OpenAI introduces Daybreak cyber platform, takes on Anthropic Mythos

Summary: OpenAI has launched Daybreak, an AI-powered cybersecurity platform that uses large language models (AI systems trained on vast amounts of text data) and agentic capabilities (the ability for AI to take independent actions toward goals) to help organizations find and fix software vulnerabilities faster. The platform competes with Anthropic's Claude Mythos and works through three stages: prioritizing threats, generating and testing patches in enterprise systems, and documenting results for verification. Daybreak is being rolled out across three versions of GPT-5.5, from general-purpose use to specialized cybersecurity workflows.

OpenAI
Anthropic
Daybreak
Claude Mythos
Project Glasswing
GPT-5.5
GPT-5.5-Cyber
Codex


Cyber Threats Spike in April 2026 as Ransomware Expands and Attack Volumes Climb After Short-Lived Moderation

Summary: In April 2026, global cyber-attacks increased sharply to an average of 2,201 weekly attacks per organization, marking a 10% monthly rise and 8% yearly increase after a brief decline in March. Attackers are exploiting automation, expanded digital footprints, and exposed cloud and GenAI (generative AI) environments to maintain sustained pressure across industries worldwide.

Solution: N/A -- no mitigation discussed in source.


Fake Claude Code takes the IElevator to your browser secrets

Summary: Attackers are distributing fake Claude Code installers that deliver malware designed to steal sensitive data from developer systems by evading detection and recovering browser encryption keys. The malware uses a PowerShell loader (a script-based delivery method) to hide malicious activities and exploits Chrome Elevation Services to bypass Application-Bound Encryption (ABE, a Chrome protection added in version 127 to prevent password and cookie theft).

Solution: Ontinue researchers shared a YARA ruleset (a tool for identifying malware by pattern matching) and indicators of compromise (IOCs, technical signatures that identify malicious activity) through GitHub repositories to support detection.


Shai Hulud attack ships signed malicious TanStack, Mistral npm packages

Summary: Hundreds of software packages on npm (Node Package Manager) and PyPI (Python Package Index) were compromised in the Shai-Hulud attack campaign, which used stolen OIDC tokens (authentication credentials that verify a developer's identity) to publish malicious versions with valid cryptographic signatures, making them appear legitimate. The malware targets developer credentials like GitHub tokens, AWS secrets, and SSH keys, then hides itself in code editor auto-run tasks so uninstalling the packages doesn't remove it. The attack affected popular projects including TanStack, Mistral AI, Bitwarden, and others.

TanStack
Mistral AI
Guardrails AI
UiPath
OpenSearch
Bitwarden
SAP
Claude


Claude Mythos Finds Only One Curl Vulnerability; Experts Divided on What It Really Means

Summary: Testing Anthropic's Claude Mythos AI model on the curl data transfer tool found only one actual low-severity vulnerability in 178,000 lines of code, despite Anthropic's claims that the model could identify thousands of zero-day vulnerabilities (previously unknown security flaws). Experts are divided on whether this result shows that Mythos is less powerful than claimed or simply that curl's code is already very secure from previous audits and analysis by other tools.

Anthropic
Claude Mythos
OpenAI
Codex
Mozilla
Firefox


Copy.Fail Linux Vulnerability

Summary: Copy.Fail is a critical Linux kernel vulnerability that lets an attacker with basic user access escalate their privileges to root (the highest permission level) by exploiting the kernel crypto API and splice function (a system call that efficiently moves data between files). The vulnerability affects most Linux distributions without requiring special tricks or version-specific offsets, and it's especially dangerous in shared environments like Kubernetes clusters and cloud servers where multiple users or containers share the same kernel.

Solution: The mainline fix landed on 1 April. Distros are rolling kernels out now. Patch. Additionally, a custom seccomp profile (a security filter that restricts which system calls programs can use) is needed, since Kubernetes Pod Security Standards and the default RuntimeDefault seccomp profile do not block the vulnerable syscall.


Go fuzzing was missing half the toolkit. We forked the toolchain to fix it.

Summary: Go's built-in fuzzing tool (a technique that tests software by feeding it random or semi-random inputs to find bugs) was missing key features available in other languages like Rust and C++, so researchers built gosentry, a modified version of the Go toolchain that adds stronger bug detection, grammar-based fuzzing (testing structured inputs like parsers), and coverage reports while keeping the same familiar interface. Gosentry detects bugs that vanilla Go fuzzing misses, including integer overflows (when numbers get too large for their storage), data races (when multiple threads access the same data unsafely), and goroutine leaks (abandoned lightweight threads), without requiring developers to rewrite existing fuzzing tests.

Solution: Use gosentry instead of Go's standard fuzzer: point existing Go fuzz harnesses at gosentry's binary and run them with new CLI flags like --catch-races=true and --catch-leaks=true to enable additional bug detection. For example: ./bin/go test -fuzz=FuzzHarness --focus-on-new-code=false --catch-races=true --catch-leaks=true. Gosentry also supports generating coverage reports from existing fuzzing campaigns with the --generate-coverage flag, and the --panic-on flag can make the fuzzer stop when specific functions like log.Fatal are called.


Why Agentic AI Is Security's Next Blind Spot

Summary: Agentic AI (AI systems that can independently execute tasks and take actions) is already running in many organizations without security teams fully understanding it, creating a significant security gap. Security professionals cannot effectively protect technology they don't understand, and teams that lack fluency in agentic AI are being bypassed by business units moving forward without their input. The article identifies three main categories of agentic AI risk: general-purpose coding agents (like GitHub Copilot), vendor-built agents using MCP (Model Context Protocol, which allows agents to connect to external services), and custom agents built by non-technical users, each requiring different security considerations.

Solution: N/A -- no mitigation discussed in source. The article identifies engagement and hands-on experimentation as the starting point ('Try building an agent. Experiment with the tools your developers are already using'), but does not describe specific fixes, patches, configurations, or other concrete mitigations for the identified risks.

Claude
GitHub Copilot
Model Context Protocol
Claude Code


TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack

Summary: Over 170 packages in popular NPM and PyPI repositories (code libraries that developers use) were compromised by the hacking group TeamPCP in a coordinated attack, including packages from TanStack, UiPath, and Mistral AI. The malware (malicious software) stolen sensitive information like API keys (credentials for accessing services), developer tokens, and cryptocurrency wallets, then tried to spread by using stolen GitHub tokens to publish infected versions of other packages. The attackers used a novel technique called a supply chain attack (compromising the tools and processes used to build and distribute software) by exploiting three security weaknesses in GitHub Actions (automated workflows for building and releasing code) to bypass security checks and make malicious packages appear legitimate.

TanStack
Mistral AI
UiPath
OpenSearch
Squawk
Guardrails AI


CISOs step into the AI spotlight

Summary: CISOs (Chief Information Security Officers, the top security leaders at companies) are taking on increasingly important roles as AI becomes central to business operations and security threats grow. Companies like Brown & Brown and PayPal are addressing AI risks by creating AI security frameworks and governance structures that require security reviews before any AI tool is deployed, ensuring AI is used safely and responsibly.

Solution: According to the source, companies should implement AI security frameworks that require security reviews before deploying any AI capability. These frameworks should evaluate AI use cases against security requirements, data sensitivity, operational risk, and business impact. Additionally, organizations should establish AI Governance Working Groups (as Brown & Brown has done) to perform AI risk assessments and ensure AI is fit for purpose and used responsibly.


Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages

Summary: TeamPCP compromised multiple popular software packages (from companies like TanStack, Mistral AI, and Guardrails AI) by injecting malicious code that steals credentials for cloud services, cryptocurrency wallets, and development tools. The attack used a technique called SLSA provenance (a system that verifies software was built securely) to make the malicious packages look legitimate, and the malware persists by modifying development tools like VS Code so it runs every time the tool starts.

TanStack
Mistral AI
Guardrails AI
UiPath
OpenSearch
DraftLab


OpenAI Launches Daybreak for AI-Powered Vulnerability Detection and Patch Validation

Summary: OpenAI launched Daybreak, a new tool that uses AI models to help organizations find and fix software vulnerabilities before attackers can exploit them. Daybreak combines OpenAI's AI capabilities with Codex Security to automate tasks like code review, threat modeling, and patch validation. However, the article notes that AI tools have created a problem where vulnerabilities are discovered faster than developers can fix them, leading to 'triage fatigue' (where maintainers get overwhelmed sorting through many vulnerability reports, some of which may be false alarms generated by AI).

Solution: According to the source, Daybreak addresses the remediation bottleneck by incorporating 'patch validation' and 'remediation guidance into the everyday development loop so software becomes more resilient from the start.' Additionally, the text states that 'companies like Anthropic, Google, and OpenAI have increasingly positioned AI security agents as a new operational layer to address the remediation bottleneck and safeguard digital infrastructure from potential exploitation.' However, no specific technical steps or implementation details are provided in the source text.

OpenAI
Codex Security
Anthropic
Google
Akamai
Cisco
Cloudflare
CrowdStrike
Fortinet
Oracle
Palo Alto Networks
Zscaler


AutoScout24 scales engineering with AI-powered workflows

Summary: AutoScout24 Group, a large European and Canadian online car marketplace, implemented AI tools like ChatGPT and Codex (an AI coding assistant) across its 2,000 employees to speed up software development and improve code quality. By embedding Codex directly into engineering workflows and creating an "AI Champions" network for knowledge sharing, the company reduced development timelines from 2-3 weeks to 2-3 days for some projects while maintaining reliability.


How NVIDIA engineers and researchers build with Codex

Summary: NVIDIA engineers and researchers use Codex, an AI coding tool built on GPT-5.5, to automate complex engineering tasks and machine learning research workflows. The tool can work autonomously for long sessions, finding bugs and writing code that earlier models couldn't, and has enabled teams to build production systems and run experiments much faster than before. Codex integrates with remote infrastructure (SSH, or secure shell protocol, which lets users securely connect to distant computers) and can even test its own code as it's being built.


