models can now discover vulnerabilities and create working exploits in hours, forcing organizations to adopt faster security practices that match AI speed rather than traditional weekly or monthly patching cycles. The Wiz Exposure Management Dashboard uses Continuous Threat Exposure Management (CTEM, a proactive strategy that continuously identifies, prioritizes, and validates the most critical attack paths) and AI-powered agents to help security teams automate vulnerability identification, prioritization, and remediation at machine speed to keep pace with AI-driven threats.


Cybersecurity Executives Urge the Trump Administration to Ease Restrictions on Anthropic AI Models

Summary: Cybersecurity executives are urging the Trump administration to reverse its ban on foreign nationals using Anthropic's latest AI models (Mythos 5 and Fable 5), arguing the restriction could help U.S. adversaries more than protect national security. Anthropic took these models offline to comply with the directive because the AI can find and exploit computer vulnerabilities better than human experts, but the executives' letter contends that other AI models have similar capabilities and that China's AI is rapidly catching up to American technology.


Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE

Summary: Researchers discovered a vulnerability in Google Cloud's Vertex AI SDK for Python (versions 1.139.0 and 1.140.0) that allowed attackers to hijack model uploads through bucket squatting (exploiting predictable cloud storage bucket names to intercept files). By predicting the victim's bucket name based on their project ID, an attacker could create that bucket in their own account, intercept the model upload, inject malicious code, and achieve RCE (remote code execution, where attackers run commands on systems they don't own) when the victim deployed the poisoned model.

Solution: Google completed fixes to address this issue in v1.148.0, released April 15, 2026. Developers should upgrade to this fixed version of the SDK.

Google Cloud Vertex AI
google-cloud-aiplatform SDK


Qualcomm CEO says AI agents will replace apps — as chip giant works on 40 new AI-powered devices

Summary: Qualcomm is developing over 40 new AI-powered devices, with CEO Cristiano Amon predicting that AI agents (autonomous software programs that can perform complex tasks across apps and services) will gradually replace traditional apps and smartphones as the center of how people interact with technology. These new devices include wearables like smart glasses, earbuds with cameras, and jewelry designed to give users constant access to these agents, potentially becoming as popular as smartphones within a few years.

Solution: N/A -- no mitigation discussed in source.

Qualcomm OpenAI Meta Apple Samsung Google


Inside the fight over Claude Mythos 5

Summary: Anthropic received a US export control directive (a government order restricting what can be shared outside the country) on Friday requiring the company to suspend access to its Claude Mythos 5 and Fable 5 AI models for all foreign nationals, including foreign employees. To comply with the order, Anthropic had to completely disable the products and planned to travel to Washington to appeal the directive to President Trump.


A Hybrid Intrusion Detection Model for Cloud Security: Feature Selection, Classification, and Authentication Using TFSEA Framework

Summary: This research paper presents a new security framework called TFSEA that combines feature selection (choosing which data points matter most), classification (sorting data into categories), and authentication (verifying user identity) to detect unauthorized access attempts in cloud computing environments. The paper proposes using this hybrid approach to improve how well systems can identify and prevent intrusions in cloud infrastructure.


Predicting model behavior before release by simulating deployment

Summary: OpenAI developed Deployment Simulation, a method that tests new AI models by replaying real conversations from previous deployments to see how the new model would behave before release. This approach helps identify unexpected problems and predict how often undesired behaviors might occur in real-world use, addressing limitations of traditional evaluation methods like coverage gaps and selection bias (favoring certain test scenarios over others).


DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act

Summary: The U.S. Department of Justice seized two websites, CFAKE.com and SOCFAKE.com, that hosted nonconsensual AI-generated nude images and videos of women, marking the first major enforcement action under the TAKE IT DOWN Act. Deepfakes (AI-generated or AI-manipulated media depicting people in ways that never occurred) of politicians, celebrities, and other public figures were shared on these sites, and the seizure resulted from a coordinated investigation involving U.S., Italian, and French authorities. The TAKE IT DOWN Act, signed into law in May 2025, makes it a federal crime to publish sexually explicit altered images without consent and requires online platforms to remove reported intimate images within 48 hours.

