CVE-2026-24213: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-boun

Summary: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend (a component that processes data) where an attacker could perform an out-of-bounds read (accessing memory locations outside the intended range). Exploiting this could allow code execution (running malicious commands), data tampering (changing information), denial of service (making the system unavailable), or information disclosure (leaking sensitive data).


CVE-2026-24210: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. A successful

Summary: NVIDIA Triton Inference Server has a vulnerability where an attacker could cause an integer overflow (a situation where a number exceeds the maximum value a program can store, causing unexpected behavior), potentially leading to denial of service (making a system unavailable to users). The vulnerability has a CVSS 4.0 severity rating (a 0-10 scale measuring how serious a security flaw is).

Solution: N/A -- no mitigation discussed in source.


CVE-2026-24209: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successf

Summary: CVE-2026-24209 is a path traversal vulnerability (a flaw where an attacker manipulates file paths to access files outside their intended directory) in NVIDIA Triton Inference Server that could allow an attacker to cause a denial of service (making a system unavailable to users). The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.


CVE-2026-24208: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successf

Summary: NVIDIA Triton Inference Server contains a path traversal vulnerability (CWE-22, a flaw where attackers can access files outside the intended directory) that could allow an attacker to cause a denial of service (making the service unavailable). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment has not yet been provided by NIST.


CVE-2026-24207: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes

Summary: NVIDIA Triton Inference Server has a vulnerability (CVE-2026-24207) where an attacker could bypass authentication (skip security checks that normally verify who someone is), potentially allowing them to run code, gain higher privileges, change data, crash the service, or steal information. The vulnerability is classified as an authentication bypass using an alternate path or channel (CWE-288, a type of weakness where attackers find different ways to access a system without proper verification).

confidentiality integrity availability safety


CVE-2026-24206: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes

Summary: NVIDIA Triton Inference Server contains a vulnerability (CVE-2026-24206) that allows attackers to bypass authentication (a security check that verifies who you are), potentially leading to privilege escalation (gaining higher-level access), denial of service (making a system unavailable), or information disclosure (unauthorized access to data). The vulnerability is classified as CWE-288, which means it exploits an alternate path to bypass normal authentication checks.


What It'll Take to Make AI BOMs Usable in a Modern Security Program

Summary: This article discusses AI Bills of Materials (BOMs, which are detailed lists of components and dependencies used in AI systems), and how security leaders can prepare to use them effectively in their organizations. The piece focuses on five strategies that CISOs (Chief Information Security Officers, the executives responsible for security) can use to both adopt AI BOMs and help shape how they're created in the future.


Singapore inks AI deals with Google, OpenAI as ChatGPT-maker commits $234 million to local ecosystem

Summary: Singapore has signed separate agreements with Google and OpenAI to strengthen its position as a global AI hub and speed up AI deployment in public services, healthcare, education, and business. OpenAI will invest over $234 million in Singapore's AI ecosystem and establish its first applied AI lab outside the U.S., while Google will focus on solving societal challenges, building an AI-ready workforce, and creating a secure AI ecosystem (systems designed to prevent harmful outcomes from AI).

OpenAI
Google
Google DeepMind
Amazon AWS
Microsoft


Google announces glasses are back and search is getting an AI makeover

Summary: Google announced updates to its search engine that will use AI more heavily, allowing users to ask longer, more natural questions that get answered by Google's chatbot instead of traditional search results. The company also revealed new smart glasses (wearable devices with computer capabilities) for consumers, marking its return to the hardware market over a decade after its previous glasses faced public criticism. These changes are powered by Google's new Gemini 3.5 AI model.


The next phase of OpenAI’s Education for Countries

Summary: OpenAI is launching 'Education for Countries,' a program to help governments deploy AI tools like ChatGPT and Codex (a code-generation AI) in schools through research partnerships, teacher training, and localized systems. The program aims to improve learning outcomes while ensuring responsible adoption by measuring real-world impact in classroom settings and building educator confidence.


How Ramp engineers accelerate code review with Codex

Summary: Ramp engineers use Codex (an AI code review tool) with GPT-5.5 to give substantive feedback on pull requests (code changes) in minutes instead of hours, catching bugs that human reviewers miss. Beyond code review, they're also using Codex to build internal tools like On-Call Assistant, which helps manage the complex demands of on-call engineer shifts (when engineers respond to system emergencies). The tool stands out because it deeply analyzes the codebase and reasons through complex problems, reducing manual work that would otherwise require significant mental effort.


An OpenAI model has disproved a central conjecture in discrete geometry

Summary: An OpenAI language model has solved a famous 80-year-old math problem in discrete geometry (the study of geometric shapes made from separate points) by disproving a long-held belief about how many pairs of points can be exactly one unit apart. The AI found an infinite family of point arrangements that beat the previous best solution, and external mathematicians have verified the proof, marking the first time an AI has autonomously solved a prominent open problem central to a mathematical field.


Gemini 3.5 Flash: more expensive, but Google plan to use it for everything

Summary: Google released Gemini 3.5 Flash, a new AI model now available to billions of users through Google apps and to developers via APIs (application programming interfaces, tools that let software communicate). The model is significantly more expensive than previous Flash versions, costing 3-6 times more, bringing it close in price to Google's more advanced Gemini 3.1 Pro model.

Google
Gemini 3.5 Flash
OpenAI
GPT-5.5
Anthropic
Claude Opus 4.7


What Will Make AI BOMs Real?

Summary: This article discusses AI BOMs (bill of materials, a detailed list of components and dependencies in an AI system), exploring what factors will encourage more organizations to create and use them. The content examines the forces and motivations driving adoption of this practice for better AI transparency and management.


OpenAI announces new Guaranteed Capacity offering for customers to secure compute

Summary: OpenAI announced a new Guaranteed Capacity offering that lets customers lock in long-term access to compute (the computational power needed to train and run AI models) by committing to one, three-year contracts with increasing discounts based on the commitment length. CEO Sam Altman said this helps OpenAI plan ahead while giving customers certainty about capacity availability, though the offering is only available until current allocation sells out.


From teen hacker to Iron Dome researcher, this founder raised $28M to fight AI phishing

Summary: Ocean, a new startup founded by former Israeli cybersecurity researcher Shay Shwartz, has raised $28 million to fight AI-powered phishing attacks (fraudulent emails designed to steal information). The company argues that AI makes phishing easier and faster by automating the research and targeting process that previously required manual effort, so traditional email security tools are insufficient. Ocean's solution uses a small language model (a scaled-down AI trained for specific tasks) to analyze incoming emails for fraud and impersonation by understanding context and the sender's intent.

Solution: Ocean built a small language model tailored to quickly analyze emails, understand the sender's intent, and evaluate it against the user's specific organizational context. According to the founder, this approach works like 'having a guard in every door' to make the inbox safe.


Google’s AI future demands trust — and your personal data

Summary: Google is promoting new AI tools like Gemini Spark (an always-on AI agent that helps organize events and brief you on your day) and expanded Gmail AI features that draft emails and create to-do lists, but these tools rely on processing large amounts of personal data. The article raises concerns about whether users should trust Google with this personal information to power its AI-powered future.


datasette-llm-accountant 0.1a4

Summary: datasette-llm-accountant 0.1a4 is a software release, but the provided content contains only a title and version number with no description of features, functionality, or issues.


Introducing OpenAI for Singapore

Summary: OpenAI announced a partnership with Singapore's government called 'OpenAI for Singapore,' backed by over S$300 million, to help the country become an AI-powered economy. The initiative will establish OpenAI's first Applied AI Lab outside the United States, create over 200 technical jobs, and focus on deploying frontier AI (cutting-edge AI systems), developing local AI talent, and expanding AI access across organizations in sectors like healthcare, finance, and public services.


datasette-llm 0.1a8

Summary: datasette-llm 0.1a8 is an early-stage release (indicated by the 'a' in the version number, meaning alpha or pre-release software) announced by Simon Willison in May 2026. The source text does not provide details about what this software does, what problems it solves, or any security issues associated with it.


Roundtables: Inside the Musk v. Altman Trial

Summary: Elon Musk lost a lawsuit against OpenAI in which he claimed that CEO Sam Altman and President Greg Brockman had misled him about the company's non-profit status. MIT Technology Review hosted a discussion with AI reporter Michelle Kim and editor Mat Honan to examine the trial details and what the outcome means for competition in the AI industry.


GHSA-6x44-w3xg-hqqf: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Summary: Coder's Azure identity verification has a critical flaw: it checks that a certificate comes from a trusted Azure authority but never verifies the actual PKCS#7 signature (a cryptographic stamp that proves data hasn't been tampered with). An attacker can forge identity data and steal session tokens that grant access to Git keys, OAuth tokens, and secrets. All Coder v2 versions are affected.

Solution: Update to patched versions: v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, or v2.24.5. If unable to patch immediately, reconfigure Azure templates to use token authentication instead of azure-instance-identity by setting coder_agent.auth to 'token' and adding CODER_AGENT_TOKEN=${coder_agent.main.token} to environment variables.

github.com/coder/coder/v2@< 2.24.5 (fixed: 2.24.5)


GHSA-22qr-rp27-j9wm: PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

Summary: PenPot's MCP REPL server binds to all network interfaces (0.0.0.0:4403) and exposes an unauthenticated /execute endpoint that runs arbitrary JavaScript code, allowing anyone on the network to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own). The vulnerability exists because the server listen call omits a host argument, defaulting to 0.0.0.0, and the /execute endpoint has no authentication checks before executing user-supplied code.


GHSA-686c-7vgv-v3fx: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

Summary: Coder's Azure identity endpoint was vulnerable to SSRF (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) because it accepted unsigned certificates and fetched arbitrary URLs without validation. An attacker could craft a fake certificate pointing to any internal or external address, forcing the Coder server to connect to it and reveal whether the target was reachable through error messages, enabling network reconnaissance and potential attacks on internal services.