CVE-2026-43899: DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.

Summary: DeepChat, an open-source AI platform combining models, tools, and agents, has a vulnerability in versions before v1.0.4-beta.1 that allows remote code execution (RCE, where an attacker can run commands on a system they don't own). An attacker can use a malicious link in Markdown or a compromised AI endpoint to bypass security checks and execute arbitrary commands by exploiting unprotected pop-up window handlers in the application.

Solution: Update DeepChat to v1.0.4-beta.1 or later, where this vulnerability is fixed.


OpenAI just released its answer to Claude Mythos

Summary: OpenAI launched Daybreak, an AI security initiative designed to find and fix vulnerabilities (weaknesses in software that attackers could exploit) before attackers discover them. Daybreak uses the Codex Security AI agent to analyze an organization's code, identify potential attack paths (ways an attacker could compromise the system), and automatically detect high-risk vulnerabilities.

OpenAI
Anthropic
Daybreak
Codex Security
Claude Mythos
Project Glasswing


Here’s what Mira Murati’s AI company is up to

Summary: Thinking Machines, an AI company founded by former OpenAI CTO Mira Murati, is developing 'interaction models' that can process audio, video, and text simultaneously and respond in real time, unlike current AI models that wait passively for users to finish typing or speaking before responding.


Google says it likely thwarted effort by hacker group to use AI for 'mass exploitation event'

Summary: Google's security team reported that it stopped hackers from using AI models to find and exploit a zero-day vulnerability (a software flaw unknown to developers) as part of a planned large-scale attack that would have bypassed two-factor authentication (a security method using two verification steps). The incident highlights a growing concern that criminals are using available AI tools to discover software weaknesses in ways that could harm companies and organizations.

Google
Gemini
Anthropic
Mythos
OpenAI
GPT-5.5-Cyber
OpenClaw
Apple
CrowdStrike
Microsoft
Palo Alto Networks


CVE-2026-8319: A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this iss

Summary: A weakness was found in aiwaves-cn agents (software components that perform tasks autonomously) that allows attackers to consume excessive resources on a system, potentially making it slow or unavailable. The vulnerability is in a function called recall_relevant_memories_to_working_memory and can be exploited remotely (from a distance over a network), with the exploit code now publicly available. The developers have been notified but have not yet responded or released a fix.


CVE-2026-42869: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57,

Summary: SOCFortress CoPilot, a security operations management tool, has a critical flaw in versions before 0.1.57 where it uses a hardcoded JWT signing secret (a fixed password used to create secure authentication tokens) as a fallback. If users don't manually set their own JWT_SECRET, the application uses this publicly known secret, allowing attackers to forge fake admin tokens and take complete control without needing real credentials. This vulnerability is fixed in version 0.1.57.

Solution: Update SOCFortress CoPilot to version 0.1.57 or later, where this vulnerability is fixed.


CVE-2026-2614: A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0

Summary: MLflow versions 3.9.0 and earlier contain a vulnerability where unauthenticated attackers can read arbitrary files from a server by exploiting a flaw in the `_create_model_version()` handler (a function that processes requests to create new model versions). An attacker can trick the system into storing any file path from the server's filesystem by using a special tag in their request, and then retrieve those files through a different function that doesn't properly check permissions.

Solution: This issue is fixed in version 3.10.0.


OpenAI revenue chief Dresser says enterprise AI adoption is 'at a tipping point'

Summary: OpenAI's Chief Revenue Officer announced that enterprise AI adoption is reaching a 'tipping point' and introduced a new Deployment Company to accelerate business adoption of AI technology. The company acquired Tomoro, an AI consulting firm, bringing about 150 forward-deployed engineers (specialists who work directly with clients to integrate AI into their business processes) who will help organizations understand their workflows and implement AI solutions.

OpenAI
Anthropic
Google Gemini
Amazon Web Services
Microsoft
Slack
Goldman Sachs
SoftBank
Bain
Blackstone
Tomoro


Using LLM in the shebang line of a script

Summary: A developer demonstrated how to use an LLM (large language model) directly in the shebang line (the first line of a script that tells the system how to run it) of executable text files, allowing scripts to be written as natural English prompts instead of traditional code. The approach uses the LLM tool with various options to generate outputs like SVG images, incorporate external tools, and even execute YAML templates that define custom Python functions.

LLM
GPT-5.4-mini
Simon Willison's LLM tool


CVE-2026-43995: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool i

Summary: Flowise, a tool for building customized AI workflows through a visual interface, has a vulnerability in versions before 3.1.0 where four specific tools bypass security protections by directly using raw HTTP clients (tools for making web requests) instead of using a secured wrapper. This could allow attackers with login credentials to make unauthorized server requests (SSRF, or server-side request forgery).

Solution: Update Flowise to version 3.1.0 or later, where this vulnerability is fixed.


CVE-2026-2393: A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` fun

Summary: MLflow versions before 3.9.0 contain an SSRF vulnerability (server-side request forgery, where an attacker tricks a server into making requests to unintended targets) in the webhook creation function. An authenticated attacker can provide a malicious URL that causes MLflow's backend to send HTTP requests to internal services, cloud credential systems, or external servers, potentially exposing sensitive data or accessing restricted networks.


CVE-2026-31253: The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an ins

Summary: The flash-attention training framework has a vulnerability in how it loads saved model checkpoints (snapshots of a model's learned weights). An attacker can hide malicious code inside a checkpoint file, and when someone loads that file using the `load_checkpoint()` function, the code runs automatically on their computer without permission.


CVE-2026-31252: CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

Summary: CosyVoice, a text-to-speech framework, has an insecure deserialization vulnerability (CWE-502, a weakness where untrusted data is converted back into executable objects) in how it loads model files. The vulnerability exists because the code uses torch.load() without the weights_only=True security setting, allowing attackers to execute arbitrary code (malicious instructions) on a victim's computer by tricking them into loading a specially crafted model file through the CosyVoice Web UI.


CVE-2026-31251: CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

Summary: CosyVoice (a speech synthesis tool) has an insecure deserialization vulnerability (CWE-502, a flaw where untrusted data is converted back into executable code) in its gRPC server (a framework for building networked services). The vulnerability occurs because the server uses torch.load() without the weights_only=True parameter to load speech models, allowing an attacker to execute arbitrary code by placing malicious model files in a directory that a victim then loads.


CVE-2026-31250: CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

Summary: CosyVoice, a voice synthesis tool, has a vulnerability in its model averaging feature where it loads PyTorch checkpoint files (serialized machine learning model files) using an unsafe method that can execute arbitrary code. An attacker can create malicious checkpoint files that, when processed by the tool, will run code on the victim's computer without permission.


CVE-2026-31249: CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

Summary: CosyVoice (a text-to-speech AI tool) has a vulnerability in how it loads PyTorch model files (machine learning data files containing voice embeddings and tokens). The tool uses an unsafe loading method that allows attackers to execute arbitrary code (run any commands they want) on a victim's computer if the victim processes a directory containing a malicious .pt file.


CVE-2026-31246: GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb448840565 (2025-09-03) contains a command injection vulnerability (

Summary: GPT-Pilot has a command injection vulnerability (CWE-78, a type of security flaw where attackers insert malicious commands into a program) in its Executor.run() method that allows attackers to execute arbitrary shell commands. When the system asks users to confirm or modify a command before running it, it doesn't properly validate the user input before passing it to the shell execution function, letting an attacker replace the intended command with malicious code and run it with GPT-Pilot's privileges.


Google stopped a zero-day hack that it says was developed with AI

Summary: Google discovered and blocked a zero-day exploit (a previously unknown security flaw) that was created with AI assistance, which criminals planned to use for mass attacks on a web administration tool. Researchers identified AI involvement by finding signs in the Python script like artificial CVSS scores (severity ratings) and text patterns typical of AI language models.


How ChatGPT adoption broadened in early 2026

Summary: OpenAI's Q1 2026 data shows ChatGPT adoption expanded beyond early adopters, with growing usage among older age groups, users with typically feminine names, and people in emerging markets across Latin America, Asia-Pacific, and Africa. Workplace use evolved to focus on specialized tasks like content creation and health documentation rather than just general writing. Overall, ChatGPT became a more mainstream tool used by diverse people in more countries for recurring tasks.


GHSA-389r-gv7p-r3rp: go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Summary: go-git (a Git implementation in Go) may parse malformed Git objects differently than upstream Git, which could cause commits or tags with ambiguous headers to be interpreted inconsistently. This is especially problematic for commit signing and verification, since go-git signs or verifies commits based on its own parsed representation rather than the original raw bytes, potentially making invalid signatures appear valid when the commit's displayed content differs from what was actually signed.

Solution: Users should upgrade to a patched version. Versions prior to v5 are likely affected, and users are recommended to upgrade to a supported go-git version.

github.com/go-git/go-git/v5@< 5.19.0 (fixed: 5.19.0)

github.com/go-git/go-git/v6@>= 6.0.0-alpha.1, <= 6.0.0-alpha.2 (fixed: 6.0.0-alpha.3)


AI-powered hacking has exploded into industrial-scale threat, Google says

Summary: According to Google's threat intelligence group, AI-powered hacking (using AI models to help create and scale cyberattacks) has rapidly grown from a minor issue to a large, organized threat in just three months. Criminal groups and state-sponsored actors are now using commercial AI models to write code and find vulnerabilities (weaknesses in software that can be exploited) more effectively and at a much larger scale.


