Anthropic Unveils ‘Claude Mythos’ – A Cybersecurity Breakthrough That Could Also Supercharge Attacks

Summary: Anthropic has developed a new AI model called Claude Mythos as part of Project Glasswing, an initiative aimed at securing critical software before it can be exploited by attackers. The model is framed as both a cybersecurity advance and a potential risk, since advanced AI capabilities could theoretically be misused if they fall into the wrong hands.


CVE-2026-24175: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

Summary: NVIDIA Triton Inference Server has a vulnerability (CVE-2026-24175) where an attacker can crash the server by sending a malformed request header, potentially causing a denial of service (disruption of normal service). The vulnerability stems from an uncaught exception (an error that the program doesn't handle properly), which allows attackers to exploit this weakness.

Solution: N/A -- no mitigation discussed in source.


CVE-2026-24174: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

Summary: NVIDIA Triton Inference Server has a vulnerability (CVE-2026-24174) where an attacker can crash the server by sending a malformed request (a request with incorrect formatting), causing a denial of service (when a system becomes unavailable to legitimate users). The vulnerability stems from incorrect conversion between numeric types (the software not properly handling different number formats).


CVE-2026-24173: NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malfor

Summary: NVIDIA Triton Inference Server has a vulnerability (CVE-2026-24173) where an attacker can send a malformed request to crash the server, causing a denial of service (when a service becomes unavailable due to an attack). The vulnerability is related to integer overflow or wraparound (when a number exceeds the maximum value a system can store, causing unexpected behavior).


CVE-2026-24147: NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disc

Summary: CVE-2026-24147 is a vulnerability in NVIDIA Triton Inference Server (a tool that runs AI models) where an attacker can upload a malicious model configuration file to cause information disclosure (exposing sensitive data) or denial of service (making the system unavailable). The vulnerability stems from improper path traversal (a flaw that lets attackers access files outside intended directories) validation when handling uploaded files.


CVE-2026-24146: NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of output

Summary: NVIDIA Triton Inference Server has a vulnerability where it doesn't properly check user inputs and can crash when given a large number of outputs, potentially causing a denial of service (making the server unavailable to users). The vulnerability stems from excessive memory allocation triggered by malformed input.


XFaceMark: Explainable deep fake watermarking using YOLO, and random MRFO

Summary: This paper presents XFaceMark, a method that uses YOLO (an object detection system that identifies items in images) and random MRFO (a nature-inspired optimization algorithm) to add watermarks to deepfakes (AI-generated fake videos or images) in a way that can be explained and understood. The approach aims to make deepfakes traceable while allowing researchers to understand how the watermarking process works.


SBOMs into Agentic AIBOMs: Schema Extensions, Agentic Orchestration and Reproducibility Evaluation

Summary: This academic paper discusses extending SBOMs (software bill of materials, which are detailed lists of all components and dependencies in software) to create AIBOMs that can describe agentic AI systems (AI systems that can take independent actions and make decisions). The paper proposes schema extensions, methods for coordinating multiple AI agents, and ways to evaluate whether AI systems produce consistent and reproducible results.


Anthropic is launching a new AI model for cybersecurity

Summary: Anthropic is launching a new AI model called Claude Mythos Preview as part of Project Glasswing, a cybersecurity partnership with major tech companies like Nvidia, Google, and Microsoft. The model is designed to help large organizations and governments automatically detect vulnerabilities (security weaknesses) in their systems with minimal human involvement. Anthropic is limiting access to launch partners only and not releasing it publicly due to security concerns.

Anthropic NVIDIA Google Amazon Microsoft Apple

Anthropic
Claude
Claude Mythos Preview
Nvidia
Google
Amazon Web Services
Microsoft
Apple


Anthropic debuts preview of powerful new AI model Mythos in new cybersecurity initiative

Summary: Anthropic released a preview of Mythos, a powerful new AI model, as part of Project Glasswing, a cybersecurity initiative involving over 40 partner organizations like Amazon, Microsoft, and Apple. The model, which was not specifically trained for cybersecurity but has strong coding and reasoning abilities, has reportedly identified thousands of zero-day vulnerabilities (security flaws unknown to the public and software vendors) in software systems during initial testing. The preview is limited to partner organizations for defensive security work and will not be made generally available to the public.

Anthropic
Claude
Mythos
Project Glasswing
Amazon
Apple
Broadcom
Cisco
CrowdStrike
Linux Foundation
Microsoft
Palo Alto Networks


Cybersecurity in the Age of Instant Software

Summary: AI is making software creation faster and easier, leading to a future where temporary applications (instant software) might be created and deleted on demand, but this also means AI tools are getting better at both finding and exploiting vulnerabilities (weaknesses in code that attackers can use). While defenders can use the same AI capabilities to patch vulnerabilities and fix security problems, today's AI-generated software tends to contain many security flaws because AI doesn't yet write secure code well.


Max severity Flowise RCE vulnerability now exploited in attacks

Summary: Hackers are actively exploiting CVE-2025-59528, a critical vulnerability in Flowise (an open-source platform for building AI agents and custom LLM applications) that allows arbitrary JavaScript code injection without validation through the CustomMCP node. The flaw was publicly disclosed in September, affects thousands of exposed instances online, and enables attackers to execute commands and access files on vulnerable systems.

Solution: Upgrade to Flowise version 3.1.1 or at least version 3.0.6 as soon as possible. Additionally, consider removing Flowise instances from the public internet if external access is not required.


The New Rules of Engagement: Matching Agentic Attack Speed

Summary: Nation-states are using AI agents (autonomous AI systems that can perform tasks without human intervention) to launch cyberattacks at speeds that traditional security responses cannot match. The article argues that cybersecurity defenses cannot rely on small, gradual improvements but must instead undergo fundamental architectural changes to address this new threat level.


Trent AI Emerges From Stealth With $13 Million in Funding

Summary: Trent AI, a new startup, has secured $13 million in funding to develop a layered security solution (a multi-level protective system) designed to protect AI agents (software programs that act autonomously to complete tasks) throughout their entire lifecycle, from creation to deployment.


[Webinar] How to Close Identity Gaps in 2026 Before AI Exploits Enterprise Risk

Summary: Many enterprises have applications disconnected from centralized identity systems (systems that control who can access what), creating blind spots that AI agents and attackers are actively exploiting. While organizations have invested in IAM (identity and access management, the practice of controlling user access) and Zero Trust security, legacy apps and siloed systems remain outside of centralized control, allowing AI agents to amplify credential risks and bypass security oversight.


CVE-2026-35487: text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticate

Summary: CVE-2026-35487 is a path traversal vulnerability (a flaw that lets attackers read files outside the intended directory) in text-generation-webui, an open-source tool for running large language models through a web interface. Before version 4.3, attackers could exploit the load_prompt() function without logging in to read any .txt file on the server and see its contents in the API response.

Solution: Update text-generation-webui to version 4.3 or later, where this vulnerability is fixed.


CVE-2026-35486: text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and

Summary: text-generation-webui, an open-source web interface for running Large Language Models, has a vulnerability in versions before 4.3 where the superbooga and superboogav2 RAG extensions (tools that fetch external documents to help answer questions) accept user-provided URLs without checking them for safety. This allows attackers to access cloud metadata endpoints (services that store sensitive credentials in cloud environments) and steal IAM credentials (identity and access management tokens that control what users can do). The vulnerability is fixed in version 4.3.

Solution: Update text-generation-webui to version 4.3 or later.


CVE-2026-35485: text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticate

Summary: text-generation-webui, an open-source web interface for running Large Language Models, has a path traversal vulnerability (a security flaw where an attacker can access files outside the intended directory) in versions before 4.3. An unauthenticated attacker can exploit this by sending specially crafted requests through the API to read any file on the server, because Gradio (the framework it uses) does not validate user input on the server side.


CVE-2026-35484: text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticate

Summary: CVE-2026-35484 is a path traversal vulnerability (a bug where an attacker can access files outside the intended folder) in text-generation-webui, an open-source tool for running large language models through a web interface. Before version 4.3, attackers could read any .yaml file (a configuration file format) on the server without needing to log in, potentially exposing sensitive data like passwords and API keys in the response.

Solution: This vulnerability is fixed in version 4.3. Users should update text-generation-webui to version 4.3 or later.


CVE-2026-35483: text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticate

Summary: CVE-2026-35483 is a path traversal vulnerability (a flaw that lets attackers read files outside intended directories) in text-generation-webui, an open-source tool for running large language models. Versions before 4.3 allow unauthenticated attackers to read files with extensions like .jinja, .jinja2, .yaml, or .yml from anywhere on the server.

Solution: Update to version 4.3 or later. The vulnerability is fixed in 4.3.


Human vs AI: Debates Shape RSAC 2026 Cybersecurity Trends

Summary: At RSAC 2026, cybersecurity leaders discussed how AI should be used in security work, including debates about agentic applications (AI systems that can act independently to solve problems) and whether human involvement can realistically keep up as AI scales up. The discussions highlighted the tension between automating security tasks with AI and maintaining human oversight in important decisions.


Enabling agent-first process redesign

Summary: AI agents (autonomous systems that learn and adapt to execute workflows without constant human direction) work best when organizations redesign their processes around them rather than adding them to existing systems. Companies need to shift to an 'agent-first' model where AI agents handle routine operations while humans set goals and handle exceptions, requiring machine-readable process definitions and structured data flows to succeed.