Solution: The TAKE IT DOWN Act (47 U.S.C. § 223) requires online platforms to remove reported intimate images and deepfakes within 48 hours of receiving a valid request from a victim. Violators are subject to fines, imprisonment, or both.


The US government’s Anthropic models ban was never about an AI jailbreak

Summary: The U.S. Commerce Department used an export control directive to force Anthropic to take its Fable 5 and Mythos 5 AI models offline, citing national security concerns without providing specifics. Security experts argue the action was based on a misunderstanding of a guardrail bypass (a method to get an AI to ignore its safety restrictions) that cannot be meaningfully fixed without weakening the models' security capabilities, and they contend the government's intervention appears retaliatory rather than justified by technical merit.


CVE-2026-48124: Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute work

Summary: Cursor, a code editor designed for programming with AI assistance, had a security flaw in versions before 3.0.0 where it would automatically run commands from a settings file (.claude/settings.local.json) without asking the user first. An attacker could create a malicious workspace or file that executes harmful commands on the user's computer when the AI completes a task, potentially allowing them to escape security restrictions, maintain access across sessions, steal local data, or cause further damage.

Solution: Update Cursor to version 3.0.0 or later. According to the source, 'This issue has been fixed in version 3.0.0.'


GHSA-5w86-c3rq-vjj7: Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

Summary: Netty's RedisArrayAggregator has a vulnerability where it pre-allocates memory (reserves space in a data structure) based on array sizes claimed in incoming messages, without checking if those sizes are reasonable. An attacker can send a message claiming an extremely large array size, causing the system to try reserving huge amounts of memory and crash or become unresponsive, even though they don't send the actual array data.

io.netty:netty-codec-redis@<= 4.1.134.Final (fixed: 4.1.135.Final)

io.netty:netty-codec-redis@>= 4.2.0.Final, <= 4.2.14.Final (fixed: 4.2.15.Final)


GHSA-8988-4f7v-96qf: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

Summary: The W3CBaggagePropagator.extract() function in OpenTelemetry Core does not limit the size of incoming baggage HTTP headers, allowing unbounded memory allocation. While Node.js's default header size limit (16,384 bytes) provides some protection, systems without this limit or using non-HTTP transports (alternative communication methods like messaging systems) are at higher risk.

Solution: Update @opentelemetry/core to version 2.8.0 or later. The fix enforces the W3C Baggage specification limits at the propagator level: maximum total baggage size of 8,192 bytes, maximum 180 entries, and maximum per-entry size of 4,096 bytes. Headers exceeding these limits are truncated. Additionally, the source recommends configuring header size limits at the server or gateway level, and for non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.

@opentelemetry/core@< 2.8.0 (fixed: 2.8.0)


Copilot 'SearchLeak' Attack Allows 1-Click Data Theft

Summary: A critical three-stage attack called 'SearchLeak' could allow attackers to steal data from Microsoft Copilot with just one click by exploiting prompt injection (tricking an AI by hiding instructions in its input) through hidden URLs and other hidden variables. This attack is part of a larger category of security issues affecting AI systems that use similar injection techniques. The vulnerability has already been patched.

Solution: The attack has been patched, though the source does not specify the patch version or detailed remediation steps.


All the news about Anthropic’s new AI fight with the White House

Summary: The White House ordered Anthropic to block foreign access to its newly released AI models, Fable 5 and Mythos 5, after researchers discovered potential jailbreaks (methods to make the AI ignore its safety guidelines) that could be exploited for cyberattacks. Anthropic complied by shutting off access to both models for all users, though the company disagreed with the decision, arguing that a narrow security flaw shouldn't justify recalling models used by hundreds of millions of people.

Solution: Anthropic removed access to Fable 5 and Mythos 5 for all users in response to the government's legal directive.

Anthropic
Claude
Fable 5
Mythos 5
Amazon
White House


CVE-2026-11931 - Insecure Permissions on Authentication Token Cache File in Kiro IDE

Summary: Kiro IDE, an AI-powered development tool, had a security flaw in versions before 0.11.133 where authentication token cache files (files storing login credentials) were saved with world-readable permissions on macOS and Linux, meaning any user or process on the same computer could read them instead of just the owner.