GHSA-q7rr-3cgh-j5r3: Prometheus exporter process crash via malformed HTTP request

Summary: A malformed HTTP request can crash any Node.js application using the OpenTelemetry Prometheus exporter because the metrics endpoint (a server that collects application performance data) doesn't properly validate incoming URLs before processing them. Since this endpoint is unauthenticated and exposed by default, any network user can send a specially crafted request to crash the entire application.

Solution: Update @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to version 0.217.0 or later, and update @opentelemetry/auto-instrumentations-node to version 0.75.0 or later. This release adds proper error handling around the URL constructor, returning an HTTP 400 response on parse failure rather than crashing the process. Run: npm install @opentelemetry/exporter-prometheus@latest. As a temporary mitigation if immediate updating is not feasible: bind the endpoint to localhost only by setting the host option to 127.0.0.1, use a firewall or network policy to restrict access to port 9464 to only trusted Prometheus scrape hosts, or place the endpoint behind a reverse proxy that filters or validates incoming requests.

@opentelemetry/auto-instrumentations-node@< 0.75.0 (fixed: 0.75.0)

@opentelemetry/sdk-node@< 0.217.0 (fixed: 0.217.0)

@opentelemetry/exporter-prometheus@< 0.217.0 (fixed: 0.217.0)


GHSA-w2pm-x38x-jp44: Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)

Summary: A vulnerability in BentoML allows command injection through environment variable names in bentofile.yaml files. When a user runs `bentoml containerize` (the command that builds a container image) on a malicious bento configuration, unquoted environment variable names get inserted into the generated Dockerfile, allowing attackers to execute arbitrary commands on the build host during the `docker build` process. This is a sibling vulnerability to two earlier command injection bugs (CVE-2026-33744 and CVE-2026-35043) that were patched for a different field but missed this one.

Solution: The source suggests two fixes in `base_v2.j2` lines 71-73: (1) Apply the `bash_quote` filter to `env.name` in both the `ARG` and `ENV` lines: `ARG {{ env.name | bash_quote }}{% if env.value %}={{ env.value | bash_quote }}{% endif %}` and `ENV {{ env.name | bash_quote }}=${{ env.name | bash_quote }}`; or (2) Better approach: validate at the schema level by adding `attr.validators.matches_re(r"^[A-Za-z_][A-Za-z0-9_]*$")` to the `name` field in `bentoml/_internal/bento/build_config.py:BentoEnvSchema` to reject newline and shell-metacharacter values when the config is loaded.


GHSA-78f9-r8mh-4xm2: BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)

Summary: BentoML has a command injection vulnerability where the `docker.base_image` field in a bento.yaml configuration file is inserted directly into a Dockerfile template without any validation or escaping. An attacker can supply a malicious bento.yaml with newlines in the `docker.base_image` value to inject arbitrary Dockerfile commands (like `RUN` directives that execute code) which get executed when a victim runs `bentoml containerize` to build a container image.

Solution: Validate `DockerOptions.base_image` at the config layer by rejecting any value containing newline characters (`\n`, `\r`) or whitespace beyond a single space-separated tag. The source suggests using a regex like `^[A-Za-z0-9._/-]+(:[A-Za-z0-9._-]+)?(@sha256:[a-f0-9]{64})?$` to enforce practical Docker reference format. The same hardening should be extended to other unvalidated fields in the Dockerfile template: `__options__build_include[*]`, `bento__user`, `bento__uid_gid`, `bento__path`, `bento__home`, and `bento__entrypoint`.


GHSA-jgj3-r8hr-9pjw: Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission

Summary: Open WebUI has an authorization flaw in standard channels (regular channels, not group or direct message channels) where the message update endpoint incorrectly allows access with read permission only. This means any authenticated user can modify other users' messages if they know the message ID, violating data integrity (the guarantee that information stays accurate and unchanged by unauthorized parties).

Solution: Update the permission check in `backend/open_webui/routers/channels.py:1451–1456` by changing the authorization requirement from `has_access(..., type="read")` to `has_access(..., type="write")`, ensuring only administrators, message owners, or users with write permission (the ability to create or modify content) can update messages.


GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

Summary: Threat actors are increasingly using AI and large language models (LLMs, systems trained on massive amounts of text to generate human-like responses) to discover vulnerabilities, create malware, and conduct cyberattacks at industrial scale, with groups linked to China, North Korea, and Russia demonstrating significant AI-enabled capabilities. AI is being used both as an attack tool (for generating exploits, evading defenses, and creating deepfakes) and as a target for compromise, with attackers seeking unauthorized access to AI systems through supply chain attacks and illicit model access. Google's Threat Intelligence Group reports these threats are advancing from experimental to mature operations, including autonomous malware like PROMPTSPY that can dynamically adapt to victim systems.

Solution: Google mitigates AI model abuse by disabling malicious accounts accessing Gemini. Additionally, Google employs AI agents like Big Sleep to identify software vulnerabilities and uses Gemini's reasoning capabilities through CodeMender to automatically fix vulnerabilities, while enhancing product safeguards to offer scaled protections to users.

Google Threat Intelligence Group
Gemini
Mandiant
PROMPTSPY
Big Sleep
CodeMender


Joanna Stern is not a robot, but she lived with them

Summary: This is a podcast interview transcript where tech journalist Joanna Stern discusses her new book 'I Am Not a Robot,' in which she spent a year integrating AI into every aspect of her life to evaluate the technology's current state. She found that many hyped AI products, especially humanoid robots (physical machines designed to look and act like humans), are not yet ready for real-world use, though she is optimistic about wearable AI (AI embedded in portable devices like smartwatches) as a potential breakthrough application.


Cerebras bumps up IPO range as it looks to raise up to $4.8 billion

Summary: Cerebras Systems, an AI chipmaker, increased its IPO (initial public offering, when a private company sells shares to the public for the first time) price range to $150-$160 per share, up from $115-$125, potentially raising $4.8 billion. The company makes specialized chips that compete with Nvidia's GPUs (graphics processing units, hardware that processes AI calculations) and claims its chips are faster and cheaper, with major backing from OpenAI.

Cerebras
OpenAI
ChatGPT
Nvidia
Amazon Web Services
Elon Musk


MalPurifier: Enhancing Android Malware Detection With Adversarial Purification Against Evasion Attacks

Summary: Machine learning systems used to detect Android malware (malicious software on Android phones) are vulnerable to evasion attacks, where attackers modify malware to trick the detection system into missing it. Researchers developed MalPurifier, a defensive framework that uses adversarial purification (a technique that removes deceptive modifications from suspicious code) combined with a Denoising AutoEncoder (a type of neural network that learns to clean up noisy or corrupted data) to protect detection systems and maintain accuracy above 90% against various evasion attacks.

Solution: MalPurifier is described as "a lightweight, model-agnostic, and plug-and-play module" that integrates "a diversified adversarial perturbation mechanism for robustness and generalizability, a protective noise injection strategy for benign data integrity, and a Denoising AutoEncoder with a dual-objective loss for accurate purification and classification." The framework is presented as "a practical and effective solution to bolster the security of ML-based Android malware detectors."


Lyrie.ai Joins First Batch of Anthropic’s Cyber Verification Program

Summary: OTT Cybersecurity LLC announced that its product Lyrie.ai has been accepted into Anthropic's Cyber Verification Program, and released the Agent Trust Protocol (ATP), an open cryptographic standard (a set of math-based rules for secure communication) that allows systems to verify the identity, permissions, and integrity of autonomous AI agents operating on the internet. ATP addresses a security gap by letting organizations confirm who an AI agent is, what it's authorized to do, and whether it has been tampered with.

Solution: N/A -- no mitigation discussed in source.

Anthropic
Claude
Lyrie.ai
OTT Cybersecurity LLC


Deep Privacy Funnel Model: From a Discriminative to a Generative Approach With an Application to Face Recognition

Summary: This research develops a privacy-preserving method for face recognition systems using the Privacy Funnel model, which balances the usefulness of facial data against protecting sensitive information like identity or demographic attributes. The authors introduce new versions of this model, including the Generative Privacy Funnel (GenPF) and deep variational Privacy Funnel (DVPF), and demonstrate that their approach works with modern face recognition systems while reducing information leakage about sensitive attributes.


A Secure and Efficient Image Sharing Method Based on Bilateral Compressive Sensing With Multilevel Privacy Preserving Function

Summary: This paper proposes a new image sharing method that uses compressive sensing (a technique that compresses and encrypts data simultaneously) with multiple privacy levels, so different users can access only the information they need without seeing sensitive details. The method uses an algorithm called T-ℓ1-B2DLDA to compress images in a way that allows some users to classify or analyze images without reconstructing the original, while others with higher access levels can fully reconstruct them.


Google discovers weaponized zero-day exploits created with AI

Summary: Google's Threat Intelligence Group discovered the first confirmed AI-crafted zero-day exploit (a previously unknown security flaw) in the wild, which was a Python script that bypassed two-factor authentication (a security method requiring two forms of verification) on a web-based system administration tool. The exploit exploited a logic flaw that the AI model found by understanding the developers' intent rather than just finding basic coding mistakes. As AI models become more advanced at reasoning about complex code, such AI-generated exploits may become more common, and threat actors are also attempting to abuse AI systems like Google's Gemini to discover vulnerabilities in firmware (the low-level software in devices) and other systems.

Google Gemini
Anthropic Claude
OpenAI
Google Threat Intelligence Group (GTIG)


Hackers Use AI for Exploit Development, Attack Automation

Summary: Attackers are increasingly using large language models (AI systems trained on vast amounts of text that can generate human-like responses) to create exploits (tools that take advantage of software vulnerabilities) and automate complex attacks. While adversaries have used AI for a while, this represents a shift toward more sophisticated automation of the attack development process.


Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads

Summary: A fake AI model repository on Hugging Face (a platform for sharing AI models) impersonated OpenAI's Privacy Filter and tricked 244,000 users into downloading it before removal. The malicious repository contained a loader.py file that delivered infostealer malware (software that steals passwords and credentials) to Windows systems, highlighting risks in how companies source and validate AI models from public repositories.


10 questions to ask when using AI models to find vulnerabilities

Summary: This article presents ten critical questions organizations should ask before using AI models to find vulnerabilities in their systems. Rather than offering a specific technical fix, it emphasizes that simply finding vulnerabilities doesn't improve security without proper processes, prioritization, and risk management in place. Key concerns include data leakage risks, whether AI is truly the best approach compared to basic security hygiene like patching, and ensuring your organization has the people and processes to actually fix discovered issues.


OpenAI to give EU access to new cyber model but Anthropic still holding out on Mythos

Summary: OpenAI announced it will give the European Union access to GPT-5.5-Cyber, a specialized AI model designed for cybersecurity defense, while Anthropic has not yet granted similar access to its competing model called Mythos. The EU plans to review OpenAI's model closely to address security concerns, though discussions with Anthropic about accessing Mythos are still at an earlier stage.


LLMs and Text-in-Text Steganography

Summary: This blog discussion explores steganography (hiding secret messages within other content) involving LLMs through techniques like white text on white backgrounds and deliberately misspelling words to confuse AI models. Commenters note that LLMs handle these obfuscation attempts easily, and discuss broader steganography methods including TEMPEST (electromagnetic emissions security), with mention that modern software-defined radios (SDRs, affordable radio receivers programmable via software) have made older defensive techniques less effective.


AI security is repeating endpoint security’s biggest mistake

Summary: AI security is currently focused on posture-based controls (checking configurations, access rules, and input filters), similar to how endpoint security relied on antivirus signatures in the early 2000s, but this approach is incomplete because the AI attack surface is expanding faster than teams can secure it. The article argues that organizations need to shift toward behavior-based detection, which monitors what AI systems actually do (API calls, data retrieval, system actions) rather than just checking if security policies are in place, because the blast radius of a compromised AI agent affects multiple systems downstream.


8 guiding principles for reskilling the SOC for agentic AI

Summary: This article discusses how security leaders should prepare their teams for agentic AI (AI systems that can autonomously perform tasks), emphasizing that it will become essential as cyber attackers increasingly use AI at machine speed. Key principles include having leaders embrace agentic AI adoption through hands-on experimentation and training, setting organizational culture around rapid iteration, and addressing staff resistance to the technology shift.

DXC Technology
7AI
Accenture
Anthropic
Virgin Atlantic
Torq
SANS Institute


1,800+ MCP servers exposed without authentication: How zero trust can secure the AI agent revolution

Summary: Over 1,800 MCP servers (Model Context Protocol servers, tools that connect AI assistants to external systems) are publicly exposed without requiring authentication, meaning anyone can see what internal tools an organization has connected to their AI. Security researchers found that production systems with access to financial databases, social media accounts, and customer data are vulnerable to attacks like EchoLeak (a zero-click exploit that hides malicious instructions in documents) and mcp-remote (a supply chain attack using a widely-downloaded package with a command injection vulnerability).

Anthropic
Model Context Protocol
Microsoft 365 Copilot
Cloudflare
Hugging Face
Auth0
JFrog


Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads

Summary: A fake repository on Hugging Face (a platform for sharing AI models) impersonated OpenAI's Privacy Filter model and tricked 244,000 users into downloading malware disguised as a legitimate tool. The malicious repository copied the real project's description verbatim and included a loader script that deployed an information stealer, a type of malware that harvests sensitive data like passwords, screenshots, and cryptocurrency wallet information from Windows machines.

Solution: Access to the malicious model has since been disabled by Hugging Face.


OpenAI launches DeployCo to help businesses build around intelligence

Summary: OpenAI is launching the OpenAI Deployment Company, a new business unit staffed with Forward Deployed Engineers (FDEs, specialists in integrating AI systems into organizations) to help businesses build and deploy AI technology across their operations. The company, backed by $4 billion in initial investment and partnerships with major investment firms and consulting companies, acquired Tomoro to bring approximately 150 experienced FDEs on board and aims to help organizations redesign workflows and infrastructure around AI to achieve measurable results.


Hackers abuse Google ads, Claude.ai chats to push Mac malware

Summary: Attackers are running a malware campaign that uses Google Ads and fake Claude.ai shared chats to trick Mac users searching for Claude into downloading malware. The malicious chats pretend to be official installation guides and trick users into pasting commands in Terminal that download and run hidden malware, which steals browser passwords, cookies, and data from macOS Keychain (the system that stores passwords and sensitive information on Macs).


Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak

Summary: Ollama, a popular framework for running large language models locally, has a critical out-of-bounds read vulnerability (CVE-2026-7482, CVSS score 9.1) that allows attackers to leak sensitive data like API keys and conversation history from process memory by uploading a specially crafted GGUF file (a file format for storing language models). The vulnerability affects versions before 0.17.1 and potentially impacts over 300,000 servers globally.

Solution: Update to Ollama version 0.17.1 or later. Additionally, the source recommends: limit network access to Ollama instances, audit running instances for internet exposure, isolate and secure them behind a firewall, and deploy an authentication proxy or API gateway in front of all Ollama instances since the REST API does not provide authentication by default.


Adaptive active-defense hardening of ML-based NIDS against RL-driven adversaries: A comparative analysis with static defenses

Summary: This research paper examines how machine learning-based network intrusion detection systems (NIDS, software that identifies unauthorized access attempts) can use adaptive active-defense hardening to protect themselves against reinforcement learning (RL, a type of AI that learns by trial-and-error) driven attacks. The study compares this dynamic defense approach with traditional static defenses (fixed security measures that don't change).


SBOMs into Agentic AIBOMs: Schema Extensions, Agentic Orchestration and Reproducibility Evaluation

Summary: This academic paper discusses extending SBOMs (Software Bill of Materials, a detailed list of all software components in a program) to create AIBOMs for agentic AI systems (AI systems that can take independent actions). The research focuses on adding new schema extensions (structured data formats) to track AI agent components, improving how these systems can be orchestrated (coordinated and controlled), and developing methods to evaluate whether AI systems produce consistent, reproducible results.


QAEAS: A quantum adaptive ensemble attack system against robust deep neural networks

Summary: Researchers have developed QAEAS, a quantum adaptive ensemble attack system that can break through the defenses of robust deep neural networks (AI systems trained to resist attacks). The system uses quantum computing techniques combined with multiple coordinated attack strategies to find weaknesses in AI models that were designed to be resistant to traditional hacking methods.


What I saw at the Musk-OpenAI trial: petty billionaires, protests and a stern judge

Summary: This article describes a legal trial between Elon Musk and OpenAI's leadership taking place in Oakland, focusing on disputes over the future of artificial intelligence. The piece is a journalistic account of the courtroom drama, featuring prominent tech figures and highlighting tensions between wealthy individuals and companies in the AI industry.


Fake OpenAI repository on Hugging Face pushes infostealer malware

Summary: A fake OpenAI repository on Hugging Face (a platform where developers share AI models and code) disguised itself as a legitimate project and tricked users into downloading a malicious loader script that steals sensitive data like passwords, cryptocurrency wallets, and browser cookies. The fake repository reached the top of Hugging Face's trending list with 244,000 downloads before the platform removed it after researchers reported the threat.

Solution: Users who downloaded files from the malicious repository are advised to reimage the machine (completely reinstall the operating system), rotate all stored credentials, replace cryptocurrency wallets and seed phrases, and invalidate browser sessions and tokens.


A multimodal approach for windows malware detection using comprehensive analysis on called APIs

Summary: This academic paper presents a method for detecting Windows malware (malicious software) by analyzing multiple types of data together, specifically focusing on the API (application programming interface, the set of functions a program uses to interact with the operating system) calls that malware makes. The research uses a multimodal approach, meaning it combines different sources of information to improve detection accuracy.


Self-supervised encrypted traffic classification via importance-aware masked clustering

Summary: Researchers developed a new method for classifying encrypted network traffic (data traveling across the internet in scrambled form) using self-supervised learning (training an AI without needing humans to label every example). The approach uses importance-aware masked clustering (grouping similar encrypted traffic patterns while focusing on the most informative pieces of data) to identify what type of application or service created the traffic without being able to see the actual content.


Deep video inpainting and video inpainting detection: A comprehensive survey from deep learning perspective

Summary: This survey paper reviews deep learning techniques for video inpainting (filling in missing or removed parts of videos) and methods to detect when videos have been inpainted. The research covers both how AI systems can reconstruct videos and how to identify when such reconstruction has occurred, addressing concerns about manipulated video content.


Proactive defense for cloud-native network slicing: A risk-aware intelligent moving target defense framework based on multi-agent deep reinforcement learning

Summary: This research paper describes a defensive framework for cloud-native network slicing (dividing a network into isolated virtual segments) that uses multi-agent deep reinforcement learning (a type of AI where multiple learning agents work together to make decisions) to protect against security threats. The framework takes a proactive approach by continuously changing the network configuration to make it harder for attackers to find vulnerabilities, similar to a moving target that's difficult to hit.


Robust Large-Scale Detection of Living-Off-the-Land Reverse Shells via Data Synthesis

Summary: This research paper presents a method for detecting living-off-the-land reverse shells (attacks where hackers use built-in system tools already present on a computer to create a backdoor connection back to their own machine) at a large scale by using data synthesis (artificially creating training examples rather than collecting real attack data). The approach aims to improve security detection systems' ability to identify these sneaky attacks that are hard to catch because they blend in with normal system activity.