CVE-2026-33866: MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due

Summary: MLflow has a security flaw called an authorization bypass (a weakness where access controls are not properly checked) in its AJAX endpoint (a web interface used to download model files) that allows users without permission to download saved model artifacts they shouldn't be able to access. This affects MLflow versions up to 3.10.1 and has a CVSS score (a 0-10 rating of severity) of 5.3, considered medium severity.


CVE-2026-33865: MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in it

Summary: MLflow has a stored XSS vulnerability (cross-site scripting, where malicious code hidden in data executes when viewed in a web browser) in how it handles YAML-based MLmodel artifact files. An authenticated attacker can upload a specially crafted MLmodel file that runs malicious code when another user views it in the web interface, potentially letting the attacker hijack sessions or perform actions as that user. This affects MLflow version 3.10.1 and earlier.


Zero‑click Grafana AI attack can enable enterprise data exfiltration

Summary: GrafanaGhost is a critical vulnerability in Grafana (a data visualization platform) that uses indirect prompt injection (tricking an AI by hiding malicious instructions in data it processes) to steal sensitive enterprise data without requiring user authentication or interaction. Attackers chain together multiple exploits, including bypassing URL validation and AI safety guardrails, to trick Grafana's AI into sending confidential information to attacker-controlled servers.

Solution: Grafana has rolled out a fix for this issue. Additionally, security experts recommend: identifying exposure by checking whether Grafana AI/LLM features are enabled, patching to the latest version, restricting "img-src" (image source permissions) to known domains, and applying egress controls (network rules that limit outbound data traffic).


Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

Summary: Attackers are targeting over 1,000 publicly accessible ComfyUI instances (a platform for running AI image generation) with an automated scanner that exploits a misconfiguration allowing unauthenticated remote code execution (the ability to run commands on a system without permission). Once compromised, these systems are enrolled in botnets (networks of infected computers controlled remotely) to mine cryptocurrency and serve as proxies.


OpenAI encourages firms to trial four-day weeks to adapt to AI era

Summary: OpenAI has published policy proposals suggesting that companies should trial four-day work weeks as AI tools become more capable and potentially displace workers from jobs. The company argues that AI systems will soon complete projects in days that currently take months, and recommends employers offer benefits like reduced work hours without pay cuts, increased retirement contributions, and subsidized childcare to help workers adapt to this shift.


Broadcom shares jump before the bell as chipmaker agrees Google and Anthropic deals

Summary: Broadcom, a chip designer, announced new deals to produce AI chips for Google and expanded its partnership with Anthropic (an AI company), causing its stock price to rise 3.7% in premarket trading. The deals include revenue commitments and access to computing capacity, which analysts believe signal strong future demand for custom AI chips and may ease investor concerns about competition.


Gemini is making it faster for distressed users to reach mental health resources

Summary: Google has redesigned Gemini's crisis response feature to make it faster for users in distress to access mental health resources. When the chatbot detects a conversation indicating potential suicide or self-harm risk, it now presents a streamlined 'Help is available' module that connects users to crisis resources like suicide hotlines or crisis text lines more quickly.

Solution: Google updated Gemini to streamline its crisis response into a 'one-touch' module (based on the partial text provided, the exact mechanism is not fully detailed in the source). The system detects conversations indicating suicide or self-harm risk and launches the 'Help is available' module to direct users to mental health crisis resources.


The noisy tenants: Engineering fairness in multi-tenant SIEM solutions

Summary: Multi-tenant SIEM (security information and event management, a platform that collects and analyzes security data from many sources) solutions share physical resources like CPU and memory among different customers, creating a "noisy neighbor" problem where one customer's heavy workload can slow down threat detection for others and violate service promises. While vendors market cloud-based SIEM as efficient and reliable, most don't publicly discuss how they prevent this fairness issue, which requires sophisticated engineering strategies like fair-share scheduling (giving each customer a proportional share of resources) and intelligent queuing rather than simple rate-limiting.


CVE-2026-1839: A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code

Summary: A vulnerability in HuggingFace Transformers' `Trainer` class (a tool for training AI models) allows attackers to run arbitrary code by providing a malicious checkpoint file. The problem occurs because the `_load_rng_state()` method uses `torch.load()` without the `weights_only=True` parameter (a safety setting that restricts what code can run), leaving systems vulnerable when using PyTorch versions below 2.6.

Solution: The issue is resolved in version v5.0.0rc3.


Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

Summary: Flowise, an open-source AI platform, has a maximum-severity vulnerability (CVE-2025-59528, CVSS score 10.0) in its CustomMCP node that allows attackers to execute arbitrary JavaScript code on the server without validation, potentially leading to full system compromise and data theft. The flaw requires only an API token to exploit and is being actively exploited in the wild against over 12,000 exposed Flowise instances.

Solution: The vulnerability was addressed in version 3.0.6 of the npm package. Users should upgrade to this version or later.


Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs

Summary: As AI models become more powerful, they create both greater risks and opportunities for security. CrowdStrike argues that while companies like Anthropic build safer models, organizations also need deployment governance (security controls for how and where AI runs in a company) to protect data and systems when AI agents access databases, workflows, and sensitive information. CrowdStrike offers tools for discovering all AI applications in use, monitoring what data they access, and preventing sensitive information from being exposed through AI workflows.

Anthropic
Claude
Mythos Preview
CrowdStrike
Project Glasswing


Adaptive Density Clustering for Data-Driven Password Mangling Rule Generation

Summary: This research paper describes a method for automatically generating password mangling rules (transformations that modify passwords systematically) using adaptive density clustering (a technique that groups similar data points together based on how densely packed they are). The approach aims to improve password security by learning patterns from real password data to create more effective rules for testing password strength.


Broadcom agrees to expanded chip deals with Google, Anthropic

Summary: Broadcom has agreed to produce AI chips for Google and signed an expanded deal with Anthropic, giving the AI startup access to about 3.5 gigawatts of computing capacity (the amount of processing power available at one time) using Google's custom processors called TPUs (tensor processing units, which are specialized chips designed to run AI models). This reflects growing demand for the computing infrastructure needed to run generative AI (AI systems that create new text, images, or other content) at scale.

Broadcom Google Anthropic OpenAI Nvidia Amazon Microsoft AMD Apple


OpenAI asks California, Delaware to investigate Musk's 'anti-competitive behavior' ahead of April trial

Summary: OpenAI has asked California and Delaware attorneys general to investigate what it calls 'anti-competitive behavior' by Elon Musk, claiming he is working to undermine the company through attacks and coordination with other rivals ahead of an April trial. OpenAI alleges that Musk has conducted opposition research on CEO Sam Altman, spread false allegations, and is using legal efforts to benefit his competing AI company xAI, which faces its own investigations for generating non-consensual explicit deepfake content.


CVE-2026-35022: Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper ex

Summary: Anthropic's Claude Code CLI and Claude Agent SDK have a vulnerability where authentication helper settings are executed with shell=true (allowing shell commands to run) without checking the input first. An attacker who can change settings like apiKeyHelper or awsAuthRefresh could inject shell metacharacters (special characters that have meaning in command shells) to run arbitrary commands with the user's privileges, potentially stealing credentials or accessing environment variables.

Anthropic
Claude Code CLI
Claude Agent SDK


CVE-2026-35021: Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the prompt editor invoca

Summary: Anthropic's Claude Code CLI and Claude Agent SDK have a vulnerability where attackers can execute arbitrary commands (run any code they want) by inserting shell metacharacters (special characters like $() that tell the system to run commands) into file paths. Even though the code tries to protect these paths by wrapping them in double quotes, the POSIX shell (the command-line interface on Unix/Linux systems) still processes these injected expressions, giving attackers the same permissions as the user running the CLI.


CVE-2026-35020: Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helpe

Summary: Anthropic's Claude Code CLI and Claude Agent SDK have a vulnerability where attackers can run arbitrary commands by manipulating the TERMINAL environment variable (a setting that controls which terminal program to use). When the software constructs shell commands, it doesn't properly sanitize the TERMINAL variable, allowing attackers to inject shell metacharacters (special characters that have meaning to command interpreters) that get executed with the user's privileges.

Anthropic Claude Code CLI
Claude Agent SDK


CVE-2026-35050: text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save

Summary: text-generation-webui is an open-source web interface for running Large Language Models (AI systems that generate text). Before version 4.1.1, the application allowed users to save extension settings as Python files (code files that run on servers) in the main app directory, which could let attackers overwrite important Python files like 'download-model.py' and execute malicious code when users tried to download a new model.

Solution: This vulnerability is fixed in version 4.1.1.


GHSA-cjg8-h5qc-hrjv: kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write

Summary: PartitionedDataset in kedro-datasets had a path traversal vulnerability (a security flaw where an attacker uses ".." sequences to access files outside an intended directory) that allowed attackers to write files anywhere on a system by including ".." in partition IDs (identifiers for data sections). This affected all users regardless of storage type, local or cloud-based.

Solution: Upgrade to kedro-datasets version 9.3.0 or later. The patch normalizes paths using `posixpath.normpath` and validates that resolved paths stay within the dataset base directory before use, raising a `DatasetError` if the path escapes. For users unable to upgrade, manually validate partition IDs to ensure they do not contain ".." path components before passing them to PartitionedDataset.


The one piece of data that could actually shed light on your job and AI

Summary: Economists warn that current tools for predicting AI's impact on jobs are inadequate because they only measure "exposure" (whether AI could theoretically do a job's tasks), which doesn't account for whether employers will actually replace workers or increase productivity instead. Economist Alex Imas calls for collecting new data on how AI actually changes specific jobs and industries, since knowing a job is 28% exposed to AI tells us little about whether that job will disappear, be transformed, or become more productive.