Solution: Update Kiro IDE to version 0.11.133 or later.


Trump’s Anthropic shutdown just made the case for non-American AI

Summary: The Trump administration ordered Anthropic to take its newest AI models offline and block access for all foreign nationals, including the company's own international employees. This incident highlights how the US government can control access to advanced AI technology, even for American companies, raising concerns about global AI development being dominated by American political decisions.


Anthropic to meet with Trump administration over Mythos dispute

Summary: The U.S. government ordered AI company Anthropic to disable access to its latest AI models, Fable 5 and Mythos 5, citing national security concerns about a potential jailbreak (a method to bypass safety restrictions). Anthropic complied by shutting down access for all users, and senior staff are meeting with Trump administration officials to resolve the dispute, which follows earlier government actions restricting defense contractors from using Anthropic's technology.


Anthropic to meet with White House over AI tool suspension

Summary: Anthropic, an AI company, is meeting with US government officials after releasing Fable 5 and Mythos 5, new versions of its Claude Mythos AI model, which the government suspended due to national security concerns. The government discovered a potential jailbreak (a method to make an AI tool do something unintended) in the publicly available version shortly after release, and Anthropic reported receiving only verbal evidence of the vulnerability so far.


Big Tech’s desperate last push at AI regulation

Summary: Tech company lobbyists in Washington have been pushing for preemption, a comprehensive federal law that would create one set of AI rules across the entire country instead of having different regulations in each state. Their efforts have faced political obstacles and public backlash, and they worry that after upcoming elections, Congress may have more Democrats who are unwilling to support their proposals.


Salesforce to buy AI customer service platform Fin for $3.6 billion to boost agentic offerings

Summary: Salesforce is acquiring Fin (formerly Intercom), an AI customer service platform, for $3.6 billion to strengthen its agentic AI (autonomous artificial intelligence agents that can independently handle tasks) offerings. Fin's main product is an AI agent powered by a proprietary model called Apex that can resolve customer inquiries across multiple channels including chat, email, WhatsApp, and Slack. This acquisition reflects how software companies are competing to invest in more autonomous AI technologies as businesses increasingly demand agentic solutions.


LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers

Summary: LiteLLM, a widely-used open-source AI gateway (a system that routes AI requests to multiple providers), has a critical vulnerability chain (CVSS score of 9.9, meaning extremely severe) that lets low-privilege users gain full admin control and run code on the server. The three bugs work together: an authorization bypass (CVE-2026-47101) that lets users create keys with unlimited access, a privilege escalation (CVE-2026-47102) that promotes users to admin, and a sandbox escape (CVE-2026-40217) that executes arbitrary code. This compromise exposes all provider API keys, encrypted credentials, and all prompts and responses passing through the gateway, plus allows attackers to alter AI responses in transit.

Solution: Upgrade to LiteLLM v1.83.14-stable or later. This release, published May 2, includes the complete fix set for all three CVEs in the vulnerability chain.

LiteLLM
OpenAI
Anthropic
Google
Amazon
Microsoft Azure


Cybersecurity vets protest ‘dangerous’ US government ban on Anthropic’s most powerful models

Summary: The U.S. government ordered Anthropic to restrict exports of its Fable and Mythos AI models (advanced models designed to find security vulnerabilities), citing national security concerns, which prompted Anthropic to suspend worldwide access to these models. Dozens of prominent cybersecurity experts published an open letter arguing this ban is dangerous because it removes powerful security tools from defenders while adversaries continue advancing, and they claim the vulnerability that justified the ban can be replicated in other widely available AI models like OpenAI's GPT-5.5 and Claude Opus 4.8.

Anthropic
Mythos
Fable
OpenAI
GPT-5.5
Claude Opus
Claude Sonnet


One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes

Summary: A critical flaw in Microsoft 365 Copilot Enterprise Search could let attackers steal emails, calendar details, and multi-factor authentication codes with a single click on a malicious link. Researchers discovered that three chained bugs, including parameter-to-prompt injection (tricking the AI by hiding instructions in a URL parameter), a timing flaw in how responses are filtered, and a Content Security Policy allowlist for Bing, allowed attackers to extract sensitive data without the user entering any passwords or clicking again.