CVE-2026-41705: Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized

Summary: Spring AI's MilvusVectorStore#doDelete(List) method has a vulnerability called filter-expression injection (where attackers can manipulate database filter commands by inserting malicious code into document IDs) because document IDs are not properly cleaned before being used. This affects Spring AI versions 1.0.0 through 1.0.x and 1.1.0 through 1.1.x.

Solution: Upgrade to Spring AI 1.0.7 or greater (for 1.0.x users) or Spring AI 1.1.6 or greater (for 1.1.x users).


Musk v. Altman week 2: OpenAI fires back, and Shivon Zilis reveals that Musk tried to poach Sam Altman

Summary: This article covers week two of a lawsuit where Elon Musk is suing OpenAI and its leaders, claiming they broke promises to keep the company as a nonprofit dedicated to safe AI development. OpenAI's president Greg Brockman countered that Musk actually pushed for the company to become for-profit and wanted majority control, and that Musk is suing because he left the company in 2018 and now sees it as a competitor to his own AI company, xAI (an artificial intelligence system). Musk is seeking $134 billion in damages and wants to remove the current leadership and undo OpenAI's recent restructuring.

OpenAI
Sam Altman
Greg Brockman
Elon Musk
xAI
Tesla
SpaceX
Microsoft


CVE-2026-44286: FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF

Summary: FastGPT, a platform for building AI agents, has a vulnerability in versions before 4.14.17 that allows attackers to send requests to internal or private network addresses without needing to log in. The problem is in the fetchData function, which retrieves data from user-provided URLs but doesn't properly check them against a blocklist (isInternalAddress) that's meant to prevent SSRF attacks (where a server is tricked into making requests to systems it shouldn't access).

Solution: Update FastGPT to version 4.14.17 or later, where this issue has been patched.


CVE-2026-44284: FastGPT is an AI Agent building platform. Prior to version 4.14.17, FastGPT had an inconsistent SSRF protection gap in M

Summary: FastGPT, a platform for building AI agents, had a security flaw in how it protected against SSRF attacks (server-side request forgery, where an attacker tricks a server into connecting to unauthorized internal systems). While some endpoints blocked internal network URLs, the tool creation endpoints did not, allowing an authenticated user to save a malicious internal URL that could later be used without additional checks when running workflows.

Solution: This issue has been patched in version 4.14.17.


CVE-2026-42345: FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

Summary: FastGPT, an AI platform for building AI agents, has a vulnerability in versions 4.14.11 and earlier where its isInternalAddress() function fails to block access to cloud metadata endpoints (services that store sensitive system information). Attackers can bypass the blocklist using URL encoding techniques (methods to disguise URLs), and because a security check is disabled by default, the metadata endpoint remains accessible without additional protection.


CVE-2026-42344: FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

Summary: FastGPT versions 4.14.11 and earlier have a DNS rebinding vulnerability (TOCTOU, or Time-of-Check to Time-of-Use, where a check happens at one moment but the actual action uses a different result moments later) in their isInternalAddress() function. The function validates that a hostname resolves to a safe private IP address, but because the actual HTTP request performs a separate DNS lookup afterward, an attacker can change the DNS record between validation and the request, bypassing the security check.


CVE-2026-42343: FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insuffi

Summary: FastGPT, a platform for building AI agents, has a vulnerability in versions 4.14.13 and earlier where its code-sandbox component (a container that safely runs code in isolation) lacks proper resource limits. Attackers can exploit this by sending requests that consume excessive memory or CPU, bypassing the weak 500ms polling interval check and causing the service to crash for legitimate users (a Denial of Service attack). The vulnerability exists because the system relies only on software-level checks instead of operating system-level safeguards like cgroups (Linux tools that restrict resource usage).


CVE-2026-42339: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.1

Summary: New API, an LLM gateway and AI asset management system, has a vulnerability in versions 0.11.9-alpha.1 and earlier where its SSRF protection (safeguards against server-side request forgery, where an attacker tricks a server into making unintended web requests) fails to block the address 0.0.0.0. Any user with a valid API token can exploit this by sending requests with 0.0.0.0 as the image URL, causing the server to make requests to localhost (its own system) and potentially leak sensitive data when using certain AWS configurations.


CVE-2026-42302: FastGPT is an AI Agent building platform. From version 4.14.10 to before version 4.14.13, the agent-sandbox component of

Summary: FastGPT versions 4.14.10 through 4.14.12 have a critical vulnerability in their agent-sandbox component that allows unauthenticated Remote Code Execution (RCE, where attackers can run commands on a system they don't own). The startup script runs code-server (a web-based code editor) with authentication disabled and opens it to all network interfaces, meaning anyone who can reach the server's port 8080 can take complete control of the sandbox environment.

Solution: Update to FastGPT version 4.14.13 or later, as this issue has been patched in that version.


GHSA-pjwx-r37v-7724: LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

Summary: LangChain has a vulnerability where older code paths deserialize (convert serialized data back into objects) untrusted user input too broadly, allowing attackers to inject specially crafted LangChain objects that get instantiated with attacker-controlled arguments. The vulnerability only affects applications that accept untrusted structured input (like JSON), don't validate it first, and use affected APIs like `RunnableWithMessageHistory` or `astream_log()`.

Solution: LangChain will deprecate the affected APIs (`RunnableWithMessageHistory`, `astream_log()`, and `astream_events(version="v1")`) and recommend migrating to newer streaming and memory patterns like the `stream` API. Additionally, LangChain will update `load()` and `loads()` functions to tighten deserialization behavior so broad object revival is not applied implicitly to untrusted input.


GHSA-4vg5-rp28-gvjf: Open WebUI has Improper Authorization Control

Summary: Open WebUI version 0.1.105 has an authorization flaw where users with a 'pending' status (the default for new sign-ups) can still receive authentication tokens (JWT, a standardized way to prove identity in web requests) and make API calls meant only for approved users, bypassing the authorization check (the system that verifies what actions a user is allowed to perform) that is only enforced on the website interface, not in the backend API itself.


Using Claude Code: The Unreasonable Effectiveness of HTML

Summary: This article discusses using HTML instead of Markdown when requesting output from Claude, an AI assistant. HTML allows Claude to create richer explanations by including SVG diagrams, interactive widgets, and better navigation, which was less practical with older language models that had strict token limits (tokens being units of text that count toward a model's processing capacity).


GHSA-wfr5-454p-mjc2: OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

Summary: The OpenTelemetry.Exporter.Instana NuGet package (a tool for monitoring application performance) disables TLS certificate validation (the security check that verifies a server's identity) when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. This means an attacker who intercepts the network connection could read sensitive telemetry data and steal the Instana API key (a credential that grants access to monitoring systems). The vulnerability only affects systems where a proxy is configured and that proxy is either controlled by an attacker or vulnerable to interception.

Solution: Pull request #4153 refactors the HttpClient creation so that TLS certificate validation is no longer disabled by default when using a proxy. For environments where disabling certificate validation is necessary (such as local development), the previous behavior can be restored by configuring a custom HttpClientFactory with ServerCertificateCustomValidationCallback set to accept any certificate, as shown in the code example provided in the remediation section.

OpenTelemetry.Exporter.Instana@<= 1.0.7 (fixed: 1.1.0)


GHSA-5c57-rqjx-35g2: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Summary: The kanban npm package (used by the cline CLI tool) runs a WebSocket server on localhost that accepts connections from any website without checking the Origin header (a validation that confirms the connection came from an authorized source). This allows attackers to leak sensitive data like file paths and AI chat messages, inject commands into running terminals to achieve remote code execution (executing arbitrary code on a developer's machine), and kill running tasks.


GHSA-gphh-9q3h-jgpp: banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

Summary: The `banks` library version 2.4.1 and earlier has a critical Remote Code Execution vulnerability because it uses an unsandboxed Jinja2 environment (a template engine that processes text with special syntax) to render prompt templates. If an application accepts user-supplied strings as templates and passes them to the `Prompt()` function, attackers can inject malicious template code to execute arbitrary commands on the server.

Solution: Fixed in `banks 2.4.2` by switching to `jinja2.sandbox.SandboxedEnvironment`, which blocks the dunder attribute traversal chain (accessing internal Python object properties using double underscores) that the exploit relies on. Developers using `banks <= 2.4.1` should upgrade to version 2.4.2 and avoid passing untrusted user input as the template argument to `Prompt()`.


A Framework for AI Threat Readiness

Summary: AI models can now autonomously discover zero-day vulnerabilities (previously unknown security flaws), create working exploits, and combine multiple weaknesses together, making vulnerabilities appear faster and get exploited more quickly than before. Organizations need to respond by acting faster to identify and fix vulnerabilities, and by having complete visibility across their entire environment (cloud systems, code, infrastructure, and software supply chain). The framework recommends reducing unnecessary exposure, prioritizing what can actually be exploited, patching quickly, and using AI-driven scanning to continuously validate every exposed system.

Solution: The source recommends a four-pillar framework but does not describe explicit fixes or patches. The closest guidance is: 'organizations need to move faster in how they assess exposure, prioritize what matters, and remediate issues before they can be exploited,' and 'scan every exposure with AI' to 'continuously scan every exposure, determine whether it can be exploited.' The source also cites the Firefox team as an example: 'after scanning with Mythos, the Firefox team fixed more security bugs in April than they had in the entire previous year.' However, no specific software update, patch version, or concrete mitigation technique is provided in the text.


GHSA-8g7g-hmwm-6rv2: n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure

Summary: n8n-mcp versions before 2.50.1 had three security issues: unvalidated workflow IDs allowed attackers to bypass access controls and leak API keys, webhook URLs followed redirects to unintended hosts (SSRF, a type of attack where a server makes unwanted requests to other systems), and telemetry (usage data sent to developers) stored sensitive information like API keys without hiding it. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 8.3 and requires an authenticated attacker with access to the n8n API.