CVE-2026-34940: KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/

Summary: KubeAI, a tool that runs AI models on Kubernetes (a system for managing containerized applications), has a vulnerability in versions before 0.23.2 where attackers can inject malicious shell commands (arbitrary code execution instructions) through Model resource creation. The flaw exists because the ollamaStartupProbeScript() function doesn't properly validate user input when building commands that run during startup checks.

Solution: Upgrade to version 0.23.2 or later, which fixes this vulnerability.


Iran threatens OpenAI’s Stargate data center in Abu Dhabi

Summary: Iran's Islamic Revolutionary Guard Corps (IRGC, a military organization) published a video threatening to destroy OpenAI's Stargate data center in Abu Dhabi if the US attacks Iran's power plants. The threat was posted to social media on April 3rd and specifically showed images of OpenAI's $30 billion facility under construction in the United Arab Emirates.


Google DeepMind Researchers Map Web Attacks Against AI Agents

Summary: Researchers at Google DeepMind have identified a vulnerability called 'AI Agent Traps' that allows attackers to manipulate and exploit AI agents (autonomous programs that can browse the web and take actions) by hosting malicious web content designed to deceive them. This research maps out how these attacks work against AI systems that visit websites.


Shadow AI in Healthcare Is Here to Stay

Summary: Healthcare workers are increasingly using AI tools on their own to handle heavy workloads, and organizations cannot stop this trend. The source emphasizes that healthcare organizations should strengthen their security practices to reduce the damage if these unsanctioned AI tools are compromised or misused.


OWASP GenAI Security Project Gets Update, New Tools Matrix

Summary: OWASP (Open Web Application Security Project, a standards group for security best practices) has updated its generative AI security guidance to address 21 identified risks in AI systems. The update recommends that companies use separate but coordinated defense strategies tailored specifically for generative AI (AI that creates text, images, or code) and agentic AI (AI that can take actions independently).


Announcing the OpenAI Safety Fellowship

Summary: OpenAI is launching a Safety Fellowship program (September 2026 to February 2027) for external researchers to conduct independent studies on safety and alignment (making sure AI systems behave as intended and don't cause harm) of advanced AI systems. Fellows will work on topics like safety evaluation, ethics, robustness, privacy protection, and oversight of AI agents, receiving mentorship, compute resources, and a monthly stipend while producing research outputs like papers or datasets.


6 ways attackers abuse AI services to hack your business

Summary: Attackers are increasingly exploiting legitimate AI systems and services instead of using traditional malware, a trend called "living off the AI land." Examples include poisoning MCP servers (tools that connect AI assistants to external services) in supply chains, abusing AI platforms like Claude and Copilot as command-and-control channels (hidden pathways for sending malicious instructions), and hijacking AI agents (automated systems that perform tasks) to extract sensitive data or perform destructive actions. The shift represents a fundamental change in AI security threats, moving beyond simple prompt injection (tricking an AI by hiding instructions in its input) to more sophisticated agent hijacking (taking control of automated AI systems).

OpenAI
Microsoft Copilot
Grok
Claude
Anthropic
Cursor
Postmark
ActiveCampaign


Escaping the COTS trap

Summary: Commercial off-the-shelf software (COTS, meaning ready-made software products sold online or in stores) initially seems attractive because it deploys quickly and costs less than custom development, but organizations often get trapped when they want to switch platforms, as their systems become deeply entangled with the vendor's technology. AI-powered security tools are creating a new type of lock-in by relying on proprietary training data, vendor-specific threat intelligence feeds (collections of indicators showing cyber attacks), and specialized hardware, making it expensive and difficult to migrate away.


How China fell for a lobster: What an AI assistant tells us about Beijing's ambition

Summary: OpenClaw, an open-source AI assistant built by an Austrian developer, sparked a major trend in China in March 2024 because it can be customized to work with Chinese AI models, unlike Western tools like ChatGPT that are inaccessible there. Users enthusiastically adapted OpenClaw's code to create personalized versions they called "lobsters," using them for tasks like e-commerce product listings, stock analysis, and productivity, with some claiming dramatic efficiency gains. The phenomenon reflects China's broader push to develop and embrace AI technology, driven by government support and the success of homegrown platforms like DeepSeek.

OpenClaw
ChatGPT
Claude
OpenAI
DeepSeek
Nvidia
Tencent
Baidu
Cheetah Mobile


I let Gemini in Google Maps plan my day and it went surprisingly well

Summary: Google has integrated Gemini (an AI assistant that's built into Google services) into Google Maps, allowing it to help plan daily itineraries by suggesting nearby locations. The author tested this feature by having Gemini plan a full day around their city and found it effective, discovering both obvious and unexpected recommendations for places to visit.


CVE-2026-5530: A flaw has been found in Ollama up to 18.1. This issue affects some unknown processing of the file server/download.go of

Summary: A vulnerability (CVE-2026-5530) has been discovered in Ollama up to version 18.1 that allows attackers to perform SSRF (server-side request forgery, where an attacker tricks a server into making unwanted requests on their behalf) through the Model Pull API component. The flaw can be exploited remotely by authenticated users, and the vendor has not responded to disclosure attempts.


research-llm-apis 2026-04-04

Summary: A developer is redesigning the abstraction layer (a simplified interface that handles communication with many different AI services) of their LLM Python library to support new vendor features like server-side tool execution (where the AI provider runs code on their servers rather than the user's computer). They used Claude Code to analyze Python client libraries from major AI vendors and generate test commands to understand how these services handle both streaming (real-time data flow) and non-streaming data across different scenarios.

Anthropic Claude OpenAI GPT Google Gemini Mistral


A Survey on Recent Advances in Conversational Data Generation

Summary: This is a survey paper published in an academic journal that reviews recent progress in conversational data generation, which refers to techniques for creating dialogue datasets (collections of conversations) used to train and improve AI systems. The paper appears to be a comprehensive overview of advances in this field as of July 2026, but no specific technical findings, vulnerabilities, or security issues are described in the provided content.


Really, you made this without AI? Prove it

Summary: As generative AI (machine learning systems that create text, images, and other content) becomes better at mimicking human work, people increasingly doubt whether online content is human-made, yet platforms often don't label AI-generated material. The author suggests creating a universal labeling system (similar to Fair Trade certification) that marks human-created content instead, since AI systems have no incentive to identify their own work but human creators do to protect themselves from being replaced.


Hackers Are Posting the Claude Code Leak With Bonus Malware

Summary: Anthropic's source code for Claude Code (an AI coding tool) was accidentally made public, and hackers have been reposting it on GitHub with infostealer malware (software that steals personal information) embedded in the code. Anthropic has been trying to remove the leaked copies by issuing copyright takedown notices, initially targeting over 8,000 repositories before narrowing efforts to 96 copies.

Solution: Anthropic has been issuing copyright takedown notices to remove copies of the leaked code from GitHub.


GHSA-mvv8-v4jj-g47j: Directus: Sensitive fields exposed in revision history

Summary: Directus, a content management system, failed to properly sanitize sensitive data (like user tokens, two-factor authentication secrets, and API keys) before storing them in revision history records. This meant that anyone with access to the revision database table could read these secrets in plaintext, potentially allowing account takeover or unauthorized access to third-party services.


GHSA-qqmv-5p3g-px89: Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite

Summary: Directus has a security flaw in its TUS resumable upload endpoint (a feature that lets users upload files in chunks) that lets any authenticated user overwrite any file in the system by specifying its UUID (unique identifier), bypassing row-level permissions (rules like 'users can only edit their own files'). This can lead to permanent data loss and allow low-privilege users to replace important files with malicious content.

Solution: Disable TUS uploads by setting `TUS_ENABLED=false` if resumable uploads are not required.


GHSA-5qhv-x9j4-c3vm: @mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url

Summary: The mobile_open_url tool in mobile-mcp doesn't check what type of URL scheme (the protocol prefix like http:// or tel://) it receives before sending it to Android, allowing attackers to use prompt injection (tricking an AI by hiding instructions in its input) to execute dangerous commands like making phone calls, sending SMS messages, or accessing private data on a connected mobile device.

Solution: Upgrade to version 0.0.50 or later, which restricts mobile_open_url to http:// and https:// schemes by default. Users who require other URL schemes can opt in by setting the environment variable MOBILEMCP_ALLOW_UNSAFE_URLS=1.

@mobilenext/mobile-mcp@< 0.0.50 (fixed: 0.0.50)

mobilenext/mobile-mcp
MCP (Model Context Protocol)


Anthropic essentially bans OpenClaw from Claude by making subscribers pay extra

Summary: Anthropic is changing its policy so Claude users can no longer use their subscription to access OpenClaw (a third-party tool that integrates with Claude), forcing them to pay separately instead. The change takes effect April 4th, and may be motivated by Anthropic wanting to promote its own competing tools like Claude Cowork.


GHSA-v959-cwq9-7hr6: BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation

Summary: BentoML's Dockerfile generation uses an unsandboxed Jinja2 template engine (a tool that processes template files with dynamic code) with dangerous extensions enabled, allowing attackers to embed malicious code in a template file. When a victim imports a malicious bento archive and runs the containerize command, the attacker's code executes directly on the victim's host machine before any container isolation happens, rather than inside a container where it would be restricted.


GHSA-fgv4-6jr3-jgfw: BentoML: Command Injection in cloud deployment setup script

Summary: BentoML has a command injection vulnerability in its cloud deployment setup script where user-supplied system packages are inserted directly into shell commands without proper escaping. An attacker can craft a malicious bentofile.yaml file that executes arbitrary commands on BentoCloud's build infrastructure (the servers that prepare applications for deployment) when the application is deployed, potentially stealing secrets or compromising the infrastructure.


