Boston Children’s uses AI to unlock new diagnoses

Summary: Boston Children's Hospital integrated AI (artificial intelligence) across its entire organization as a core part of clinical and operational work, rather than treating it as a separate experiment. By building an enterprise AI layer (a shared, secure internal AI system used across teams) and redesigning workflows in areas like supply chain and surgical scheduling, the hospital has diagnosed over 40 previously unresolved rare conditions, saved approximately 60,000 hours of staff time, and enabled more than one-third of employees to use AI daily in their work.


How Braintrust turns customer requests into code with Codex

Summary: Braintrust, an AI observability company, uses Codex (OpenAI's code-generation AI model) to quickly turn customer feature requests into working preview branches in minutes, with half the team adopting it within one month. The speed of Codex enables faster feedback loops with customers and allows engineers to test ideas in real time rather than letting requests sit in a backlog. Codex's ability to handle large amounts of text output without slowing down makes it more effective than other models for this workflow.

Solution: N/A -- no mitigation discussed in source.


What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks

Summary: Employees are using AI-driven development platforms (vibe coding, where non-programmers build working applications by describing what they want) to quickly build custom applications and connect them to company systems, then publish them on the public internet without involving security teams or implementing basic access controls. A study found over 2,000 such exposed applications containing sensitive data across major companies, sitting unprotected because traditional security tools like EDR (endpoint detection and response, software that monitors what happens on company devices) and DLP (data loss prevention, software that blocks sensitive information from leaving the company) were designed to catch different types of threats and don't detect these cloud-to-cloud connections or applications built in web browsers.


Adobe’s conversational AI agent is a mediocre design intern

Summary: Adobe's Firefly AI Assistant is a conversational AI agent designed to automate tasks within Adobe's design software while keeping users in control of the creative process, unlike traditional AI image generators that work independently. The assistant acts as a multitasking middleman that can operate design apps on behalf of users, though early testing suggests the results are not particularly impressive despite the tool's thoughtful approach to preserving creative control.


GDPR set the tone for regulatory action — and the AI fine pushback to come

Summary: Big tech companies are legally challenging GDPR (General Data Protection Regulation, Europe's data protection law) fines, with nearly 40% of the €7.1 billion in fines announced over eight years either annulled or under appeal. While GDPR successfully established a global 72-hour breach notification standard (the requirement that organizations tell people within three days if their data is stolen), experts note the framework has structural weaknesses that companies exploit in court, and upcoming AI regulations may face similar challenges.


Shadow AI: The Hidden Risk Expanding Across the Enterprise

Summary: Organizations are rapidly adopting unauthorized AI tools without proper security oversight, creating 'shadow AI' (unsanctioned AI use that bypasses governance controls) that exposes sensitive data and creates new attack surfaces. Traditional security tools like firewalls and Zero Trust architecture (a security model that requires verification for every access request) cannot detect AI-specific threats such as prompt injection (tricking an AI by hiding malicious instructions in its input), leaving companies vulnerable to data leaks, compliance failures, and attacks that exploit AI systems.

Solution: CrowdStrike Falcon AI Detection and Response (AIDR) is designed to provide visibility, control, and protection for AI-driven environments and can identify and stop AI-specific threats such as prompt injection.


Strengthening societal resilience with Rosalind Biodefense

Summary: OpenAI is launching Rosalind Biodefense, a program that gives vetted developers access to GPT-Rosalind (a reasoning model trained for life sciences) to build defensive tools against biological threats like pandemics. The company is also expanding trusted access to this model for select U.S. government and allied partners working on public health and biodefense, supported by safety measures like capability assessments, expert red teaming, and security controls to prevent misuse.


Anthropic's run-rate revenue hits $47 billion

Summary: Anthropic, an AI company, announced that its run-rate revenue (an annualized projection based on current monthly earnings) has grown to $47 billion as of May 2026, up from $30 billion in April 2026. This represents extraordinarily rapid growth, with the company increasing its run-rate revenue more than 10 times annually over the past three years, driven by widespread adoption among enterprise customers.


IBM and Red Hat want to become the ‘security clearinghouse’ for open source applications in the enterprise

Summary: IBM and Red Hat announced Project Lightwell, a $5 billion initiative to create an AI-powered 'security coordination layer' that helps enterprises discover and fix vulnerabilities (security weaknesses) in open source software faster. The clearinghouse will deliver validated patches directly into existing software supply chains without requiring upgrades, starting with Java/Maven code and eventually expanding to other programming languages.

Solution: Project Lightwell will backport fixes (apply patches to older versions) to exact dependency versions that have already been tested and deployed, operate on configuration manifests like pom.xml so code remains in controlled enterprise environments, and deliver fixes across dependency chains. Enterprises will receive validated patches spanning Red Hat platforms and independent community code, and can share fixes upstream through a 'secure map' so the wider open-source community can incorporate them.


Anthropic confirms Claude Mythos-class models will roll out to the public

Summary: Anthropic announced plans to release Claude Mythos-class models (powerful AI systems initially restricted due to security concerns) to the general public in the coming weeks. The company stated it has developed strong guardrails (safety measures to prevent misuse) and is making progress on safeguards before the public rollout, though it has not specified an exact timeline.

Anthropic
Claude
Claude Mythos
Claude Opus


A shared playbook for trustworthy third party evaluations

Summary: This document outlines best practices for evaluating frontier AI models (advanced AI systems at the cutting edge of capability) through independent third-party assessments. Modern frontier models are more complex than simple chatbots because they can use tools, maintain information across multiple steps, and operate within larger workflows, so evaluations must account for the "harness" (the surrounding setup and environment) that can significantly affect performance. Evaluation reports should clearly state what claim is being tested (such as whether a model can perform a capability, how robust its safety features are, or how it compares to other models) and provide evidence that the results are valid by addressing potential issues like reward hacking (exploiting shortcuts in scoring), contamination (overperforming due to exposure to similar tasks in training data), and sandbagging (deliberately underperforming when aware of being evaluated).


Claude Opus 4.8: "a modest but tangible improvement"

Summary: Anthropic released Claude Opus 4.8 on May 28, 2026, describing it as a modest incremental improvement over its predecessor. A key advancement is improved honesty: the model is about four times less likely than the previous version to overlook flaws in code it writes, and it achieves lower factual hallucination rates (incorrect answers) primarily by declining to answer questions when uncertain rather than attempting to answer more questions.


llm-anthropic 0.25.1

Summary: The llm-anthropic tool (a command-line program for using Anthropic's Claude AI models) was updated to version 0.25.1, adding support for a new Claude Opus 4.8 model and a fast mode option for users with that feature enabled. The update also changed how the tool handles max_tokens (the maximum number of words the AI can generate in a single response) by making it default to each model's actual maximum instead of a fixed 8,192 limit.


GreyVibe hackers use ChatGPT, Gemini to power cyberattacks

Summary: A threat group called GreyVibe, likely linked to Russia, has been running cyberattacks since August 2025 against Ukrainian and other organizations using AI-generated fake content and custom malware tools. The group uses ChatGPT, Gemini, and other AI tools to create realistic phishing lures (fake websites and emails impersonating legitimate organizations), and likely uses AI to help develop malware like LegionRelay (a remote access trojan, or RAT, which lets attackers control a victim's computer from afar) and FallSpy (Android spyware that steals personal data). Researchers say the attackers show less sophistication than typical state-sponsored groups and may include current or former cybercriminals.


Okta jumps 8%, tops first-quarter results on agentic AI demand

Summary: Okta, a company that provides identity security tools (software that verifies who users are and controls access to systems), reported strong earnings driven by increased demand from companies building agentic AI (AI systems that can independently perform tasks and make decisions). CEO Todd McKinnon emphasized that while agentic AI is boosting interest in Okta's security products, the company is preparing for long-term infrastructure needs rather than chasing short-term profits.


Anthropic tops OpenAI as most valuable AI startup, nears $1 trillion valuation in latest round

Summary: Anthropic, an AI company that makes Claude (a large language model, or LLM, which is software trained on huge amounts of text to generate human-like responses), has become the most valuable AI startup in Silicon Valley after raising $65 billion in funding, pushing its valuation to $965 billion and surpassing competitor OpenAI. The company's valuation jump is driven by strong revenue from Claude Code, an AI coding assistant, which reached a $47 billion annual run rate. Anthropic is now preparing for an initial public offering (IPO, when a private company sells shares to the public to raise money), alongside other major AI companies.