Solution: Upgrade to n8n-mcp version 2.50.1 or later. If upgrading is not immediately possible, the source provides these workarounds: for issues 1 and 2, restrict network access to the HTTP port through firewall rules or switch to stdio mode (a communication method that does not expose HTTP); for issue 3, set the environment variable `N8N_MCP_TELEMETRY_DISABLED=true` before starting the server, or run `npx n8n-mcp telemetry disable` once.


GHSA-cmrh-wvq6-wm9r: n8n-mcp webhook and API client paths has an authenticated SSRF

Summary: An authenticated SSRF (server-side request forgery, where an attacker tricks a server into making unwanted requests to internal services) vulnerability affects n8n-mcp's webhook and API client features. An attacker with access to the system can make the n8n-mcp host send HTTP requests to internal services or cloud credential endpoints that should be blocked, allowing them to steal credentials or enumerate internal systems.

Solution: Fixed in n8n-mcp@2.50.2. If you cannot upgrade immediately, the source suggests three workarounds: (1) Restrict network egress from the n8n-mcp host using a firewall or cloud security group to deny cloud metadata IPs (169.254.169.254, 169.254.170.2, 100.100.100.200, 192.0.0.192, and GCP metadata.google.internal) and RFC1918 networks; (2) Run in stdio mode instead of HTTP if multi-tenant mode is not needed; (3) Disable workflow management tools via `DISABLED_TOOLS=n8n_trigger_webhook_workflow,n8n_create_workflow,n8n_test_workflow` if not needed. Additionally, if N8N_API_URL points to localhost or a private network address, set `WEBHOOK_SECURITY_MODE=moderate` (allows localhost, blocks private networks and cloud metadata) or `WEBHOOK_SECURITY_MODE=permissive` (allows private networks too, only safe on trusted networks).


Anthropic's Mythos set off a cybersecurity 'hysteria.' Experts say the threat was already here

Summary: Anthropic released Mythos, an AI model that can find thousands of previously unknown software vulnerabilities (flaws in code that haven't been patched yet), which sparked concern among banks, governments, and tech companies about a new wave of AI-enabled cyberattacks. However, cybersecurity experts say this vulnerability-finding capability already exists in older, publicly available AI models from Anthropic and OpenAI, and can be achieved through orchestration (coordinating multiple tools or models to work together on a task).

Anthropic
OpenAI
Claude
GPT-5.5-Cyber
Apple
Amazon
JPMorgan Chase
Palo Alto Networks


CVE-2026-41487: Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, the

Summary: Langfuse, an open source platform for managing large language models, had a role-based access control flaw (a security issue where user permissions weren't properly enforced) in versions 3.68.0 through 3.166.9 that allowed low-privileged project members to redirect API requests to attacker-controlled servers, potentially exposing sensitive API keys. The vulnerability required the attacker to already have basic access to a project as a member.

Solution: Update to Langfuse version 3.167.0 or later, where the issue has been patched.


Everybody wants to rule the AI world

Summary: This article discusses the chaotic leadership transition at OpenAI in 2024, when Sam Altman was removed as CEO under unclear circumstances involving video calls and informal communications between current and former leadership. The situation's complexity is now being revealed through an ongoing legal dispute between Elon Musk and Altman.


Running Codex safely at OpenAI

Summary: OpenAI's Codex is a coding agent that can autonomously perform tasks like reviewing code and running commands, which creates security risks that need careful control. To deploy Codex safely, OpenAI uses sandboxing (technical boundaries limiting where the agent can write and what it can access), approval policies (requiring human review for risky actions), network restrictions (blocking unexpected connections), and audit logging (recording what the agent does). These controls work together to let Codex move quickly on routine, low-risk tasks while stopping for review on higher-risk actions.

Solution: OpenAI's explicit mitigations include: sandboxing to define execution boundaries, approval policies requiring human review for higher-risk actions, auto-approval mode for routine low-risk requests, managed network policies (allowing expected destinations and blocking unwanted ones), secure credential storage in the OS keyring, forcing authentication through ChatGPT tied to enterprise workspace controls, command rules that allow benign commands without approval but block or require approval for dangerous commands, and agent-native telemetry and audit trails for visibility into agent behavior.


Claude in Chrome is taking orders from the wrong extensions

Summary: Claude in Chrome, Anthropic's browser extension, has a bug called ClaudeBleed that allows malicious extensions to hijack it and trick it into performing unauthorized actions like stealing files, sending emails, or stealing code from private repositories. The vulnerability exists because the extension trusts any script from its origin (claude.ai) without checking who is actually running it, breaking Chrome's normal security model. Anthropic released a partial fix in version 1.0.70 on May 6, but researchers found the vulnerability can still be exploited by switching the extension to privileged mode.

Solution: Anthropic released version 1.0.70 on May 6 with added security checks that prevent extensions from executing remote commands in standard mode. The company also stated that 'a fix that removes the affected message handler has been merged and will ship in an upcoming extension release,' though the source notes this promised fix did not fully materialize in version 1.0.70.


The Tech Download: Meta, Google enter AI agent race as ‘agentic wars’ heat up

Summary: Major tech companies like Meta and Google are racing to develop AI agents (AI tools that can perform tasks for users rather than just answer questions), following the viral success of OpenClaw earlier this year. While AI agents promise major business benefits through increased user engagement and revenue opportunities, significant security and governance challenges remain unresolved, particularly the risk of agents "doing the wrong thing" rather than just saying the wrong thing.

Solution: N/A -- no mitigation discussed in source.

Meta Google OpenAI Nvidia OpenClaw Baidu AMD


Your CTEM program is probably ignoring MCP. Here’s how to fix it

Summary: Model Context Protocol (MCP, a plugin system that lets AI agents connect to external tools) has become a major security blind spot because organizations aren't scanning for or monitoring MCP risks, leaving them vulnerable to attacks that exploit supply chain vulnerabilities, exposed credentials, and malicious AI tool installations. The article highlights how attackers can compromise widely-trusted MCP packages (like the postmark-mcp npm package that exfiltrated emails from 300 organizations) and how developers often hardcode sensitive credentials into AI configurations, making MCP a vehicle for old attack types (like supply chain attacks and credential theft) to cause new damage.

Anthropic
Model Context Protocol
MCP
OpenAI
ChatGPT
Postmark
npm
SolarWinds


Pen tests show AI security flaws far more severe than legacy software bugs

Summary: Penetration tests (security checks where experts try to break into systems) show that AI and large language model (LLM, advanced AI systems trained on huge amounts of text) systems have significantly more high-risk security flaws than traditional software, with 32% of AI findings rated high-risk compared to 13% for legacy systems. LLM vulnerabilities are also fixed less often, with only 38% of high-risk issues resolved, and experts attribute this to AI systems being deployed quickly without mature security controls, newer attack surfaces like prompt injection (tricking an AI by hiding instructions in its input), and unclear responsibility for fixing problems across teams.

Cobalt
HackerOne
OWASP
Zero Networks
Closed Door Security
Sumo Logic
Pentest-Tools.com

confidentiality integrity availability safety


Vulnerability in Claude Extension for Chrome Exposes AI Agent to Takeover

Summary: A vulnerability called ClaudeBleed in the Claude extension for Chrome allows attackers to take over the AI agent by exploiting weak permission checks and improper trust verification. The flaw lets any malicious Chrome extension send commands to Claude and use prompt injection (tricking the AI by hiding instructions in its input) to control its actions, potentially stealing data from Gmail or Google Drive or sending emails on the user's behalf.

Solution: Anthropic released a patch that added internal security checks to prevent extensions running in 'standard' mode from executing remote commands. However, LayerX noted this fix only partially addressed the issue, as attackers can switch the extension to 'privileged' mode to bypass the protection, and users are not notified or asked to approve this mode switch.

Anthropic
Claude
Claude for Chrome
Gmail
GitHub
Google Drive


CVE-2026-42271: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before vers

Summary: LiteLLM is a proxy server (an intermediary that forwards requests between clients and AI language model APIs) that had a critical vulnerability in versions 1.74.2 through 1.83.6. Two test endpoints allowed users to submit server configurations that could execute arbitrary commands (running any code an attacker wants) on the server itself, as long as they had a valid API key, even a low-privilege one.

Solution: This issue has been patched in version 1.83.7. Users should upgrade to version 1.83.7 or later.


CVE-2026-42261: PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.

Summary: PromptHub versions 0.4.9 to before 0.5.4 contain an SSRF vulnerability (server-side request forgery, where an attacker tricks the server into fetching URLs they control). An authenticated endpoint allows users to supply a URL that the server fetches and returns the response, but the security check meant to block private IP addresses (internal network addresses) can be bypassed using alternate IPv6 (internet protocol version 6, the newer internet addressing system) representations. Any registered user can exploit this, or anyone on the internet if registration is enabled.

Solution: Update to version 0.5.4 or later, which includes a patch for this vulnerability.


CVE-2026-42208: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before ver

Summary: LiteLLM, a proxy server (intermediary program that forwards requests to different AI APIs) versions 1.81.16 through 1.83.6, has a SQL injection vulnerability (a flaw where attackers insert malicious code into database queries by manipulating user inputs). An unauthenticated attacker could craft a fake Authorization header to read or modify data stored in the proxy's database, potentially gaining unauthorized access to stored API credentials.

Solution: Update to version 1.83.7 or later, where this issue has been patched.


CVE-2026-42203: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before vers

Summary: LiteLLM is a proxy server (a middleman that forwards requests to AI language model APIs) that had a security flaw in versions 1.80.5 through 1.83.6 in its POST /prompts/test endpoint. This endpoint took user-supplied prompt templates and ran them without sandboxing (isolating them in a restricted environment), allowing attackers with valid API keys to execute arbitrary code (running any commands they want) on the server, potentially stealing secrets like API keys or database passwords.

