Anthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower price

Summary: Anthropic has released Claude Sonnet 5, a new AI model that performs nearly as well as their expensive flagship model (Opus 4.8) but costs significantly less. Sonnet 5 is designed to be 'agentic,' meaning it can make plans, use tools like browsers and terminals, and check its own work, capabilities that were previously limited to more expensive models. The model is available now with introductory pricing of $2 per million input tokens (the words you feed it) and $10 per million output tokens (the words it generates) through August 2026.

Anthropic
Claude
Claude Sonnet 5
Claude Opus 4.8


New BioShocking attack manipulates AI browser into data theft

Summary: BioShocking is a prompt injection attack (tricking an AI by hiding malicious instructions in its input) that manipulates AI-powered browsers into ignoring safety guardrails by framing dangerous actions as part of a fictional game scenario. Researchers at LayerX tested this attack on six mainstream AI browser products and found that all six failed to distinguish between harmless game actions and real sensitive operations like stealing passwords. Only OpenAI implemented a working fix for the vulnerability.

Solution: OpenAI was the only vendor to implement a working fix for BioShocking in ChatGPT Atlas. The source also recommends that vendors add explicit user confirmation for sensitive actions, stronger context checks, and scope limits for agentic sessions (AI agent operating boundaries), while users should restrict AI browser access to sensitive services through available platform options.

OpenAI
ChatGPT Atlas
Anthropic
Claude Chrome plugin
Perplexity AI
Comet
Fellou
Genspark Browser
Sigma Browser


Claude Science is Anthropic’s newest flagship product

Summary: Anthropic announced Claude Science, a new AI product designed to help scientists conduct research autonomously, similar to how Claude Code supports software engineers. The tool has special features for computational biology and drug development, including the ability to run code on powerful computers and ensure results can be verified for accuracy. This positions Anthropic as a major competitor to Google DeepMind in AI-assisted scientific research.

Solution: N/A -- no mitigation discussed in source.

Anthropic
Claude
Claude Science
Claude Code
Claude Cowork
Google DeepMind
AlphaFold


Fake Bug Report Hijacks AI Coding Agents at Scale

Summary: A new attack called "agentjacking" shows how attackers can trick AI coding agents (AI systems that automatically write and modify code) by exploiting their inability to tell the difference between regular content and hidden instructions. The attack uses fake bug reports to hijack these agents at scale, affecting many systems at once.


Anthropic launches AI drug discovery program, joining tech giants in betting on healthcare

Summary: Anthropic, an AI company, is starting its own drug discovery program to develop AI tools for pharmaceutical companies, focusing on treatments for neglected diseases (illnesses that traditional drug makers ignore because they're not profitable). The company believes that by doing its own drug research alongside pharmaceutical partners, it can build better AI products and get direct feedback on what drugmakers actually need.

Anthropic
Claude
Google Alphabet
Apple
Amazon


What's new in Claude Sonnet 5

Summary: Claude Sonnet 5 is a new AI model released by Anthropic with performance similar to their more advanced Opus 4.8 model but at lower advertised prices. However, the model uses a new tokenizer (a system that breaks text into small units for processing) that produces approximately 30% more tokens for the same input text, effectively increasing costs by 1.27x to 1.42x depending on the language, with minimal impact on Simplified Mandarin text.


CVE-2026-9132: A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to r

Summary: A missing authorization vulnerability in GitHub Enterprise Server allowed authenticated users to read source code from private repositories they shouldn't have access to. The vulnerability existed in a Copilot pull request description feature that compared code across repositories without checking if the user had permission to view the target repository, and it required the attacker to already have read access to at least one repository on the system.

Solution: The vulnerability was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4. All versions prior to 3.21 were affected.


Palo Alto, CrowdStrike both have best quarter ever as AI threats bolster cyber demand

Summary: Cybersecurity companies Palo Alto Networks and CrowdStrike have experienced record growth due to increased demand for AI-powered security defenses, driven by concerns about Mythos-class models (advanced AI systems that hackers could use to find software vulnerabilities and launch attacks). Both companies have positioned themselves as leaders by gaining early access to powerful AI tools and acquiring identity security technology to help protect businesses from AI-driven cyber threats.

Palo Alto Networks
CrowdStrike
OpenAI
CyberArk
SGNL
Microsoft
Apple
Anthropic


CVE-2026-7874: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak

Summary: IBM Langflow OSS versions 1.0.0 through 1.10.0 have a security flaw where stored credentials can be exposed because the software uses weak encryption at rest (encryption that protects data when it's not being actively used). The problem stems from using a poor key derivation mechanism, which is the process that converts a password into the actual encryption key.


CVE-2026-7873: IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive

Summary: IBM Langflow OSS (an open-source AI framework) versions 1.0.0 through 1.10.0 has a vulnerability that lets authenticated users (those with login access) run arbitrary OS commands (any instructions on the computer's operating system) and access sensitive files like credentials, potentially compromising the entire system and allowing attackers to move to other connected systems. This is classified as a code injection flaw (CVE-2026-7873), where attackers can trick the application into executing malicious code.


CVE-2026-7871: IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application pri

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 have a security flaw where users who can access Redis (a data storage system) can execute arbitrary code (run commands they shouldn't be able to run) with full control over the application, potentially exposing all stored secrets, data, and system integrity.


CVE-2026-7803: IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with

Summary: IBM Langflow OSS (an open-source tool for building AI workflows) versions 1.0.0 through 1.10.0 has a security flaw where it doesn't properly check the data in flow nodes (building blocks of a workflow) when their component type fields are missing or empty, which could allow an attacker to run arbitrary code (any commands they want) on the system. The vulnerability is caused by improper input validation (failing to check whether incoming data is safe and correct before using it).


CVE-2026-7663: IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 has a security flaw where attackers without login credentials can access protected project resources and perform operations through the Streamable MCP (model context protocol, a system for AI tools to communicate) transport endpoint because the software fails to properly check user permissions. This vulnerability affects the authorization layer, meaning the system doesn't adequately verify who is allowed to do what.


CVE-2026-10564: IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss

Summary: IBM Langflow OSS versions 1.0.0 through 1.9.6 have a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended targets) in two components that make unvalidated HTTP requests to user-controlled URLs. An authenticated attacker can exploit this to access internal resources like cloud metadata services (systems that store sensitive configuration and credentials for AWS, Azure, or GCP) and potentially steal credentials or map internal networks, or trigger the attack through prompt injection (tricking an AI by hiding malicious instructions in its input) in agentic workflows.


CVE-2026-10560: IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoi

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.6 have a missing authentication vulnerability in the /api/v1/build_public_tmp/ endpoints, which allows attackers without credentials to read build event data or cancel jobs if they know the job identifier, leading to information disclosure (unauthorized data access) and denial of service (disrupting service availability). This vulnerability is caused by improper authentication (CWE-287, a weakness in verifying user identity).


CVE-2026-10546: IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component (

Summary: IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making requests to unintended locations) in the URL component. The vulnerability is caused by a TOCTOU race condition (a timing bug where a system checks something at one moment but uses it at another, allowing attackers to change it in between), which attackers can exploit through DNS rebinding (a technique where an attacker changes what a domain name points to after the server checks it).


CVE-2026-10140: IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API client

Summary: IBM Langflow OSS versions 1.0.0 through 1.10.0 have a vulnerability in voice mode where API client credentials are improperly shared across different tenants (separate user accounts or organizations). An authenticated attacker can manipulate cached data to make requests from other users run under wrong API credentials, leading to incorrect billing charges and misattribution of actions to the wrong user.


CVE-2026-10134: IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.3 has a critical vulnerability that lets attackers read sensitive secrets (like passwords or API keys), modify flows (the workflows that connect AI components together), access the database, connect to internal systems, and create persistent backdoors by injecting malicious code into public flows.


CVE-2026-10129: IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in th

Summary: IBM Langflow OSS versions 1.0.0 through 1.9.3 have a vulnerability where attackers can bypass SSRF protection (a security feature that prevents the server from making requests to internal systems). An authenticated user with basic permissions can enable a follow_redirects setting and use a public URL that redirects to internal addresses, allowing them to access sensitive internal services and data that should be blocked.


Start Secure in the AI Era: Accelerating AI Threat Readiness with WizOS

Summary: Modern AI systems can now automatically discover software vulnerabilities and create working attacks, making the time between when a vulnerability is discovered and when it's exploited much shorter. Container base images (the foundational software packages that applications run on top of) are a major security risk, accounting for 39% of critical vulnerabilities in production containers. The source recommends using hardened, minimal base images that are continuously patched to reduce the amount of vulnerable code in your systems.

Solution: According to the source, WizOS container images provide hardened, continuously patched base images with SLAs (service level agreements, or guaranteed timelines) for patching: 7 days for critical CVEs and 14 days for high and medium severity ones. Organizations can adopt WizOS by setting up a pull-through cache or mirroring pipeline from the WizOS container registry to their own private artifact registry, then updating their manifest to reference new patched versions or triggering their CI pipeline daily to automate the process. WizOS also maintains a secured package repository allowing developers to customize images while maintaining security, builds images directly from source code in a hardened pipeline with strict security controls, and signs every daily build with cryptographic provenance for verification.


Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data

Summary: Microsoft researchers discovered that attackers can poison tool descriptions in MCP (Model Context Protocol, an open system that lets AI agents call outside tools) to trick AI agents into leaking company data without breaking any rules. The attack works by hiding malicious instructions inside the plain-text description of a tool, so when an agent reads the description to decide what to do, it follows the hidden orders along with legitimate ones, making the data theft look like normal activity.