Solution: Microsoft mitigated the flaw on its backend, so customers have nothing to worry about. No customer action was required.

Microsoft 365 Copilot
Microsoft Copilot Enterprise Search
Bing


"They screwed us": Personality clashes sent Anthropic's models offline

Summary: Anthropic's AI models were taken offline due to disagreements between the company and US government officials over export controls, with personality clashes between key leaders cited as a contributing factor. The government is concerned about jailbreaks (methods to bypass safety restrictions on AI models), and one proposed solution is to make Anthropic's models resistant to jailbreaking, though officials acknowledge this may be impossible to achieve perfectly.

Solution: The source mentions that Anthropic has worked on Constitutional Classifiers (a method to detect and prevent unsafe outputs) and claims no universal jailbreak has been found against Claude Mythos. However, no explicit fix, patch, or confirmed mitigation is presented as a resolved solution in the text.

Anthropic
Claude
Claude Mythos
Claude Fable
Google DeepMind


NewCore Emerges From Stealth Mode With $66 Million in Funding

Summary: NewCore, an Israeli cybersecurity startup, has emerged from stealth mode with $66 million in funding to build an identity platform designed for the era of agentic AI (AI systems that can take autonomous actions). The platform uses Secure Split Key (SSK), a technique that prevents a specific class of attacks on SAML (Security Assertion Markup Language, a system for managing authentication) infrastructure, and includes features like hardware-bound credentials and continuous identity discovery to protect human, machine, and AI agent identities.


As AI agents become employees, NewCore emerges with $66M to give them identities

Summary: NewCore, a new cybersecurity startup, has raised $66 million to help companies manage AI agents as workplace participants by giving them digital identities with proper authentication and access controls. As companies increasingly deploy AI agents alongside human employees, NewCore argues that traditional identity platforms (systems that verify who users are and what they can access) are outdated and designed only for humans, not software workers. NewCore's platform treats AI agents as first-class identities with their own permissions and access controls, using a 'split-key' architecture (dividing credentials between the customer and the platform to prevent a single point of failure) to secure them.

Solution: NewCore's platform addresses this through several built-in features explicitly described in the source: a 'split-key' architecture that divides critical identity credentials between the customer and the platform to eliminate a single point of compromise; an 'Agentic Skill' integration package for coding assistants like Claude Code, OpenAI's Codex, and Cursor that allows AI tools to access enterprise systems as managed identities rather than through manually distributed credentials; and a mobile app that lets employees grant, review, and revoke access for AI agents, providing human oversight as companies deploy more autonomous systems.

Anthropic
OpenAI
Cursor
Check Point
Okta
Microsoft


New attack turned Microsoft 365 Copilot into 1-click data theft tool

Summary: SearchLeak is a critical vulnerability in Microsoft 365 Copilot Enterprise that allowed attackers to steal sensitive data like emails, passwords, and documents through a single malicious link. The attack worked by chaining three separate flaws together: parameter-to-prompt injection (tricking the AI by hiding instructions in a URL parameter), an HTML rendering race condition (exploiting a moment when HTML isn't yet protected), and a server-side request forgery in Bing (making Bing unknowingly help retrieve stolen data). Microsoft fixed this vulnerability and assigned it CVE-2026-42824 with a critical severity rating.

Solution: Microsoft addressed SearchLeak at the beginning of the month. With Microsoft having fixed CVE-2026-42824, there's no user action required to mitigate this threat.


Langflow RCE under active attack months after a patch was shipped

Summary: Langflow, an open-source platform for building AI applications, has a path traversal vulnerability (CVE-2026-5027, rated 8.8 CVSS, a measure of how severe a vulnerability is) that allows attackers to write files to any location on a system and potentially execute remote code. The flaw is particularly dangerous because Langflow has login disabled by default, letting unauthenticated users exploit it with a single request, and attackers are actively using public exploit code to attack the approximately 7,000 internet-exposed instances.