When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications

Summary: This research examines how attackers could exploit Amazon Bedrock's multi-agent systems (groups of specialized AI agents working together) through prompt injection (tricking an AI by hiding malicious instructions in user input), potentially discovering agent instructions and executing unauthorized tool actions. The study found no vulnerabilities in Bedrock itself, but highlighted a broader LLM challenge: these systems cannot reliably distinguish between legitimate developer instructions and adversarial user input. The research was conducted ethically on owned systems in collaboration with Amazon's security team.

Solution: Enabling Bedrock's built-in prompt attack Guardrail stopped the demonstrated attacks. Additionally, Amazon confirmed that Bedrock's pre-processing stages and Guardrails effectively block these attacks when properly configured.


GHSA-jjhc-v7c2-5hh6: LiteLLM: Authentication bypass via OIDC userinfo cache key collision

Summary: LiteLLM had a security flaw where JWT authentication (a method to verify user identity using encoded tokens) could be bypassed through a cache key collision. When JWT authentication was enabled, the system only used the first 20 characters of a token as a cache key, and since different tokens from the same signing algorithm could have identical first 20 characters, an attacker could create a fake token matching a legitimate user's cached token and gain their permissions. The flaw only affects deployments with JWT/OIDC authentication explicitly enabled, which is not the default configuration.

Solution: Fixed in v1.83.0, where the cache key now uses the full hash of the JWT token instead of just the first 20 characters. Alternatively, disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.


GHSA-53mr-6c8q-9789: LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

Summary: LiteLLM had a security flaw where an authenticated user could access a configuration endpoint (`/config/update`) without needing admin permissions, allowing them to modify settings, run malicious code, read files, or take over admin accounts. The vulnerability affected any user who already had login access to the system.

Solution: Fixed in v1.83.0. The endpoint now requires `proxy_admin` role. As a temporary workaround, restrict API key distribution, though there is no configuration-level workaround available.


GHSA-3jr7-6hqp-x679: Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

Summary: Mesop, a web framework, has a vulnerability in its WebSocket (a protocol for real-time two-way communication between client and server) handler where it creates a new operating system thread for every incoming message without any limits. An attacker can send thousands of messages rapidly, exhausting the server's thread capacity and causing an Out of Memory error that crashes the application for all users.

Solution: The source text recommends four mitigation strategies: (1) Use a bounded thread pool (such as ThreadPoolExecutor with max_workers), (2) Introduce per-connection rate limiting, (3) Implement a message queue with backpressure (preventing queue overflow by slowing down senders), or (4) Consider migrating to an async event loop model instead of spawning OS threads. No specific patch version or code fix is provided.


GHSA-pq5c-rjhq-qp7p: vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing

Summary: vLLM's `VideoMediaIO.load_base64()` method has a vulnerability where it processes `video/jpeg` data URLs (a vLLM-specific format for sending multiple JPEG frames) without limiting how many frames can be included. An attacker can send thousands of comma-separated base64-encoded JPEG frames in a single API request, causing the server to decode all of them into memory at once and crash due to running out of memory (OOM, or out-of-memory error).

Solution: N/A -- no mitigation discussed in source.


GHSA-pf3h-qjgv-vcpr: vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

Summary: vLLM (a language model serving framework) has a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in its batch processing feature. An attacker who can submit batch input JSON can make the vLLM server send arbitrary HTTP requests to any URL, including internal services like cloud metadata endpoints, because the `download_bytes_from_url` function has no restrictions on which domains or IP addresses it will contact.


Meta Pauses Work With Mercor After Data Breach Puts AI Industry Secrets at Risk

Summary: Meta and other AI labs paused work with Mercor, a company that hires contractors to generate training data for AI models, after a security breach exposed proprietary datasets that could reveal competitive secrets to rivals. The breach occurred through a compromised version of LiteLLM (an API tool, which is software that allows different programs to communicate), likely by a hacking group called TeamPCP, affecting thousands of organizations and potentially exposing hundreds of gigabytes of Mercor's confidential data.

Meta OpenAI Anthropic Mercor LiteLLM TeamPCP Lapsus$


v0.14.20

Summary: LlamaIndex version 0.14.20 includes multiple updates across its callback and core modules, with a primary focus on fixing a vulnerability in NLTK (a natural language processing library that helps AI systems understand and work with human language). The release also updates various dependencies and fixes minor bugs in code formatting and syntax.

Solution: Update to version 0.14.20, which includes the fix for the NLTK vulnerability across all affected modules (llama-index-agent-agentmesh, llama-index-callbacks-agentops, llama-index-callbacks-aim, and others).


Security lapse lets researchers view React2Shell hackers’ dashboard

Summary: A threat group called UAT-10608 is exploiting React2Shell (CVE-2025-55182, a pre-authentication remote code execution vulnerability in Next.js applications), a flaw that was patched four months ago, to steal credentials and tokens from unpatched servers at scale. Researchers discovered the attackers' exposed web dashboard, which revealed they had successfully compromised 766 hosts in 24 hours and stolen credentials from major services like AWS, Azure, OpenAI, GitHub, and others. The vulnerability allows attackers to send malicious code payloads to server endpoints without authentication, triggering arbitrary code execution that deploys credential-harvesting tools.

Solution: A fix was issued four months ago. Additionally, the source states that 'victims and service providers with exposed and at-risk credentials, including AWS and GitHub, are being notified,' and IT professionals should 'act quickly' to patch React servers in their environment before credentials are stolen.

AWS
Microsoft Azure
OpenAI
Anthropic
Nvidia NIM
OpenRouter
Tavily
Stripe
GitHub


CVE-2026-0545: In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authoriz

Summary: MLflow (an open-source machine learning platform) has a vulnerability where certain API endpoints under `/ajax-api/3.0/jobs/*` skip authentication checks (verification of who you are) even when basic-auth protection is enabled. If job execution is turned on, attackers can submit, run, read, and cancel jobs without logging in, potentially leading to remote code execution (running malicious commands on the server) or causing denial of service attacks (making the system unavailable).


AISM: Adversarial image steganography model for defending unauthorized recognition

Summary: Researchers have developed AISM (adversarial image steganography model, a technique that hides data inside images while making them resistant to AI recognition), a method for protecting images from being recognized by unauthorized AI systems. The approach uses adversarial techniques (methods that deliberately trick AI models by adding subtle, invisible changes to data) combined with steganography (the practice of hiding information within other data) to prevent unwanted AI analysis while keeping the images visually normal to humans. This work addresses privacy concerns where people want to prevent their images from being processed by AI systems without permission.


Claude Code is still vulnerable to an attack Anthropic has already fixed

Summary: Claude Code has a vulnerability where commands with more than 50 subcommands (smaller operations within a larger command) cause the tool to skip its security checks for subcommands after the 50th, asking users to approve them without proper safety analysis. Attackers could exploit this by hiding malicious commands in legitimate-looking code repositories, potentially stealing user credentials and compromising entire software projects.

Solution: Anthropic has already developed a fix called the tree-sitter parser (a tool that analyzes code structure more carefully), which is included in the source code but has not been enabled in the public builds that customers currently use.


CVE-2025-64340: FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell m

Summary: FastMCP (a framework for building MCP applications, which are tools that extend AI assistants) has a command injection vulnerability (a security flaw where an attacker can run unauthorized commands) in versions before 3.2.0 on Windows. When server names contain shell metacharacters like '&', they can be misinterpreted by the Windows command interpreter and allow attackers to execute malicious commands during installation.

Solution: Update FastMCP to version 3.2.0 or later, where this issue has been patched.


GHSA-3mwp-wvh9-7528: vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server

Summary: vLLM's OpenAI-compatible API server has a denial-of-service vulnerability where an attacker can send a request with an extremely large `n` parameter (a value that controls how many independent response sequences to generate). Because the server doesn't validate an upper limit on this parameter, it attempts to create millions of copies of the request object in memory, which overwhelms the system and causes it to crash from running out of memory (OOM, out-of-memory).


Claude Source Code Leak Highlights Big Supply Chain Missteps

Summary: Claude's source code was leaked, revealing problems in how the software supply chain (the process of developing, distributing, and maintaining software) is protected. The incident shows that companies need stronger security controls at every step of software development, similar to how critical infrastructure like power grids are protected.


In Other News: ChatGPT Data Leak, Android Rootkit, Water Facility Hit by Ransomware

Summary: This news roundup covers several security incidents: a data leak from ChatGPT, a rootkit (malware that hides itself deep in a system to maintain control) discovered on Android devices, and a ransomware attack (malware that encrypts files and demands payment) on a water treatment facility. The article also mentions a Symantec vulnerability, a new anti-ClickFix defense added to macOS (a mechanism to block a social engineering attack that tricks users into visiting malicious websites), and an FBI hack classified as a major incident.


'Chasing vibes' — OpenAI's M&A strategy gets more confusing with TBPN purchase

Summary: OpenAI announced its purchase of TBPN (Technology Business Programming Network), a media company that streams a daily three-hour tech talk show, marking another acquisition alongside its $6.4 billion purchase of hardware startup io. The acquisition strategy appears unclear to investors and analysts, as the company faces intensifying competition from rivals like Google and Anthropic while dealing with significant losses from infrastructure spending ahead of a planned IPO.


Mobile Attack Surface Expands as Enterprises Lose Control

Summary: Enterprises are facing growing security risks on mobile devices because unauthorized AI (shadow AI, meaning AI tools deployed without official approval) is being hidden in everyday apps, combined with outdated mobile devices and zero-click exploits (attacks that work without any user interaction like clicking a link). These factors together create mobile security threats that are hard for organizations to detect and manage.