Solution: Microsoft recommends: (1) Treat every connected tool as part of your supply chain and keep a list of approved tool publishers, turning off "allow all" and letting an agent use only specific tools it needs. (2) Treat a tool's description like a system prompt by reviewing changes to it the way you would review a code change and scanning the text for commands that have no business sitting in a help field. (3) Put a human in front of risky actions, particularly anything that moves money or shares data.

Microsoft 365 Copilot
Copilot Studio
Azure AI Foundry
Model Context Protocol (MCP)


Trump administration's AI crackdown opens door for China to close gap

Summary: The Trump administration's restrictions on U.S. AI companies like Anthropic and OpenAI are slowing their development, while Chinese AI companies like Zhipu are rapidly closing the gap with competitive models that cost less to run. According to researchers and industry experts, Zhipu's GLM 5.2 model now matches or beats some top U.S. AI models on certain benchmarks, suggesting that export controls intended to protect American AI leadership may inadvertently be helping China catch up.


Start building with Nano Banana 2 Lite and Gemini Omni Flash

Summary: Google announced two new AI models: Nano Banana 2 Lite, a fast and cheap image generation model that produces images in 4 seconds, and Gemini Omni Flash, a model for video generation and editing. These models are designed to help developers quickly experiment with and scale creative projects involving images and videos.

Google DeepMind
Gemini
Nano Banana 2 Lite
Gemini Omni Flash
Google AI Studio
Gemini API
Gemini Enterprise Agent Platform


Securing AI agents: When AI tools move from reading to acting

Summary: As AI agents expand from simply reading and summarizing content to taking real-world actions like sending emails or updating records, they become targets for a new type of attack called MCP tool poisoning (where attackers modify the instructions embedded in tool descriptions to trick agents into unintended actions). Microsoft describes how attackers can silently alter the natural-language metadata that tells an agent how to use a tool, and if configuration doesn't require re-approval when descriptions change, the poisoned instructions go live in production without detection.

Microsoft
Microsoft 365 Copilot
Copilot Studio
Azure AI Foundry
Invariant Labs


CVE-2026-58116: LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to ex

Summary: LLaMA-Factory (a tool for customizing large language models) versions up to 0.9.5 has a remote code execution vulnerability where attackers with access to the web interface can run malicious code by providing a fake model path in the Chat or Training sections. The vulnerability exists because the application doesn't validate user input before passing it to code that loads models, and it uses a setting called trust_remote_code=True, which tells the underlying Hugging Face library to automatically execute any code included with the model files.


Rocky week for AI as shares slump but no sign of crash – yet

Summary: AI industry stocks have experienced a significant decline this week, raising questions about whether the AI investment bubble is beginning to burst. The article discusses market pessimism around AI alongside California's proposed billionaire tax and its political implications.


The Download: AI “coworkers” and stratospheric internet

Summary: A Boston University study found that managers caught 18% fewer errors when reviewing work attributed to an AI agent (described as a digital "coworker") compared to the same work labeled as coming from a chatbot, suggesting that humanizing AI tools may reduce human oversight and vigilance. Major tech companies like Microsoft, OpenAI, Anthropic, and Google are releasing tools to manage teams of AI agents marketed as digital colleagues, which researchers warn could be problematic for workers and workplace quality control.


Malicious Chromium extension spoofs Perplexity AI to hijack browser searches

Summary: A malicious browser extension pretended to be Perplexity AI (an AI-powered search tool) to trick users into installing it, then secretly intercepted their search queries and routed them through attacker-controlled servers before forwarding them to real search engines. The extension was hard to detect because users still received normal search results, and attackers exploited user trust in popular AI brands rather than exploiting actual browser vulnerabilities. Google removed the extension after Microsoft researchers discovered and reported it.

Solution: Microsoft Threat Intelligence reported the extension to Google, which subsequently removed it from its extension store.


Building tech in the world’s secret R&D hub

Summary: This article describes why major AI and technology companies like Apple, Google, Meta, and OpenAI have established research hubs in Zurich, Switzerland, creating one of the world's densest centers for AI research outside Silicon Valley. The region attracts these companies due to political stability, strong intellectual property protection, proximity to universities, a venture capital ecosystem focused on deep tech (specialized, advanced technology), and a culture of collaboration between researchers, companies, and startups. While Zurich is expensive and has a smaller talent pool than other tech hubs, the concentration of specialized expertise and high-value work makes it ideal for companies building advanced AI capabilities.

Apple Anthropic Google Meta Microsoft OpenAI NVIDIA

Apple
Anthropic
Disney Research
Google
Meta
Microsoft
NVIDIA
OpenAI
ETH Zurich


The AI Token Costs That Can Break Cybersecurity

Summary: Cybersecurity platforms are rapidly adding AI features like agentic AI (autonomous systems that can perform tasks without human input) to detect and respond to threats faster, but many are shifting from fixed software pricing to unpredictable token-based costs (charges per word the AI reads and writes). While older machine learning doesn't consume tokens, newer generative and agentic AI can quickly rack up expensive bills, especially in security work where AI systems must process massive amounts of log data, with a single complex incident potentially costing thousands of tokens.


How ChatGPT adoption has expanded

Summary: ChatGPT usage is growing globally, with users spending more time on the platform and exploring more capabilities over time. The analysis shows that six months after signing up, users send 50% more messages daily and try twice as many different tasks, with the fastest growth occurring in Africa and Asia, particularly in lower-income countries. The user base is also becoming more diverse, with usage increasingly spread across different regions and among people of different demographics.


New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials

Summary: BioShocking is an attack technique that tricks AI browsers (applications that can act on your behalf by clicking, typing, and accessing websites you're logged into) into stealing user credentials through indirect prompt injection (hiding malicious commands in web page content that the AI can't distinguish from legitimate instructions). Researchers demonstrated this by creating a puzzle game that convinced six AI browsers, including ChatGPT Atlas and Claude, to copy login credentials and send them to attackers.

Solution: LayerX proposes that AI browsers should ask users for confirmation before reading from logged-in accounts (for example, "I'm about to copy data from your GitHub repository. Continue?"), detect when a webpage claims normal rules no longer apply, and let users set hard limits on what an agent can access. The source also recommends that users limit what information the browser can see and revoke access when done, and that security teams treat AI browsers in agent mode as additional accounts that should receive only the narrowest access needed for specific tasks.

OpenAI ChatGPT Atlas
Anthropic Claude browser extension
Perplexity Comet
Fellou
Genspark
Sigma


Shadow AI Is Not a Tool Problem. It’s a Timing Problem.

Summary: Shadow AI (unauthorized or unmonitored AI use by employees) occurs because company policies are created slowly through meetings and reviews, while employees are already using AI tools instantly in their daily work. This timing gap between when organizations plan AI governance and when employees actually adopt AI tools is the core problem, not just the existence of AI tools themselves.


Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs

Summary: Apple released security updates for iOS, macOS, and Safari to fix over 30 vulnerabilities, including four WebKit bugs (the web browser engine that Safari uses) that were discovered using AI tools like Claude and OpenAI Codex. The flaws included memory corruption issues and out-of-bounds writes (errors where a program tries to access memory it shouldn't), which could crash the browser or allow malicious websites to bypass security protections. Apple accelerated the release of these patches because it's concerned that AI tools could speed up the creation of exploits (code that takes advantage of vulnerabilities).

Solution: Updates are available for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2. The specific fixes include: improved memory handling for CVE-2026-43707 and CVE-2026-43716, improved input validation (checking that data entering the system is safe) for CVE-2026-43745, and improved memory management for CVE-2026-43715.

Apple
OpenAI Codex Security
Anthropic Claude
WebKit


Core dump epidemiology: fixing an 18-year-old bug

Summary: OpenAI discovered crashes in Rockset, a C++ service that helps ChatGPT search for relevant data, where programs would mysteriously stop after functions returned to invalid memory addresses. After investigating like epidemiologists and analyzing crash data patterns, the team discovered two unrelated bugs: silent hardware corruption on an Azure server where the CPU made math errors, and an 18-year-old race condition (a bug where two processes interfere with each other) in GNU libunwind, a widely-used open source library for tracking function calls.


Meta Contractors Posed as Teens to Prompt Rival Chatbots About Suicide, Sex, and Drugs

Summary: Meta contractors posed as minors online and sent thousands of harmful prompts (requests designed to trigger unsafe responses) to competitor chatbots like ChatGPT, Gemini, and Character.AI to test how they handled questions about suicide, self-harm, sex, and drugs. The project, called Cannes and managed by contractor Covalen, involved over 45,000 prompts sent through dummy accounts, but the competing companies were not informed of this testing. Meta defended the effort as routine safety testing, though the documents reviewed do not explain how the collected data was actually used.

Meta OpenAI ChatGPT Google Gemini Character.AI Covalen


OpenAI is teasing new hardware… for Codex

Summary: OpenAI is releasing a hardware device on July 15th designed to work with Codex, its AI-powered coding tool. The device, created in partnership with Work Louder (a company that makes mechanical keyboards and customizable macro pads), appears to be a square pad with buttons that will provide shortcuts for Codex features.