Anthropic
Claude
Claude Code
Claude Opus 4.8
Claude Mythos Preview
OpenAI
SpaceX
SpaceXAI
Mistral


Microsoft 365 Copilot gets a speed boost and cleaner design

Summary: Microsoft is releasing an updated version of Microsoft 365 Copilot (an AI assistant integrated into Microsoft's productivity tools) with a faster loading time and redesigned interface. The new version uses progressive disclosure (showing only relevant tools based on what you ask for, rather than all options at once) and includes an improved prompt box that lets you format text directly.


Anthropic reaches valuation of $965bn, beating OpenAI to become world’s most valuable AI firm

Summary: Anthropic, the company behind Claude (a large language model, or LLM, which is an AI trained on massive amounts of text to generate human-like responses), raised $65 billion in funding and is now valued at $965 billion, making it the world's most valuable AI startup. The company's growth has been driven by widespread adoption of its products by large businesses, especially after releasing powerful coding tools recently.


GHSA-27vp-2mmc-vmh3: nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

Summary: A sandbox escape vulnerability in nono (a sandboxing tool using Landlock/seccomp, which are Linux security features that restrict what programs can do) allows processes running inside the sandbox to break out by communicating with systemd D-Bus sockets (the inter-process communication system that manages user services). An AI agent or untrusted tool with bash access could exploit this to write files or run commands outside the sandbox with the user's permissions.

Solution: The source states: 'Support for restricting this behavior has since been added and the fix is available in the repository pending release.' However, no specific version number, patch details, or explicit mitigation steps are provided in the text.


CVE-2026-4944: vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in t

Summary: vLLM version 0.14.1 has a security flaw where a setting called `trust_remote_code` is permanently turned on in two model files, even when users try to turn it off. This allows RCE (remote code execution, where attackers can run harmful code on your computer) through malicious models downloaded from HuggingFace, a popular model repository. This is a partial fix attempt for two earlier vulnerabilities that didn't fully solve the problem.


Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks

Summary: GreyVibe is a Russia-linked hacking group that uses AI tools like ChatGPT and Google Gemini across all stages of attacks, from creating fake websites to building custom malware, targeting Ukrainian military and government entities since August 2025. Although the group appears less sophisticated than elite state actors (evidenced by design flaws in their AI-generated malware and casual naming conventions), they leverage AI to operate at a much higher capability level than their technical skill would normally allow. Researchers expect GreyVibe's AI expertise and attack complexity to continue increasing over time.


GHSA-995v-fvrw-c78m: opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

Summary: OpenTelemetry Go's `ParseFile` function has a file descriptor leak (a reference to an open file that is never closed), where each call to parse a schema file leaves the file open in memory. In a long-running application that repeatedly parses schema files, these open files can accumulate until the process runs out of available file descriptors and crashes, causing a denial of service (unavailability).

go.opentelemetry.io/otel/schema/v1.0@<= 0.0.16 (fixed: 0.0.17)

go.opentelemetry.io/otel/schema/v1.1@<= 0.0.16 (fixed: 0.0.17)


Geordie Raises $30 Million for AI Security and Governance Platform

Summary: Geordie, an AI security startup, raised $30 million to expand its platform that helps organizations monitor and control AI agents (AI systems designed to complete tasks independently) deployed across their systems. The platform provides real-time visibility into agent behavior and risks, while its Beam tool uses context engineering (a technique that shapes how AI systems understand and respond to instructions) to constrain agent behavior at scale.


GHSA-5wrp-cwcj-q835: opentelemetry-go's baggage parsing no longer caps raw header length

Summary: A removed safety check in OpenTelemetry Go's baggage parsing (the mechanism for passing contextual data between services) allows attackers to send extremely large or malformed baggage headers that consume excessive CPU and memory while being fully processed and logged, creating a denial-of-service vulnerability. The parser no longer rejects oversized inputs upfront and instead processes every invalid member completely, sending errors to the logging system by default.

go.opentelemetry.io/otel/propagation@= 1.43.0 (fixed: 1.44.0)

go.opentelemetry.io/otel/baggage@= 1.43.0 (fixed: 1.44.0)

go.opentelemetry.io/otel/propagation@= 1.41.0 (fixed: 1.42.0)

go.opentelemetry.io/otel/baggage@= 1.41.0 (fixed: 1.42.0)


Claude’s new model is more ‘honest’ when it messes up

Summary: Anthropic is releasing Claude Opus 4.8, a new AI model designed to be more 'honest' by better recognizing when it doesn't have enough information to answer confidently. The model addresses a common problem where AI systems make unsupported claims (stating things as fact without solid evidence), and early testers found that Opus 4.8 is about 4 times less likely to do this compared to its predecessor.


Agentic AI Isn't Risky; the Way Orgs Deploy It Is

Summary: AI agents (AI systems that can take actions by using external software tools) aren't inherently dangerous, but the risk comes from how they're set up and deployed in organizations. The main concern is the overlap between what the AI can do and what tools it has access to, which can create security vulnerabilities if not managed carefully.


These new iOS 27 renders hint at Siri’s big redesign

Summary: Apple is planning a major redesign of Siri, its voice assistant, for iOS 27, which may feature a ChatGPT-like chat interface. The redesign shows a pill-shaped chat bubble that appears from the Dynamic Island (the notch area on iPhones) with options to choose between Ask, Siri, and ChatGPT, though Apple has not officially confirmed these details and the final design may differ.


Rivian’s software chief thinks you don’t need CarPlay or buttons

Summary: Wassym Bensaid, Rivian's chief software officer, leads both Rivian's internal software development and RV Tech, a joint venture with Volkswagen that builds the operating system and electrical architecture for future electric vehicles from Volkswagen Group brands. Rivian recently launched an AI-powered voice assistant in its R1 vehicles and is preparing to release the R2, the first car built on the new shared architecture developed through the joint venture. The article discusses how Rivian is moving toward AI-powered, agent-like software platforms in cars while reducing reliance on traditional physical controls and Apple CarPlay integration.


The Autonomous Security Platform Built for Attacker Speed

Summary: Attackers are increasingly using AI agents (autonomous software that can act independently) to find and exploit security vulnerabilities much faster than before, with the time from a vulnerability becoming public to actual attacks dropping from 2.3 years in 2018 to about 10 hours in 2026. Organizations continue to suffer breaches due to common problems like misconfigurations (incorrect security settings), unpatched systems (software without the latest security fixes), and identity sprawl (too many user accounts and access permissions), not because they lack awareness of these issues but because fixing them at scale is difficult.


How Endava builds an agentic organization with Codex

Summary: Endava, a software contracting firm, uses Codex (an AI tool for code generation and software development) to transform into an 'agentic organization' where AI agents work alongside teams throughout project lifecycles. The tool enables small teams to deliver large amounts of work faster by codifying senior expertise into guidance for junior developers, compressing weeks of sequential analysis and design work into days, and improving knowledge transfer across the organization.


New AI Usage Report: Enterprise AI Risk Is Heavily Concentrated Among a Small Group of AI "Power users"

Summary: A LayerX Security report shows that enterprise AI risk is not spread evenly across workers but is concentrated among a small group of "power users" (employees who use AI much more frequently and deeply than average) and a few dominant platforms like ChatGPT and Copilot. While most employees use AI casually, the top 5% of users generate far more AI conversations and sensitive data exposure, and AI tools are fragmenting across many unmanaged platforms like personal accounts and browser extensions, making it hard for organizations to see and control where their data goes.

ChatGPT
Copilot M365
Gemini
Gemini Enterprise


Raising the Cybersecurity Stakes: Ante up for the Agentic Era

Summary: Organizations are rapidly adopting AI agents (autonomous systems that can execute tasks and make decisions without human intervention), but this creates serious security risks that traditional defenses cannot match. Threat actors are developing agentic attacks (cyberattacks powered by AI that learn and adapt autonomously) that move faster than human security teams can respond, while AI agents themselves lack the judgment to avoid harming their own enterprises. The security industry must evolve from manual fixes to automated, scaled remediation strategies to defend against machine-speed attacks.


The AI governance imperative you can’t afford to ignore

Summary: Many organizations are deploying AI agents (autonomous software systems that make decisions with minimal human oversight) without proper observability (visibility into how they work) or governance processes, creating serious risks. The article highlights that 54% of surveyed organizations cannot fully trace what their agents are doing, and traditional security tools were designed to detect human anomalies rather than rogue agents, making them ineffective for agent monitoring.