Solution: Fixed in PR #25274 (commit 57b11d405). Upgrade to patched versions: v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, or v2.24.5 (ESR), depending on your release line.


GHSA-fhh6-4qxv-rpqj: 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

Summary: 9router, a tool for managing AI plugins, has a critical vulnerability where two unprotected API endpoints can be chained together to run arbitrary OS commands. The problem occurs because the authentication middleware (a security check) only protects 8 specific routes, while 40+ routes under `/api/cli-tools/*` and `/api/mcp/*` have no protection, allowing attackers with network access to register malicious commands and then trigger them without any credentials.


AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks

Summary: The npm (node package manager, a repository for reusable code libraries) registry was attacked on May 19 when hackers compromised a maintainer account and published 637 malicious versions of 317 packages, including the popular AntV data visualization tool used by Alibaba. The malware, called Mini-Shai-Hulud worm, steals credentials like npm tokens, GitHub tokens, and passwords from cloud platforms and wallets. After detection, AntV's maintainers deleted the infected packages and marked remaining ones as deprecated, advising users to download only the latest verified versions.

Solution: According to AntV's GitHub warning, the infected packages have been deleted and remaining ones marked as deprecated. Users should identify and download the latest versions from a list of compromised packages. Beyond this, experts recommend developers look for signs of compromise in CI/CD (continuous integration/continuous deployment, automated systems that build and deploy code) environments and repositories, and rotate all credentials.


Gemini will use Volvo’s external cameras to interpret parking signs

Summary: Google and Volvo announced that Gemini, an AI assistant, will soon be able to access external cameras in Volvo's EX60 SUV to help interpret the vehicle's surroundings. This capability works because Volvo uses Google's Android Automotive (an operating system designed for vehicles) in the car. The first planned use is helping drivers understand confusing parking signs, though Google expects other applications in the future.


The 13 biggest announcements at Google I/O 2026

Summary: Google announced new AI models called Gemini 3.5 at its I/O 2026 conference, including Gemini 3.5 Flash (available immediately) and Gemini 3.5 Pro (coming next month). The Gemini 3.5 Flash model will now be the default AI powering Google's Gemini app and AI Mode in Search. The announcement was part of a broader keynote that also covered updates to Gmail, Search features, and Project Aura smart glasses.

Google
Gemini 3.5 Flash
Gemini 3.5 Pro
Project Aura


Meta is rapidly reorganizing its workers’ jobs around AI: ‘Transfers aren’t optional’

Summary: Meta is forcing over 7,000 employees to transfer to new teams focused on AI, including groups building AI cloud infrastructure and an internal AI agent called Hatch. This reorganization is mandatory, with the company previously telling workers that similar transfers to an AI data labeling team were non-optional, even after initially offering them as voluntary.


Google wants to compete with Anthropic’s Mythos

Summary: Google is expanding access to CodeMender, an AI agent (a software system that can perform tasks autonomously) for code security that can both identify and fix vulnerabilities (security weaknesses) in software. This move appears to be Google's response to Anthropic's recent announcement of Claude Mythos Preview, intensifying competition in the AI security tools market.


Google debuts new AI models, personal AI agents in effort to keep pace with OpenAI and Anthropic

Summary: Google announced new AI models at its I/O conference, including Gemini 3.5 Flash (a faster, cheaper version of its main model) and Gemini Spark (an AI agent that can take actions in connected apps on a user's behalf). The company also introduced Omni, a world model (AI trained to simulate and predict physical environments) that can edit videos and generate realistic imagery, as Google competes with rivals like OpenAI and Anthropic.

Google
Gemini
Gemini 3.5 Flash
Gemini 3.5 Pro
Gemini Spark
OpenAI
Anthropic
DeepMind
Omni


Google is launching its own version of OpenClaw

Summary: Google has announced Gemini Spark, its own AI agent platform (software that can perform tasks automatically on your behalf) that runs constantly in the background to help with tasks like writing emails, creating study guides, and monitoring credit card statements. Powered by the Gemini 3.5 Flash model, it will initially work with Google Workspace apps like Gmail and Docs, with plans to connect to other third-party applications.

Google
Gemini
Gemini 3.5 Flash
Gemini Spark
Google Cloud
Gmail
Docs
Sheets
Slides


Would you let robots spend your money? Google is betting on it

Summary: Google is expanding its AI shopping tools by introducing a 'Universal Cart' that lets users add products from different retailers while browsing Google Search and chatting with Gemini (Google's AI assistant), then checkout directly through Google. The cart will also track prices, notify users about stock availability, suggest discounts, and flag potential problems with selected items.


Gmail is going to start talking to you

Summary: Google is launching Gmail Live, a new AI-powered voice mode feature that lets users speak questions aloud in Gmail instead of typing them. The feature pulls relevant information from a user's inbox to answer questions, such as details about school events or travel plans.


Google Search is getting its biggest changes ever

Summary: Google Search is being redesigned to better integrate AI features, including AI Overviews (AI-generated summaries at the top of search results) and AI Mode (a chatbot-like search experience). The new search box, powered by Gemini 3.5 Flash model, expands for longer queries and includes AI-powered autocomplete to help refine questions.


Google Pics is a new app that tries to fix AI image editing

Summary: Google is launching Pics, a new AI image generation app for Workspace that uses Gemini and Google's Nano Banana 2 image model to make editing easier. Instead of rewriting entire prompts to change small details, users can click on specific parts of an image and leave notes describing what they want to change, similar to commenting in Google Docs.


Google is trying to make deepfake detection more accessible for everyone

Summary: Google is making it easier for people to detect deepfakes (synthetic media created by AI to look real) by adding detection tools to Chrome and Search. The tools will check for SynthID, which is invisible watermarking technology that marks images made with Google's AI tools, and C2PA content credentials (metadata that shows how content was created or changed), helping users understand whether online content is authentic or manipulated.


Anthropic hires OpenAI co-founder Andrej Karpathy, former Tesla AI leader

Summary: Andrej Karpathy, an AI researcher who co-founded OpenAI and later led Tesla's computer vision team, has joined Anthropic as a senior hire. At Anthropic, he will build a team focused on using Claude (the company's LLM, or large language model, a type of AI trained on text) to improve pretraining research, which helps AI models learn their core knowledge and abilities. This hire is part of Anthropic's ongoing competition with OpenAI to attract top talent in the AI field.


GHSA-jwp7-wg77-3w9v: Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

Summary: A domain allowlist (list of approved websites) in the Apify Model Context Protocol server is bypassed because it uses simple string prefix matching instead of proper URL validation. An attacker can create a fake subdomain like `https://docs.apify.com.evil.com/` that passes the check, allowing the tool to fetch arbitrary content from attacker-controlled servers and return it to the AI, which can lead to prompt injection (tricking the AI by hiding instructions in fetched content) and potential account compromise.

@apify/actors-mcp-server@< 0.9.21 (fixed: 0.9.21)


GHSA-4gph-2hhr-5mwg: Envoy AI Proxy - MCP Message Smuggling Vulnerability

Summary: Envoy AI Gateway has a vulnerability where it improperly parses JSON-RPC messages (a protocol for remote procedure calls) in a case-insensitive way, even though the specification requires case-sensitive matching. This allows attackers to send messages with duplicate fields using different capitalization (like 'name' and 'Name'), causing the gateway to alter and forward a different request than what was originally sent, potentially bypassing security checks in systems that use this gateway.

github.com/envoyproxy/ai-gateway@< 0.6.0 (fixed: 0.6.0)

Envoy AI Gateway
Model Context Protocol
modelcontextprotocol/go-sdk


GHSA-3875-8gcx-7v46: n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass

Summary: A security flaw in n8n (a workflow automation tool) allowed authenticated users to bypass restrictions on which websites could receive sensitive credentials, potentially exposing them. The vulnerability was in an endpoint (a URL that accepts requests) that didn't properly check the intended security rules before sending data to external servers.

Solution: The issue has been fixed in n8n version 2.20.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n access to fully trusted users only and limit credential sharing to users who genuinely require access to those credentials, though these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-hv85-774v-26fg: auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

Summary: The `download_media` and `auth_fetch` tools in auth-fetch-mcp accept any URL without validation, allowing an attacker (via prompt injection or a malicious MCP client) to make the server fetch from private or internal services like cloud metadata endpoints or localhost, and then exfiltrate the response data. The `download_media` tool makes this worse by saving fetched content to disk where it can be read and stolen.

Solution: The source text describes the fix shape but does not provide an explicit implementation or version update: 'after URL parsing, resolve to IP, reject if private/loopback/link-local. Same defense as the well-known SSRF-guard pattern shipped by other MCP fetchers in the ecosystem (e.g., `Akitaroh/scraper-mcp` `src/security/url-guard.ts`).' However, no patched version, release number, or completed code fix is provided in the source.

auth-fetch-mcp
ymw0407/auth-fetch-mcp
MCP (Model Context Protocol)


GHSA-xmpw-2vmm-p4p6: Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Summary: An attacker published malicious code in guardrails-ai version 0.10.1 on PyPI (a package repository where developers download Python libraries), but PyPI removed it within 2 hours and found no evidence that user data was stolen through this compromise. This is an example of a supply chain attack, where someone tries to harm users by corrupting a widely-used software package.

Solution: Downgrade to guardrails-ai==0.10.0, which is unaffected. Alternatively, install from GitHub using `pip install git+https://github.com/guardrails-ai/guardrails.git@v0.10.0`. If you installed 0.10.1, rotate all credentials accessible from that machine (GitHub PATs, cloud provider keys, package registry tokens, API keys) and audit your GitHub account for unauthorized workflows or repositories. Snowglobe and Guardrails Hub users should rotate API keys before 2:00 PM Pacific on May 13, 2026, when all existing keys will be invalidated.