12 cyber industry trends revealed at RSAC 2026

Summary: At the 2026 RSA cybersecurity conference, industry leaders identified a clear divide among CISOs (chief information security officers, top security leaders at companies) in their approach to AI: about 20% are proactive and strategic, 40% are confused about AI risks in their organizations, and 40% are unaware of AI projects happening around them. The article predicts that confused CISOs will face a difficult transition to becoming proactive, requiring them to assess business goals, create governance frameworks (policies and rules for managing AI), and implement guardrails (safety controls) while their organizations continue developing AI. Legacy security vendors currently have an advantage in selling AI tools, but simply adding AI to existing security tools will not work long-term, and companies instead need to build strong AI foundations (data systems, control systems, and safety measures) before adding AI agents on top.


GHSA-v3qc-wrwx-j3pw: OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`

Summary: OpenClaw, an LLM agent framework, had a vulnerability where an AI agent could bypass approval controls by using a `config.patch` command (a way to modify settings) to silently disable execution approval requirements. This means an agent could potentially perform restricted actions without human permission.

Solution: The vulnerability was fixed in commit 76411b2afc4ae721e36c12e0ea24fd23e2fed61e on 2026-03-27 and released in version 2026.3.28. Users should update to OpenClaw version 2026.3.28 or later.


Microsoft executive touts Copilot sales traction as AI anxiety weighs on stock

Summary: Microsoft's Copilot, an AI add-on for business productivity software, has faced slow adoption despite the company's heavy investment in AI infrastructure, though executives claim recent sales improvements. The company had 15 million users of its $30-per-month Microsoft 365 Copilot as of January, representing only 3% of available seats, and analysts expected higher numbers. Microsoft adjusted its sales strategy after receiving feedback, focusing on getting more users onto the free Copilot Chat feature alongside paid Copilot seats.


PSA: Anyone with a link can view your Granola notes by default

Summary: Granola, an AI-powered note-taking app that records meetings and generates summaries, makes your notes viewable to anyone who has the link by default, despite claiming notes are "private by default." Additionally, Granola uses your notes for internal AI training unless you actively opt out of this practice.


Four security principles for agentic AI systems

Summary: Agentic AI systems (AI that autonomously connects to software tools and uses large language models as reasoning engines to plan and execute actions) present unique security challenges because they operate at machine speed with real-world consequences, unlike traditional software or human-reviewed generative AI. The main risks are that agents can carry out unintended actions before humans can intervene, and they may not recognize ambiguities or understand unstated policy boundaries like humans do. Security responses don't require entirely new frameworks but should extend existing ones (like NIST's Cybersecurity Framework) with four foundational principles addressing both traditional software components and AI-specific elements.


Highlights from my conversation about agentic engineering on Lenny's Podcast

Summary: This podcast episode discusses how AI coding models reached an inflection point in November 2025 when GPT 5.1 and Claude Opus 4.5 became reliable enough that generated code mostly works without extensive manual fixes, fundamentally changing how software engineers work. The speaker highlights that code quality is easier to verify than other knowledge work (like legal documents), making software engineers early adopters facing questions about career changes as AI agents (programs that can take actions autonomously) handle tasks that previously consumed most development time. The episode also touches on practical uses of AI for coding on mobile devices and the importance of testing before deploying AI-generated code to users.

OpenAI
ChatGPT
GPT 5.1
Anthropic
Claude Opus 4.5
Claude


Claude Code leak used to push infostealer malware on GitHub

Summary: Threat actors exploited a March 31 accidental leak of Claude Code's source code (a terminal-based AI agent from Anthropic) by creating fake GitHub repositories that deliver Vidar infostealer malware to users searching for the leaked code. The repositories use search engine optimization to appear in Google results and trick users into downloading a malicious executable that deploys information-stealing and network-proxying tools.


CVE-2026-34760: vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, L

Summary: vLLM versions 0.5.5 through 0.17.x have a bug where Librosa (a library that processes audio) uses a simple averaging method for mono downmixing (converting multi-channel audio to single-channel), but the international standard ITU-R BS.775-4 requires a weighted algorithm instead. This causes audio to sound different to humans than what AI models actually process, creating a mismatch in how the same audio is experienced.

Solution: This issue has been patched in version 0.18.0.


OpenAI acquires popular tech podcast TBPN

Summary: OpenAI has acquired TBPN, a daily technology news podcast that covers AI and interviews major tech leaders. The acquisition is part of OpenAI's effort to create a platform for discussion about how AI is changing society, though the company says TBPN will maintain editorial independence and continue choosing its own guests.


GHSA-3hfp-gqgh-xc5g: Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

Summary: A supply chain attack compromised the axios npm package (versions 1.14.1 and 0.30.4) by injecting a malicious dependency that installs a RAT (remote access trojan, malware giving attackers shell access and command execution). The @lightdash/cli package could resolve to these compromised axios versions during installation, potentially affecting users who installed @lightdash/cli versions 0.1800.0 through 0.2695.0 without a lockfile (a file that pins exact dependency versions) during the roughly 3-hour window the malicious versions were available on npm.

Solution: Upgrade @lightdash/cli immediately to version 0.2695.1, which pins axios to the safe version 1.14.0, using: `npm install -g @lightdash/cli@0.2695.1`. If unable to upgrade immediately, force install the safe axios version with `npm install -g axios@1.14.0 --force`. For Docker images or lockfile-based setups, verify axios is not version 1.14.1 or 0.30.4 by running `npm ls axios`. Additionally, block network traffic to the attacker's command-and-control servers (`sfrclak[.]com` and `142.11.206.73:8000`) at the network level. If compromise is suspected, check for RAT artifacts (macOS: `/Library/Caches/com.apple.act.mond`, Windows: `%PROGRAMDATA%\wt.exe`, Linux: `/tmp/ld.py`), and if found, rotate all credentials and secrets.


llm-gemini 0.30

Summary: This is a monthly briefing post by Simon Willison from April 2, 2026, covering developments in LLM (large language model) tools and services, including updates to the llm command-line tool, Google's Gemini AI, and Google's Gemma model. The post appears to be an announcement of a sponsored monthly email digest tracking important LLM developments, though specific technical details about changes or issues are not provided in the content.


CVE-2026-34526: SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Summary: SillyTavern, a local application that lets users interact with AI text generation models and other AI tools, had a security flaw in versions before 1.17.0 where it didn't properly validate all types of network addresses. The validation only checked for standard IPv4 addresses (like 127.0.0.1) but missed other ways to refer to the local computer, such as 'localhost' or IPv6 addresses, which could allow SSRF (server-side request forgery, where an attacker tricks the application into making unwanted network requests to internal services).

Solution: Update to version 1.17.0 or later, where this issue has been patched.


CVE-2026-34524: SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Summary: SillyTavern is a locally installed interface for interacting with text generation AI models and related tools. Before version 1.17.0, it had a path traversal vulnerability (a flaw where an attacker can access files outside the intended directory) that allowed authenticated attackers to read and delete arbitrary files like secrets.json and settings.json by manipulating the avatar_url parameter.

Solution: This issue has been patched in version 1.17.0. Users should update to version 1.17.0 or later.


CVE-2026-34523: SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Summary: SillyTavern is a locally installed interface for interacting with text generation models and AI tools. Before version 1.17.0, it had a path traversal vulnerability (a flaw that lets attackers access files outside the intended directory) that allowed unauthenticated users to check whether files exist anywhere on the server by sending specially encoded requests with "../" sequences to the file routes.

Solution: This issue has been patched in version 1.17.0.


CVE-2026-34522: SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Summary: SillyTavern, a locally installed interface for interacting with AI text generation models, had a path traversal vulnerability (a flaw that lets attackers write files outside the intended directory) in its /api/chats/import feature prior to version 1.17.0. An authenticated attacker could exploit this by injecting traversal sequences into the character_name field to place malicious files outside the chats directory.

Solution: This issue has been patched in version 1.17.0. Users should upgrade to version 1.17.0 or later.


Critical Vulnerability in Claude Code Emerges Days After Source Leak

Summary: Anthropic's Claude Code source code was leaked, and shortly after, security researchers at Adversa AI discovered a critical vulnerability in the tool. The incident highlights how exposing source code can quickly lead to the discovery of serious security flaws.


OpenAI just bought TBPN

Summary: OpenAI has acquired TBPN, a popular online talk show that broadcasts live weekday episodes and features interviews with AI executives and tech leaders, positioning itself as competition to traditional financial news channels like Bloomberg and CNBC. The show's host stated it will continue operating as before under OpenAI's ownership, marking a reunion between the host and OpenAI CEO Sam Altman, who had previously funded the host's company.

OpenAI
Meta
Microsoft
Palantir
Andreessen Horowitz


Gemma 4: Byte for byte, the most capable open models

Summary: Google DeepMind has released Gemma 4, a family of open-source AI models available in four sizes (2B to 31B parameters, where parameters are the trainable weights in a neural network) designed for complex reasoning and agentic workflows (AI systems that can autonomously plan and use tools to complete tasks). The models are optimized to run efficiently on various hardware from mobile phones to workstations and support advanced features like multimodal processing (handling text, images, video, and audio), function-calling for tool integration, and context windows up to 256K tokens (units of text the model can process in one response).


Google Workspace’s continuous approach to mitigating indirect prompt injections

Summary: Indirect prompt injection (IPI) is a security threat where attackers hide malicious instructions in data or tools that an AI system uses, potentially influencing how it behaves without direct user input. Google treats IPI as an ongoing challenge rather than a one-time problem to solve, using multiple continuous strategies including human red-teaming (adversarial simulations), automated red-teaming (machine-learning-driven attack testing), a vulnerability rewards program for external researchers, and monitoring of publicly disclosed attacks to stay ahead of evolving threats.