Solution: According to the source, organizations should implement: least-privilege scoped tool permissions (limiting what actions agents can perform), policy enforcement layers that review every prompt and tool call, end-to-end tracing (detailed logs that record prompts, tool calls, and downstream actions), and tiered autonomy (giving agents free rein on low-stakes tasks while requiring human approval for consequential decisions). The source also emphasizes that organizations need centralized agent inventory and governance layers, and must collect detailed execution traces to enable transparency and make governance signals actionable.

Google
NVIDIA
Guardrail Technologies
TrueFoundry


This AI stock is surging after an ex-OpenAI employee's fund disclosed a stake. Here's why

Summary: Nebius, a cloud provider that supplies GPUs (graphics processing units, the specialized chips used to train AI models), saw its stock rise after a hedge fund founded by a former OpenAI researcher disclosed a 5.6% ownership stake in the company. Nebius has become a major provider of AI computing infrastructure in Europe, recently securing major partnerships including a $27 billion deal with Meta and a $2 billion investment from Nvidia.

OpenAI
Nebius
Yandex
Meta
Nvidia
Leopold Aschenbrenner
Situational Awareness


Google Unveils AI Threat Defense Platform to Fight AI-Powered Cyberattacks

Summary: Google Cloud announced AI Threat Defense, a new security platform that uses AI to automatically detect and stop cyberattacks powered by AI before they cause damage. The platform combines threat intelligence, cloud security scanning, and code repair tools (powered by Google's Gemini AI model) to find weaknesses in software, predict attack paths, and deploy security fixes within minutes rather than days.

Solution: Google describes AI Threat Defense's four-step framework: (1) map environments and make sensitive assets unreachable from the internet; (2) conduct deep-dive code analysis and AI-driven testing to find vulnerabilities in internet-accessible applications and business-critical systems; (3) use AI agents to generate and test patches, with CodeMender automatically creating fixes in developers' tools at build time and tagging libraries across source control and production; and (4) implement machine-speed detection and real-time defense with consistent operational tracking. Google states this approach reduces remediation time to minutes by proactively generating verified fixes before attackers can exploit vulnerabilities.

Google Cloud
Google
Gemini
CodeMender
Mandiant
Wiz
Antigravity


Mistral to explore designing own chips, CEO says, as it ramps up infrastructure build

Summary: Mistral AI, a French startup competing with OpenAI and Anthropic, is exploring the design of its own semiconductor chips to reduce costs and gain more control over its infrastructure, though it currently relies on Nvidia chips. The company is also expanding data centers in France and Sweden, and launching a new enterprise platform called Vibe that uses agentic AI (systems that can autonomously complete tasks like coding and drafting) to help customers with work tasks.

Mistral AI
OpenAI
Anthropic
Amazon
Google
NVIDIA


Survey on Explainable AI for Traditional Machine Learning and Domains

Summary: This is an academic survey article that reviews methods for making traditional machine learning models more explainable and interpretable across different fields. The survey covers techniques that help users understand how machine learning models make decisions, rather than treating them as "black boxes" where the reasoning is hidden. It was published in a peer-reviewed computer science journal in September 2026.


OpenAI’s Frontier Governance Framework

Summary: OpenAI has published a Frontier Governance Framework that describes how its safety and security practices meet new legal requirements from California and the EU, building on its existing Preparedness Framework for managing risks from advanced AI systems. The framework covers risk assessment and mitigation in areas like cyber attacks, dangerous biological/chemical/nuclear risks, manipulation, and loss of control, along with model reporting and incident response. OpenAI says it will update this framework as AI capabilities and regulations evolve.


MUFG aims to become AI-native with OpenAI

Summary: MUFG, one of Japan's largest financial groups, is partnering with OpenAI to become an AI-native company (an organization where AI is integrated into everyday work processes) by rolling out ChatGPT Enterprise to approximately 35,000 employees at Mitsubishi UFJ Bank starting in 2026. The bank chose ChatGPT Enterprise for its broad applicability and enterprise-grade security (security features designed for large organizations), and paired the technology rollout with mandatory employee training, custom workshops, and guidance to help workers understand how to use AI confidently and in compliance with financial regulations.

Solution: OpenAI worked with MUFG on security requirements by offering concrete proposals through product improvements and updates to address security and governance barriers. Additionally, OpenAI supported the rollout through guidance for enterprise use, operational planning, product education, training programs for all employees, custom GPT workshops, and executive study sessions. MUFG also implemented mandatory AI training, requiring employees to complete e-learning before they could use ChatGPT Enterprise.

OpenAI
ChatGPT Enterprise
Mitsubishi UFJ Bank
MUFG


Another IT governance headache: AI-enabled sanction evasion

Summary: Governments and private companies must quickly adapt their security practices as adversaries use AI to evade financial sanctions and finance weapons of mass destruction, with countries like North Korea and Iran now deploying AI models to create fraudulent documents, manage fake company networks, and hide cryptocurrency transactions. AI is making these illegal activities faster, higher quality, and more coordinated, shifting from AI-assisted evasion (using AI for individual tasks like writing emails) to AI-enabled evasion (where AI orchestrates entire deception schemes across multiple systems and channels). Enterprise IT managers face a critical challenge because traditional security boundaries designed for human attackers are being bypassed by automated technologies.

Solution: Dr. Aaron Arnold advises IT managers to protect their organizations by "incorporating defensive AI, the use of behavior-based analytics, using 'circuit breakers' when there is heavy use of API or MCPs (management control planes, systems that oversee how applications connect), updating personnel training, and hardening identity verification, especially for any remote hiring."


Out of the Crypt: The Evolving Cyber Extortion Economy

Summary: Cybercriminals are increasingly using data theft and extortion without encryption (ransomware, a type of malware that locks files until payment is made), shifting from the 90% encryption rates seen in 2021-2024 to just 78% in 2025. This change is driven by better backup systems, stricter regulations like GDPR's 72-hour reporting requirement, and the fact that data exposure alone now costs organizations an average of $5.08 million in fines and lawsuits. Threat actors are particularly targeting mid-sized firms in Professional Services, Healthcare, and Construction, focusing on valuable business data like financial records and bids.


AI models more vulnerable than claimed when faced with iterative attacks

Summary: A Cisco study found that popular AI models from OpenAI, Anthropic, Google, and others are much more vulnerable to attack when faced with multiple prompts in a conversation compared to single-prompt tests. Current safety benchmarks (standardized tests that measure how well models resist harmful requests) only test models with one prompt at a time, but real attackers use iterative techniques like role-playing, breaking tasks into smaller steps, and gradually escalating requests across multiple turns, which bypass safety guardrails far more effectively than official scores suggest.

OpenAI Anthropic Google Meta Microsoft Amazon Mistral

OpenAI
Anthropic
Google
xAI
Amazon
Meta
Mistral
Alibaba
DeepSeek
Zhipu
Microsoft
Claude Opus
GPT-5.4
Gemini 3 Pro
Grok 4.1
Nova Lite
Nova Lite 2
Nova Micro


CVE-2026-45136: claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.

Summary: claude-code-cache-fix is a tool that speeds up Claude Code by caching results. Versions 3.5.0 through 3.5.1 have a code injection vulnerability (CWE-94, inserting malicious code into a program) in a file called tools/quota-statusline.sh, where user input containing certain byte sequences (''') can break out of a Python string and execute arbitrary code on the user's system. This is a high-severity bug that affects local attackers who can control the input to Claude Code.

Solution: This vulnerability is fixed in version 3.5.2. Users should update to claude-code-cache-fix 3.5.2 or later.


v2026.05

Summary: ATLAS v2026.05 introduces a major structural overhaul that separates versioning for content updates from format changes, moving to a new YAML format (v6.0.0) with improved consistency and relationship handling. The update adds support for multiple AI platforms (Predictive, Generative, Agentic, and Enterprise) to techniques and introduces new tooling including Pydantic schemas (strict data validation), SQLAlchemy ORM models (database storage), and a FastAPI REST API (web service for managing the data). Historical ATLAS releases have been migrated and preserved in the new structure.


GHSA-mxfr-6hcw-j9rq: Langroid has Prompt to SQL Injection, Leading to RCE

Summary: Langroid versions before 0.63.0 have a vulnerability where SQLChatAgent (a tool that lets an AI execute SQL queries) can be tricked through prompt injection (hiding malicious instructions in input data) into running dangerous SQL commands. If the database is configured with elevated privileges, an attacker can achieve RCE (remote code execution, where an attacker runs commands on a system they don't own) on the database server, potentially stealing or deleting data.