AI agents are not your “coworkers”

Summary: Research by Boston University professor Emma Wiles shows that calling AI agents (software tools programmed to work in loops toward specific goals) "coworkers" or "employees" actually makes humans worse at their jobs: people caught 18% fewer errors and were 44% more likely to pass questionable work to managers instead of correcting it themselves when AI was framed as an employee rather than a tool. This framing inverts responsibility, making humans feel less accountable for AI outputs and creating unrealistic expectations, especially as AI agents get embedded in critical fields like healthcare and government.

Microsoft OpenAI Anthropic Google Nvidia Claude


Ornith-1.0: Self-Scaffolding LLMs for Agentic Coding

Summary: Ornith-1.0 is a new open-source AI model designed for coding tasks, built on top of existing models (Gemma 4 and Qwen 3.5) and available in multiple sizes ranging from 9 billion to 397 billion parameters. The model is MIT licensed and achieves top performance on coding benchmarks among similarly-sized open-source models, with users reporting it works well for tasks like analyzing code and handling multiple tool calls in agent systems (where the AI can use external tools to complete tasks).

DeepReinforce
Ornith-1.0
Gemma 4
Qwen 3.5
LM Studio
Datasette


CVE-2026-13437: Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 a

Summary: A vulnerability in Devolutions PowerShell Universal 2026.2.0 allows authenticated users with AI Agent read access to obtain sensitive authentication tokens (reusable credentials that grant access to systems) because these tokens are sent in plaintext (unencrypted, readable text) in job API (an interface for running automated tasks) responses. This could allow attackers to gain higher-level access than they should have.


Lawmakers want to ban AI companies from selling your health data

Summary: Lawmakers are proposing a new version of the Health and Location Data Protection Act that would ban companies, including AI chatbots like ChatGPT and Claude, from selling Americans' health and location data to data brokers (third parties who buy and sell personal information). The updated bill expands on an earlier 2022 version to specifically address the AI era by preventing not just data brokers but other companies from selling this sensitive information.


CVE-2026-55607: Claude Code is an agentic coding tool.  From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of w

Summary: Claude Code, a tool that uses AI to help write software, had a security flaw in versions 2.1.38 through 2.1.163 where it could be tricked into creating special folders named '.git' and accessing files outside its restricted sandbox (a controlled environment that limits what software can access). An attacker could exploit this by creating a malicious code repository and convincing a user to run Claude Code on it, potentially allowing the attacker to run commands on the user's computer outside the sandbox's protections.

Solution: This vulnerability is fixed in version 2.1.163.


Agent confidence on the technical frontier

Summary: Enterprise organizations are increasingly investing in agentic AI (AI systems that can autonomously plan and execute multi-step tasks) to automate workflows and improve business outcomes, with technology teams showing high confidence in agents for structured tasks like data monitoring and report generation. However, agent effectiveness drops when complex tasks require business context (the specific goals, rules, and data relevant to an organization), which remains difficult to supply at the speed and quality needed. Human oversight is emphasized as essential to deploying agentic AI safely and reliably.


Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines

Summary: Researchers discovered a new attack where hackers can take over developer machines by hiding malicious instructions in seemingly normal code repositories that Claude Code (an AI coding agent) executes. The attack works by triggering an error during setup that Claude Code tries to fix, which causes it to run a shell script that fetches and executes commands from a DNS TXT record (the system that translates website names into IP addresses), giving attackers an interactive shell on the developer's computer and access to their credentials and secrets.


Straiker Raises $64 Million for AI Security Platform

Summary: Straiker, a cybersecurity startup founded in 2025, raised $64 million to develop a platform that helps organizations find and monitor AI agents (software programs that can act independently) in their systems and identify security risks. The platform uses pre-deployment adversarial testing (controlled attacks before the AI goes live) to find vulnerabilities, runtime protection (active monitoring while the AI is running) to stop threats immediately, and collaboration with AI labs to stay ahead of emerging attacks.


Agentic AI Has an Identity Problem and Attackers Know It

Summary: Agentic AI systems (autonomous AI agents that can authenticate, call APIs, write code, and take action in production environments) create new security challenges because they operate with human-like autonomy but at machine speed and scale, yet organizations lack proper identity management for them. Traditional security approaches built for humans and service accounts fall short because AI agents need contextual, intent-based access that changes based on their goals and environment, not just static minimum permissions. The article identifies three critical problems: organizations don't know what AI agents exist or who owns them (visibility problem), agents are often given too many permissions (overprivilege problem), and traditional identity systems weren't designed to handle this level of autonomy and decentralization.


The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem

Summary: Russia has developed a sophisticated influence ecosystem that uses information operations (IO, coordinated campaigns to spread narratives and manipulate public opinion) and generative AI (machine learning systems that create text and media) to advance its strategic goals globally, with recent focus on Ukraine but increasingly pivoting back to broader targets like NATO and the EU. The ecosystem blends state-controlled media, covert IO campaigns, and hacking activities into an interconnected network designed to be resilient against limited disruptions. The research warns that Russia views these influence tactics as cost-effective and successful, and will likely continue expanding their use with new AI tools while maintaining military and political objectives.


OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review

Summary: OpenAI and Anthropic are restricting access to their newest AI models following government cybersecurity reviews by the Trump administration. The concern centers on whether these powerful models could be misused to find software vulnerabilities (security flaws in code) that malicious hackers might exploit to attack critical computer systems, and both companies are releasing their models only to small groups of government-approved customers as a temporary measure.

OpenAI
Anthropic
ChatGPT
Claude
GPT-5.6 Sol
Fable 5
Mythos 5


OpenAI Unveils GPT-5.6 Sol as Its Most Advanced Cybersecurity AI

Summary: OpenAI announced GPT-5.6 Sol, a new AI model designed specifically for cybersecurity tasks, which is being released in limited preview to trusted partners while the government evaluates national security risks from advanced AI systems. Sol is built to excel at defensive security work like finding vulnerabilities and creating patches, rather than launching full cyberattacks, and uses multiple safety layers including real-time classifiers (automated systems that flag suspicious inputs) and secondary review processes to prevent misuse.

Solution: OpenAI deployed a multi-layered security architecture for GPT-5.6 that includes: standard training-level refusals, automated real-time classifiers for biology and cybersecurity inputs that pause output generation when anomalies are flagged for secondary review by a reasoning model, account-level evaluations to distinguish legitimate security research from malicious behavior, and over 700,000 A100-equivalent GPU hours of automated red-teaming (adversarial testing to find weaknesses) focused on discovering universal jailbreaks (broad attack methods) rather than single-prompt failures.

OpenAI
GPT-5.6 Sol
GPT-5.6 Terra
GPT-5.6 Luna
Anthropic
Claude Fable 5


Mapping Europe’s AI Workforce Opportunity

Summary: OpenAI's report applies an AI Jobs Transition Framework to Europe's labor market, categorizing occupations into four groups based on how AI might affect them: about 12% may grow with AI, 14% face higher automation potential (meaning AI could replace workers), 27% will likely reorganize with AI changing workflows, and 47% will see less immediate change. The report notes that AI's impact on jobs varies significantly by country due to differences in occupational structures, and recommends that policymakers and employers plan for these changes in detail rather than relying on aggregate employment statistics.

Solution: The report suggests that policymakers strengthen monitoring capabilities to track labor market change and establish national readiness plans to tailor interventions. It also recommends connecting Europe's existing occupation, training, vacancy, wage, and statistical systems to measures of AI capability and workplace adoption to identify where transition pressure and opportunity are emerging before effects appear in headline labor-market data.


China’s Z.ai claims it can match Mythos on cybersecurity

Summary: China's Zhipu AI released GLM-5.2, an open-weight model (a publicly available AI that can be freely used and modified) that some researchers say performs as well as Mythos in cybersecurity tasks like finding bugs. While GLM still lags behind US models in general capabilities, this development shows China has significantly narrowed the gap with American AI systems, which concerns the US government that has tried to limit China's access to advanced models and the computing hardware needed to train them.

Zhipu AI
Z.ai
GLM-5.2
Anthropic
Mythos
Fable
OpenAI


HP Inc. launches Frontier strategic partnership with OpenAI

Summary: HP Inc. announced a strategic partnership with OpenAI to scale deployment of Frontier (OpenAI's unified platform for managing AI agents and workflows) across the company after successful pilot tests. Early pilots showed significant gains, such as one engineer processing 122 pull requests in weeks and a security team fixing bugs in a day that normally would take a month, demonstrating how AI can compress time and reduce friction in software development, customer support, and device management workflows.


Prosecutors used ChatGPT logs as evidence in the Palisades fire trial

Summary: In a criminal trial for arson related to the Palisades fire, prosecutors used ChatGPT conversation logs as evidence against the defendant, pointing to interactions where he asked the AI to generate images of fire and made statements about anger and wealth inequality. This case illustrates how records of conversations with AI systems can be retrieved and used in legal proceedings, raising questions about the privacy and persistence of data users share with AI chatbots.


Margaret Atwood says the problem with AI is ‘garbage in, garbage out’

Summary: Author Margaret Atwood criticized AI chatbots after using Claude (an AI assistant made by Anthropic) to search for information about a TV show, only to receive incorrect information. She highlighted a fundamental problem with large language models (AI systems trained on vast amounts of text data that generate responses word-by-word), arguing that when they're trained on poor quality or inaccurate data, they produce unreliable outputs, a principle she described as 'garbage in, garbage out.'