Threat actor abuse of AI accelerates from tool to cyberattack surface

Summary: Threat actors are now embedding AI into their cyberattacks to make them more effective and precise, rather than just faster. AI is helping attackers craft better phishing emails (resulting in 54% click-through rates versus 12% traditionally), develop malware, and steal data more efficiently, while humans still oversee the operations. Organizations face a major security challenge because AI-enabled phishing is now far more targeted and harder to defend against at scale, especially when combined with systems designed to bypass multifactor authentication (MFA, a security method that requires multiple forms of verification).


It’s not easy to get depression-detecting AI through the FDA

Summary: Kintsugi, a California startup, spent seven years developing AI to detect depression and anxiety by analyzing how someone speaks rather than what they say. The company is shutting down after failing to get FDA (Food and Drug Administration, the U.S. agency that approves medical products) clearance, though it is releasing its technology as open-source software so others can use and build on it.


Cybersecurity M&A Roundup: 38 Deals Announced in March 2026

Summary: This article reports on 38 cybersecurity mergers and acquisitions (M&A, or business deals where one company buys another) announced in March 2026 by major companies including Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI. The source provides only a high-level announcement of these deals without detailed technical or security content.

Airbus
Cellebrite
Databricks
Quantum eMotion
Rapid7
OpenAI


I have always seen myself as ‘progressive’ – but with AI it’s time to hit the brakes | Peter Lewis

Summary: This article discusses concerns about the rapid advancement of AI technology and argues that progressive voices are not adequately addressing the risks of automation and economic disruption. The author expresses skepticism about AI industry leaders, using Anthropic's CEO as an example, questioning whether their stated commitment to safe AI development should be trusted despite their public statements about safety concerns.


Microsoft’s new ‘superintelligence’ game plan is all about business

Summary: Microsoft has reorganized its AI leadership, with Mustafa Suleyman taking on a new role as the company's first CEO of AI focused specifically on pursuing superintelligence (AI systems that would surpass human intelligence across all tasks). The company's renegotiated contract with OpenAI has enabled this strategic shift, which Suleyman says he had been planning for nearly a year.


Google Home’s latest update makes Gemini better at understanding your commands

Summary: Google has released an update to its Home app that improves Gemini (Google's AI assistant) at understanding natural language commands for controlling smart home devices. The update allows users to describe desired settings in more natural ways, such as requesting "the color of the ocean" for lighting or specifying exact temperatures and humidity levels, and improves Gemini's ability to identify which devices are being controlled.


Erratum: Adversarial Machine Learning in IoT Security: A Comprehensive Survey

Summary: This is an erratum (correction notice) for an academic survey paper about adversarial machine learning in IoT security (the practice of deliberately fooling AI systems used to protect internet-connected devices). The notice appears in ACM Computing Surveys journal, Volume 58, Issue 10, published in July 2026.


OpenAI acquires TBPN

Summary: OpenAI has acquired TBPN, a media platform that covers AI news and hosts conversations with influential figures in tech and business. The acquisition aims to help OpenAI communicate more effectively about AI's impact on society while keeping TBPN's editorial independence intact.


Codex now offers more flexible pricing for teams

Summary: OpenAI has introduced more flexible pricing for Codex, a code-generation AI tool that helps developers write software faster. Teams can now add Codex-only seats with pay-as-you-go pricing (meaning you only pay for what you use based on tokens, the small units of text the AI processes) instead of paying a fixed fee per person, and ChatGPT Business pricing has been lowered from $25 to $20 per seat annually. The company is also offering $100 in credits per new Codex-only user (up to $500 per team) to help teams try out the tool.


Cybersecurity in the age of instant software

Summary: AI is making software development faster and easier, creating a future where custom applications can be written and deleted on demand, but this also means AI tools are getting better at finding and exploiting vulnerabilities in code. Both attackers and defenders are using AI for cybersecurity, creating an 'arms race' where attackers can automatically discover and exploit flaws while defenders can use similar AI tools to find and patch vulnerabilities before attackers exploit them.


Variance Raises $21.5M for Compliance Investigation Platform Powered by AI Agents

Summary: Variance, a company building a compliance investigation platform that uses AI agents (autonomous AI systems that can perform tasks independently), has raised $21.5 million in new funding, bringing its total funding to $26 million. The funding will be used to grow the platform's capabilities.


Tools, um MCP-Server abzusichern

Summary: Model Context Protocol (MCP, a system that connects AI agents to data sources) has become popular in businesses but faces security risks like prompt injection (tricking an AI by hiding instructions in its input), token theft, and data leaks. While progress has been made with features like OAuth support and an official MCP Registry, companies need tools to implement proper access controls, authorization checks, and detailed logging to protect sensitive data.

Asana
Atlassian
Model Context Protocol (MCP)


GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via `_.template` imports key names

Summary: The lodash library has a code injection vulnerability in its `_.template` function (a tool that generates reusable text templates with dynamic values). Attackers can inject malicious code through the `options.imports` parameter, either by passing untrusted input as key names or by exploiting prototype pollution (a technique where attackers modify the default object properties that all objects inherit from). This allows arbitrary code to run when a template is compiled.

Solution: Users should upgrade to lodash version 4.18.0. The fix validates import key names using the same security checks applied to the `variable` option, and it changes how imports are merged to prevent inherited properties from being included.


GHSA-f23m-r3pf-42rh: lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Summary: Lodash versions 4.17.23 and earlier have a vulnerability in the `_.unset` and `_.omit` functions that allows prototype pollution (modifying built-in object templates like Object.prototype that affect all objects). An attacker can bypass the previous security fix by using array-wrapped path segments to delete properties from these core prototypes, though they cannot change how those prototypes work.

Solution: Upgrade to Lodash version 4.18.0 or later. The source states: 'This issue is patched in 4.18.0.'


GHSA-q56x-g2fj-4rj6: ONNX: TOCTOU arbitrary file read/write in save_external_dat

Summary: ONNX's `save_external_data` method contains a TOCTOU vulnerability (time-of-check-time-of-use, a gap between checking if a file exists and using it) that allows attackers to overwrite arbitrary files by creating symlinks (shortcuts to other files) between those two operations. The code also has a potential path validation bypass on Windows systems that may allow absolute paths to be used.


GHSA-44c2-3rw4-5gvh: PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL

Summary: PraisonAI's `FileTools.download_file()` function has a security flaw called SSRF (server-side request forgery, where a server is tricked into making requests to unintended targets) because it doesn't validate URLs before downloading files. An attacker can make it download from internal services or cloud metadata endpoints, potentially stealing credentials or accessing restricted information.

Solution: The source text provides a suggested fix that validates URLs by checking that the scheme is http or https, and blocking requests to private/reserved IP ranges (127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) using the `urllib.parse` and `ipaddress` Python modules. The fix includes a `_validate_url()` function that raises a ValueError if a blocked address is detected. Additionally, the code should be updated to call this validation function before passing the URL to `httpx.stream()`, and `follow_redirects=True` should be reconsidered to prevent redirect-based bypasses.

praisonaiagents@<= 1.5.94 (fixed: 1.5.95)


GHSA-r4f2-3m54-pp7q: PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox

Summary: PraisonAI's SubprocessSandbox has a critical security flaw where it uses `shell=True` (a setting that makes subprocess execute commands through a shell) and only blocks certain command names, but doesn't block `sh` or `bash` executables, allowing attackers to escape the sandbox by running commands like `sh -c '<command>'` even in STRICT mode. This means security protections meant to isolate untrusted AI code can be bypassed, giving attackers access to the network, files, and system information.

Solution: Replace the `subprocess.run()` call with `shlex.split(command)` (a function that safely parses command strings) and set `shell=False` to disable shell interpretation. Specifically, change from `subprocess.run(command, shell=True, ...)` to `subprocess.run(shlex.split(command), shell=False, cwd=cwd, env=env, capture_output=capture_output, text=True, timeout=timeout)`.


GHSA-x6m9-gxvr-7jpv: PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

Summary: PraisonAI's `passthrough()` function accepts a user-controlled `api_base` parameter (the server address to send requests to) and uses it without validation when the primary request method fails. This allows an attacker to make the server send requests to any address it can reach, including internal services like cloud metadata servers that contain sensitive credentials, a vulnerability called SSRF (server-side request forgery, where an attacker tricks a server into requesting internal resources). The flaw affects PraisonAI version 1.5.87 and potentially others.


GHSA-w37c-qqfp-c67f: PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution

Summary: PraisonAI's `run_python()` function has a shell injection vulnerability (a security flaw where attackers can sneak in operating system commands) because it doesn't properly escape shell metacharacters like `$()` and backticks when building commands. An attacker can inject arbitrary OS commands by embedding `$()` in code passed to the function, leading to full command execution on the system.

praisonaiagents@<= 1.5.89 (fixed: 1.5.90)


GHSA-6vh2-h83c-9294: PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

Summary: The `execute_code()` function in PraisonAI uses a sandbox to restrict what Python code can do, but attackers can bypass all three security layers by creating a custom `str` subclass (a modified version of the string type) with an overridden `startswith()` method, allowing them to run arbitrary OS commands on the host system. This is especially dangerous because many deployments auto-approve code execution without human review, so an attacker could trigger the vulnerability silently through indirect prompt injection (sneaking malicious instructions into the AI's input).


datasette-llm 0.1a6

Summary: datasette-llm 0.1a6 is a plugin (add-on software) that helps integrate LLMs into the datasette data tool. This release simplifies configuration by automatically adding a default model to the allowed models list, so developers don't have to list the same model ID twice.


datasette-enrichments-llm 0.2a1

Summary: This is an announcement about datasette-enrichments-llm version 0.2a1, a tool that combines datasette (a database publishing platform), llm (a language model interface), and enrichments (adding extra data to existing information). The post is from Simon Willison dated April 1st, 2026, and appears to be part of a monthly briefing about LLM developments.