Solution: Fixed in v0.63.0 by defaulting SQLChatAgent to a SELECT-only sqlglot-parsed statement allowlist (a list of approved SQL operations) with a dialect-aware dangerous-pattern blocklist. Users can restore the previous unrestricted behavior by setting allow_dangerous_operations=True, but only for trusted deployments.


CVE-2026-45046: Gryph provides a security layer for AI coding agents. Prior to 0.7.0, Gryph implements logging levels that determine wha

Summary: Gryph is a security tool that protects AI coding agents (software that writes code with AI help) by controlling what information gets saved to a local database. Before version 0.7.0, Gryph's documentation incorrectly stated that logging (recording activity) was set to a minimal level by default, but it was actually set to standard, causing sensitive file content to be stored in the database even though Gryph was supposed to filter it out.

Solution: This vulnerability is fixed in version 0.7.0.


PacketPatch: Practical generation and deployment of adversarial packets for byte-feature-based encrypted traffic classification

Summary: Researchers have developed PacketPatch, a method for creating adversarial packets (malicious network data designed to fool AI systems) that can deceive byte-feature-based encrypted traffic classification systems (AI models that identify what type of network traffic is flowing through encrypted connections by analyzing raw data patterns). The work demonstrates how attackers could potentially manipulate encrypted network communications to evade detection by these AI-powered security systems.


I think Anthropic and OpenAI have found product-market fit

Summary: OpenAI and Anthropic have shifted their enterprise pricing models away from discounted per-seat plans to usage-based API pricing (paying for every token, a unit of text processed by the AI model), making enterprise costs equivalent to their public API rates. Both companies released new, more expensive AI models in April 2026 and locked enterprise customers into year-long contracts at these higher prices, suggesting they have found a profitable business model with coding agents and enterprise customers willing to pay $200+ per month per user.

OpenAI
Anthropic
ChatGPT
Claude Code
Codex
Claude Cowork
GPT-5.5
GPT-5.4
Opus 4.7
Opus 4.6


Malicious npm Package Stole Files From Claude AI User Directory via GitHub

Summary: Researchers discovered a malicious npm package (a collection of code shared through Node Package Manager, a repository for JavaScript libraries) called "mouse5212-super-formatter" that steals files from Claude AI users' directories. The package disguises itself as a legitimate tool but actually uploads files to a threat actor-controlled GitHub account by authenticating with stolen or hard-coded credentials during installation.


AI tried to bury this politician — now people have actually heard of him

Summary: OpenAI and other AI companies have spent millions through a political action committee to oppose Alex Bores, a New York state assemblyman who wrote AI safety regulations, inadvertently making him more famous and turning him into a prominent figure in the AI regulation debate. The article suggests this corporate spending against Bores has backfired by drawing public attention to him and the issue of who should regulate AI technology.


CVE-2026-48545: Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Spa

Summary: Gradio versions before 6.15.0 have a cookie injection vulnerability that lets attackers perform session fixation (tricking a system into using a fake session ID) across multiple user spaces. An attacker controlling one Gradio Space can inject a cookie into a shared HTTP client (a tool that sends web requests) that automatically gets sent to all other legitimate Spaces, affecting every user on that Gradio deployment.

Solution: Update Gradio to version 6.15.0 or later. The vulnerability is fixed in the release available at https://github.com/gradio-app/gradio/releases/tag/gradio%406.15.0.


FastAPI-based AI tools exposed to authentication bypass by flaw in Starlette framework

Summary: A flaw in Starlette (CVE-2026-48710), the framework that powers FastAPI, allows unauthenticated attackers to bypass authentication by sending a malformed character in a web request's Host header. The flaw tricks Starlette into parsing the request path differently than the actual server sees it, so security checks on one path may allow access to a protected route, potentially enabling SSRF (server-side request forgery, where an attacker makes the server request data from unintended locations) or even remote code execution on affected systems.

Solution: Starlette's maintainer released a patch through an official GitHub security advisory. Additionally, researchers created badhost.org, a website that can test whether applications are vulnerable to this flaw.

Starlette
FastAPI
OpenAI
OpenAI-compatible proxies


Robinhood will let your AI agent trade stocks and make (or lose) lots of money

Summary: Robinhood has launched a feature allowing traders to create separate accounts for AI agents (software programs that can make decisions automatically) with dedicated funds to buy and sell stocks. The feature is designed to automate investment decisions like monitoring specific industries or rebalancing portfolios, but Robinhood warns that agentic trading carries significant risk, including potential loss of the entire investment.


CVE-2026-7528: IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.0 has a vulnerability that allows a denial of service attack, which is when an attacker overwhelms a system with requests to make it unavailable. The problem is caused by uncontrolled resource consumption (the system fails to limit how much memory, CPU, or other resources a single request can use).


CVE-2026-7524: IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links duri

Summary: IBM Langflow OSS (open-source software) versions 1.0.0 through 1.9.1 has a vulnerability that could allow remote code execution (running malicious code on a system from a distance) because it doesn't properly validate symbolic links (shortcuts that point to files) when extracting archive files. This is a path traversal (CWE-22) weakness, meaning an attacker could potentially access or execute files outside the intended directory.


SecurityWeek to Host AI Risk Summit August 11-12 at the Ritz-Carlton, Half Moon Bay

Summary: SecurityWeek is hosting the 2026 AI Risk Summit on August 11-12 in Half Moon Bay, California, bringing together security leaders, AI researchers, and policymakers to discuss challenges in AI adoption and security. The conference will cover topics like securing AI systems, adversarial attacks (techniques where attackers try to fool AI models), deepfakes (AI-generated fake media), data protection in AI workflows, and AI governance and compliance.


Defending at Machine-Speed: Building AI Threat Readiness with Wiz

Summary: AI models can now discover zero-day vulnerabilities (previously unknown security flaws) and chain exploits (combine multiple attacks together) faster than organizations can patch them, shrinking response windows from weeks to minutes. To defend effectively, organizations need to operate at machine-speed by focusing on two key areas: reducing the time to identify and fix vulnerabilities, and maintaining visibility across their entire environment including cloud, code, and software supply chains. The Wiz platform helps with this through tools like ASM (attack surface management, which maps all exposed systems and applications) and Red Agent (an AI-based security tester that finds complex vulnerabilities automatically).

Solution: The source describes Wiz's approach to addressing this threat but does not explicitly detail specific patches, versions, or technical mitigations. It recommends using Wiz ASM to reduce attack surface by identifying and remediating exposed vulnerabilities, and leveraging Wiz Red Agent as an autonomous AI-pentester to continuously uncover exploitable vulnerabilities at machine-speed. However, no concrete patching steps, version updates, or specific mitigation techniques are provided in the text.


The Pope isn’t AGI-pilled

Summary: Pope Leo XIV released an encyclical letter called Magnifica Humanitas warning that AI is not just a technical tool but a system that affects people's rights, opportunities, and freedom when used in processes impacting human lives. The letter was created in partnership with Anthropic, a major AI company, and sparked various reactions from the tech industry.


RevEng.AI Raises $15 Million to Hunt for Flaws and Backdoors in Software Binaries

Summary: RevEng.AI, a cybersecurity startup, raised $15 million to develop an AI tool called BinNet that analyzes compiled software binaries (the machine-readable code that actually runs on computers) to find vulnerabilities and backdoors without needing the original source code. The technology aims to secure the software supply chain by verifying what software actually does before it's deployed, which is increasingly important as AI systems are used to write code automatically.


5 Steps to Managing Shadow AI Tools Without Slowing Down Employees

Summary: Shadow AI refers to unapproved AI tools that employees use without IT oversight, often gaining access to company data through OAuth (a login system that grants third-party apps permission to access accounts) or browser sessions. Most organizations lack visibility into these tools and don't have governance policies in place, creating a security risk. The article describes a five-step program to manage shadow AI by discovering which tools are in use, creating practical policies, and establishing approved alternatives.

Solution: The source explicitly recommends five steps: (1) Discover shadow AI tools through auditing OAuth connections, scanning browser extensions, identifying AI features in already-approved tools, and conducting employee surveys. (2) Write an AI governance policy that lists approved tools, defines clear data classification rules (specifying which data like customer records and source code should never enter AI tools), confirms data training opt-out status for each tool, and establishes a defined process for requesting new tools. (3-5) The text cuts off before fully detailing steps 3-5, so no additional mitigations are explicitly stated in the provided content.