GitHub scales back bug bounties, reminds users security is their responsibility too

Summary: GitHub is replacing cash bounties with swag rewards for low-impact bug reports and asking researchers to stop submitting low-quality reports, because AI tools have flooded the platform with submissions that don't represent real security risks. The company clarified that many rejected reports describe scenarios where users must actively engage with malicious content (like cloning a malicious repository), which means the security boundary lies with the user's decision to trust that content rather than with GitHub's security controls.

Solution: GitHub requires that all AI-generated submissions must be reviewed and validated by a human first, a rule that applies to any tool used to help with bug hunting. The company also publishes a list of submission types that are ineligible for rewards, which it uses to screen out reports without proof of concept and theoretical attack scenarios that don't hold up under scrutiny.


Palladium: Guarding Neural Network Training With Confidential Computing

Summary: Palladium is a system that protects private training data and model parameters when training deep neural networks (DNNs, AI systems with many layers that learn patterns from data) on remote cloud servers with GPUs. The system uses TEEs (trusted execution environments, secure areas of a processor that are isolated from the rest of the system) combined with a "Cloak" strategy to hide sensitive information while still allowing most computations to run on untrusted accelerators, achieving both privacy protection and reasonable performance.


PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoors

Summary: Diffusion models (AI systems that generate images from text descriptions) can be misused to create unauthorized portraits or copies of artistic styles through personalization, which threatens privacy and copyright. PersGuard is a new defense framework that embeds protective backdoors (hidden mechanisms) into these models before release, so that if someone tries to personalize the model with protected images, it generates predetermined protective outputs instead, while still working normally for unprotected images.

Solution: PersGuard embeds protective backdoors into pre-trained diffusion models before release. The framework uses three optimization objectives: a backdoor behavior loss to activate protection, a prior preservation loss to maintain normal generation capabilities, and a novel backdoor retention loss designed to ensure the backdoor remains robust when users fine-tune (customize) the model on protected images.


Hard-Label Black-Box Attacks on 3D Point Clouds

Summary: Researchers developed a new method to attack 3D point cloud models (AI systems that process 3D sensor data) using only the final prediction label, without needing access to the model's internal details or calculations. Their technique uses a spectrum-aware decision boundary algorithm to create adversarial examples (slightly modified inputs that fool the AI) that are harder to detect and more practical to deploy in real-world scenarios than existing attack methods.


SilentNoise: Non-Interactive Noise Generation for Differential Privacy With Malicious Security

Summary: SilentNoise addresses a problem in differential privacy (DP, a method for analyzing data while protecting individual privacy), which traditionally relies on one trusted party holding all sensitive data, creating a security risk. The researchers propose a decentralized system using secure multiparty computation (MPC, where multiple parties jointly compute results without fully revealing their individual data) that allows noise (random data added for privacy) to be generated securely even when some parties act maliciously, improving both efficiency and accuracy compared to previous approaches.


Garland: Graph Neural Network-Based Federated Recommendation With Malicious Security via Secret-Shared Shuffle

Summary: Garland is a system for recommendation engines that use graph neural networks (GNNs, which are AI models that learn patterns from interconnected user-item relationships) in federated settings, where data stays on users' devices instead of being sent to one central server. The system addresses a key problem: untrusted servers that help expand users' local data can spy on both item information and user relationships, so Garland uses secret-shared shuffle (a cryptographic technique that mixes data while keeping it encrypted) to protect privacy while still catching if a malicious server tries to cheat.


The Download: Musk v. Altman, smart glasses for warfare, and Google I/O

Summary: This newsletter covers several AI industry developments, including Elon Musk losing his lawsuit against OpenAI (a company creating large language models, which are AI systems trained on large amounts of text data) because he sued too late under statutes of limitations rather than on the merits of whether OpenAI violated its nonprofit mission. Other stories include Anduril and Meta developing augmented-reality smart glasses (wearable devices that overlay digital information on the physical world) for military use with eye-tracking controls, and Google preparing to showcase its AI capabilities at its I/O developer conference while facing competition from other AI companies.

OpenAI
Google DeepMind
Anthropic
Meta
Anduril
Fei-Fei Li's World Labs
Yann LeCun


2026 CNBC Disruptor 50 list: Why Anthropic was No. 1 in this year's rankings

Summary: Anthropic, an AI company founded about three years ago, topped CNBC's 2026 Disruptor 50 list due to its rapid growth, enterprise focus, and emphasis on safety through constitutional AI (a method designed to make AI systems align with human values). The company's CEO reports 80x revenue growth in the first quarter, and its Claude Code product has gained trust among businesses for handling complex tasks reliably.

Anthropic
OpenAI
Claude
Claude Code
Cursor
Lovable
Replit
Anduril
Saronic
Shield AI
Cyera
Abnormal AI
Applied Intuition
Ramp
Ripple
Revolut
Kalshi
Polymarket


Advancing content provenance for a safer, more transparent AI ecosystem

Summary: OpenAI is improving how people can verify where AI-generated images and audio come from by using multiple approaches: adding C2PA conformance (a cross-industry standard using metadata and cryptographic signatures to attach source information to content), partnering with Google to embed invisible watermarks called SynthID into images, and releasing a public tool to verify if images came from OpenAI. These layered approaches help protect provenance information (details about content's origin and creation) even when it's edited, downloaded, or shared across different platforms.

Solution: The source describes OpenAI's implemented approaches rather than fixes to a problem. OpenAI has: (1) become C2PA Conforming, which gives platforms a 'trusted way to read, preserve, and pass along the provenance information' attached to content; (2) incorporated 'SynthID embeds an invisible watermarking layer that complements C2PA metadata-based approaches,' starting with images from ChatGPT, Codex, or the OpenAI API; and (3) is 'previewing a' public verification tool for users to detect if images came from OpenAI. The source states these approaches are designed to work together: 'C2PA helps content carry detailed context; SynthID helps preserve a signal when metadata does not survive.'

OpenAI
Google DeepMind
DALL-E 3
Sora
ChatGPT
Codex
Voice Engine


Gemini is in danger of going full Copilot

Summary: Google's Gemini AI is being integrated into many Google apps and services at an increasing pace, similar to how Microsoft aggressively added Copilot to Windows 11. Users are experiencing fatigue from AI features appearing everywhere in their software, which is causing frustration.


CVE-2026-2611: In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.

Summary: MLflow version 3.9.0 has a vulnerability in its Assistant feature where /ajax-api endpoints don't properly validate the origin (the source website making a request). This allows an attacker on a malicious webpage to send cross-origin requests (requests from a different domain) to trick the MLflow Assistant running on a victim's computer, bypass security restrictions meant to only allow local access, and execute arbitrary commands (run any code they choose) through the Claude Code sub-agent.

Solution: Update to MLflow version 3.10.0, where this issue is resolved.


Anthropic and U.S. government to face off in DC court over blacklisting of AI company

Summary: Anthropic, an AI company, is suing the U.S. Department of Defense in federal court after the DOD labeled it a "supply chain risk" (a designation suggesting it threatens national security), which requires defense contractors to stop using Anthropic's Claude AI models in military work. The court judges questioned whether the DOD properly justified this blacklisting, with one judge calling it a "spectacular overreach," while the DOD argued it needed to act quickly to notify agencies about the risk.


The Iran war is exposing weak spots in the AI supply chain

Summary: The conflict between the U.S. and Iran is disrupting the supply chains that produce computer chips, which are essential for AI systems. Key materials like helium (a gas used in semiconductor manufacturing), bromine, and aluminum are becoming harder to get and more expensive, affecting companies like TSMC (the main manufacturer of Nvidia chips) and other chipmakers. Without a resolution to the conflict, these supply chain problems and rising costs could worsen throughout 2025 and impact the AI industry's growth.

Solution: TSMC's strategy involves building inventory buffers (stockpiles of materials), diversifying sourcing (buying from multiple suppliers), and continuously developing multi-source supply solutions to build a well-diversified global supplier base and improve the local supply chain. The source also notes that chip companies generally understand they need to diversify to be less dependent on a specific region.

NVIDIA
TSMC
Foxconn
Infineon
VAT Group
Advantest


The last six months in LLMs in five minutes

Summary: Between November 2025 and February 2026, large language models (LLMs, AI systems trained on vast text data) underwent rapid advancement, with the 'best' model changing hands multiple times among major providers. The most significant development was that coding agents (AI systems that write software code) improved dramatically from often-working to mostly-working, becoming reliable enough for daily professional use after months of reinforcement learning from verifiable rewards (a technique where AI systems learn by receiving feedback on whether their outputs are correct). This progress sparked widespread experimentation and led to the emergence of 'Claws' (personal AI assistants), with OpenClaw becoming particularly popular by February.

Claude Sonnet 4.5
Claude Opus 4.5
GPT-5.1
GPT-5.1 Codex Max
Gemini 3
OpenClaw
NanoClaw
ZeroClaw


How Sam Altman’s victory over Elon Musk clears way for OpenAI’s trillion-dollar ambitions

Summary: A jury in Oakland, California ruled that Sam Altman and OpenAI did not break any laws or contracts with Elon Musk, rejecting his claims that they enriched themselves unfairly. This court victory removes legal obstacles to OpenAI's plans for continued growth and development.


Jury hands victory to Sam Altman and OpenAI in battle with Elon Musk

Summary: A jury ruled that OpenAI CEO Sam Altman and president Greg Brockman are not liable for Elon Musk's claims that they broke a founding contract and unfairly profited from the company. This verdict ends a legal dispute between Musk and OpenAI's leadership over the terms under which OpenAI was originally established.