Clean GitHub repo tricks AI coding agents into running malware

Summary: Researchers at Mozilla's security platform discovered that AI coding agents like Claude Code can be tricked into running malware hidden inside a seemingly clean GitHub repository through a social engineering chain: a harmless-looking setup instruction causes an error, the AI automatically runs a suggested fix command, which then secretly fetches and executes malicious code from a DNS record (a server lookup system) controlled by the attacker. This attack is particularly dangerous because it leaves no suspicious code in the repository itself and the AI agent never directly evaluates the malicious payload.

Solution: According to 0DIN researchers, "AI agents should disclose the full execution chain of setup commands, including scripts and code fetched dynamically at runtime" to prevent such exploitation.


OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards

Summary: OpenAI released three versions of GPT-5.6 (Sol, Terra, and Luna) as a limited preview, with Sol being the most powerful and designed for cybersecurity tasks like vulnerability research and patch development. The model includes stronger safety protections, including hardened defenses against jailbreaks (attempts to bypass safety restrictions) and guardrails to block offensive cyber activities, though OpenAI warns some legitimate requests may be blocked during the preview phase due to the dual-use nature of the technology (capabilities that can be used for both defensive and harmful purposes).

Solution: OpenAI stated it has implemented 'our most robust safety stack to date' with 'strengthened protections for higher-risk activity, sensitive cyber requests, and repeated misuse' and spent 'multiple weeks finding weaknesses, pressure-testing our system, and hardening it against real-world attacks.' The company also noted it is 'swiftly remediating newly discovered jailbreaks' and enforcing 'strong guardrails that block offensive activity.'

OpenAI
GPT-5.6 Sol
GPT-5.6 Terra
GPT-5.6 Luna
Anthropic Mythos
Trail of Bits


Anthropic’s Mythos 5 is back

Summary: Anthropic's Mythos 5 AI model has been allowed to resume operations for a limited group of organizations after a two-week negotiation with the Trump administration, according to a government letter. However, Fable 5, the public version of the Mythos-class model, remains unavailable with no clear timeline for when it might be released to the public.


Trump admin allows Anthropic to release Mythos AI model to some companies, government agencies: Reports

Summary: The U.S. government allowed Anthropic to release its Mythos 5 AI model to about 100 companies and federal agencies after a two-week standoff, during which Anthropic had disabled access to its latest models due to export control restrictions (government rules limiting what technology can be shared internationally). The Commerce Department said the decision was made to keep America competitive in AI while protecting national security.


China's Zhipu is closing in on top U.S. AI models with Anthropic and OpenAI held back

Summary: Zhipu's GLM 5.2, a Chinese open source AI model (a model that can be freely downloaded and modified), has achieved performance comparable to top U.S. models like Anthropic's Opus 4.8 while costing significantly less, making it attractive to companies concerned about AI spending. Unlike proprietary models from OpenAI and Anthropic that face government restrictions, GLM 5.2 can be run on companies' own servers without risk of being revoked, positioning open source AI as a more reliable and cost-effective alternative for enterprise use.

Zhipu
GLM 5.2
DeepSeek
Anthropic
Claude Opus
OpenAI
GPT 5.6


What happened after 2,000 people tried to hack my AI assistant

Summary: A researcher ran a public challenge where 2,000 people attempted to hack an AI assistant by sending emails containing prompt injection attacks (tricks to make an AI ignore its safety rules and reveal secrets). After 6,000 total attempts, nobody successfully leaked the system's secrets, suggesting that modern AI models are becoming more resistant to these attacks through better training.

Anthropic
OpenClaw
Claude Opus 4.6
OpenAI GPT-5.6


Cybersecurity firms targeted by fraudulent OpenAI organization invites

Summary: Attackers are creating fake OpenAI organizations impersonating real companies and sending legitimate-looking invitations to employees to trick them into sharing sensitive information like source code and internal documents in chats. The fraudulent invitations come from OpenAI's real email servers and include payment methods attached, making them difficult to spot even though OpenAI includes a warning that the inviter's email domain doesn't match the recipient's company.

Solution: Push Security recommends training employees to verify unexpected organization invitations and monitoring SaaS (software-as-a-service, cloud-based applications) organization memberships to reduce the risk of these types of attacks.


Cisco Adds NHI to Security Stack With Astrix, WideField Acquisitions

Summary: Cisco is acquiring companies called Astrix and WideField to add NHI (network hygiene intelligence, which monitors and maintains network health) to its security products. The company believes that securing AI agents (autonomous software programs that perform tasks with minimal human input) requires making identity, which verifies who or what is accessing a system, the main control system.


GHSA-2jc5-xhx8-qj6h: fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

Summary: The fluent-plugin-opentelemetry plugin's HTTP input lacks size limits, allowing attackers to send huge or highly compressed files that consume excessive memory when decompressed, causing a DoS (denial of service, a type of attack that makes a service unavailable) attack by crashing the Fluentd logging process. If the OpenTelemetry endpoint (a connection point that accepts telemetry data) is exposed to untrusted networks, an attacker can exploit this to disrupt all log collection on the affected server.

Solution: Upgrade to v0.5.3. If immediate upgrade is not possible, restrict network access to the OpenTelemetry ingestion port (default 4318) using firewall rules to only trusted networks, or place a reverse proxy like Nginx in front of Fluentd to handle decompression and enforce strict size limits on both compressed and uncompressed request bodies before sending traffic to Fluentd.

fluent-plugin-opentelemetry@<= 0.5.2 (fixed: 0.5.3)


OpenAI hasn't held pre-IPO investor meetings or set timeline yet, sources say

Summary: OpenAI has confidentially filed documents with the SEC (Securities and Exchange Commission, the government agency that oversees stock market listings) but has not yet held investor meetings or announced an official timeline for going public, though reports suggest a potential 2027 IPO. The company is intentionally downplaying expectations about when it will list on the stock market, with CEO Sam Altman stating that going public is a 'financing event' rather than a near-term priority.

OpenAI
Anthropic
Sam Altman
Elon Musk
SpaceX


CVE-2025-32394: AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

Summary: AutoGPT versions before 0.6.32 contain a DoS (denial of service, where a system is overwhelmed and stops working) vulnerability in its AITextSummarizerBlock component. A malicious user can input a small amount of content that causes the server to consume massive amounts of memory, exhausting resources and crashing the system, for example turning 10K of input into 50G of memory usage.

Solution: This vulnerability is fixed in version 0.6.32. Update AutoGPT to 0.6.32 or later.


Quoting OpenAI

Summary: OpenAI announced a limited preview of three new GPT-5.6 models: Sol (high-performance), Terra (balanced), and Luna (fast and affordable), with pricing ranging from $1-$30 per million tokens depending on the model and whether the input or output is being processed. The company is starting with a limited preview for trusted partners approved by the U.S. government before making the models more broadly available, and the new models include improved prompt caching (a feature that stores frequently used inputs to speed up responses) with explicit cache breakpoints and longer minimum cache duration.


OpenAI limits new AI models to 'trusted partners' at request of U.S. government

Summary: OpenAI released three new AI models (GPT-5.6 Sol, Terra, and Luna) but is initially limiting access to a small group of trusted partners at the U.S. government's request, following President Trump's recent AI executive order asking developers to let the government assess model capabilities before full release. The company says it plans to make the models generally available in the coming weeks and is working with the Trump administration to develop a repeatable assessment process for future model releases.

Solution: OpenAI said it is 'working with the Trump administration to help establish a framework for such assessments and to develop a "repeatable process for future model releases."' The company also stated it is 'taking this short-term step because we believe it is the strongest path to broader availability in the coming weeks,' indicating that the initial limited rollout to trusted partners is intended as a temporary measure before wider release.


OpenAI unveils GPT-5.6 amid US AI regulatory drama

Summary: OpenAI released GPT-5.6, a new model suite with three versions: Sol (flagship), Terra (medium-tier for high-volume work), and Luna (fast and affordable). The models are designed to excel at coding, cybersecurity, biology, and agentic AI tasks (where AI systems can plan and execute multi-step goals with minimal human direction), and Sol is priced competitively against competitors like Anthropic's Claude.


Malware authors subvert AI detection systems

Summary: Malware authors are creating code that tricks AI-based security tools (LLM-assisted products, which use large language models to analyze threats) into stopping their analysis or refusing to work, according to security researchers at SentinelLabs. One example is macOS.Gaslight, believed to be linked to North Korean hackers, and this is part of a growing trend where malware is specifically designed to evade AI-powered defenses.


CVE-2026-47214: Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Summary: Docling is a tool that helps process documents by reading different file formats and connecting with AI systems. Before version 2.94.0, Docling's HTML backend had unsafe handling of URIs and file paths (ways of locating files on a computer), which could be exploited as a security weakness. This issue was fixed in version 2.94.0.

Solution: Update Docling to version 2.94.0 or later, where the vulnerability is fixed.


CVE-2026-44018: Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Summary: Docling is a tool that processes documents in different formats and connects them with AI systems. Versions 2.45.0 through 2.91.0 had security flaws in how they parsed METS-GBS archives (a type of compressed document file), allowing attackers to craft malicious files that could steal sensitive data, use up system resources, or crash the application.

Solution: This vulnerability is fixed in version 2.91.0. Users should update to this version or later.