Solution: Update Langflow to version 1.9.0 or later (current version is 1.10.0). The vulnerability affects versions up to 1.8.4, and the fix was released on April 15.


US Cracks Down on Anthropic AI Models Amid Abuse Concerns

Summary: Anthropic stopped all access to its Fable 5 and Mythos 5 AI models after receiving an export control directive (a government order restricting who can use certain technology) that prevents foreign nationals from using these systems. The shutdown was triggered by US regulations that treat advanced AI as technology that needs restricted access.


Attackers can turn AI agent guardrails into denial-of-service weapons

Summary: Researchers discovered that attackers can exploit AI agent guardrails (safety systems that check AI behavior) by inserting malicious content into documents, causing the security mechanisms to enter extended thinking loops that dramatically slow down or crash shared AI systems. This reasoning-extension DoS (denial-of-service, a type of attack that makes systems unavailable) attack targets the safety layer itself rather than trying to jailbreak the AI model, and it works across multiple AI frameworks and different LLM families. Unlike traditional attacks that try to produce unsafe outputs, this technique compromises availability by exhausting computational resources, with some systems experiencing slowdowns of up to 148 times normal speed.

LangChain LangGraph BrowserGym OpenHands OSWorld OpenAI Anthropic


Sovereign cloud won’t fix your AI risk. Identity governance will

Summary: Sovereign cloud (cloud infrastructure located in a specific country or region to comply with data residency laws) alone does not guarantee the control that enterprises expect over their AI workloads, despite regulatory pressure in Europe and increasing scrutiny in the US. The real control point lies in identity governance (managing who can access what resources and under what circumstances) and related infrastructure layers like encryption key management, access logging, and workload identity management, not just where data is physically stored.


5 runtime signals for catching a compromised AI agent

Summary: AI agents (software systems that can read data, process external content, and take actions) now commonly have all three dangerous capabilities together, making them vulnerable to prompt injection (tricky instructions hidden in data that trick the AI into doing harmful things). Security experts like Meta recommend the 'Rule of Two,' which limits agents to only two of these three capabilities per session and requires human approval if all three are needed, but this framework has limitations and doesn't fully solve the problem.

Solution: Meta's security team published the 'Rule of Two' framework, which recommends agents satisfy no more than two of the three trifecta properties (access to private data, exposure to untrusted content, ability to communicate externally) in a single session, with human-in-the-loop approval required if all three are necessary. Simon Willison endorsed this framework as 'the best practical advice for building secure LLM-powered agent systems today.'

OpenAI Google Microsoft Amazon LangChain

Microsoft 365 Copilot
GitHub
GitLab Duo
Slack AI
Google Bard
Amazon Q
Meta
Sophos


CrowdStrike Announces Continuous Identity for AI Agents

Summary: AI agents operate at machine speed across multiple systems, making traditional security models that grant access once at login insufficient for protecting modern infrastructure. CrowdStrike's Continuous Identity approach continuously evaluates identity, device, threat, and business context to grant, adjust, or revoke access in real time, with specific features for AI agents including verification based on SPIFFE standards (an identity framework), removal of standing privileges (permissions that remain active indefinitely), and immediate revocation when risk conditions change.

Solution: CrowdStrike provides Continuous Identity for AI Agents through Falcon Next-Gen Identity Security, which eliminates standing privileges and verifies trust for every agent action in real time using SPIFFE identity standards and the Shared Signals Framework. The system evaluates each action against the human user's and agent's entitlements and current security and business context, ensures agents cannot exceed the permissions of their human operator, preserves human identity and permissions when agents delegate to sub-agents, and immediately revokes access if context changes (such as new vulnerabilities or HR status changes). Additionally, CrowdStrike Falcon AI Detection and Response (AIDR) continuously inspects prompts and intent to detect permission misuse, triggering Continuous Identity to revoke access before damage occurs.


CVE-2026-12203: A vulnerability was found in HKUDS AI-Trader up to 74caf996f78dcc0c657df8365c8544678a16e215. This affects an unknown par

Summary: A vulnerability in HKUDS AI-Trader allowed attackers to access sensitive information through the research export feature by manipulating the /api/research/agents.csv file, and this flaw could be exploited remotely without needing physical access to the system. The vulnerability affects versions up to commit 74caf996f78dcc0c657df8365c8544678a16e215, and the exploit details have been made publicly available.