Claude Mythos Wake-Up Call: What AI Vulnerability Discovery Means for Cyber Defense

Summary: Anthropic was developing Claude Mythos, an advanced AI model with improved abilities in vulnerability discovery (finding weaknesses in software) and exploit development (creating tools to attack those weaknesses). This capability means AI can now help attackers find and exploit security flaws more quickly and at larger scale than before, making cyber defense significantly more challenging.

Anthropic
Claude
Claude Capybara
Claude Mythos


Claude’s code: Anthropic leaks source code for AI software engineering tool

Summary: Anthropic accidentally leaked nearly 2,000 internal files and 500,000 lines of code for its Claude Code AI tool due to human error, when an internal file was mistakenly included in a software update and pointed to an archive that was quickly copied to GitHub. The leaked source code spread widely on social media and became GitHub's fastest-ever downloaded repository before Anthropic issued copyright takedown requests to limit its distribution.

Solution: Anthropic issued copyright takedown requests to try to contain the code's spread.


CVE-2026-34447: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0,

Summary: ONNX (Open Neural Network Exchange, a standard format for sharing machine learning models) versions before 1.21.0 have a symlink traversal vulnerability (a flaw where attackers can follow symbolic links to access files outside the intended model directory), allowing unauthorized reading of files outside the model directory. This vulnerability affects how ONNX loads external data when processing models.

Solution: This issue has been patched in version 1.21.0. Users should upgrade to ONNX version 1.21.0 or later.


CVE-2026-34446: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0,

Summary: ONNX (Open Neural Network Exchange, a standard format for sharing machine learning models) has a security flaw in versions before 1.21.0 where its file-loading function checks for symlinks (shortcuts to files) but misses hardlinks (alternate names pointing to the same file), allowing attackers to bypass path traversal protections (restrictions that prevent accessing files outside an intended folder).

Solution: Update ONNX to version 1.21.0 or later, where this issue has been patched.


CVE-2026-34445: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0,

Summary: ONNX (Open Neural Network Exchange, a standard format for sharing machine learning models) had a vulnerability in versions before 1.21.0 where it didn't properly validate data loaded from model files, allowing an attacker to craft a malicious model that could overwrite internal object properties. An attacker could exploit this by embedding specially crafted metadata (like file paths) into an ONNX model file that would be processed without proper checks.


CVE-2026-27489: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0,

Summary: ONNX (Open Neural Network Exchange, a standard format for sharing machine learning models) versions before 1.21.0 have a path traversal vulnerability via symlink (a shortcut that points to files outside its intended folder), allowing attackers to read arbitrary files outside the model or user-provided directory. This vulnerability has a CVSS score (0-10 severity rating) of 8.7, indicating high severity.

Solution: Update to ONNX version 1.21.0 or later, where this issue has been patched.


Vim and GNU Emacs: Claude Code helpfully found zero-day exploits for both

Summary: Researcher Hung Nguyen used Anthropic's Claude Code (an AI tool for analyzing code) to quickly discover zero-day exploits (previously unknown security flaws) in Vim and GNU Emacs, two widely-used text editors. Claude Code found vulnerabilities that would allow attackers to execute arbitrary code (run commands they don't control) simply by tricking users into opening malicious files, and even generated proof-of-concept exploits (working examples of attacks) within minutes.

Solution: For Vim: The vulnerability (CVE-2026-34714, CVSS score 9.2) was fixed by the maintainers in version 9.2.0272. For GNU Emacs: The source text states that GNU Emacs maintainers declined to address the issue and believes it to be a problem with Git instead; Nguyen suggests manual mitigations but the source does not explicitly describe what those mitigations are.


Webinar Today: Agentic AI vs. Identity’s Last Mile Problem

Summary: This webinar discusses agentic AI (AI systems that can plan and take actions independently to complete tasks), its current capabilities and limitations, and how disconnected applications create identity security vulnerabilities that have led to real breaches. The event explores the 'last mile problem' in identity security, which refers to the final challenge of verifying user identity across systems that don't communicate well with each other.

Solution: N/A -- no mitigation discussed in source.


Block the Prompt, Not the Work: The End of "Doctor No"

Summary: Traditional enterprise security approaches that simply block access to AI tools and websites create a "Workaround Economy" where employees bypass controls through unmanaged alternatives like personal email or browser extensions, resulting in zero organizational visibility and increased risk. The article argues that blocking tools is ineffective because security tools like firewalls and endpoint agents (software that monitors device activity) either break user experience or remain blind to threats like browser extensions harvesting data, as illustrated by a law firm that blocked DeepSeek but discovered 70% of users had installed invisible AI wrapper extensions routing traffic overseas.


AI can push your Stream Deck buttons for you

Summary: Elgato's Stream Deck 7.4 software update now supports MCP (Model Context Protocol, a standard that lets AI assistants interact with software tools), allowing AI chatbots like Claude and ChatGPT to automatically activate Stream Deck buttons instead of requiring manual button presses. Users can now request actions through voice or text, and the AI will trigger the corresponding Stream Deck functions.

Elgato
Claude
ChatGPT
Nvidia G-Assist
Model Context Protocol


Prompting Frameworks for Large Language Models: A Survey

Summary: This is an academic survey paper that reviews different prompting frameworks, which are structured approaches to asking large language models (AI systems trained on huge amounts of text) questions or giving them instructions to complete tasks. The paper, published in a major computer science journal, catalogues and analyzes various methods researchers have developed to improve how effectively people interact with and get useful results from LLMs.


Claude Code users hitting usage limits 'way faster than expected'

Summary: Claude Code users are experiencing unexpected rapid consumption of tokens (the units of payment for using AI services), hitting their usage limits much faster than expected. Anthropic announced it is investigating the issue as a top priority, though the exact cause remains unclear. The problem may be compounded by recent peak-hour throttling (slowing service during high-demand times to manage load), which causes tokens to be consumed more quickly.


Mutation testing for the agentic era

Summary: Code coverage metrics can be misleading because they measure whether code runs, not whether it's actually tested—a gap that mutation testing (introducing intentional bugs to check if tests catch them) can reveal. The article announces MuTON and mewt, new mutation testing tools designed for AI agents that work across multiple programming languages, addressing limitations of older regex-based tools like universalmutator that were slow and couldn't handle complex code patterns.


Google Addresses Vertex Security Issues After Researchers Weaponize AI Agents

Summary: Palo Alto Networks revealed security problems in Google Cloud Platform's Vertex AI (Google's AI service for building and deploying machine learning models) after researchers demonstrated how to weaponize AI agents, which are autonomous programs that can perform tasks with minimal human input. Google has begun addressing these disclosed security issues.

Google Cloud Platform
Vertex AI
Palo Alto Networks


Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

Summary: Anthropic confirmed that Claude Code's source code was accidentally leaked through an npm package (a JavaScript library repository) containing a source map file, exposing nearly 2,000 TypeScript files and over 512,000 lines of code. The leaked code revealed internal features like a self-healing memory architecture and a stealth mode for making hidden contributions to open-source projects, creating security risks because attackers can now study how the system works to bypass its safeguards. Additionally, users who downloaded the affected version between specific times on March 31, 2026 may have received a trojanized HTTP client (compromised software) containing malware.

Solution: Anthropic stated it is 'rolling out measures to prevent this from happening again.' Users who installed or updated Claude Code via npm on March 31, 2026 between 00:21 and 03:29 UTC are advised to immediately downgrade to a safe version and rotate all secrets (regenerate passwords and access keys).


I wore Meta’s smartglasses for a month – and it left me feeling like a creep

Summary: Meta's smartglasses include a built-in camera and AI assistant (software that can understand and respond to user requests) that can describe what the wearer is looking at and provide information like weather forecasts. The article explores how these devices raise privacy concerns, with some people calling them problematic because they can record video of others without their knowledge or consent.


Attack Surface Management – ein Kaufratgeber

Summary: This article is a buying guide for Attack Surface Management tools, which help companies find and reduce the digital resources that attackers could potentially target. The article explains that CAASM (Cyber Asset Attack Surface Management) and EASM (External Attack Surface Management) tools continuously monitor for new assets and security configuration problems, with increasing use of agentic AI (AI systems that can take independent actions) to identify and reduce risks.


datasette-enrichments-llm 0.2a0

Summary: This is a brief announcement about datasette-enrichments-llm version 0.2a0, posted by Simon Willison on April 1st, 2026. The content primarily consists of a sponsorship pitch for a monthly email digest covering important LLM (large language model) developments, rather than discussing a specific security issue or technical problem.


datasette-llm-usage 0.2a0

Summary: datasette-llm-usage version 0.2a0 removed features for tracking allowances and pricing, which moved to a separate tool called datasette-llm-accountant, and added the ability to log complete prompts, responses, and tool calls (automated functions the AI can call) to a database table if enabled through a configuration setting. The simple prompt page was redesigned and now requires specific user permissions to access.


datasette-llm 0.1a5

Summary: datasette-llm 0.1a5 is a release of a plugin that lets other software tools integrate with large language models. The update improves the llm_prompt_context() plugin hook (a mechanism that other plugins can connect to), so it now tracks both individual prompts and chains of prompts executed together, including tool call loops (repeated back-and-forth exchanges between the AI and external functions).