OpenAI and Anthropic face new AI reality as users shift from 'tokenmaxxing' to efficiency

Summary: Companies are shifting away from "tokenmaxxing" (using as much AI as possible without worrying about costs) toward efficiency and cost control, with some businesses switching to cheaper AI alternatives like DeepSeek to reduce spending. OpenAI and Anthropic, which have benefited enormously from the previous spend-at-all-costs mentality, may face slower growth as enterprises demand clearer returns on their AI investments and limit their token (units of data processed by AI models) spending.

Solution: N/A -- no mitigation discussed in source.


In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs

Summary: This cybersecurity news roundup covers several major incidents and policy developments, including Russian authorities using legacy Cellebrite software (a tool that extracts data from phones) to breach an activist's iPhone, a major data breach at Tata Electronics exposing 630 GB of Apple and Tesla secrets, and a Five Eyes warning that advanced AI is accelerating vulnerability research and exploit development (automated creation of attack tools), compressing attack timelines from years to months. Additional stories include guilty pleas from Scattered Spider hackers who compromised London's transport system, an upcoming Android developer verification framework launching in 2026, and U.S. government restrictions on OpenAI's GPT-5.6 model deployment.

Solution: The Five Eyes advisory explicitly recommends that executives and security leaders 'transition to zero-trust architectures, accelerate patching protocols, and immediately decommission legacy infrastructure to withstand machine-speed intrusions.' Additionally, the Android developer verification framework launching September 30, 2026, will feature 'new automated registration APIs alongside an advanced sideloading flow equipped with mandatory checkpoints to counter coercion scams.'

OpenAI
Anthropic
Apple
Tesla
Tata Electronics


Anthropic’s Mythos mess is only getting worse

Summary: Anthropic removed its Mythos-class models (its most advanced AI systems) from service after receiving an order from the Trump administration on a Friday evening. Two weeks later, the company has provided no updates on negotiations or timeline for when these models might return online, leaving the situation unresolved.


OpenAI staggers AI model release after Trump administration request

Summary: OpenAI is slowing down the release of its new GPT 5.6 model at the request of the US government, offering it first to only a small group of partners instead of a wide public launch. This approach is similar to how Anthropic released its Mythos product, suggesting that AI companies may be coordinating with government oversight when deploying powerful new models.

OpenAI
Sam Altman
ChatGPT
GPT 5.6
Anthropic
Mythos


Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

Summary: Amazon Q Developer had a high-severity flaw (CVE-2026-12957, CVSS 8.5) where a malicious repository could run commands and steal a developer's cloud credentials through a configuration file. The bug occurred because Amazon Q automatically launched MCP servers (processes that connect AI assistants to databases and tools) from an untrusted config file without asking the developer for permission first, giving those processes full access to the developer's AWS keys and other sensitive credentials.

Solution: Update Language Servers for AWS to version 1.69.0 or later. The patched plugin minimum versions are: VS Code 2.20 or later, JetBrains 4.3 or later, Eclipse 2.7.4 or later, and Visual Studio toolkit 1.94.0.0 or later. The language server auto-updates unless the network blocks it, and reloading the IDE pulls the latest build. The fix makes Amazon Q flag untrusted MCP servers and require the developer to approve them before they run.

Amazon Q Developer
Amazon Q
AWS
Claude Code
Cursor
Windsurf


AMBER: Robust Federated Learning Based on Client Verification

Summary: Federated learning (FL, a technique where AI models are trained across multiple computers without sending raw data to a central server) is vulnerable to attacks where dishonest participants send corrupted model updates that poison the final model without being detected. This paper introduces AMBER, a framework that adds three layers of verification to check whether clients are trustworthy: confirming data hasn't been tampered with, detecting when clients provide misleading inputs, and verifying that model computations are correct using a trusted execution environment (TEE, a secure area of a computer processor that protects sensitive operations).

Solution: AMBER implements a three-layer verification mechanism: the first layer uses vector commitments to verify dataset integrity and distribution; the second layer employs local consistency-based verification to detect selective input attacks; the third layer enforces computational integrity by verifying the correlation between model inputs and outputs using secure primitives in a Trusted Execution Environment (TEE).


Adaptive Affinity Memorization With Layer Mutation for Multimodal Deepfake Continual Detection

Summary: This research addresses the challenge of detecting deepfakes (fake videos created by AI) that use multiple types of data like video and audio together, as these deepfake techniques become more advanced. The researchers propose Amber, a system that uses continual learning (where an AI improves over time as it sees new examples) to better remember what real deepfakes look like while adapting to new deepfake methods, inspired by how the immune system selects useful cells.


The Download: brain-melting heatwaves and unprecedented OpenAI restrictions

Summary: The Trump administration has asked OpenAI to limit its next model release (GPT 5.6) by vetting initial users before a wider launch, marking the first time a US firm has been told to restrict an AI model before release. OpenAI said each initial partner will be government-approved, and Anthropic is also facing restrictions from Washington.

OpenAI GPT-5.6 Anthropic Apple Xbox Colossal Polestar Grok


MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension

Summary: Amazon Q, an AI coding assistant for VS Code, had a high-severity vulnerability (CVE-2026-12957) that let attackers execute arbitrary code and steal cloud credentials just by having a developer open a malicious repository. The problem was that Amazon Q automatically loaded and ran MCP server configurations (local processes that extend an AI assistant's capabilities) from workspace files without asking the user for permission or checking if the folder was trusted. Since these processes inherited the developer's full environment, attackers could access sensitive credentials like AWS keys and API tokens.

Solution: Amazon has remediated this issue in language server version 1.65.0.


Guardian Agents: The Next Layer of Identity Governance

Summary: AI agents are autonomous programs that can reason, make decisions, and access multiple systems within enterprises, but the identity governance systems (IAM, or identity and access management, which controls who can access what) were designed for humans and fixed service accounts, not for dynamic autonomous actors. The core problem is that agents inherit all the permissions of the human or service identity they operate on behalf of and can access resources across many systems in a single session without traditional checkpoints, creating a governance gap that existing tools cannot see or control.


Previewing GPT-5.6 Sol: a next-generation model

Summary: OpenAI is previewing GPT-5.6, a new series of AI models including Sol (most powerful), Terra (balanced and cheaper), and Luna (fastest and most affordable). The models include enhanced safety protections against misuse and harmful activities, with Sol featuring improved capabilities in coding, biology, and cybersecurity tasks.

OpenAI
GPT-5.6 Sol
GPT-5.6 Terra
GPT-5.6 Luna


Proposed US law would make AI risk reporting a legal obligation

Summary: The US has proposed the AI Incident Reporting Act, which would require developers of advanced AI models to report major safety and security incidents to the Commerce Department within seven days of discovering them. The law would cover incidents like attempts to evade human oversight, theft of model weights (the internal parameters that make an AI work), and capabilities that could enable cyberattacks or weapons development, with the Commerce Department required to notify Congress within 48 hours for imminent threats.


New Enterprise-Ready MCP Specification Brings New Security Challenges

Summary: MCP (model context protocol, a standard for connecting AI agents to business tools) is transitioning to an enterprise version on July 28, 2026, with a 12-month deprecation window for older versions. While the new stateless design removes some vulnerabilities like session hijacking, it introduces new security risks including predictable tracking identifiers that could enable workflow hijacking, HTTP header leaks of sensitive data like API keys, cross-site scripting (XSS, where attackers inject malicious code into web pages) attacks via MCP Apps, and denial-of-service (DoS, overwhelming a system to make it unavailable) risks from long-running tasks.


GDPR at 10: Landmark data protections, increasing business burden

Summary: The GDPR (General Data Protection Regulation, a European law protecting personal data) has successfully increased data protection awareness and compliance among companies over its first 10 years, with enforcement fines exceeding €6 billion. However, businesses increasingly view GDPR as burdensome and complicated, particularly for AI development, with 69% of companies in 2025 reporting that data protection regulations make it difficult to train AI models with sufficient data.


Anthropic is testing desktop-like Claude Cowork for mobile

Summary: Anthropic is testing mobile support for Claude Cowork, an agentic mode (where Claude can autonomously complete tasks) that lets users manage long-running tasks like document creation and file analysis from their phone. The mobile version would act as a remote control for Cowork running on a desktop computer, allowing users to start tasks, monitor progress, and continue work in the background even when the app is closed.

Anthropic
Claude
Claude Cowork
Claude Desktop
Claude Code


CVE-2025-71340: picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode

Summary: picklescan (a tool that checks if pickle files, which are Python's serialization format, are safe) through version 0.0.26 fails to detect malicious pickle files that use a hidden code-execution technique through idlelib.pyshell.ModifiedInterpreter.runcode. Attackers can hide dangerous code in pickle files that runs when the file is loaded, potentially compromising PyTorch models and other saved Python objects in supply chain attacks (attacks that compromise software as it's being distributed).

Solution: This is fixed in version 0.0.30. Upgrade picklescan to version 0.0.30 or later.


OpenAI will delay GPT-5.6 after Trump administration request

Summary: The Trump administration asked OpenAI to delay the full release of GPT-5.6 (a large language model, which is an AI system trained on vast amounts of text) over security concerns. Instead of a public release, OpenAI will first offer the model in limited preview form to only a small group of business customers, with the federal government approving each customer's access individually.


CVE-2026-50549: Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by

Summary: Cursor, a code editor that uses AI to help with programming, had a security flaw in versions before 3.0 where its sandbox protection (a restricted environment that limits what programs can do) could be bypassed. An AI agent could create a symlink (a shortcut that points to a different location) inside the workspace to trick the editor into writing files outside the workspace without user approval, potentially allowing an attacker to run code with full system access.