'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments

Summary: Security vulnerabilities called 'Claw Chain' were found in OpenClaw, a framework for building AI agents (programs that can perform tasks autonomously). These vulnerabilities allowed attackers to steal login credentials, gain higher-level access to systems, and stay hidden in compromised systems for extended periods. The vulnerabilities have now been patched.

Solution: The vulnerabilities have been patched. Users should update to the patched version of OpenClaw.


CVE-2026-4137: In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` cr

Summary: MLflow versions before 3.11.0 create temporary directories with overly permissive access permissions (world-writable or group-writable), allowing local attackers to modify model files and execute arbitrary code when those files are loaded. This is especially dangerous in shared environments like Databricks where multiple users access the same network storage.

Solution: Update MLflow to version 3.11.0 or later.


GHSA-pq7c-x8g4-rvp6: NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

Summary: NiceGUI has a vulnerability in two routes (resource and ESM module routes) that serve files without authentication. If a request tries to access a directory instead of a file through these routes, it causes an unhandled error that writes a large traceback (around 100 lines) to the server log. An attacker can repeatedly trigger this to fill up disk space, overload logging systems, and create false alarms in monitoring without needing any special access.

Solution: The source mentions three workarounds for deployments unable to upgrade immediately: (1) Place NiceGUI behind a reverse proxy that rejects requests where the path after `/_nicegui/<version>/esm/<key>/` or `/_nicegui/<version>/resources/<key>/` is empty. (2) Rate-limit the `/_nicegui/` prefix at the proxy. (3) Configure log rotation aggressively for the affected service. For a permanent fix, upgrading NiceGUI is recommended, though no specific patched version is mentioned in the source.


GHSA-jfrm-rx66-g536: NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

Summary: NiceGUI's `ui.restructured_text()` function renders user-supplied reStructuredText using Docutils without disabling file insertion directives, allowing attackers to read local files accessible to the server using standard Docutils directives like `include` and `raw`. This vulnerability only affects applications that pass untrusted or user-controlled content to this function, not those using only static trusted strings.

Solution: Disable unsafe Docutils features by modifying the `publish_parts()` call in `prepare_content()` to include these `settings_overrides`: `'file_insertion_enabled': False`, `'raw_enabled': False`, and `'_disable_config': True`. This blocks the `include`, `csv-table :file:`, and `raw :file:` directives as well as local `docutils.conf` overrides.


GHSA-43g7-cwr8-q3jh: OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

Summary: OpenTelemetry eBPF Instrumentation (OBI) contains an integer overflow vulnerability in its memcached protocol parser that allows a remote attacker to crash the OBI process. When parsing memcached storage commands, the parser accepts extremely large byte values without checking if adding the delimiter length will overflow, causing a negative value that triggers a runtime panic (a sudden crash caused by an error the program cannot recover from).

Solution: N/A -- no mitigation discussed in source.


GHSA-j8p6-96vp-f3r9: OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

Summary: Malformed MongoDB wire messages can crash the OpenTelemetry eBPF Instrumentation telemetry agent through uncaught panics in its MongoDB parser, allowing remote attackers to cause denial of service. The parser checks attacker-controlled network data without fully validating it first, so a single crafted message can stop telemetry collection until the agent restarts.

Solution: The bounds-check panics affecting versions v0.1.0 through v0.3.0 were fixed by commit `3aa58cdaaa97fbb72f8ef4c3609ae425aacaf8bb` (`Fix MongoDB client panic`), which first appears in release `v0.4.0`. However, the unchecked BSON type assertion panic affecting versions v0.1.0 through v0.8.0 remains unfixed as of the advisory date.

go.opentelemetry.io/obi@< 0.9.0 (fixed: 0.9.0)


GHSA-962q-hwm5-52x5: OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

Summary: OpenTelemetry eBPF Instrumentation has a memory leak in its `CappedConcurrentHashMap` class, which is used to track Java TLS connections. When entries are deleted from the map, the keys are not removed from an internal queue, causing the queue to grow indefinitely in systems with many short-lived connections. This can eventually cause the Java process to run out of memory.


CVE-2026-47092: Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attac

Summary: Claude HUD versions up to 0.0.12 contain a command injection vulnerability (a security flaw where an attacker can trick a program into running harmful commands) that affects Windows systems. An attacker with local access can manipulate the COMSPEC environment variable (a Windows setting that specifies which command interpreter to use) before the software checks its version, causing it to run malicious code with system permissions.

Solution: The vulnerability was patched in commit 234d9aa. Users should update to a version after 0.0.12 that includes this patch.


CVE-2026-47091: Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that allows attackers to r

Summary: Claude HUD versions up to 0.0.12 contain a path traversal vulnerability (a flaw where attackers can access files outside intended directories by manipulating file paths) that lets attackers read any file the program can access by sending a malicious transcript_path value. Additionally, the vulnerability creates a cache file with weak permissions that records which files were accessed, leaving evidence even after the program stops running.

Solution: The vulnerability was patched in commit 234d9aa. Users should update to a version containing this commit or later.


CVE-2026-47090: Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd

Summary: Claude HUD version 0.0.12 and earlier has a vulnerability where it creates terminal hyperlinks (clickable links in terminal windows) using user-controlled data without properly cleaning it first, allowing attackers to inject malicious terminal codes (ANSI codes, which control formatting and behavior in terminals) that could change text colors, fake command prompts, steal clipboard data, or redirect users to attacker-controlled websites.

Solution: Patched in commit 234d9aa.


GHSA-r6c9-g6q5-qrf9: OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

Summary: OpenTelemetry eBPF Instrumentation (OBI) has a memory leak vulnerability where a CPU mismatch causes the system to use a 256-byte fallback buffer but still tries to read up to 8KB of data from it, reading beyond the buffer's boundaries and leaking adjacent memory into telemetry (data about system performance). This happens in the HTTP tracing path when context propagation is enabled and certain conditions are met.


Pope Leo to issue text on human dignity and AI with Anthropic co-founder

Summary: Pope Leo is releasing an encyclical (a major teaching document from the Catholic Church) called Magnifica Humanitas that addresses how artificial intelligence affects human dignity, workers' rights, and society. The document will be presented at the Vatican on May 25 with Christopher Olah, co-founder of Anthropic (an AI company), and other speakers, marking a significant moment where the Church signals its engagement with rapid technological change similar to how Pope Leo XIII responded to the Industrial Revolution in 1891.


Musk v. Altman proved that AI is led by the wrong people

Summary: Elon Musk sued Sam Altman over control of OpenAI, a major AI company they co-founded together, but a jury dismissed the case after just two hours due to legal time limits. The trial revealed concerns that many of the powerful tech leaders directing AI development may not be trustworthy or temperamentally suited for the responsibility.


5 Steps to Managing Shadow AI Tools Without Slowing Down Employees

Summary: Shadow AI refers to unapproved AI tools that employees use at work without IT oversight, often gaining access to corporate data through quick login approvals that bypass traditional security monitoring. The article explains that 80% of employees use unapproved generative AI applications, and most companies lack formal AI governance policies, creating a visibility gap for security teams. The source describes a five-step program to manage this risk by discovering which tools are running, creating employee-friendly policies, and establishing approved alternatives.

Solution: The source explicitly recommends a five-step program: (1) discover all AI tools in use by auditing OAuth (authorization tokens that grant app access to data) connections, scanning for browser extensions, identifying AI features in already-approved tools, and surveying employees; (2) write a practical policy listing approved tools, specifying which data categories (customer records, source code, financial information) should never enter AI tools, confirming data training opt-out status for sensitive tools, and defining a process for requesting new tools; (3-5) [the source text is incomplete and does not provide steps 3-5]. Implement steps 1-2 to give security teams visibility while providing employees a clear approved path for AI tool adoption.

Microsoft Copilot
Google Gemini
Salesforce Einstein


Tech firms face tougher UK rules on intimate image abuse

Summary: UK regulators (Ofcom) are requiring social media platforms, messaging services, and online forums to follow stricter rules to prevent the spread of intimate image abuse (sharing private sexual images without consent, sometimes called 'revenge porn') and AI-generated deepfakes (fake videos created with AI to show people doing things they didn't do). This comes after a rise in such harmful content, particularly targeting women and girls, including a spike in deepfakes created with AI tools like Elon Musk's Grok.

Solution: Ofcom said it would change its codes of practice to force service providers to detect and quash intimate image abuse and crack down on AI-generated deepfakes.


Jury tosses Elon Musk's lawsuit against OpenAI and its boss Sam Altman

Summary: A California jury dismissed Elon Musk's lawsuit against OpenAI and CEO Sam Altman, ruling that Musk had waited too long to file his claims (the statute of limitations, a legal deadline for when lawsuits must be filed, had expired). Musk had accused Altman of breaching a non-profit agreement by converting OpenAI to a for-profit company after Musk donated $38 million early in the company's history. The jury's decision means the case was dismissed on timing grounds rather than on the actual merits of Musk's accusations.


GHSA-8rrq-wcg8-cv5q: OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

Summary: OpenTelemetry eBPF Instrumentation (OBI) exports unfiltered error messages from Redis directly into span status messages, which are then sent to telemetry backends (systems that collect and store trace data). This means sensitive information like tokens or passwords that appear in Redis errors could be leaked into monitoring systems, and attackers could inject malicious text into these systems.


GHSA-wp73-mwgf-4jq9: OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

Summary: OpenTelemetry eBPF Instrumentation (OBI) has a vulnerability where its ELF parser (a tool that reads executable file formats) blindly trusts offsets and metadata from binary files without checking if they're valid. A malicious or corrupted executable can cause OBI to crash when it tries to analyze what programming language a process uses, disrupting monitoring for other applications on the system.