Solution: Upgrade to version 1.83.7 or later. According to the source: 'This issue has been patched in version 1.83.7.'


The AI jailbreakers – podcast

Summary: Major AI chatbots like ChatGPT, Gemini, Grok, and Claude have safety features designed to prevent them from producing harmful content such as hate speech, criminal instructions, and exploitation material. However, people called 'AI jailbreakers' deliberately try to bypass these safety restrictions, and journalist Jamie Bartlett explores why they do this and what it reveals about how large language models (AI systems trained on huge amounts of text data) actually work.


GHSA-39j6-4867-gg4w: utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Summary: The utcp-http plugin has a security flaw called SSRF (server-side request forgery, where an attacker tricks a server into making unwanted requests on their behalf) that lets attackers redirect the tool to access internal systems. An attacker can host a fake OpenAPI specification (a standard format describing API endpoints) on a legitimate HTTPS server, but include instructions to access internal addresses like cloud metadata servers. The plugin didn't properly validate these addresses before making requests, allowing attackers to expose sensitive data or internal services to the LLM.

Solution: Upgrade to utcp-http version 1.1.2. The patch adds a new security function called `ensure_secure_url()` that properly validates hostnames (not just string patterns) against a list of allowed addresses, and this validation is now performed both when manually registering tools and right before making requests. Users unable to upgrade should avoid calling `register_manual()` with any untrusted URLs and restrict outbound network access from the agent host to block access to internal addresses (RFC1918 private ranges, 169.254.0.0/16, and loopback addresses).


Cloudflare stock sinks 18% after earnings as company cuts 1,100 employees due to AI changes

Summary: Cloudflare's stock dropped 18% after the company announced it would cut 1,100 employees (20% of its workforce) because agentic AI (AI systems that can autonomously plan and execute tasks) has fundamentally changed what jobs the company needs. Despite beating earnings expectations with strong revenue growth of 34% year-over-year, CEO Matthew Prince stated that the company's AI usage increased over 600% in three months as it shifts to an AI-first operating model, making many current roles obsolete.


CVE-2026-35435: Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges

Summary: CVE-2026-35435 is a vulnerability in Azure AI Foundry M365 published agents where improper access control (weak rules about who can access what) allows an unauthorized attacker to gain higher privileges over a network. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) assessment that has not yet been provided by NIST.

Microsoft Azure AI Foundry
Azure AI Foundry M365


CVE-2026-33111: Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) all

Summary: CVE-2026-33111 is a command injection vulnerability (where an attacker inserts malicious commands into user input) in Copilot Chat for Microsoft Edge that could allow an unauthorized attacker to disclose information over a network. The vulnerability stems from improper handling of special characters in commands. No severity score has been assigned yet by NIST.


CVE-2026-32207: Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an

Summary: CVE-2026-32207 is a cross-site scripting vulnerability (XSS, where an attacker injects malicious code into a web page that gets executed in users' browsers) in Azure Machine Learning that allows an unauthorized attacker to perform spoofing (impersonating someone or something else) over a network. The vulnerability stems from improper handling of user input during web page generation.


CVE-2026-26164: Improper neutralization of special elements in output used by a downstream component ('injection') in M365 Copilot allow

Summary: CVE-2026-26164 is a vulnerability in Microsoft 365 Copilot caused by improper neutralization of special elements in output (a type of injection attack, where specially crafted input can be misinterpreted as commands). An attacker without authorization could exploit this to access and disclose information over a network.


CVE-2026-26129: Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over

Summary: CVE-2026-26129 is a vulnerability in Microsoft 365 Copilot where improper neutralization of special elements (failure to safely handle certain characters or code) allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0, indicating moderate severity.


OpenAI rolls out new model for cybersecurity teams a month after Anthropic's Mythos debut

Summary: OpenAI announced GPT-5.5-Cyber, a specialized version of its latest AI model designed for cybersecurity teams, which is being released in limited preview to vetted partners. Unlike the standard GPT-5.5 model, this version has relaxed safety restrictions to make it easier for security professionals to use it for tasks like vulnerability identification (finding weaknesses in software), patch validation (checking if security updates work), and malware analysis (studying malicious software). This release comes one month after rival Anthropic launched Claude Mythos, a similar AI tool also restricted to select cybersecurity organizations.

OpenAI
Anthropic
GPT-5.5-Cyber
Claude Mythos


CVE-2026-41691: Copilot said: i18nextify is a JavaScript library that adds
i18nextify is a JavaScript library that adds website internat

Summary: i18nextify is a JavaScript library that enables website internationalization (support for multiple languages) through a simple script tag. Versions before 3.0.5 have a URL-injection vulnerability (where attackers can manipulate URLs by injecting special characters) because the library doesn't properly validate language and namespace values before using them in web requests, allowing attackers to exploit this if an application accepts user input for language selection.

Solution: This issue has been fixed in version 3.0.5. If users cannot upgrade immediately, they can work around the issue by sanitising lng / ns before they reach i18next by stripping .., /, \, ?, #, %, whitespace, and control characters; and capping the length.


Ollama vulnerability highlights danger of AI frameworks with unrestricted access

Summary: Ollama, a popular framework for running AI models locally, has a critical vulnerability (CVE-2026-7482, called Bleeding Llama) that allows attackers to steal sensitive data like passwords, chat messages, and system secrets from over 300,000 exposed servers. The flaw lets unauthenticated attackers upload a specially crafted file that tricks Ollama into reading memory beyond its intended boundaries, and the vulnerability is easy to exploit because Ollama has no authentication enabled by default.

Solution: Users should update to Ollama version 0.17.1, which includes a patch for this vulnerability. Additionally, deploy an authentication proxy or API gateway (a security layer that controls access) in front of all Ollama instances and never expose them to the internet without IP access filters and firewalls. If your Ollama server was internet-accessible, assume environment variables and secrets in memory may be compromised and rotate API keys, tokens, and credentials immediately. On local networks, Ollama servers should be isolated on secure network segments and behind firewalls.


French prosecutors escalate probe of Elon Musk and X to criminal investigation

Summary: French prosecutors have escalated their investigation of Elon Musk and his social network X into a criminal probe, focusing on allegations of algorithmic manipulation (using computer programs to influence user feeds and information), spreading of nonconsensual sexually explicit deepfake images (synthetic media created without consent), and Holocaust denial content on X's AI chatbot Grok. Musk and former X CEO Linda Yaccarino were summoned to appear in April but declined to do so, and similar investigations are underway in other countries and by California authorities.


How to Disable Google's Gemini in Chrome

Summary: Google's Chrome browser automatically downloaded and installed Gemini Nano, a local AI model (an AI that runs directly on your computer rather than in the cloud) taking up about 4 GB of space, without clear user notification. Many users were unaware of this installation until recent reports highlighted the issue, raising concerns about transparency in how tech companies roll out AI features.

Solution: To disable Gemini Nano, open Chrome on your computer, click the 'More' menu (three vertical dots) in the top right corner, go to Settings, then System, and toggle 'On-device AI' to off. According to Google, "Once disabled, the model will no longer download or update." However, the source notes that directly uninstalling the file from the directory will cause Chrome to silently redownload it when the browser restarts, so using the settings toggle is the proper method. Be aware that disabling this feature will prevent certain security functions like on-device scam detection from working.


When prompts become shells: RCE vulnerabilities in AI agent frameworks

Summary: AI agent frameworks like Semantic Kernel, LangChain, and CrewAI let AI models control tools and plugins (software add-ons that perform actions like running scripts or accessing databases), but researchers discovered that prompt injection (tricking an AI by hiding instructions in its input) can turn into RCE (remote code execution, where an attacker runs commands on a system they don't own). Two critical vulnerabilities in Microsoft's Semantic Kernel (CVE-2026-25592 and CVE-2026-26030) could allow attackers to execute code on a host machine through malicious prompts.

Solution: The source states that the two vulnerabilities in Semantic Kernel "have since been fixed" but does not provide specific patch versions, mitigation steps, or technical details on how to address the vulnerabilities. The text mentions "responsible disclosure" and working with maintainers but does not explicitly describe how to patch or mitigate these issues. N/A -- no explicit mitigation or patch version details discussed in source.

Microsoft Semantic Kernel
LangChain
CrewAI
AI agent frameworks


llm-gemini 0.31

Summary: This is a brief announcement of llm-gemini version 0.31, posted by Simon Willison on May 7, 2026. The content appears to be metadata and navigation elements from a blog or news site covering developments in large language models (LLMs, AI systems trained on vast amounts of text data) and Google's Gemini AI model, rather than detailed technical information about the release itself.


Apple’s AirPods with cameras for AI are apparently close to production

Summary: Apple is developing AirPods with built-in cameras that are approaching production testing stages. The cameras won't take traditional photos or videos, but instead capture low-resolution visual information that users can ask Siri (Apple's AI assistant) to analyze, such as identifying what meals they could make with ingredients in front of them.


Worries About AI’s Risks to Humanity Loom Over the Trial Pitting Musk Against OpenAI’s Leaders

Summary: A legal trial between Elon Musk and OpenAI leaders centers on whether OpenAI broke promises to remain a nonprofit, but testimony has also highlighted broader AI safety concerns, including risks like job displacement, misinformation, and the potential dangers of AGI (artificial general intelligence, an advanced AI system that surpasses humans at many tasks). Expert witness Stuart Russell warned that the competitive race to develop AGI first poses a threat to humanity, though the judge has tried to keep the trial focused on the nonprofit dispute rather than AI's dangers.


ICYMI: April 2026 @AWS Security

Summary: This is a monthly digest of AWS security resources from April 2026 covering topics like AI security, identity management, and data protection. The posts provide practical guidance on securing agentic AI systems (AI systems that can act independently), implementing fine-grained access controls using ABAC (attribute-based access control, which grants permissions based on user characteristics rather than just roles), and defending against emerging threats like token abuse and privilege escalation attacks.