Microsoft Copilot
Google Gemini
Salesforce Einstein
Google Workspace
Microsoft 365


Cisco and OpenAI redefine enterprise engineering with Codex

Summary: Cisco partnered with OpenAI to integrate Codex (an AI code generation tool) directly into their enterprise software engineering workflows, treating it as an AI teammate rather than just a developer productivity tool. By using Codex in production environments, Cisco accelerated development on products like AI Defense (a security solution protecting against AI-related risks), compressing work that normally takes quarters into just weeks, while also automating large-scale defect repairs and build optimization across interconnected code repositories.


‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems

Summary: SymJack is an attack that exploits AI coding agents by tricking them into inserting malicious code into software projects through disguised symlinks (shortcuts that point to files). The attacker controls a code repository and hides malicious instructions in an innocent-looking file request, which the AI agent approves and executes without the developer realizing what's happening, potentially stealing credentials or compromising production systems.

Solution: Anthropic hardened Claude Code to resolve symlinks (determine where shortcuts actually point) before asking for approval and display the real destination path in the prompt to the user. The source notes that persuading users to consider before acting on automation requests could help stop SymJack attacks and would be simple for other coding agents to implement.

Anthropic Claude Code
Google Gemini CLI
Cursor Agent CLI
xAI Grok Build CLI
GitHub Copilot CLI


The NSA, ‘Mythos’ and the quiet emergence of AI cyber doctrine

Summary: Advanced AI models like Claude Mythos are becoming autonomous cyber-attack tools that can identify vulnerabilities, chain multiple exploits together, and conduct multi-stage attacks with minimal human input, fundamentally changing how cyber offense and defense operate. Major tech companies have formed a defensive coalition (Project Glasswing) to respond to this emerging threat, signaling that AI-powered cyber operations have moved beyond experimentation into real operational capability. This represents a shift in cyber doctrine where speed, scale, and autonomy (the ability of AI to act without human direction) have become the defining factors in cyber conflict.

Anthropic OpenAI Google Microsoft Amazon Apple

Anthropic
Claude
OpenAI
Google
Microsoft
Amazon
AWS
Apple
Broadcom
Cisco
CrowdStrike
NVIDIA
Palo Alto Networks
Linux Foundation
JPMorgan Chase


DSPM buyer’s guide: Top 10 data security posture management tools

Summary: Data security posture management (DSPM, tools that help find sensitive data scattered across systems) helps security teams locate hidden data across cloud and on-premises environments to reduce data loss risk. Shadow data (data stored outside official IT oversight) can come from forgotten repositories, cloud containers, or unauthorized AI usage, making it difficult to track and protect. DSPM tools work alongside broader cloud security tools to discover both known and unknown data and manage exposure risks, with the market consolidating through major acquisitions by companies like Palo Alto Networks, IBM, and Varonis.


Building self-improving tax agents with Codex

Summary: Tax AI is a system built by OpenAI and Thrive Holdings that uses Codex (a code-generating AI model) to automate tax return preparation for accounting firms, and it improves itself automatically rather than waiting for engineers to manually fix problems. The system learns from real-world use by collecting practitioner feedback, tracking how returns are processed (production traces, or a structured record of inputs and outputs), and using tailored evaluations to continuously refine itself. Within six weeks of launch, the system improved from only 25% of returns being correct enough to need minimal fixes to 86% reaching that standard.

Solution: The source describes the infrastructure that enables self-improvement but does not prescribe a specific fix or mitigation for any problem. No version update, patch, or explicit remediation step is mentioned. N/A -- no mitigation discussed in source.


Anthropic Releases New Claude Sandbox, Security Guidance Plugin

Summary: Anthropic released two new security features for Claude: a self-hosted sandbox that lets Claude Managed Agents (AI systems that can perform tasks autonomously) run code in user-controlled environments like their own servers or managed providers, and a security guidance plugin for Claude Code that scans for vulnerabilities (weaknesses that attackers could exploit) as developers write code. The plugin has reduced security issues by 30-40% in internal testing by catching problems before formal code review.

Solution: Anthropic provides two explicit mitigations: (1) Deploy the Claude sandbox by configuring Claude Managed Agents to execute tools in a user-controlled environment, applying your own network policies, audit logging, and security tooling while keeping files and repositories within your perimeter; (2) Use the security guidance plugin for Claude Code, available through the official Anthropic marketplace, which scans for vulnerabilities during file edits, after AI-generated changes, and at commit time to catch issues before full code review.

Anthropic
Claude
Claude Code
Claude Managed Agents
Cloudflare
Daytona
Modal
Vercel


Microsoft previews automatic device isolation in Defender for Endpoint

Summary: Microsoft is previewing automatic device isolation in Defender for Endpoint, a feature that uses AI to quickly disconnect compromised devices from the network while keeping them connected to security services, helping contain attacks that move at machine speed. However, a SANS Institute research paper warns that attackers could potentially exploit this feature to disable user accounts if it is not properly configured and tuned. Security experts emphasize that autonomous AI action tools like this must be carefully configured and tested, similar to any other automation capability.

Solution: N/A -- no mitigation discussed in source. The source warns of a potential risk but does not provide an explicit fix, patch, or configuration guidance to address it. Johannes Ullrich only notes that the feature 'must be carefully tuned' and that organizations should avoid leaving it 'unconfigured,' but the source does not detail specific mitigation steps.

Microsoft
Microsoft Defender for Endpoint
Microsoft Defender XDR


Champion ethical hacker warns AI tools like Mythos could put her out of business

Summary: Champion ethical hacker Valentina Palmiotti warns that powerful AI tools like Claude Mythos (an AI model that can find vulnerabilities, or security weaknesses, in software) could soon make human hackers like her unable to compete in bug bounty competitions (where hackers earn money by finding security flaws before criminals do). While she currently uses AI tools like Claude Code to work faster and win prizes at the Pwn2Own hacking competition, she believes advanced AI models will eventually take over most of the easier hacking tasks, leaving only the very best human hackers with opportunities to find new bugs.

Solution: N/A -- no mitigation discussed in source.

Anthropic
Claude
Claude Mythos
Claude Code
OpenAI
GPT 5.5 Cyber


Did the Pope use AI to write about the dangers of AI?

Summary: An analysis suggests that parts of Pope Leo XIV's encyclical (a formal letter from the Pope) about AI's dangers may have been written by AI itself, with some sections scoring 40-100% AI-generated according to Pangram, an AI detection tool. The document shows linguistic patterns common in AI writing, such as unusual word frequency that matches Claude, an AI made by Anthropic.


CVE-2026-45321: TanStack Unspecified Vulnerability

Summary: TanStack contains a vulnerability that allowed attackers to publish malicious versions of the software to npm (a package repository where developers download code libraries) under the trusted TanStack identity, potentially distributing credential-stealing malware (software that steals login information). This vulnerability is currently being actively exploited by attackers.

Solution: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.


Warp’s big bet on building open source with GPT-5.5

Summary: Warp, a modern terminal application, is using GPT-5.5 to power AI agents (software programs that can autonomously plan and execute tasks) that help write code and manage open-source development. In Warp's internal testing, GPT-5.5 uses 30% fewer tokens (units of text that the AI processes) per coding task than GPT-5.4, making the system more efficient as it scales to handle longer, more complex workflows.


CVE-2026-44895: GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships

Summary: GitLab MCP Server (a tool that lets AI agents interact with GitLab) had a critical security flaw in versions before 0.6.0 where its HTTP transport exposed an unauthenticated endpoint (a service that processes requests without checking who is calling it) to any website, combined with a misconfiguration that made it accessible from all network interfaces instead of just locally. This allowed attackers from anywhere to make changes to GitLab repositories using the server operator's stored credentials.

Solution: Update GitLab MCP Server to version 0.6.0, which fixes the vulnerability.


Trump officials split over Pope Leo’s AI warning as Vatican feud enters new front

Summary: Pope Leo XIV released an encyclical (a formal church letter) warning that artificial intelligence could displace workers, increase inequality, and remove humans from lethal weapons decisions, but Trump administration officials disagreed on how to respond. Interior Secretary Doug Burgum dismissed the pope's concerns as outside his role, while Vice President JD Vance praised the message as important moral leadership, highlighting a split in the administration over whether AI should face stronger oversight or remain deregulated for competitive advantage.