OpenTelemetry
OpenTelemetry eBPF Instrumentation


GHSA-jgg6-4rpr-wfh7: Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

Summary: Three Mistral AI npm packages (@mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp) were compromised in a supply chain attack (where malicious code is inserted into legitimate software dependencies) between May 11-12. However, the malicious code, called a dropper (a program designed to download and execute harmful payloads), was broken and failed to run because it referenced the wrong filename. The affected versions have been removed from npm.

Solution: 1. Stop using the affected package versions immediately (2.2.2, 2.2.3, 2.2.4 for @mistralai/mistralai; 1.7.1, 1.7.2, 1.7.3 for @mistralai/mistralai-azure and @mistralai/mistralai-gcp). 2. Clean systems where these packages were installed. Check your installed versions using 'npm ls' or by searching your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) for the affected version numbers. Also check build artifacts, container images, and package caches for the malicious files: router_init.js, tanstack_runner.js, or @tanstack/setup package.json.

@mistralai/mistralai-gcp@= 1.7.3
@mistralai/mistralai-gcp@= 1.7.2
@mistralai/mistralai-azure@= 1.7.3
@mistralai/mistralai-azure@= 1.7.2
@mistralai/mistralai@= 2.2.4


GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package

Summary: Version 2.4.6 of the mistralai package on PyPI contained malicious code that runs when the package is imported on Linux systems. The malicious code downloads and executes a file from a remote server, and versions 2.4.5 and earlier are not affected.

Solution: Pin mistralai to version 2.4.5 or earlier. The source text states: 'Pin mistralai to 2.4.5 or earlier. While the PyPI project is quarantined, install from this repository at a known-good tag, e.g. git+https://github.com/mistralai/client-python.git@v2.4.5.' Additionally, on affected Linux hosts, rotate every credential reachable from the importing process and review host and cloud audit logs for activity from approximately 2026-05-12 00:05 UTC onward.


GHSA-jxx9-px88-pj69: n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

Summary: In n8n-mcp (a tool that bridges AI agents to n8n workflow automation) running in multi-tenant mode, requests missing tenant identification headers would fall back to using the operator's own n8n credentials, allowing an authenticated tenant to access or modify the operator's workflows and data instead of their own. This only affects shared multi-tenant deployments, not single-tenant setups.

Solution: Fixed in n8n-mcp 2.51.2. The fix rejects requests without proper tenant headers at the HTTP edge with a 400 error before processing, prevents the system from using fallback operator credentials when in multi-tenant mode, and blocks secondary leaks in health checks and other handlers. Upgrade via 'npx n8n-mcp@latest' (NPM) or 'docker pull ghcr.io/czlonkowski/n8n-mcp:latest' (Docker). Workarounds if upgrading immediately is not possible: disable multi-tenant mode and run separate instances per tenant, use a proxy to reject requests missing both tenant headers, or restrict the operator API key to minimum required permissions if your n8n supports scoping (Enterprise or compatible Community Edition builds).


What to expect from Google this week

Summary: Google is attending its annual I/O developer conference as the third-place competitor in the foundation model (large AI systems trained on broad data) race, having fallen behind Anthropic's Claude and OpenAI's systems, particularly in coding capabilities. The article previews expected announcements in three areas: a potential comeback attempt in AI coding tools, continued strength in AI for science (where Google won a Nobel Prize), and moves in health and medicine AI. While Google's internal teams reportedly needed to use competitors' tools to stay productive, major breakthroughs at the conference are unlikely.

Google
Google DeepMind
Anthropic
Claude
Claude Code
OpenAI
Codex
Gemini
AlphaFold
ChatGPT Health


CVE-2026-45829: A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an un

Summary: ChromaDB (a Python project for storing AI embeddings) versions 1.0.0 and later contain a code injection vulnerability that lets unauthenticated attackers run arbitrary code on the server by sending a malicious model repository with a specific setting enabled to a particular API endpoint. The vulnerability has a CVSS score (a 0-10 severity rating) of 10.0, marking it as critical.


AI cyberattackers are getting better faster

Summary: AI models are rapidly improving at performing multi-stage penetration tests (simulated attacks where attackers try to break into systems through multiple steps), with the difficulty of tasks they can complete doubling every 4.7 months as of early 2025. The UK government's AI Security Institute measured this by comparing how well AI models could replicate tasks that human cybersecurity experts can complete, finding that the latest AI systems are now showing even greater capability and posing real security risks to organizations with weak defenses.

Claude Mythos Preview
GPT-5.5
UK AI Security Institute (AISI)


Amazon Alexa Plus can now create AI-generated podcasts

Summary: Amazon has added a new feature to Alexa Plus (its upgraded AI assistant) that lets users generate podcasts on nearly any topic by simply describing what they want. The AI creates two AI-generated hosts that discuss the chosen topic, and users can preview and customize the podcast before it's created.


Anthropic to share Mythos cyber flaw findings with global finance watchdog

Summary: Anthropic is briefing global financial regulators on Claude Mythos, an AI model with advanced capabilities in finding previously unknown cybersecurity flaws that hackers could exploit. Rather than releasing Mythos publicly, Anthropic has restricted access to selected tech companies and banks to help identify weaknesses, while the UK's AI Security Institute has found the latest version shows a significant capability jump, even completing a difficult autonomous hacking test that no prior model had solved.

Solution: UK regulators and the Treasury released guidance directing firms to 'double down' on 'core cyber hygiene,' which includes reviewing legacy systems, implementing good detection mechanisms, establishing proper governance, planning recovery procedures, and considering insurance coverage.


Intelligent Penetration Testing Through Integrated Knowledge Graph and Historical Decision Enhancement

Summary: Penetration testing (PT, a security technique where experts simulate attacks to find weaknesses in networks) is traditionally slow and expensive because it relies heavily on manual expert work. This research proposes an automated and intelligent PT method using a knowledge graph (a structured database of relationships between network components) and historical decision data to create realistic test environments and make smarter attack decisions, achieving a 69% reduction in repeated testing attempts.


Enhancing Cloud Network Resilience via a Robust LLM-Empowered Multi-Agent Reinforcement Learning Framework

Summary: This paper presents CyberOps-Bots, a system that combines Large Language Models (LLMs, which are AI models trained on text) with reinforcement learning (RL, a type of AI that learns by trial and error) to defend cloud networks against attacks. The system uses a two-layer approach where an upper LLM agent handles planning and human input, while lower RL agents execute specific defense actions, and testing shows it maintains network availability much better than existing methods without needing to retrain when network conditions change.


ROSE: Extended Evaluation of RObust and SEcure Black-Box DNN Watermarking

Summary: ROSE is a black-box watermarking method (a technique to prove ownership of AI models by embedding hidden triggers that only the owner can activate) for protecting deep neural networks (DNNs, large AI models that learn patterns from data) in machine learning services. The method uses secret trigger-label pairs connected through a hash function to verify ownership while resisting attacks like fine-tuning, pruning, and other model modifications, while maintaining the model's performance on its original task.


GCP: Guarded Collaborative Perception With Spatial-Temporal Aware Malicious Agent Detection

Summary: Connected autonomous vehicles share sensor data to improve driving safety, but this collaboration is vulnerable to adversarial message attacks (malicious input designed to fool AI systems) from bad actors that can degrade performance. The paper describes a new blind area confusion attack that bypasses existing defenses, then proposes GCP, a framework that detects malicious agents by checking both spatial consistency (whether sensor readings from different vehicles agree) and temporal anomalies (unusual patterns over time) using statistical testing methods.

Solution: The paper proposes GCP (Guarded Collaborative Perception), which maintains spatial consistency through a confidence-scaled spatial concordance loss while examining temporal anomalies by reconstructing historical bird's eye view motion flows in low-confidence regions, and employs a joint spatial-temporal Benjamini-Hochberg test (a statistical method for detecting anomalies across multiple data streams) to synthesize results for malicious agent detection.


Principled Uncertainty Decomposition With Bayesian Ensemble Transformers for Trustworthy Intrusion Detection

Summary: This research presents a new AI framework for network intrusion detection systems (IDS, which are tools that identify unauthorized access attempts on computer networks) that provides both accurate threat detection and reliable confidence levels in its predictions. The framework combines transformer models (a type of neural network architecture) with ensemble methods (combining multiple AI models for better results) to break down prediction uncertainty into two types: epistemic uncertainty (uncertainty from the model itself) and aleatoric uncertainty (uncertainty from noisy or incomplete data). Testing on four benchmark datasets shows the system achieves strong detection rates (77.55% to 97.00% F1-scores, a measure of accuracy) while maintaining good calibration (accurate confidence estimates) and remaining resilient to adversarial attacks (attempts to fool the AI with specially crafted malicious inputs).


Perfect Privacy for Discriminator-Based Byzantine-Resilient Federated Learning

Summary: This research proposes ByITFL and LoByITFL, two new federated learning (FL, a method where multiple computers train an AI model together without sharing raw data) schemes that protect user privacy while defending against Byzantine users (participants who send corrupted or malicious data). ByITFL uses Lagrange coded computing (a technique that spreads data across multiple servers to protect it) and re-randomization to achieve perfect privacy but requires significant communication overhead, while LoByITFL reduces communication costs but requires a Trusted Third Party (TTP, an external organization that users must trust) for one-time setup before training begins.


Toward More Practical Label Inference Attacks Against Graph-Based Vertical Federated Learning

Summary: This research paper describes a new attack called Knowledge Transfer Attack (KTA) that can steal private labels (the correct answers or classifications) from graph-based vertical federated learning (GVFL, a system where multiple parties collaborate on machine learning while keeping their data private). Unlike previous attacks that required unrealistic access to training data or labeled examples, KTA only needs auxiliary graphs from unrelated domains to infer the private labels, making it a more practical threat to real-world GVFL systems.