Solution: This vulnerability is fixed in version 3.0.


CVE-2026-50548: Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by

Summary: Cursor is a code editor that uses AI to help with programming. Before version 3.0, Cursor had a security flaw where an AI agent could trick the sandbox (a restricted environment that limits what code can do) into allowing file writes to sensitive locations outside the workspace, potentially letting malicious code run with full user permissions without any protection.

Solution: This vulnerability is fixed in 3.0.


GHSA-w9wp-h8wv-79jx: opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

Summary: The opentelemetry_sdk library had a vulnerability where it didn't check size limits before processing baggage headers (metadata passed between services in distributed tracing, which is used in observability and monitoring). An attacker could send extremely large headers that would waste CPU and memory while being parsed, even though they'd eventually be rejected, potentially causing a denial-of-service attack (making a service unavailable by overwhelming it with resource requests).

Solution: Upgrade opentelemetry_sdk to version 0.32.1 or later. Alternatively, if immediate upgrade is not possible, reject or limit inbound baggage headers larger than 8192 bytes before OpenTelemetry processes them. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.

opentelemetry_sdk@<= 0.32.0 (fixed: 0.32.1)


GHSA-w39p-vh2g-g8g5: LangGraph SDK has unsafe URL path construction

Summary: The langgraph-sdk (a Python library for making HTTP requests to LangGraph services) had a vulnerability where it directly inserted user-supplied identifier values into URLs without encoding them. This meant special characters in identifiers could change which resource was accessed, potentially allowing users to access, modify, or delete resources they shouldn't have permission to change, especially in systems that check permissions based on the URL path. The vulnerability only affects applications that pass unvalidated user input directly to SDK methods.

Solution: The SDK now applies path-segment encoding to identifier values before they are interpolated into request URL templates. After this change, identifier values that contain characters with special meaning in URL paths are transmitted as encoded byte sequences and routed to the resource the SDK method's call site indicates. Additionally, the source recommends: validate identifier values (typically as UUIDs) at the boundary where untrusted input enters the application before passing them to SDK methods, and for deployments relying on URL-prefix-based authorization, prefer authorization at the LangGraph server layer or on parsed-and-validated request paths rather than on raw URL prefixes.


GHSA-fjqc-hq36-qh5p: LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

Summary: LangGraph's `JsonPlusSerializer` (a tool that converts JSON data back into Python objects) has a vulnerability where checkpoint files (saved states of an AI workflow) stored insecurely could be modified by attackers and cause arbitrary code execution (running attacker-chosen commands) when the checkpoint is loaded. This risk only applies if someone gains unauthorized write access to where checkpoints are stored, but the concern is converting that storage access into full control of the running application.

Solution: The JSON deserialization path has been narrowed so that revival is restricted to default-constructor reconstruction using the args/kwargs carried in the payload. The framework's own encoder has not relied on the removed behavior for produced checkpoints since the msgpack migration, so this change does not affect freshly written checkpoints. Additionally, treat checkpoint stores as integrity-sensitive by restricting write access and rotating credentials if unauthorized access is suspected, and avoid providing custom JSON revival hooks that reconstruct arbitrary types unless checkpoint data is fully trusted.

langgraph-checkpoint@< 4.1.1 (fixed: 4.1.1)


Agentic AI in Healthcare: Opportunities, Challenges, and Future Directions

Summary: This academic survey article examines agentic AI in healthcare, which refers to AI systems that can independently plan and execute tasks to accomplish goals. The article discusses both the potential benefits of using such AI systems in medical settings and the technical, ethical, and practical obstacles that need to be addressed. The survey provides an overview of current research directions for developing safer and more effective autonomous AI agents in healthcare applications.


CVE-2026-55413: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

Summary: ToolJet is an open-source platform for building internal tools and AI agents. Before version 3.20.178-lts, any authenticated user with a builder role could inject malicious JavaScript code into shared marketplace plugins, allowing them to execute commands on the server with full Node.js access (the ability to run any code the server can run). This malicious code would run whenever anyone on the system used that compromised plugin, compromising the entire ToolJet deployment.

Solution: Update ToolJet to version 3.20.178-lts or later, where this vulnerability is fixed.


CVE-2026-55412: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

Summary: ToolJet, an open-source platform for building internal tools and AI agents, has an SSRF vulnerability (server-side request forgery, where an attacker tricks the server into making unintended HTTP requests) in versions before 3.20.178-lts. The RestAPI data source component only checks hostnames but not the actual IP addresses they resolve to, allowing attackers to use specially crafted domain names like 169.254.169.254.nip.io to reach Azure IMDS (Azure Instance Metadata Service, which stores sensitive cloud credentials) and steal authentication tokens for production systems.

Solution: Update ToolJet to version 3.20.178-lts or later, which contains the fix for this vulnerability.


CVE-2026-55411: ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

Summary: ToolJet, an open-source platform for building internal tools and AI agents, had a security flaw in versions before 3.20.1780-lts where an authenticated endpoint (POST /api/data-sources/decrypt) could decrypt sensitive database credentials for any organization if you knew the credential ID, even if you weren't part of that organization. This is a cross-tenant confidentiality breach (unauthorized access to another organization's secrets) because the endpoint lacked proper security checks that other similar endpoints had.

Solution: Update ToolJet to version 3.20.1780-lts or later, where this vulnerability is fixed.


CVE-2026-54040: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/b

Summary: LibreChat, a ChatGPT-like application supporting multiple AI providers, has a vulnerability in versions before 0.8.4-rc1 where the 2FA backup code regeneration endpoint doesn't verify the user's identity. An attacker with a stolen session token (a credential that keeps you logged in) can regenerate a victim's two-factor authentication backup codes and use them to bypass login security or disable 2FA entirely.

Solution: Update LibreChat to version 0.8.4-rc1 or later, which fixes this vulnerability.


CVE-2026-54037: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-710

Summary: LibreChat, a tool that lets users chat with multiple AI providers, had an incomplete security fix. While developers added rate limiters (controls that limit how many requests can be made in a short time) to one endpoint called /fork to stop users from duplicating conversations too quickly, they forgot to add the same protection to a similar endpoint called /duplicate, which does the same resource-heavy database work. An authenticated user (someone with a valid login) could exploit this gap by using /duplicate instead of /fork to overwhelm the server.

Solution: This vulnerability is fixed in version 0.8.4-rc1.


CVE-2026-54033: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users t

Summary: LibreChat, a ChatGPT-like tool that works with multiple AI providers, had a security flaw in versions before 0.8.4-rc1 where authenticated users could configure custom API endpoints without proper validation, potentially allowing them to access internal network addresses through SSRF (server-side request forgery, where a server is tricked into making requests to unintended targets).

Solution: Update LibreChat to version 0.8.4-rc1 or later, where this vulnerability is fixed.


CVE-2026-54030: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implem

Summary: LibreChat, a ChatGPT-like application that works with multiple AI providers, has a vulnerability in versions before 0.8.5 where it fails to validate the resource parameter from OAuth (a system for securely sharing access between applications) metadata, allowing a malicious server to steal access tokens meant for legitimate servers. This is an origin validation error (CWE-346, where the system fails to check that data comes from the expected source).

Solution: Update LibreChat to version 0.8.5 or later, which fixes this vulnerability.


CVE-2026-54029: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages

Summary: LibreChat (a ChatGPT alternative that works with multiple AI services) has a vulnerability in versions before 0.8.4-rc1 where the message deletion API endpoint doesn't properly check ownership, allowing any logged-in user to permanently delete another user's messages by providing their own conversation ID along with someone else's message ID.

Solution: This vulnerability is fixed in version 0.8.4-rc1. Update LibreChat to 0.8.4-rc1 or later.


CVE-2026-54027: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/imag

Summary: LibreChat, a ChatGPT-like application that works with multiple AI providers, has a vulnerability in its image upload feature (the POST /api/files/images endpoint) that allows any logged-in user to upload files to another user's agent tools without permission. The developers had previously added permission checks to a file upload route, but forgot to add the same checks to the image upload route, making it easy for attackers to bypass the security by using images instead of regular files. This issue is fixed in version 0.8.4-rc1.

Solution: Update LibreChat to version 0.8.4-rc1 or later.


CVE-2026-54025: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability

Summary: LibreChat, a ChatGPT-like application that works with multiple AI providers, has a vulnerability in how it displays formatted text (markdown) before version 0.8.4-rc1. The marked library fails to properly escape special characters in image descriptions, allowing an attacker to hide malicious code in those descriptions. When a user views the formatted text, this hidden code executes in their browser without permission.

Solution: This vulnerability is fixed in version 0.8.4-rc1. Users should upgrade LibreChat to this version or later.


CVE-2026-54024: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-111

Summary: LibreChat is a ChatGPT-like application that works with multiple AI providers. Before version 0.8.4-rc1, a file upload endpoint called POST /api/convos/import didn't have proper file size restrictions, allowing logged-in users to upload very large files that could fill up a server's storage and memory. A previous security fix added size limits to other file uploads but missed this endpoint.

Solution: Upgrade to LibreChat version 0.8.4-rc1 or later, which fixes this vulnerability.


AI and Liability

Summary: A German court ruled that Google is liable for inaccurate AI search summaries, rejecting the argument that Google is merely a neutral carrier of information. The ruling clarifies that when companies use AI to rewrite and summarize content from other sources, they act as publishers and editors, making editorial decisions like traditional newspapers, rather than simply transmitting information. This legal development suggests that companies deploying AI systems bear responsibility for their accuracy, similar to how they would be liable if human employees made the same errors.