For Enterprises, Security Remains Agentic AI's Biggest Challenge

Summary: Companies need strategies for using agentic AI (AI systems that can plan and execute multi-step tasks independently), but security tools to safely deploy these systems are still being developed. The main obstacle preventing wider adoption is the lack of proven security solutions to protect enterprises from risks that agentic AI introduces.


CVE-2026-44723: Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pul

Summary: Vowpal Wabbit, a machine learning system, has a vulnerability in its GitHub workflow file where pull request titles are inserted directly into bash commands without proper protection. An attacker can craft a malicious pull request title with shell commands that will execute on the build system before Python runs, since the shell processes the string first. Since pull requests can be opened on any branch without special permission, anyone can trigger this attack.

Solution: This vulnerability is fixed by commit 998e390e80a7e8192d7849b7784bc113dbd190ad.


CVE-2026-24162: NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of unt

Summary: NVIDIA Transformers4Rec for Linux has a vulnerability where attackers can exploit improper deserialization (unsafe processing of data that was converted into a storable format) of untrusted data, potentially leading to code execution (running commands on the system), data tampering, and information disclosure. The vulnerability is tracked as CVE-2026-24162 and a CVSS score (a 0-10 rating of how severe a vulnerability is) has not yet been assigned by NIST.


Microsoft Copilot Cowork Exfiltrates Files

Summary: Microsoft Copilot Cowork had a security flaw where its agents (automated systems that perform tasks) could send emails to users without approval, and these emails could contain external images that leak data when opened. An attacker could use prompt injection (tricking the AI by hiding instructions in its input) to make the agent create download links to files on OneDrive, allowing the attacker to steal those files.


Rethinking organizational design in the age of agentic AI

Summary: Many organizations want to adopt agentic AI (AI systems that can independently execute complete workflows with minimal human input), but 76% say their current operations cannot support this change. The problem is that most companies are simply adding AI agents onto existing human-centered business models rather than fundamentally redesigning their operations, technology, workflows, and decision-making systems to work with AI as an integrated part of the organization.


CVE-2026-9540: A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component

Summary: A vulnerability (CVE-2026-9540) was found in vllm version 0.19.0 that affects the OpenAI-compatible Serving Path component and can be exploited remotely to cause a denial of service (making a service unavailable by overwhelming it). The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 5.5 (medium severity), and a public exploit is already available.

Solution: A pull request to fix this issue awaits acceptance (mentioned in the source as pending at https://github.com/vllm-project/vllm/pull/37594).


GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos

Summary: The Megalodon campaign used compromised credentials to inject malicious commits into over 5,500 GitHub repositories, modifying GitHub Actions workflows (automation tools that run code tasks) to steal sensitive secrets like cloud credentials and SSH keys (authentication files). The attack hid malicious code in base64-encoded bash payloads (encoded script commands) and used fake author names like "build-bot" to disguise itself as routine maintenance, with researchers detecting unexpected workflow runs as a warning sign.

Solution: SafeDep recommended checking GitHub Actions tabs for unexpected workflow_dispatch runs (manual workflow triggers), and if using OIDC federation (a cloud authentication method) for deployments, review cloud audit logs for token requests from unknown workflow runs. The researchers also shared a list of indicators of compromise (IOCs), including the attacker's command-and-control domain (216.126.225.129:8443), campaign signatures, forged author names and emails, commit messages, and names of compromised repositories to aid in detection and cleanup.


How Varonis Atlas integrates Claude Compliance API for AI governance

Summary: Varonis Atlas has integrated with the Claude Compliance API to help organizations monitor and secure their use of Claude Enterprise and Claude Platform, which are AI tools used for tasks like document analysis and building custom applications. The integration allows security teams to track AI usage, detect misuse and sensitive data exposure, investigate complete chat sessions, and test for vulnerabilities like prompt injection (tricking an AI by hiding instructions in its input) and jailbreaks. Varonis Atlas connects AI activity to underlying data permissions and access controls to help organizations understand what data their AI systems can reach and whether that access is safe.

Solution: The source does not explicitly describe a specific fix or mitigation for a particular vulnerability. Instead, it describes Varonis Atlas's features for monitoring and securing AI systems: continuous monitoring of conversation content, real-time detection of sensitive data exposure and jailbreak attempts, session-level investigations, runtime guardrails, and proactive pen testing (stress-testing assistants and agents for vulnerabilities). Organizations can access these capabilities through the Varonis Atlas platform, including its AI inventory, posture management, security testing, runtime guardrails, and compliance reporting functionality.

Varonis
Claude
Claude Enterprise
Claude Platform
Varonis Atlas


Sundar Pichai on AI, the future of search, and what’s happening to the web

Summary: Google CEO Sundar Pichai discusses major AI changes coming to Google Search and YouTube, including new Gemini models (advanced AI systems for generating text and understanding information) and AI agents that can perform tasks rather than just deliver search results. These changes will likely reduce traffic to websites from Google Search, a phenomenon the interviewer calls 'Google Zero,' forcing publishers and content creators to adapt their business strategies.


Check Point Frontier AI Models Readiness Program – Security Update

Summary: Check Point launched a proactive Frontier AI Models Readiness Program to protect their products against threats from increasingly capable AI systems that could help attackers find and exploit vulnerabilities. The program involved scanning their code with AI tools, reviewing security, strengthening weak components, and speeding up their ability to create and release security patches.


Musk and Altman’s AI rivalry reaches boiling point as IPO race heats up

Summary: This article discusses the competitive race between Elon Musk's SpaceX and Sam Altman's OpenAI as both companies move toward initial public offerings (IPOs, which is when a private company sells shares to the public for the first time). The piece highlights how a small group of tech leaders is gaining increasing influence over the future direction of artificial intelligence development.

OpenAI
SpaceX
Elon Musk
Meta
Nvidia
Tesla
Grok


Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations

Summary: Anthropic announced that Claude now integrates with 28 enterprise security and compliance platforms, allowing organizations to monitor and govern Claude's use alongside other workplace software. The integration works through the Claude Compliance API, which gives security teams access to conversation content and activity logs from Claude Enterprise, enabling them to apply their existing monitoring policies to Claude.

Anthropic
Claude
CrowdStrike
Palo Alto Networks
Microsoft
Okta
Zscaler
Netskope
Cloudflare
Datadog
Fortinet
Wiz
SailPoint
Relativity
ReliaQuest
Sumo Logic
Geordie AI
Forcepoint
Cribl
Mimecast
Smarsh
Snyk
Cyera
Proofpoint
Rubrik
Tenable
Trellix
Theta Lake
Varonis
IBM
Google
OpenAI
1Password


TrapDoor malware campaign puts developer workstations in CISO spotlight

Summary: The TrapDoor malware campaign compromised over 34 malicious packages across npm, PyPI, and Crates.io (popular code repositories where developers download libraries) to steal developer secrets like AWS credentials, GitHub tokens, and SSH keys (authentication credentials for secure systems). The campaign is particularly dangerous because it targets entire developer workflows, including AI coding assistants, and uses normal software development processes as cover, making it harder to detect and potentially giving attackers access to CI/CD pipelines (automated systems that build and deploy software) and cloud infrastructure.


Uber president says AI spending is getting ‘harder to justify’

Summary: Uber has spent its entire annual AI budget in just four months of 2026 and is questioning whether the spending is worthwhile, as the company struggles to see a clear connection between rising token consumption (the computational cost of running AI models like Claude Code) and actual improvements in features delivered to customers. Uber's president says it's difficult to prove that increased AI spending is directly producing more useful features for consumers.


CERT-In Mandates 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks

Summary: India's CERT-In has issued new security guidelines requiring organizations to patch critical vulnerabilities in internet-exposed systems within 12 hours because attackers are increasingly using AI and LLMs (large language models, which are AI systems trained on large amounts of text) to automate the discovery and exploitation of security weaknesses faster than ever before. The guidelines warn that AI-assisted attacks can compress the time needed for attackers to find and weaponize vulnerabilities, and recommend defensive measures like continuous vulnerability monitoring, Zero Trust security (verifying access at every step), layered security controls, and secure-by-design practices.