Data-Efficient Cross-Domain Few-Shot Website Fingerprinting With Unsupervised Domain Adaptation

Summary: Website fingerprinting (WF) attacks identify which websites users visit on Tor, a privacy network, but struggle when traffic patterns differ between training and real-world scenarios. This research presents UDA-WF, a new method using unsupervised domain adaptation (a machine learning technique that helps models work across different data distributions) to identify websites more efficiently with less training data. UDA-WF reduces the auxiliary data needed by 95% while maintaining 97.37% accuracy.


PVDI: Preserving Vital and Disrupting Irrelevant Latent Attentions for Robust Backdoor Defense

Summary: Backdoor attacks (hidden triggers that manipulate AI model predictions while keeping normal performance intact) are a serious security threat to deep neural networks (machine learning models with many layers). This paper presents PVDI, a defense method that removes backdoors by selectively preserving important attention patterns (the AI's focus on relevant input features) while disrupting irrelevant ones, successfully reducing attack success rates without hurting the model's normal performance.


ParaVul: A Parallel Large Language Model and Retrieval-Augmented Framework for Smart Contract Vulnerability Detection

Summary: ParaVul is a framework that uses LLMs (large language models, AI systems trained on huge amounts of text) combined with RAG (retrieval-augmented generation, where an AI pulls in external documents to answer questions) to detect vulnerabilities in smart contracts (self-executing programs on blockchain networks). The framework improves detection accuracy and reduces computational costs by using a new fine-tuning technique called SLoRA (Sparse Low-Rank Adaptation) and combining multiple detection methods through a verification module.


DiffHash: Text-Guided Targeted Attack via Diffusion Models Against Deep Hashing Image Retrieval

Summary: DiffHash is a new attack method that can fool deep hashing models (AI systems used to quickly search through large collections of images) by generating adversarial examples (slightly modified images that trick AI systems). Unlike older attacks that simply change individual pixels, DiffHash uses text descriptions from a Large Language Model to guide the creation of fake images that appear normal to humans but cause the hashing model to return wrong search results for a target image.


Decoupled Neural Audio Steganography for Adaptive Sender-Side Model Updates

Summary: This research addresses a security weakness in neural steganography (hiding secret messages inside audio files using AI networks), where sender and receiver models must stay perfectly synchronized, creating risks of information leakage. The researchers propose a decoupled framework based on the destruction-restoration principle, where embedding works through a destructive operation and recovery uses a separate neural network, allowing the sender to change their embedding network without breaking the receiver's ability to extract the hidden message.


Robust Malicious Network Traffic Detection Framework With Automated Drift Detection, Identification, and Adaptation

Summary: Network traffic patterns constantly change, causing traditional malicious traffic detection systems to become less effective over time, a problem called concept drift (when the patterns an AI learned on no longer match real-world data). Researchers developed Argus, a framework that automatically detects when traffic patterns shift, identifies new malicious patterns without human help, and continuously updates itself to maintain high detection accuracy even as attacks evolve.


FaceReclaim: Deep Traceability of Face-Swapped Images Through Feature Decoupling

Summary: Face-swapping deepfakes (AI-generated videos or images where one person's face is replaced with another) are widely misused for fraud and misinformation, and while detection tools exist, there has been little work on tracing and recovering the original face that was replaced. This paper presents FaceReclaim, a new AI method that uses diffusion models (neural networks trained to gradually refine noisy images into clear ones) to restore the original face from a deepfaked image by separating facial attributes like expressions from identity information.


‘Capitalism has to become more humane’: a Stanford economist on big tech, power hoarding and democracy

Summary: According to Stanford economist Mordecai Kurz, tech billionaires are concentrating technological power in a way that weakens democracy, similar to patterns seen during industrialization and the first Gilded Age. Kurz argues that tech moguls often see themselves as superior beings meant to reshape society, citing examples like Anthropic's CEO claiming AI could become a transcendent good while potentially causing mass unemployment.


The Boring Stuff is Dangerous Now

Summary: AI agents (autonomous programs that can perform tasks with minimal human direction) are becoming sophisticated enough to find and exploit obscure vulnerabilities (weaknesses in software), while at the same time developers are creating enormous amounts of AI-generated code that may contain bugs. This combination is forcing security teams to develop new defense strategies.


New image-based prompt injection attack targets multimodal AI models

Summary: Researchers have developed CrossMPI, an image-based prompt injection attack (tricking an AI by hiding instructions in its input) that uses nearly invisible changes to images to manipulate how multimodal AI systems (AI that processes both images and text) interpret user instructions without modifying the text itself. The attack successfully fooled multiple vision-language models (AI systems that understand both images and text) about 66% of the time by targeting the intermediate layers where visual and textual information are combined, posing growing security risks as enterprises increasingly adopt multimodal AI systems.


OpenAI and Dell partner to bring Codex to hybrid and on-premise enterprise environments

Summary: OpenAI and Dell Technologies are partnering to let businesses use Codex (an AI tool that writes and understands code) in their own private data centers and hybrid environments (networks that combine on-site systems with cloud services) rather than only in the cloud. This allows companies to keep sensitive data secure while using Codex across their existing tools and workflows for both coding tasks and broader business automation.

OpenAI
Codex
Dell Technologies
ChatGPT Enterprise
Dell AI Data Platform
Dell AI Factory


AI coding is fueling a secrets-sprawl crisis few CISOs are containing

Summary: AI-assisted coding is causing a rapid increase in leaked secrets (authentication credentials and API keys), with AI-related secrets exposed jumping 81% in 2025 alone, because developers prioritize speed and functionality over security reviews. When secrets are discovered, organizations should treat them as security incidents, immediately revoking or disabling the exposed credential, generating a new one, investigating system impact, performing cleanup, and hardening systems, followed by post-mortems to improve processes.

Solution: When a leaked secret is detected, organizations should: (1) activate their incident response process immediately; (2) revoke or disable the secret and generate a new one; (3) have the incident response team and R&D investigate the impact across systems and data; (4) perform cleanup and hardening; and (5) conduct post-mortems and implement necessary updates to systems or policies based on lessons learned. The source notes that the CISO office typically coordinates incidents while the R&D team owns actual revocation and cleanup.

Moltbook Supabase GitGuardian WithSecure Wiz


How Elon Musk and Sam Altman went from besties to bitter rivals

Summary: This article covers a legal dispute between Elon Musk and Sam Altman over OpenAI's conversion from a nonprofit to a for-profit company. Musk founded OpenAI in 2015 with Altman to prevent Google from monopolizing AI technology, but sued in 2024 claiming they violated their commitment to keep it nonprofit, while Altman argues no such commitment was ever made. The article focuses on their trial testimony rather than any technical AI issue or security concern.


Can Laws Stop Deepfakes? South Korea Aims to Find Out

Summary: South Korea is using its upcoming local elections as a test case to see whether laws can effectively stop deepfakes (fake videos or audio created using AI to manipulate what people look like or sound like). The country is examining whether regulation can reduce the spread of these manipulated media during elections.


Introducing Gemini Omni

Summary: Google has introduced Gemini Omni Flash, a new AI model that can generate and edit videos from text, images, audio, or video inputs combined together. The model uses reasoning about physics and real-world knowledge to create realistic videos and allows users to edit them through natural language conversation (giving text instructions rather than using traditional editing tools), with changes building on each other while maintaining consistency in characters, physics, and scene details.

Google
Gemini Omni
Gemini Omni Flash
Google AI
Gemini app
Google Flow
YouTube Shorts


The Double-Edged Sword of GenAI Feedback: How Generative AI Influences Employee Motivation and Perceived Devaluation

Summary: A study of 350 MBA students and 42 information systems graduates found that feedback from generative AI (AI systems that create new text or content) has mixed effects on workers: it boosts confidence in their abilities and motivation, but simultaneously makes them feel devalued and replaceable because the AI can perform the same tasks independently. The research also discovered that GenAI creates 'prompt engineering convergence' (where different types of work become repetitive prompting and reviewing tasks), which doesn't motivate workers the way traditional job variety does.

AIS eLibrary (Journal of AIS, CAIS, etc.)


Generative AI and the Tertiary Sector: Current Issues, Key Opportunities and Risks for Institutions and Policymakers

Summary: A panel of Australian information systems academics examined how generative AI (GenAI, AI systems that create new text, images, or code based on patterns in training data) is changing higher education, drawing on research from 45 universities across Australia and New Zealand. The panel identified key challenges including learning assurance (ensuring students actually learn the material), privacy, intellectual property rights, and security, while also exploring opportunities for innovation in teaching and research. The discussion emphasized the need for responsible AI governance and policies to guide institutions in adopting GenAI safely and ethically.


A Panel Report on the Implications of Artificial Intelligence for Academic Knowledge Work

Summary: A panel of academics discussed how AI is changing their work in teaching, research, and service roles, finding both opportunities to boost productivity and concerns about ethical and professional risks. The impact of AI in academia depends on factors at multiple levels, including individual understanding of AI, how institutions govern its use, and discipline-specific practices. The researchers recommend that Information System scholars study human-AI collaboration, build trustworthy AI tools, and examine how AI affects academics' careers.


Gemini for Science: AI experiments and tools for a new era of discovery

Summary: Google has introduced Gemini for Science, a collection of AI tools designed to help researchers work faster and tackle complex scientific problems. The tools include Hypothesis Generation (which uses AI to synthesize research and propose ideas), Computational Discovery (which tests thousands of code variations automatically), and Literature Insights (which organizes and analyzes scientific papers). These tools aim to free up researchers from time-consuming manual work so they can focus on high-impact scientific questions.