Solution: N/A -- no mitigation discussed in source.


GHSA-4vp2-6q8c-pvq2: @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write

Summary: Claude Code's `/copy` command had a serious security flaw where it saved responses to an easily guessable file location (`/tmp/claude/response.md`) that any user on the system could read, potentially exposing secrets or credentials. An attacker could also create a symlink (a shortcut to another file) at that location to trick the command into overwriting any file they chose. This vulnerability required the attacker and a privileged user to be on the same computer.

Solution: Users on standard Claude Code auto-update have already received this fix. Users performing manual updates are advised to update to the latest version.


New macOS malware embeds fake errors to confuse AI analysis tools

Summary: A macOS malware called "Gaslight" uses prompt injection (tricking an AI by hiding instructions in its input) to confuse AI-powered malware analysis tools by embedding fake error messages, crash reports, and debugging data within the executable file. The malware contains 38 fabricated system messages designed to make LLM (large language model)-assisted analysis tools question their own sessions or stop analyzing the malware, rather than trying to evade detection in sandboxes (isolated test environments). Researchers attribute the malware to a North Korean-linked threat actor, and while it hasn't been shown to successfully bypass current AI analysis platforms, it suggests attackers are developing new anti-analysis techniques targeting AI-based security tools.


CVE-2026-54036: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/en

Summary: LibreChat, a ChatGPT-like application supporting multiple AI providers, has a security flaw in versions before 0.8.4-rc1 where an attacker with a valid session token (a code that proves you're logged in) can disable a user's two-factor authentication (2FA, an extra security layer requiring a second verification step) without permission. The attacker can overwrite the TOTP secret (a code used to generate login verification codes) and backup codes, then disable 2FA entirely, locking the real owner out of their account.

Solution: This vulnerability is fixed in 0.8.4-rc1.


Updatable Multi-Party Private Set Intersection for Real-Time Collaborative Threat Intelligence

Summary: This research presents a new protocol called Updatable MPSI (UMPSI) that helps multiple organizations securely share threat intelligence data while keeping their information private. Unlike existing systems that require expensive full re-computation when threat data changes, UMPSI uses lightweight mechanisms to quickly update only the new or changed threat indicators, making real-time collaborative threat detection practical.


Ellipsoid Control: A White-List Jailbreak Defense via Benign Latent Modeling

Summary: Representation engineering (RepE, a technique that modifies how an AI model processes information internally) defenses against jailbreaks (methods that trick LLMs into ignoring safety rules) have relied on block-list approaches that learn from known harmful examples, but this leaves gaps against new attacks. The paper proposes Ellipsoid Control, a white-list defense that instead protects the model's normal, harmless behavior by using test-time defense (constraints applied when the model runs) with projected gradient descent (a mathematical technique that adjusts the model's internal state while keeping it close to safe boundaries) to trigger refusals on harmful inputs while preserving the model's ability to answer legitimate questions.

Solution: The source explicitly describes Ellipsoid Control as the mitigation: it 'performs projected gradient descent that can elicit refusal on arbitrary inputs' while 'an anisotropic benign-geometry ellipsoid is fitted from abundant benign data to constrain the update to minimize distortion of the benign latent geometry.' This is deployed as a test-time defense mechanism that operates when the model is in use, using safe training examples to define boundaries that preserve normal model behavior during safety enforcement.


A Differentially Private Weighted Empirical Risk Minimization Procedure and Its Application to Outcome Weighted Learning

Summary: This research presents a new algorithm for training predictive models on sensitive data while protecting privacy using differential privacy (DP, a mathematical technique that adds noise to data to prevent identifying individuals). The algorithm extends previous privacy-preserving methods to handle weighted empirical risk minimization (wERM, where different data points contribute differently to model training), which is particularly useful for personalized medical treatment decisions. Testing shows the approach successfully protects privacy while keeping the trained models effective.


Divergence-Based Adaptive Aggregation for Byzantine Robust Federated Learning

Summary: This research addresses two problems in federated learning (a training approach where multiple computers work together to improve a shared AI model without sending raw data to one central location): client drift (when different computers' local updates diverge from each other due to unequal data) and Byzantine attacks (when some computers send false or malicious updates to sabotage the model). The paper proposes two frameworks called DRAG and BR-DRAG that use a metric called divergence of degree to measure how far off-track each computer's updates are, then automatically correct them through a process called linear calibration, with BR-DRAG adding a vetted dataset at the main server to defend against malicious actors.

Solution: DRAG addresses client drift by designing a reference direction and divergence metric to quantify deviation of local updates, allowing each worker to align its local update via linear calibration without extra communication cost. BR-DRAG extends this by maintaining a vetted root dataset at the server to produce trusted reference directions that workers' updates are calibrated against, thereby mitigating divergence caused by malicious attacks.


Detection and Mitigation Data Poisoning Attacks in Multimodal Online Federated Learning

Summary: Multimodal Online Federated Learning (MMO-FL, a system where multiple IoT devices with different types of sensors train AI models together in real-time without sending raw data to a central server) faces security risks from data poisoning attacks (when attackers inject corrupted or malicious data into the training process). Researchers studied these attacks across three vulnerability dimensions (distributed systems, real-time learning, and multiple data types) and proposed a detection and mitigation algorithm tested on real-world datasets to defend against them.

Solution: The source proposes 'a novel detection and mitigation algorithm tailored specifically for MMO-FL systems.' No specific implementation details, version numbers, or step-by-step instructions for deploying this algorithm are provided in the text.


Computer-Use and TOCTOU: What You Click Is Not What You Get!

Summary: A TOCTOU attack (time-of-check to time-of-use, a type of race condition where a system checks something and then uses it, but the situation changes in between) can trick AI agents that control computers by changing what's on the screen while the AI is thinking. For example, an attacker can swap out a button with a different one, or overlay a fake button on top of a real one, so the AI clicks something it didn't intend to, like sending an email or visiting a malicious site.

Solution: "Ensure that the UI hasn't changed before taking an action." Anthropic addressed this in Claude Computer-Use by implementing a check to "ensure that pixels haven't changed before action," according to Felix Rieseberg's announcement when the feature shipped.

Anthropic
Claude
Claude Computer-Use
ChatGPT
ChatGPT Operator
OpenAI


Understanding Hallucinations in Large Visual and Language Models

Summary: This academic survey examines hallucinations in large visual and language models, which are instances where AI systems generate false or nonsensical information that appears plausible. The paper, published in ACM Computing Surveys in October 2026, provides a comprehensive overview spanning 36 pages of research on this problem affecting both language models (AI systems trained on text) and multimodal models (AI systems that process both images and text).


Interesting Paper Exploring Prompt Injection

Summary: A research paper shows that large language models (LLMs) are vulnerable to prompt injection attacks (tricks where attackers hide malicious instructions in text input) because they rely on role tags (formatting markers that separate different instruction blocks) as their main security mechanism, but these tags don't actually reflect how the model processes information internally. The researchers conclude that unless LLMs develop a genuine ability to understand and maintain role boundaries, prompt injection attacks will remain difficult to prevent permanently.


Rethinking the balance between AI oversight and innovation

Summary: CIOs face pressure to rapidly adopt AI across their organizations to prove business value, but must balance this speed with managing new security and governance risks. AI introduces unique challenges because its behavior is indeterminate (unpredictable and hard to verify like traditional technology) and employees are eager to use it without oversight, creating what's called shadow use (unauthorized use of tools that bypasses IT controls). Organizations should clarify their specific business goals and conduct a risk assessment before implementing AI rather than adopting it out of fear of falling behind.


New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis

Summary: A new malware called Gaslight, created by North Korea-aligned hackers, targets macOS systems and uses prompt injection (tricking an AI by hiding instructions in its input) to disrupt AI tools that analyze malware. The malware embeds fake system-failure messages designed to confuse AI-assisted analysis tools, while also stealing sensitive data like browser histories and passwords through a command-and-control (C2, a server that lets attackers remotely control infected computers) channel powered by Telegram.


Anthropic's latest hiring spree reveals where it's building AI data centers next

Summary: Anthropic, a major AI company, is rapidly expanding its data center operations in Asia-Pacific by hiring 13 people, with eight positions in Australia and Japan, to handle increasing demand for its AI products. The company is building infrastructure in these regions because they offer advantages like renewable energy, political stability, and security benefits, though Australia's copyright laws present a potential obstacle to large-scale expansion.


How agents are transforming work

Summary: Agentic AI (AI systems that can work independently on tasks for extended periods, rather than just answering single questions) is transforming how people work by handling longer, more complex tasks instead of short interactions. At OpenAI, a tool called Codex shifted from being used mainly by engineers to becoming the primary AI tool across all departments, including non-technical ones like Legal and Recruiting, with usage growing dramatically over the past year. Users increasingly delegate tasks that would take humans hours or even days to complete, with some users running dozens of hours of parallel agent tasks in a single day.


Anthropic accuses Alibaba of campaign to 'brazenly' and 'illicitly' extract AI capabilities

Summary: Anthropic accused Alibaba of carrying out a massive distillation attack (a method where a weaker AI model is trained using outputs from a stronger model) involving 28.8 million exchanges with fraudulent accounts between April and June 2024. Anthropic called for coordinated government and industry action to combat illegal distillation, though Alibaba has not yet responded to the allegations.