Solution: CERT-In recommends organizations implement the following: "Assume breach and prepare for rapid detection, containment, and recovery from compromise scenarios. Adopt a Zero Trust approach by enforcing continuous verification and least-privilege access. Implement a defense-in-depth strategy with layered controls across infrastructure to eliminate single points of failure and minimize the overall impact of a successful breach. Monitor and reduce exposure to security vulnerabilities. Embed a secure-by-design paradigm into systems, applications, and AI workflows. Maintain operational continuity during cyber incidents and disruption scenarios. Safeguard sensitive and operationally critical data throughout its lifecycle. Reduce software supply chain risks arising from third-party software, AI models, and dependencies through SBOM (software bill of materials), provenance validation, and assessments. Test security effectiveness against evolving threats through red teaming, vulnerability assessments, penetration testing, and independent audits." Organizations should also adopt "continuous, risk-based vulnerability and patch management practices" and prioritize patching known exploited vulnerabilities affecting internet-facing and critical systems.

confidentiality integrity availability safety


Stop treating AI governance as a review layer. Make it release infrastructure

Summary: AI systems change continuously between deployments (such as when retrieval indexes update overnight or new tools are added), which breaks the traditional governance model where compliance is checked after development is complete. Most organizations still treat governance as a separate review layer rather than embedding it into the actual deployment process, leaving companies blind to changes most likely to affect the system. Chinese AI companies instead treat governance as release infrastructure, embedding compliance checkpoints directly into the deployment pipeline so that no product launches without passing these checks.

Solution: Embed governance checkpoints directly into the deployment pipeline as release infrastructure rather than treating it as a separate review layer. According to the source, this means making governance 'part of the product' by including compliance checks that must be cleared before any product launch occurs, similar to how Chinese AI companies structure their deployment processes. Specific practices mentioned include maintaining current, pipeline-generated records of components like retrieval indexes, establishing output-monitoring thresholds that are owned by responsible parties, and tying model evaluation results to enforceable release gates.


Project Glasswing has uncovered 10,000 vulnerabilities: Anthropic

Summary: Anthropic's Project Glasswing, which uses Claude Mythos Preview (an AI model trained to find software bugs), has discovered approximately 10,000 critical or high-severity vulnerabilities across over 1,000 open-source projects and 50 partner organizations. While the AI successfully identified thousands of real vulnerabilities, maintainers are overwhelmed by the flood of bug reports and lack the capacity to patch them quickly, creating a major cybersecurity challenge where finding bugs is now much easier than fixing them.

Anthropic
Claude
Claude Mythos Preview
Claude Security


Anthropic’s restricted Claude Mythos model may be coming to Claude Code

Summary: Anthropic is preparing to publicly release its Mythos model, an advanced AI designed for code analysis that can automatically develop professional-level cyberattacks but also help find and fix software bugs before they're exploited. The company initially delayed public release due to security concerns, but has since developed a guardrail system (safety restrictions built into the model) and is now testing Mythos in Claude Code and Claude Security. Anthropic is also running a project called Glasswing, which partners with companies to use Mythos Preview to find vulnerabilities in critical software, having uncovered 10,000 high or critical-severity vulnerabilities in its first month.

Solution: Anthropic decided against public rollout of the Mythos model until it prepared a powerful guardrail system (safety restrictions to prevent misuse). The company is also collaborating with other companies through the Glasswing project to identify and secure potential AI-driven exploits before widespread release.

Anthropic
Claude
Claude Mythos
Claude Code
Claude Security
Claude Opus


Pope Leo calls for being ‘profoundly human’ in the age of AI

Summary: Pope Leo XIV released a papal encyclical (an official open letter from the Catholic Church) called 'Magnifica Humanitas' warning about risks from AI and rapid technological advancement, including AI-powered warfare and job displacement. The document emphasizes that current legal and ethical protections are inadequate to safeguard human dignity as AI adoption accelerates.


Secure Optimization With Asynchronous Structured Skyline Predicates Under Vertical Data Federation

Summary: This paper presents a method for performing skyline optimization (a technique that filters data to find the most important records based on multiple criteria) on encrypted data that is split across multiple locations in a vertical data federation (a system where different organizations each hold different columns of the same dataset). The researchers developed an asynchronous structured skyline predicate that improves both efficiency and security while protecting sensitive data from unauthorized access.


Deformable 3-D Point Cloud Perturbations Using Cage-Based Deformation for Semantic Consistency

Summary: Researchers developed a new method to attack deep neural networks that analyze 3D point clouds (collections of data points representing 3D objects) by using cage-based deformation, which smoothly warps the entire shape rather than moving individual points. The method generates adversarial attacks (malicious inputs designed to fool AI systems) that look natural to humans while successfully tricking classifiers, and these attacks remain effective even against defense methods.


Federated Contrastive Diffusion Prototypes for Robust Private Learning

Summary: Federated Learning (FL, a technique where multiple computers train an AI model together without sharing raw data) faces security challenges from adversarial attacks (attempts to trick the model with carefully crafted inputs) and data heterogeneity (when each computer has different types of data). The paper introduces Fed-CDP (Federated Contrastive Diffusion Prototypes), a new approach that uses a server to actively synthesize improved features from client data rather than just collecting them, which helps make the shared model more robust against attacks and reduces model drift (when local models diverge from each other).


Fundamental Limit of Discrete Distribution Estimation Under Utility-Optimized Local Differential Privacy

Summary: This research paper studies how to estimate discrete distributions (collections of data categories and their frequencies) while protecting sensitive information using utility-optimized local differential privacy (ULDP, a privacy protection method that keeps data private locally while allowing more accurate results for non-sensitive information). The authors mathematically prove the fundamental limits of this privacy-utility trade-off and propose new optimal mechanisms called utility-optimized block design schemes to achieve the best possible accuracy under these privacy constraints.


Reliable Multi-Modal Object Re-Identification via Modality-Aware Graph Reasoning

Summary: This paper presents MGRNet, a graph reasoning model (a method that uses network structures to understand relationships between data points) designed to improve multi-modal object re-identification (ReID, the task of matching the same object across different image types like visible and infrared photos). The approach handles low-quality local features by constructing modality-aware graphs (structures that represent relationships between image patches while accounting for different image types) and selectively swapping graph nodes to combine local and global information, ultimately creating more reliable object representations.


EA-APO: A Universal Proactive Defense Against Facial Manipulation

Summary: Facial manipulation techniques like face-swapping and face attribute editing (changing features in images) threaten privacy and identity security, but existing defense methods work poorly against both types of attacks in a unified way. Researchers developed EA-APO (Epoch-Adaptive Adversarial Perturbation Optimization), a defense framework that adds specially designed invisible noise patterns to face images to disrupt both face-swapping and attribute-editing AI models, even ones the defense hasn't seen before. The method was tested across multiple commercial facial manipulation tools and remained effective even after common image processing and social media compression.


AI security needs a shift from models to systems, researchers argue

Summary: Researchers argue that enterprises cannot secure AI agents by making the underlying models more robust. Instead, they must enforce security controls at the system level, treating AI models as fundamentally untrusted components, similar to how operating systems treat processes. The paper identifies five security principles from traditional systems security (least privilege, tamper resistance, complete mediation, secure information flow, and accounting for human error) that should be applied to AI agents, and notes that all eleven real-world attacks analyzed violated the secure information flow principle.

Google
University of California San Diego
University of Wisconsin-Madison
Microsoft
ChatGPT
Claude
Cursor
Jira


Infer-Shield: Defending against membership inference attacks in heterogeneous federated learning via adaptive distillation

Summary: This research paper describes a defense technique called Infer-Shield that protects AI models trained across multiple organizations (federated learning, where different parties train a shared model without sharing raw data) from membership inference attacks (attempts to determine if specific individuals' data was used in training). The paper proposes using adaptive distillation (a technique where a smaller model learns from a larger one to reduce information leakage) as a way to make these distributed AI systems more secure.


As AI speeds coding, CVE Lite CLI keeps security deliberately AI-free

Summary: CVE Lite CLI is an open-source tool that scans JavaScript and TypeScript project dependencies for vulnerabilities by analyzing lockfiles (files that track which packages a project uses) locally while developers are coding, rather than waiting for security checks to fail later in the CI pipeline (automated testing system). The tool provides detailed remediation guidance, distinguishing between direct dependencies (packages you explicitly use) and transitive dependencies (packages that your dependencies use), and recommending specific upgrade paths. According to the creator, this local-first approach is increasingly important because AI coding assistants allow developers to add packages quickly, potentially without proper security review.

Solution: CVE Lite CLI scans npm, pnpm, and Yarn lockfiles using OSV vulnerability data and can be configured for JSON, SARIF, or HTML outputs and integrated into CI workflows as a GitHub Action. The tool analyzes lockfiles to identify which vulnerabilities are direct versus transitive, validates upgrade targets, and recommends actionable fix paths while developers are still writing code.