AWS
Amazon Bedrock
Amazon CloudWatch
Anthropic
Claude


ChatGPT’s ‘Trusted Contact’ will alert loved ones of safety concerns

Summary: OpenAI is launching an optional safety feature called 'Trusted Contact' that lets adult ChatGPT users designate an emergency contact (friend, family member, or caregiver) who will be notified if the AI detects concerning conversations about self-harm or suicide. The feature is designed to connect people in crisis with trusted people they know, working alongside existing mental health helplines.


Behind the Scenes Hardening Firefox with Claude Mythos Preview

Summary: Mozilla used early access to Claude Mythos (an advanced AI model) to find and fix hundreds of security vulnerabilities in Firefox that had gone undetected for years. The AI became much more useful for this task once the model became more capable and Mozilla developed better techniques for controlling the AI, filtering out false reports, and combining multiple AI analyses together.


Notes on the xAI/Anthropic data center deal

Summary: Anthropic has signed a deal with SpaceX/xAI to use all capacity from the Colossus 1 data center, which has a poor environmental record including unpermitted gas turbines that lack pollution controls and have been linked to increased hospital admissions from poor air quality. The deal also creates a potential supply chain risk (a vulnerability where a company depends on another company that could cut off essential services) since Elon Musk, who owns xAI, has stated he reserves the right to reclaim the compute if Anthropic's AI causes harm, with the criteria for 'harm' decided by Musk himself.

Anthropic
xAI
SpaceX
Elon Musk
Claude
Grok


GHSA-mcfx-4vc6-qgxv: BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

Summary: BentoML's `bentoml build` command has a symlink traversal vulnerability (following attacker-controlled symbolic links, which are shortcuts to files) that allows attackers to copy files from outside the build directory into the generated Bento artifact (the packaged application). If a developer builds an untrusted repository, an attacker can hide a symlink pointing to sensitive files like credentials or API tokens, and these files will be copied into the final package where they could be leaked through export or upload workflows.


How Anthropic’s Mythos has rewritten Firefox’s approach to cybersecurity

Summary: Anthropic's Mythos model, an advanced AI system for finding bugs, has dramatically improved Firefox's ability to discover software vulnerabilities (flaws in code that attackers can exploit), unearthing thousands of high-severity bugs including some hidden for over a decade. Unlike older AI bug-finding tools that produced many false positives (incorrect alerts), Mythos uses agentic systems (AI that can assess and filter its own work) to deliver higher-quality results, leading Firefox to ship 423 bug fixes in April 2026 compared to 31 a year earlier. However, Mozilla's engineers still manually write and review patches rather than deploying AI-generated code directly, as they have not found the fix-writing process automatable.


Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking

Summary: Attackers can steal OAuth tokens (digital keys that grant access to connected services) from Claude Code, an AI system that performs tasks autonomously, through a man-in-the-middle attack (intercepting communication between two parties). The attack involves installing a malicious npm package that modifies Claude Code's configuration file to redirect all traffic through the attacker's infrastructure, allowing them to capture tokens while remaining undetected.


OpenClaw and Claude can put your AI-generated podcasts in Spotify

Summary: Save to Spotify is a command-line tool (a program you run through text commands rather than clicking buttons) that lets AI agents like Claude Code create audio summaries and podcasts that automatically save to your Spotify library. Users can set it up by downloading the tool from GitHub and then asking their AI to create content with the instruction to 'save to Spotify,' and the resulting podcast will appear in their Spotify feed alongside regular episodes.


Attackers Could Exploit AI Vision Models Using Imperceptible Image Changes

Summary: Researchers at Cisco discovered that attackers can manipulate vision-language models (AI systems that read and interpret images) by making tiny, imperceptible changes to image pixels that humans cannot see. These changes can make hidden malicious instructions embedded in images readable to the AI, allowing attackers to trick the AI into following commands like stealing data, while content filters and humans see only visual noise or blurry content.

Cisco OpenAI GPT-4o Claude Qwen JinaAI SigLIP


An Integrated Speech Tampering Detection Framework With Deep Neural Networks

Summary: Malicious actors can now manipulate recorded speech using AI tools through techniques like copy-move forgery and splicing (inserting audio segments), creating fake voices and spreading misinformation. Researchers developed an integrated detection framework (IDF), a system combining multiple deep neural networks (computer models inspired by how brains learn) to both detect when speech has been tampered with and identify what type of tampering was used, achieving over 95% accuracy across multiple languages.


Automatic Red Teaming LLM-Based Agents With Model Context Protocol Tools

Summary: LLM-based agents now use MCP tools (model context protocol tools, standardized connectors that let AI agents interact with external programs and services) to access external resources, but this creates a security vulnerability called tool poisoning attacks, where malicious MCP tools can trick these agents into behaving in harmful ways. Researchers developed AutoMalTool, an automated red teaming framework (a security testing approach where researchers simulate attacks to find weaknesses) that generates malicious MCP tools to expose these vulnerabilities in mainstream LLM-based agents.


'TrustFall' Convention Exposes Claude Code Execution Risk

Summary: A security issue called 'TrustFall' allows malicious code repositories to execute code in Claude Code, Cursor CLI (a code editor tool), Gemini CLI, and CoPilot CLI (command-line interfaces for AI coding tools) with little or no user action needed, because the warning messages shown to users are minimal and easy to ignore. This means an attacker could potentially run harmful code on a developer's computer without much effort.

Claude Code
Cursor CLI
Gemini CLI
CoPilot CLI
Google Gemini
Microsoft Copilot


Scaling Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber

Summary: OpenAI released GPT-5.5 and a specialized version called GPT-5.5-Cyber with Trusted Access for Cyber (TAC), a framework that verifies the identity of cybersecurity defenders and gives approved users lower refusal rates so they can perform defensive security tasks like vulnerability analysis and malware detection. The system maintains safeguards to block malicious activities like credential theft and system exploitation, and requires users to have phishing-resistant authentication (protection against attacks where hackers trick users into revealing passwords) by June 2026.

Solution: The source explicitly mentions one safeguard: "Individual members of Trusted Access for Cyber accessing our most cyber capable and permissive models will be required to enable Advanced Account Security beginning June 1, 2026. Organizations with trusted access can, as an alternative, attest that they have phishing resistant authentication as part of their single sign-on workflow." No other mitigation or fix beyond this account security requirement is discussed in the source.


AMD's big day, Anthropic-SpaceX deal, the jet fuel crisis and more in Morning Squawk

Summary: Anthropic, an AI startup, announced a deal to use all the computing power from SpaceX's Colossus 1 data center in Tennessee to improve service for its paid Claude Pro and Claude Max subscribers. The deal will give Anthropic access to significant computational resources (the processing power needed to run AI models) to better handle demand from paying customers.

AMD
Anthropic
SpaceX
McDonald's
Disney
Uber
McLane
United Airlines
Southwest Airlines
American Airlines
Goldman Sachs
Nvidia


Bots in translation: Can AI really fix SIEM rule sprawl across vendors?

Summary: Enterprises migrating between different SIEM platforms (security information and event management systems, which collect and analyze security data) struggle because each vendor uses different query languages and data models, requiring manual rule rewrites. Researchers developed ARuleCon, an AI system that can automatically translate detection rules across platforms while preserving their detection logic, improving accuracy by 10-15% over standard AI approaches. However, security experts debate whether the problem truly needs AI, since manual translation is slow but some argue deterministic engineering (rule-based programming without AI) could solve it.

Solution: ARuleCon combines AI-driven reasoning with deterministic approaches by using AI to infer detection intent and iteratively refine translated rules while constraining outputs through syntax validation and semantic checks. According to the researchers, the system is not intended to replace deterministic approaches entirely, but to combine "their reliability with the flexibility of AI-driven reasoning."

Splunk
Microsoft Sentinel
IBM QRadar
Google Chronicle


Privacy Against Agnostic Inference Attacks in Vertical Federated Learning

Summary: This academic paper examines privacy risks in vertical federated learning (a machine learning approach where different organizations each hold different features of the same data and train a model together) when facing agnostic inference attacks (attacks where the attacker doesn't know the model's structure in advance). The paper analyzes how attackers could potentially infer private information from the shared computations in this system.


Parloa builds service agents customers want to talk to

Summary: Parloa has built an AI Agent Management Platform (AMP) that helps businesses create and manage customer service AI agents without coding, using large language models (LLMs, AI systems trained on huge amounts of text data) like GPT-5.4. The platform lets non-technical teams define agent behavior in plain language, then tests agents through simulations (one AI model acting as a customer, another as the agent) before deploying them to handle real customer interactions. Parloa continuously monitors live conversations and updates the platform with newer model versions when they perform better in real-world use.


Gemini CLI Vulnerability Could Have Led to Code Execution, Supply Chain Attack

Summary: Gemini CLI (Google's open source AI agent for terminal access to the Gemini AI assistant) had a critical vulnerability with a CVSS score of 10/10 that could have allowed attackers to inject malicious prompts into GitHub issues, causing the AI agent to execute unauthorized commands and steal secrets from the build environment in a supply chain attack (compromising software distributed to many users). The vulnerability existed because the --yolo mode (which auto-approves all tool calls without user confirmation) ignored tool allowlists (restrictions on what actions the AI could perform), and Google fixed it in version 0.39.1 by properly enforcing those restrictions.

Solution: Google addressed the vulnerability on April 24 in Gemini CLI version 0.39.1, which evaluates tool allowlisting under --yolo mode. The run-gemini-cli GitHub Action was also updated. The same version resolved a separate trust issue in headless mode (where the AI runs without user interaction) that was automatically loading configuration and environment variables from the current workspace folder.