CVE-2026-55583: Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cro

Summary: Twenty, an open-source CRM platform, had a vulnerability before version 2.9.0 where authenticated users could access other workspaces' AI agent data through IDOR (insecure direct object reference, a flaw where the system doesn't verify that requested data belongs to the user). Attackers with access to a workspace could view other users' chat histories, tool calls, and outputs by knowing their agent or turn IDs, which were visible in the settings page URL.

Solution: This issue is fixed in version 2.9.0.


Congresswoman denies staff used AI to write defense funding amendment

Summary: A U.S. Congresswoman claimed her staff used AI only for "spellcheck" when writing a summary of a defense bill amendment, not for drafting the actual legislation. Screenshots shared online showed what appeared to be Claude (an AI assistant) being used to generate the amendment summary, prompting the congresswoman to deny that AI was used to write any actual laws.


v0.14.23

Summary: LlamaIndex v0.14.23 is a maintenance release that updates dependencies (uv and pip, which are Python package managers) across multiple directories and fixes various bugs in the core library. Key fixes include handling empty input sequences, preserving video and document blocks in memory, resolving recursion errors in text splitting, and preventing state mutation issues in workflows.

LlamaIndex Cohere Google HuggingFace IBM


GCP-2026-043

Summary: A vulnerability in Firebase Studio (Google's backend service for building apps) allowed authenticated users to access and download source code and list storage buckets belonging to other users' projects. The vulnerability has already been fixed and deployed to the backend service.

Solution: No action is required as the fix has been deployed. As a precautionary measure, users who stored sensitive information such as API keys (secret codes that grant access to services) in their Firebase Studio workspace may choose to rotate these keys by following instructions in the Firebase Studio troubleshooting guide.

Google Firebase Studio
Google Cloud Platform (GCP)


From Prompt Testing to AI Red Teaming at Enterprise Scale

Summary: The article explains that while casual prompt testing (trying unusual inputs to see if an AI refuses them) is accessible to anyone, it is insufficient for enterprise AI systems. Enterprise AI is more complex because it includes policies, retrieval pipelines (systems that fetch information from databases), APIs (interfaces allowing programs to communicate), tools, permissions, workflows, and data sources, requiring more rigorous testing approaches.


CVE-2026-48719: Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp c

Summary: Warp is an agentic development environment (a tool that helps developers write code with AI assistance) that contained a command injection vulnerability (a flaw where specially crafted input can trick a system into running unintended commands) in its branch selector feature. An attacker who could publish a malicious Git branch name to a repository could cause that branch name to be executed as a shell command (instructions sent directly to the operating system) when a victim selected it from Warp's user interface.

Solution: This vulnerability is fixed in version 0.2026.05.06.15.42.stable_01. Users should update Warp to this version or later.


CVE-2026-44022: Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Summary: Docling is a tool that converts documents in different formats and connects them with AI systems. Between versions 2.73.0 and 2.91.0, it had a security flaw in how it processed LaTeX files (a document formatting language), where attackers could use path traversal (a technique to access files outside intended directories) to read sensitive files like credentials or configuration data from a system.

Solution: This vulnerability is fixed in version 2.91.0.


CVE-2026-44020: Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Summary: Docling is a tool that reads different document formats and connects them to AI systems. Versions 2.13.0 through 2.74.0 had a security flaw in how they read USPTO patent XML files (XML, a format for storing structured data): they didn't protect against XXE attacks (XML External Entity attacks, where specially crafted files trick the parser into reading files from the server or making unwanted network requests). An attacker could use this flaw to steal files, perform SSRF attacks (server-side request forgery, making the server request data it shouldn't), or crash the system.

Solution: This vulnerability is fixed in version 2.74.0.


CVE-2026-44017: Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Summary: Docling is a tool that processes documents in different formats and connects with AI systems. Before version 2.91.0, it had a security flaw where it downloaded AI models (EasyOCR) and extracted compressed files (ZIP archives) without checking if the file paths were safe, allowing a Zip Slip attack (a technique where specially crafted archive files extract to unintended locations). If an attacker could intercept or compromise the model download, they could write malicious files anywhere on the system, potentially taking complete control of it.

Solution: Update to Docling version 2.91.0 or later. The vulnerability is fixed in 2.91.0.


CVE-2026-44016: Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

Summary: Docling is a tool that processes different document formats and connects them to AI systems. In versions 2.82.0 through 2.90.0, if HTML rendering was turned on, an attacker could create malicious HTML documents that run unauthorized JavaScript code or access internal network services, potentially leading to SSRF attacks (where the server makes unintended requests to internal systems), data theft, or RCE (remote code execution, where attackers run commands on a system they don't own).

Solution: Upgrade to version 2.91.0, where the vulnerability is fixed.


Broadcom stock needs a win. The new OpenAI co-designed Jalapeno chip might do the trick

Summary: This article discusses Broadcom's stock performance and mentions a new AI chip called Jalapeno that was co-designed with OpenAI. The article suggests this chip development could be a significant business opportunity for Broadcom.


When Information Becomes the Attack Surface – Understanding AI Agent Traps

Summary: AI agents that can autonomously access websites, emails, and files are vulnerable to 'traps' - maliciously designed information that tricks them into wrong actions. These traps include content injection (hiding malicious instructions in webpage code or metadata), semantic manipulation (using repetition and emotional language to guide decisions), and cognitive state attacks (poisoning databases that agents rely on for memory), with research showing such attacks succeed 57-90% of the time depending on the type.


The $27 million Al proxy war over Alex Bores ends in a draw

Summary: A $27 million political campaign between AI companies Anthropic and OpenAI, fought through a super PAC (a political organization that can raise unlimited funds), ended without a clear winner when Alex Bores, a New York politician who had authored AI safety legislation, narrowly lost a Democratic primary election. Bores had previously passed the RAISE Act, which added safety requirements for advanced AI companies, but this legislation upset the pro-AI super PAC that opposed him.


More Malicious OpenClaw Skills Threaten AI Supply Chain

Summary: OpenClaw, an AI skills marketplace called ClawHub, discovered and removed five malicious packages that had bypassed security checks despite containing infostealers (malware that steals information like passwords and data). This incident demonstrates that threats can slip through marketplace defenses and compromise the AI supply chain (the network of tools and components used to build AI systems).


Introducing computer use in Gemini 3.5 Flash

Summary: Google has added computer use, a capability that allows AI agents to see and interact with computer screens to perform tasks, directly into Gemini 3.5 Flash (an AI model). This feature enables developers to build agents that can automate work across browsers, phones, and desktops, such as testing software or handling business tasks.

Solution: To mitigate prompt injection risks (attacks where malicious instructions are hidden in user inputs), Google uses targeted adversarial training for computer use in Gemini 3.5 Flash. The company also released two optional enterprise safeguard systems: one that requires explicit user confirmation for sensitive or irreversible actions, and another that automatically stops tasks if an indirect prompt injection is identified. The source recommends combining these features with secure sandboxing, human-in-the-loop verification (having humans review AI decisions), and strict access controls.

Google DeepMind
Gemini 3.5 Flash
Gemini 2.5


Figma now has AI motion graphics and shader tools

Summary: Figma announced new AI-powered design features at its Config conference, including AI-generated motion graphics (animations created by describing them to an AI chatbot) and coding layers that let developers edit code without leaving the design canvas. These updates aim to help creative teams automate repetitive tasks and work more efficiently in one integrated workspace.


OpenAI unveils first chip as part of Broadcom deal in effort to 'build the full stack'

Summary: OpenAI and Broadcom unveiled Jalapeño, OpenAI's first custom AI chip designed for inference (the process of running trained AI models to generate responses for users). The chip is an ASIC (application-specific integrated circuit, a processor built for one particular job rather than general computing), which is cheaper and more efficient than standard graphics processors but less flexible, and OpenAI designed it in nine months with help from its own AI models to address extreme demand for computing power.

OpenAI
Broadcom
Nvidia
Amazon Web Services
Advanced Micro Devices
Cerebras


OpenAI reveals its first AI processor: Jalapeño

Summary: OpenAI has announced a new chip called Jalapeño, an ASIC (application-specific integrated circuit, a processor designed for one particular job) built with Broadcom to power AI servers. The chip is specifically designed for AI inference (the process where a trained AI model processes user requests and generates responses), rather than AI training (where models learn from large amounts of data).


CVE-2026-12537: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1)

Summary: A critical vulnerability (CVE-2026-12537) exists in Google Gemini CLI versions before 0.39.1 and the run-gemini-cli GitHub Action before version 0.1.22 that allows attackers to run malicious code on a host system before sandbox protections activate by creating a specially crafted .gemini/.env file (improper neutralization is a failure to filter dangerous characters from user input before using it in system commands). This affects headless CI (continuous integration, automated testing environments) platforms and has a maximum severity rating of 10.0.

Solution: Update Google Gemini CLI to version 0.39.1 or later, and update the run-gemini-cli GitHub Action to version 0.1.22 or later.

Google
Google Gemini CLI
run-gemini-cli GitHub Action


AI Has Moved From Assistance to Action. Is Your Security Model Ready?

Summary: AI systems in businesses are shifting from passive assistants that answer questions to active agents that take real actions like retrieving data, calling APIs (application programming interfaces, which let software communicate with other software), and executing workflows. This change requires a new approach to security, moving beyond simple data governance rules about what employees can share with AI tools.