Google
Gemini
AlphaEvolve
Co-Scientist
ERA
NotebookLM
Google Labs
Google Cloud


CVE-2026-8756: A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted elem

Summary: A path traversal vulnerability (a type of attack where an attacker manipulates file paths to access files outside the intended directory) was found in fishaudio Bert-VITS2, specifically in the generate_config function of the Gradio Interface (a web-based tool for interacting with AI models). The vulnerability can be triggered remotely by manipulating the data_dir argument, and the exploit is now publicly known.


What we learned from the cringey courtroom drama between Elon Musk and Sam Altman

Summary: This article covers a legal dispute between Elon Musk and Sam Altman over OpenAI, where Musk has accused Altman of 'stealing a charity.' The trial featured testimony from major tech industry figures and revealed private communications about OpenAI's history and leadership practices. The article focuses on the courtroom drama and business conflict rather than any technical or security issue related to AI systems.


Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks

Summary: This is a survey paper that examines vulnerabilities and attack methods targeting embodied AI systems (AI systems that control physical robots or devices in the real world). The paper reviews the landscape of security risks in embodied AI and appears to focus on understanding these threats rather than proposing specific fixes.


Cerebras' blockbuster IPO boosts hype for SpaceX and OpenAI, but crowds out smaller players

Summary: Cerebras Systems' successful IPO, where shares jumped 70% in value, has created excitement around AI investment opportunities, but smaller tech companies are struggling to attract investor attention because massive AI firms like SpaceX, OpenAI, and Anthropic (each valued near or above $1 trillion) are preparing their own IPOs that will overshadow all other offerings. Companies without strong AI-related stories, particularly SaaS companies (software-as-a-service, meaning applications accessed over the internet), face especially difficult conditions in the public market right now.

Cerebras SpaceX OpenAI Anthropic Alibaba Facebook Uber CoreWeave


How WeatherNext helped the National Hurricane Center better predict Hurricane Melissa’s historic landfall in Jamaica

Summary: WeatherNext, an AI weather prediction model developed by Google DeepMind and Google Research, helped the National Hurricane Center predict Hurricane Melissa would reach Category 5 intensity five days before landfall in Jamaica with high confidence, marking the first time such rapid intensification was successfully forecasted from a weak starting point. Unlike traditional weather models that excelled at predicting either a storm's path or intensity but not both, WeatherNext bridges this gap by training on decades of global weather patterns and extreme tropical cyclone data, allowing it to run multiple "what-if" scenarios (called ensembles, where the model generates 50 different possible outcomes) to give forecasters a fuller picture for decision-making. The early and accurate prediction gave communities crucial time to prepare and evacuate.

Google DeepMind
Google Research
WeatherNext


OpenAI and Malta partner to bring ChatGPT Plus to all citizens

Summary: OpenAI and Malta have announced a partnership to provide ChatGPT Plus (a paid subscription service) free to all Maltese citizens who complete an AI literacy course developed by the University of Malta. The course teaches people what AI is, what it can and cannot do, and how to use it responsibly, with the first phase launching in May and eligible citizens receiving one year of free access after completion.


Musk v. Altman week 3: Musk and Altman traded blows over each other’s credibility. Now the jury will pick a side.

Summary: This article covers the final week of a trial where Elon Musk is suing OpenAI CEO Sam Altman, claiming Altman broke a promise to keep OpenAI as a nonprofit organization dedicated to AI safety. The jury sided with OpenAI, finding that Musk's claims are blocked by the statute of limitations (a legal time limit for filing lawsuits), though the judge will make the final decision. The case centers on whether OpenAI's 2025 restructuring into a for-profit entity violated Musk's original vision, with Musk seeking up to $134 billion in damages.

OpenAI
Sam Altman
Elon Musk
xAI
SpaceX
Helion Energy


Gemini 3.5: frontier intelligence with action

Summary: Google has released Gemini 3.5 Flash, an AI model designed to help developers and enterprises build agents (AI systems that can perform multi-step tasks autonomously) and handle coding work. The model matches the performance of larger flagship models while running 4 times faster, and works with Google's Antigravity platform to execute complex workflows like code refactoring, financial document preparation, and game development at a fraction of the time and cost of previous approaches.

Google
Gemini 3.5
Gemini 3.5 Flash
Gemini 3.5 Pro
Google Antigravity
Gemini API
Google AI Studio
Gemini Enterprise


YouTube is expanding its AI deepfake detection tool to all adult users

Summary: YouTube is expanding an AI tool to all adults that detects deepfakes (AI-generated videos where someone's face is swapped onto another person's body) by scanning a user's selfie and searching YouTube for matching content. If the tool finds a potential deepfake, it notifies the user, who can then request YouTube remove the video.


CVE-2026-45401: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the v

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a security flaw in versions before 0.9.5 where it only checked the first URL a user submitted but didn't check where that URL redirected to (HTTP redirects are automatic forwards to different addresses). This meant authenticated users could trick the system into accessing internal addresses like 127.0.0.1 or 169.254.169.254 (special private IP addresses) and read sensitive data from those internal systems.

Solution: This vulnerability is fixed in 0.9.5.


ArXiv will ban researchers who upload papers full of AI slop

Summary: ArXiv, a platform where researchers share academic papers before formal publication, is implementing new rules to reduce AI slop (low-quality or unreliable AI-generated content). Authors who submit papers with clear evidence they didn't check their AI outputs, such as hallucinated references (false citations made up by the AI) or leftover comments from an LLM (large language model, an AI trained on massive amounts of text), will be banned from the platform for one year and must have future papers accepted at a reputable peer-reviewed venue.

Solution: According to ArXiv's Code of Conduct, authors must not submit papers with incontrovertible evidence that they failed to review LLM-generated results. Those found in violation face a one-year ban from ArXiv and must have subsequent submissions accepted at a reputable peer-reviewed venue before resubmission.


CVE-2026-44563: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a vulnerability before version 0.9.0 where certain API endpoints (like /api/generate and /api/embeddings) accepted any model name from users and sent requests to the backend without checking if those users had permission to use that model. The endpoints only verified that a user was logged in and that the model existed, but skipped the access control check (AccessGrants.has_access(), which determines what resources a user is allowed to access).

Solution: The vulnerability is fixed in version 0.9.0.


CVE-2026-44556: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /

Summary: Open WebUI, a self-hosted AI platform that runs offline, had a security flaw in versions before 0.9.0 where the /responses endpoint allowed any logged-in user to access any model on the system without proper permission checks. While the main chat endpoint verified that users had the right to use specific models through ownership, group membership, and access grants, the /responses proxy skipped these checks and only confirmed the user was logged in, letting attackers use models they shouldn't have access to.

Solution: This vulnerability is fixed in 0.9.0.


OpenAI keeps shuffling its executives in bid to win AI agent battle

Summary: OpenAI reorganized its leadership structure to focus on developing AI agents (AI systems that can independently perform multiple tasks and make decisions). The company plans to merge ChatGPT and Codex (a code-generation AI tool) into a single unified platform designed around this agentic approach, with president Greg Brockman now overseeing all product decisions.


GHSA-rpj4-7x2v-wjrf: Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Summary: Budibase's AI Extract File automation step has a server-side request forgery vulnerability (SSRF, a type of attack where a server makes requests to internal addresses it shouldn't access) because it uses `fetch()` directly without IP blacklist validation. Every other automation step in the same codebase properly uses `fetchWithBlacklist()` to block requests to internal networks like 127.0.0.1 and 169.254.169.254, but the AI step bypasses these protections, allowing authenticated users to access cloud metadata, scan internal networks, and potentially steal credentials.

@budibase/server@< 3.34.8 (fixed: 3.34.8)


The AWS AI Security Framework: Securing AI with the right controls, at the right layers, at the right phases

Summary: The AWS AI Security Framework is a structured approach that helps organizations secure AI systems by applying the right security controls across three layers (infrastructure, identity/data, and AI application), three use cases (question-answering AI, data-connected AI like RAG, and autonomous agents), and three phases (prototype, production, and scale). The framework addresses unique AI security challenges like prompt injection (tricking AI systems by hiding malicious instructions in user input) and non-deterministic outputs by implementing input validation, content filtering, and continuous monitoring from day one of development.

Solution: The framework recommends implementing controls across three phases: Phase 1 (Foundational) involves extending existing controls to AI, establishing identity management and fine-grained access controls, and adding content filtering and guardrails; Phase 2 (Enhanced) adds threat detection, data classification, and AI-specific monitoring for production; Phase 3 (Advanced) automates governance, compliance, and incident response at scale. AWS also offers a no-cost SHIP engagement to baseline security posture and build a prioritized roadmap.


CVE-2026-46383: Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM conta

Summary: Microsoft APM is a tool that manages dependencies for AI agents, and versions before 0.13.0 have a security flaw on Windows systems. When installing a bundle (a package of code) from a .tar.gz file (a compressed archive format), the tool extracts files without properly checking if any file paths could escape the intended folder, potentially allowing an attacker to place files anywhere on the system by using absolute paths like D:/.

Solution: This vulnerability is fixed in version 0.13.0.


CVE-2026-45539: Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive

Summary: Microsoft APM, a dependency manager for AI agents, had a vulnerability in versions 0.5.4 to 0.12.4 where symbolic links (shortcuts that point to other files) in downloaded packages were followed without checking, potentially allowing attackers to read or write arbitrary files on a developer's machine. The vulnerability went undetected by security checks because the resulting files were not flagged by the package hash verification, security scans, or audit tools.


CVE-2026-44641: Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM norma

Summary: Microsoft APM is a tool that manages dependencies (external code libraries) for AI agents. Before version 0.8.12, it had a path traversal vulnerability (a security flaw where an attacker can access files outside the intended directory) that allowed malicious plugins to copy arbitrary files from a user's computer during installation by using absolute paths or '../' sequences to escape the plugin directory.