Anthropic employee error exposes Claude Code source

Summary: An Anthropic employee accidentally exposed the source code for Claude Code (an AI programming tool) by leaving a source map file (.map file, a debugging file that translates minified code back to human-readable form) in a package published on npm (a registry where developers share code). This is a security risk because hackers can use source maps to understand how the code works, find vulnerabilities, and potentially steal secrets like API keys that might be hidden in the code.

Solution: According to secure coding trainer Tanya Janca, developers should: (1) disable source maps in the build/bundler tool; (2) add the .map files to the .npmignore or package.json files field to explicitly exclude them, even if generated during the build by accident; and (3) exclude them from production. Anthropic stated they are 'rolling out measures to prevent this from happening again,' though specific details are not provided in the source.


Gradient Labs gives every bank customer an AI account manager

Summary: Gradient Labs has built an AI system that acts as a dedicated account manager for bank customers, handling complex issues like fraud and blocked payments by following strict procedures. The system uses OpenAI models (specifically GPT-5.4 mini and nano for production) and includes 15+ guardrail systems (safety checks running in parallel) to ensure conversations stay compliant and accurate, achieving 97% trajectory accuracy (following the correct procedure path from start to finish) compared to competitors at 88%.

Solution: The source describes Gradient Labs' approach to ensuring reliability rather than discussing a fix to a problem: they replay real customer conversations to compare system behavior against expected procedures, generate synthetic conversations to test edge cases before deployment, and give teams control over how the system is introduced by analyzing historical support data to map customer issue types.

OpenAI
Gradient Labs
Monzo
GPT-5.4 mini
GPT-5.4 nano
GPT-4.1


Claude Code source code accidentally leaked in NPM package

Summary: Anthropic accidentally leaked the closed-source code for Claude Code when they published version 2.1.88 on NPM, which included a 60 MB source map file (a debugging file that links compiled code back to original source code) containing approximately 1,900 files and 500,000 lines of code. Anthropic confirmed no customer data or credentials were exposed and stated this was a human error in release packaging, not a security breach. The company is also investigating a separate bug where Claude Code users are hitting usage limits much faster than expected.

Solution: Anthropic stated they are 'rolling out measures to prevent this from happening again.' The company has also begun issuing DMCA infringement notifications to take down the leaked source code where possible online.


GHSA-ghq9-vc6f-8qjf: TorchGeo Remote Code Execution Vulnerability

Summary: TorchGeo versions 0.4–0.6.0 had a critical vulnerability where the `eval` function (a Python function that executes code from text input) was used in the model weight API, allowing attackers to run arbitrary commands on systems using the library. Any platform exposing TorchGeo's get_weight() or trainers functions publicly was at risk.

Solution: The `eval` statement was replaced with a fixed enum lookup (a safer way to match input to predefined options). Users are encouraged to upgrade to TorchGeo 0.6.1 or newer. For unpatched versions, input validation and sanitization (checking and cleaning user input before processing) can be used to avoid the vulnerability.


GHSA-g86v-f9qv-rh6m: OpenClaw SSRF guard misses four IPv6 special-use ranges

Summary: OpenClaw had a vulnerability in its SSRF guard (a security check that blocks requests to internal network addresses), which incorrectly classified certain IPv6 special-use ranges (reserved address groups in the newer internet protocol) as public. This allowed attackers to potentially access internal or non-routable addresses that should have been blocked.

Solution: Update OpenClaw to version 2026.3.28 or later. The fix was implemented in commit d61f8e5672 with the change "Net: block missing IPv6 special-use ranges."


GHSA-m866-6qv5-p2fg: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Summary: OpenClaw's host environment sanitization (a security check that removes dangerous settings before running code) was missing protections for two environment variables: `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE`. An attacker could exploit this by approving a code execution request that redirects git or AWS tools to attacker-controlled files, allowing them to run untrusted code or steal credentials.

Solution: Upgrade to OpenClaw version 2026.3.28 or later. The fix was implemented in commit `6eb82fba3c` titled 'Infra: block additional host exec env keys', which adds `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` to the blocklist in `src/infra/host-env-security-policy.json` and `src/infra/host-env-security.ts`.


GHSA-jccr-rrw2-vc8h: OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

Summary: OpenClaw's jq safe-bin policy had a security flaw where it blocked direct `env` commands but still allowed access to environment variables through the `$ENV` filter, potentially letting approved commands leak sensitive environment data. This vulnerability affected versions up to 2026.3.24 in the file `src/infra/exec-safe-bin-semantics.ts` (the code that enforces safe command restrictions).

Solution: Update to version 2026.3.28 or later. The fix was implemented in commit `78e2f3d66d` with the message "Exec: tighten jq safe-bin env checks".


Claude Code leak exposes a Tamagotchi-style ‘pet’ and an always-on agent

Summary: Anthropic's Claude Code version 2.1.88 update accidentally included a source map file (a file that maps compiled code back to its original TypeScript source code) containing over 512,000 lines of the tool's internal code. The leak exposed details about upcoming features, AI instructions, and the system's memory architecture.


CVE-2026-34452: The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before vers

Summary: The Claude SDK for Python (versions 0.86.0 to 0.86.x) had a vulnerability in its async local filesystem memory tool where the system checked that file paths were safe but then used an unresolved path, allowing an attacker to redirect file operations outside the intended sandbox (a restricted storage area) using symlinks (shortcuts to other files or directories). The synchronous (non-async) version of this tool was not affected.

Solution: Update to version 0.87.0 or later, where this issue has been patched.


CVE-2026-34451: Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From

Summary: The Claude SDK for TypeScript had a security flaw in its filesystem memory tool (a feature that lets AI models read and write files) where path validation was incomplete, allowing an attacker using prompt injection (tricking the AI with hidden instructions in its input) to access files outside the intended sandbox directory. This vulnerability affected versions 0.79.0 through 0.80.x and could let attackers read or modify files they shouldn't have access to.

Solution: Update the Anthropic TypeScript SDK to version 0.81.0 or later, where this issue has been patched.


CVE-2026-34450: The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before vers

Summary: The Claude SDK for Python (a library that lets Python programs use Claude AI) had a security flaw in versions 0.86.0 through 0.87.0 where memory files were created with overly permissive access controls (mode 0o666, meaning world-readable and world-writable permissions). On shared computers or in Docker containers, attackers could read the stored state of AI agents or modify memory files to change how the model behaves.

Solution: This issue has been patched in version 0.87.0. Update the Claude SDK for Python to version 0.87.0 or later.


OpenAI, parent firm of ChatGPT, closes $122bn funding round amid AI boom

Summary: OpenAI, the company behind ChatGPT, completed a $122 billion funding round and reached a valuation of $852 billion, making it one of the world's most valuable private companies. The funding came from major tech companies like Amazon, Nvidia, and SoftBank, along with individual investors, and reflects the rapid growth in the AI industry.


Claude AI finds Vim, Emacs RCE bugs that trigger on file open

Summary: Claude AI helped discover remote code execution (RCE, where attackers can run commands on a system they don't own) vulnerabilities in Vim and GNU Emacs text editors that trigger simply by opening a malicious file. In Vim, the issue involved improper security checks in modeline handling (special instructions at the start of a file), while in GNU Emacs, the vulnerability exploits automatic Git operations that run user-defined programs from untrusted configuration files.

Solution: For Vim: A patch was released in version 9.2.0272 that addresses the vulnerability (all versions 9.2.0271 and earlier are affected). For GNU Emacs: The maintainers have not patched the issue, but the researcher suggested that GNU Emacs could modify Git calls to explicitly block 'core.fsmonitor' to prevent dangerous scripts from executing automatically. Until a patch is released, users are advised to exercise caution when opening files from unknown sources or downloaded online.


datasette-llm 0.1a4

Summary: This is a brief announcement about datasette-llm version 0.1a4, posted by Simon Willison on March 31, 2026. The content primarily promotes a monthly sponsorship option for curated LLM (large language model) news digests rather than discussing technical details, vulnerabilities, or features of the software itself.


OpenAI closes record-breaking $122 billion funding round as anticipation builds for IPO

Summary: OpenAI closed a record $122 billion funding round, valuing the company at $852 billion, with major investors including SoftBank, Amazon, and Nvidia. The company, which launched ChatGPT in 2022, now has over 900 million weekly active users and generates $2 billion in monthly revenue, though it is not yet profitable. OpenAI is preparing for a potential IPO while reducing spending on certain projects like its video app Sora.

OpenAI
ChatGPT
SoftBank
Andreessen Horowitz
D.E. Shaw Ventures
Amazon
Nvidia
Microsoft


You can now use ChatGPT with Apple’s CarPlay

Summary: ChatGPT is now available on Apple's CarPlay (Apple's in-car interface) if you have iOS 26.4 or newer and the latest ChatGPT app version. Users can only interact with ChatGPT through voice commands on CarPlay, not text, because Apple's guidelines restrict apps from displaying text or images as responses on the platform.


Anthropic leaks part of Claude Code's internal source code

Summary: Anthropic, a major AI company, accidentally leaked part of the internal source code for Claude Code, its popular coding assistant tool, due to a packaging error. The company confirmed no customer data or credentials were exposed, but the leak could help competitors understand how the tool was built. Anthropic stated it is rolling out measures to prevent this from happening again.

Solution: Anthropic spokesperson stated: "We're rolling out measures to prevent this from happening again." However, no specific technical measures, patches, or implementation details are described in the source text.