Solution: Apply patch 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65. The vendor confirms the fix requires authentication (proof of identity) and the research_exports capability (a specific permission) to access research export endpoints.


China may have accessed Mythos

Summary: According to a report, the White House may have restricted exports of Anthropic's Mythos AI model because it feared a group linked to China had accessed it, which would pose serious national security risks. One concern is that the Chinese government could use distillation (training a simpler AI on a more advanced one to copy its behavior) to reverse engineer the model.


Introducing the OpenAI Partner Network

Summary: OpenAI announced a new Partner Network program to help organizations adopt AI by connecting them with consulting and technology partners who can identify use cases, integrate AI into existing systems, and manage organizational change. The program invests $150 million to support partners across systems integration, consulting, and technology, with plans to train 300,000 certified consultants by the end of 2026, recognizing that enterprise AI success depends on strategy and implementation support, not just model capabilities.


A year after Meta tapped Alexandr Wang to build a new AI model, Zuckerberg has to sell it

Summary: Meta spent $14.3 billion to hire Alexandr Wang and his team to build proprietary AI models, resulting in the Muse Spark model released in April 2024, a shift away from Meta's previous open-source approach. However, Meta still struggles to compete with OpenAI and Google, and faces challenges convincing developers and investors that it can monetize AI products beyond its core advertising business, which currently accounts for 98% of revenue. The company's earlier open-source Llama models failed to attract developers, damaging its reputation in the AI community.

Meta
Scale AI
OpenAI
Anthropic
Google
Llama
Muse Spark


Rethinking ransomware defense in the age of generative AI

Summary: This article examines how ransomware (malicious software that locks files and demands payment to unlock them) defense strategies need to change as generative AI (AI systems that create new content like text or code) becomes more common. The piece suggests that traditional security approaches may be less effective in an environment where AI is widely used.


A Survey of Neural Network Robustness Assessment in Image Recognition

Summary: This academic survey paper reviews methods for testing how well neural networks (AI systems trained to recognize patterns in data) perform when faced with unexpected or manipulated images. The paper examines various approaches researchers use to assess whether image recognition systems remain accurate and reliable under challenging conditions.


Amazon security research reportedly led to the White House’s Anthropic Fable ban

Summary: Amazon's security research found that Anthropic's Fable 5 AI model could be manipulated through prompt injection (tricking an AI by hiding instructions in its input) to reveal information usable for cyberattacks. After Amazon CEO Andy Jassy shared these findings with the White House, Anthropic restricted access to Fable 5 and Mythos 5 to prevent foreign nationals from using the models.


Amazon CEO reportedly raised Anthropic model concerns before government crackdown

Summary: Amazon CEO Andy Jassy reportedly told U.S. government officials that researchers discovered security vulnerabilities in Anthropic's Claude models that could be exploited for cyberattacks, leading the government to ban exports of two models (Fable 5 and Mythos 5). Anthropic subsequently cut off worldwide access to these models, though the company stated that the concerning capabilities were already available in other public models.

Anthropic
Claude Fable 5
Mythos 5
Amazon
AWS


My yard is dying, so I made an app for that

Summary: A user prompted Google's Gemini AI to build a functional app in a single request, and the AI generated working code in a preview window. However, Gemini encountered a bug (a race condition, which is when the order of operations in code causes unexpected behavior) and reported a broken channel, though it provided a button to fix the issue, which succeeded after 233 seconds.


Anthropic cuts off Fable 5 and Mythos 5 access following government order

Summary: The U.S. government ordered Anthropic to block access to two AI models called Fable 5 and Mythos 5 due to unspecified national security concerns, and the company complied by cutting off access for all users worldwide, including its own employees. Anthropic stated that the government did not provide detailed information about the security threat and only mentioned potential jailbreak (tricks to make the AI ignore its safety instructions) vulnerabilities verbally, which the company claims were minor.