Solution: This vulnerability is fixed in version 0.8.12. Users should update Microsoft APM to 0.8.12 or later.


AI radio hosts demonstrate why AI can’t be trusted alone

Summary: Andon Labs ran an experiment where four different AI models (Claude, ChatGPT, Gemini, and Grok) were each given $20 to run their own radio station independently, with instructions to develop a personality and make a profit. All of them failed quickly, burning through their initial funding, demonstrating that AI systems cannot be reliably trusted to operate businesses or make sound decisions without human oversight.

Solution: N/A -- no mitigation discussed in source.


GHSA-3363-2ph6-35wh: Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator

Summary: Pipecat's development runner has a path traversal vulnerability (a flaw that lets attackers access files outside the intended directory) in its `/files` endpoint. An attacker can use URL-encoded slashes (`%2F` instead of `/`) to bypass Starlette's (the web framework) security checks and read any file accessible to the Pipecat process, such as SSH keys or system files, without needing credentials.


Google updates its spam rules to include attempts to ‘manipulate’ AI

Summary: Google updated its spam policy to classify attempts to manipulate its AI search results as spam, including tactics like biased listicles or recommendation poisoning (injecting false information to trick an LLM into giving preferred answers). This rule applies to Google Search's AI features like AI Overview and AI Mode.


OpenAI now wants ChatGPT to access your bank accounts

Summary: OpenAI announced a new preview feature that will let ChatGPT connect directly to users' bank accounts through Plaid, a platform that links banking apps to third-party services. This integration would give the chatbot access to detailed financial information, including credit card debt and account balances, to help answer users' finance questions.


In Other News: Big Tech vs Canada Encryption Bill, Cisco’s Free AI Security Spec, Audi App Flaws

Summary: This cybersecurity news roundup covers several significant incidents and developments, including a data breach at Nvidia's GeForce NOW service in Armenia that exposed user personal information, extended security update timelines for foreign-made routers and drones, and OpenAI's offer to give EU regulators access to a specialized version of GPT-5.5 for monitoring cyber security risks. The roundup also highlights an active malware campaign targeting developers with fake Claude Code installers, an Iran-linked group breaching South Korean electronics manufacturers, and Google's Android 17 release introducing AI-driven security features like verified financial calls and real-time threat detection.

Solution: For the fake Claude Code installer campaign, the source explicitly mentions the discovery but does not provide a stated mitigation. For Android 17, the source describes the security upgrades included in the update itself (verified financial calls, Live Threat Detection, post-quantum cryptography, automatic OTP hiding, and default-on theft protections), which function as built-in protections rather than external mitigations. For the FCC router waiver, the solution is the extended update window allowing security patches and firmware updates until at least January 1, 2029. No other explicit mitigations or patches are discussed in the source for the remaining incidents.


Thinking carefully before adopting agentic AI

Summary: Agentic AI tools (AI systems that can plan, make decisions, and take actions without constant human supervision) are becoming more common in organizations but introduce significant security risks beyond traditional AI systems. These risks include broader system access, unpredictable behavior, and difficulty explaining AI actions. The NCSC and international partners recommend organizations adopt agentic AI carefully by starting with low-risk tasks, deploying incrementally with tight controls, maintaining human oversight, and ensuring clear human accountability before connecting agents to real systems or data.

Solution: The source explicitly recommends several mitigation approaches: (1) 'deploy agentic AI incrementally, starting with tightly bounded pilots using clearly defined tasks, and build confidence in the system before you expand the scope'; (2) 'Think about what could happen if an agent misunderstood its task, exceeded its intended scope or was manipulated, and never grant an agent unrestricted access to sensitive data or critical systems'; (3) 'Ensure you maintain ongoing visibility of the system's operation, and understand how to retain meaningful human oversight and control'; (4) 'If you cannot understand, monitor or contain an agent's actions, it is not ready for deployment'; and (5) define clear human accountability for deployment decisions, granted access, safeguards, and the ability to stop the system before connecting it to real systems or data.


TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates

Summary: OpenAI disclosed that two employee devices were compromised through the Mini Shai-Hulud supply chain attack on TanStack (a software dependency library), resulting in limited credential theft from internal code repositories but no user data or production systems were affected. Because the compromised repositories contained signing certificates (digital credentials that verify software authenticity) for macOS apps, OpenAI revoked the old certificates and requires macOS users of ChatGPT Desktop, Codex App, Codex CLI, and Atlas to update to the latest versions before June 12, 2026, when the old certificates will be blocked by macOS protections.

Solution: OpenAI isolated impacted systems and identities, revoked user sessions, rotated all credentials across impacted repositories, temporarily restricted code-deployment workflows, audited user and credential behavior, and revoked the compromised signing certificates while issuing new ones. macOS users must update ChatGPT Desktop, Codex App, Codex CLI, and Atlas to the latest versions before June 12, 2026.

OpenAI
TanStack
Mistral AI
UiPath
OpenSearch
Guardrails AI


OpenAI Hit by TanStack Supply Chain Attack

Summary: OpenAI disclosed that two employee devices were infected during a supply chain attack on TanStack, a web development framework, which allowed attackers to steal credential material from internal source code repositories. The stolen credentials gave attackers access to code-signing certificates (digital keys used to verify that software is authentic) for OpenAI's applications on iOS, macOS, Windows, and Android. OpenAI confirmed that no customer data or intellectual property was compromised, but took steps to prevent further risk.

Solution: OpenAI rotated credentials across all affected repositories, revoked user sessions, temporarily restricted code-deployment workflows, revoked the compromised code-signing certificates, and re-signed all applications with new certificates. The company also coordinated with platform providers to stop new notarizations (a verification process that confirms software is safe) and prevent misuse of the stolen certificates. macOS users must update their OpenAI apps to the latest versions by June 12, 2026, after which date the old apps will no longer receive updates.


CVE-2026-2652: A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when

Summary: MLflow (an open-source platform for managing machine learning workflows) versions 3.9.0 and earlier have a security flaw where certain API endpoints don't require authentication even when the server is set up with authentication enabled. This happens because the authentication check only protects `/gateway/` routes, leaving other endpoints like the Job API and trace ingestion API unprotected, allowing attackers to submit jobs, view results, and inject fake data without logging in.

Solution: This vulnerability is fixed in version 3.10.0. Users should upgrade mlflow to version 3.10.0 or later.


datasette-llm-limits 0.1a0

Summary: datasette-llm-limits is a plugin that works with Datasette (a tool for exploring databases) to set spending limits on how much money users can spend on LLM API calls. The plugin lets administrators configure daily or rolling limits per user or globally, for example restricting one user to $1.00 of LLM usage per 24-hour period.


Databricks brings GPT-5.5 to enterprise agent workflows

Summary: Databricks has made GPT-5.5 available for enterprise AI agent workflows, where the model achieved a new benchmark record by reaching 50% accuracy on OfficeQA Pro (a test measuring how well AI systems handle complex business document tasks like parsing scanned PDFs and legacy files). Compared to the previous GPT-5.4 model, GPT-5.5 reduced errors by 46% and showed major improvements in parsing old documents and managing multi-step tasks without unnecessary detours.


A new personal finance experience in ChatGPT

Summary: OpenAI is launching a new personal finance feature in ChatGPT that lets Pro users in the U.S. securely connect their bank accounts and ask the AI questions about their spending and financial goals. The feature uses improved AI reasoning (GPT-4.5) to analyze your real financial data alongside your goals, helping you spot spending patterns and plan major decisions, though it is not a replacement for professional financial advice.


The EU AI Act’s transparency rules: A practical guide to Article 50

Summary: Article 50 of the EU AI Act requires organizations to inform users when they interact with AI systems or encounter AI-generated content, with a deadline of August 2026. These transparency obligations apply broadly to any AI system used in four situations: direct interaction with people, synthetic content generation, emotion recognition or biometric categorization, and deepfake or AI-generated text on public matters. Providers must design systems to disclose AI involvement and mark outputs in machine-readable formats, while deployers must inform individuals affected by emotion recognition systems and disclose artificially generated or manipulated content.

Solution: The EU Commission has published draft Guidelines on the scope and application of Article 50, and a Code of Practice on AI-generated content is being developed to provide practical solutions on marking and labelling. Additionally, a standardized EU label is being developed for marking AI-generated outputs in machine-readable format to make them detectable as artificially generated or manipulated.


High-stakes courtroom drama of Musk v OpenAI hears closing arguments

Summary: Elon Musk is suing OpenAI and its leader Sam Altman, with closing arguments recently heard in federal court in Oakland, California. A nine-person jury will decide whether OpenAI improperly took money or benefits from Musk and enriched itself unfairly. The case has revealed private communications between the two tech leaders and details about OpenAI's internal history.


AI agent finds 18-year-old remote code execution flaw in Nginx

Summary: Researchers using an AI model discovered a critical 18-year-old flaw in Nginx (a web server that powers about one-third of all websites) called a heap buffer overflow (a type of memory corruption bug where data overwrites adjacent memory). The vulnerability, tracked as CVE-2026-42945 with a 9.2 severity score, can crash servers or potentially allow attackers to run malicious code, especially on systems with ASLR (Address Space Layout Randomization, a security feature that randomizes memory locations) disabled.

Solution: Upgrade to patched versions: Nginx 1.31.0 or 1.30.1 for the open-source version, or Nginx Plus versions R36 P4, R32 P6, or 37.0.0 for the commercial product. The source notes that users should 'upgrade to a patched version as soon as possible' since exploit code has been published publicly and past Nginx vulnerabilities have been actively exploited by attackers.