The Alert Firehose Finally Meets Its Match

Summary: Network Detection and Response (NDR, a security tool that monitors network traffic for threats) has traditionally been criticized for generating too many alerts, but newer NDR systems using agentic AI (AI that autonomously performs tasks like data analysis and alert prioritization) are reducing false positives by correlating multiple data points and automatically triaging alerts for analysts. This allows security teams to focus on genuine threats rather than sorting through overwhelming amounts of data.

Solution: The source discusses operational best practices but does not explicitly describe a specific fix or mitigation. It mentions that NDR systems should be properly deployed through baselining (allowing the system to learn normal network behavior), staying tuned (ongoing configuration), and SOC integration, but does not present these as solutions to a problem—rather as necessary deployment steps. N/A -- no mitigation discussed in source.


Anthropic: Mythos Detected 23,000 Potential Vulnerabilities Across 1,000 OSS Projects

Summary: Anthropic's Claude Mythos model, an AI system designed to find security vulnerabilities (bugs that attackers could exploit), discovered over 23,000 potential weaknesses across more than 1,000 open source software projects, with 1,726 confirmed vulnerabilities including over 1,000 rated as high or critical severity. So far, 75 of these serious issues have been patched by software vendors, and Anthropic expects this number to grow significantly as vendors continue their 90-day review period. The company has also released Claude Security, a tool to help developers scan their own code for security issues.

Solution: Anthropic has unveiled Claude Security, a codebase scanner designed to help developers find security issues in their applications. Additionally, Anthropic is working to add safeguards to prevent misuse of Mythos and has limited its access through Project Glasswing (a program that gives about 50 organizations controlled access to the model) while developing stronger protections before making it more widely available.

Anthropic
Claude
Mythos
Mozilla
Firefox
Palo Alto Networks
Google
Chrome
Curl
XBOW


The AI Era Is Creating a Bug Hunting Arms Race

Summary: AI models are becoming better at automatically finding software vulnerabilities (weaknesses in code) and creating exploits (tools to attack them), which is flooding bug bounty programs (programs that reward researchers for reporting bugs) with submissions. This surge is changing how companies pay for bug discoveries and forcing faster security responses, potentially shortening the traditional 90-day responsible disclosure window (the agreed-upon time between finding a bug and publicly revealing it) where companies typically release patches (fixes).


OpenAI, Grupo Folha and Grupo UOL announce strategic content partnership

Summary: OpenAI has partnered with two major Brazilian news organizations, Folha de S.Paulo and Grupo UOL, to integrate their journalism into ChatGPT. Starting immediately, ChatGPT's 900 million weekly active users can access summaries and articles from these sources with attribution and links back to the original reporting. This partnership is part of OpenAI's broader effort to work with news publishers globally and bring trusted journalism into AI-powered experiences.


Scotland’s ‘green datacentres’ policy ignores emissions impact of AI, analysis shows

Summary: Scotland's policy encouraging "green datacentres" (facilities designed to minimize environmental impact) was created in 2022 before AI tools like ChatGPT became widespread, and a Scottish charity warns it may not account for the significant carbon emissions that AI systems actually produce. The policy is meant to attract AI investment to Scotland as part of the country's economic development strategy, but it appears outdated regarding the true environmental costs of running AI.


Hackers are learning to exploit chatbot ‘personalities’

Summary: Early AI chatbots were vulnerable to jailbreaks, which are attacks where users trick the AI into ignoring its safety guidelines by simply asking it to do so, requiring no technical expertise or coding knowledge. Hackers are now becoming more sophisticated in exploiting chatbot personalities to bypass safety measures that were built into these expensive AI systems.


How big tech got its way on Trump’s AI executive order

Summary: President Trump reversed his plan to require a government safety review of new AI models before their release, deciding instead that the US government would not slow down AI development. The reversal happened hours before the executive order was set to be signed, and Trump cited American competitiveness and competition with China as reasons for prioritizing speed over safety reviews despite expert warnings about security risks.


Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software

Summary: Anthropic's Project Glasswing uses Claude Mythos Preview, an advanced AI model, to automatically find security flaws (vulnerabilities) in widely-used software before attackers can exploit them. Since launching last month, the program has identified over 10,000 high-severity vulnerabilities across critical software, with 97 already patched and 88 security advisories issued. However, Anthropic notes that finding vulnerabilities is much easier than fixing them, presenting a major challenge for cybersecurity.

Solution: Anthropic recommends that software developers and network defenders shorten their patch cycles and deployment timelines. Specific steps mentioned include: hardening networks' default configurations, enforcing multi-factor authentication (requiring two or more ways to verify identity), and keeping comprehensive logs for detection and response. Additionally, Anthropic launched a Cyber Verification Program that allows security professionals to use its models without safety restrictions for legitimate purposes such as vulnerability research, penetration testing, and red teaming (simulated attacks by friendly security experts).

Anthropic
Claude Mythos
OpenAI
GPT-5.5-Cyber
WolfSSL
Oracle
Microsoft
XBOW


Google’s new anything-to-anything AI model is wild

Summary: Google's Gemini AI model can generate realistic videos from simple inputs, as demonstrated by an experiment where someone created deepfake (synthetic media made to look real) videos of a stuffed animal. The article highlights how accessible and effective these video generation tools have become, raising questions about the line between harmless creative use and potentially misleading AI-generated content.


Adaptive Trust-Aware SOC Human–AI Teaming for resilient operations

Summary: This research paper examines how Security Operations Centers (SOCs, teams that monitor and respond to security threats) can work effectively with AI systems by using adaptive trust mechanisms. The study focuses on building resilient operations, meaning systems that can continue functioning even when problems occur, through better collaboration between human security experts and AI tools that can process large amounts of data quickly.


Elon, stop trying to make Grok happen

Summary: According to a Reuters report, Grok (Elon Musk's AI chatbot) is not performing well and has minimal adoption, appearing in only 3 out of over 400 documented cases of U.S. government AI use, and only for basic tasks like document drafting or social media management. This low usage is a sign of trouble for xAI's flagship product, despite Musk's plans to make it central to a major financial offering.


CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI

Summary: Kiro CLI, a command-line tool that lets developers use AI to run code and shell commands, has a security flaw (CVE-2026-9255) where it doesn't properly check where input comes from before authorizing tool execution. An attacker on the same computer could trick the tool into running arbitrary commands without the user's permission by sending specially crafted data through stdin (the standard input stream that feeds data into a program).

Solution: Update kiro-cli to version 1.28.0 or later. The affected versions are kiro-cli prior to 1.28.0.


Microsoft says it’s making AI ‘safe for work’ in your browser

Summary: Microsoft is testing agentic AI (AI that can perform multi-step tasks automatically) in its Edge for Business browser to help employees complete routine work like filling forms and gathering information across tabs. A key focus is protecting corporate data through features that keep AI prompts within the company's Microsoft 365 tenant (a private cloud environment), prevent copy-paste operations, block sensitive uploads, and allow companies to audit what users do.

Solution: Microsoft provides several data protection features in Edge for Business: enterprises can block copy and paste functionality, ensure all AI prompts and responses stay within their Microsoft 365 tenant (preventing use for model training), enable audit capabilities for prompts, and use the Purview compliance tool to analyze file uploads and detect sensitive data to block risky actions. These protections are active as soon as users sign into Edge for Business.

Microsoft
Edge for Business
Copilot
Microsoft 365
Purview


The literary world isn’t prepared for AI

Summary: A story selected for a prestigious British literary award appears to have been written by an LLM (large language model, an AI trained on text to generate human-like writing) rather than by a human author, raising concerns about how the literary world will handle AI-generated submissions. The story exhibits characteristic patterns of AI-generated text, such as repetitive sentence structures and predictable phrasing.


Spotify says its AI remix tool is for superfans, but I’m not convinced

Summary: Spotify has partnered with Universal Music Group (UMG) to create a new tool that uses generative AI (AI that creates new content from patterns in training data) to let users make remixes and covers of songs from UMG's music catalog. The article expresses concern that this tool will make it even easier to flood the internet with AI-generated music covers, which already appear widely on platforms like YouTube, TikTok, and Instagram.


FairRoP: Robust Client Selection Scheme for Fairness-Aware Federated Learning

Summary: Federated learning (a system where multiple computers train an AI model together while keeping their data private) can be unfair to some participants and vulnerable to attacks where bad actors tamper with the process. FairRoP is a new method that uses adaptive client selection (choosing which computers to include based on their trustworthiness) and a bandit algorithm (a technique for balancing exploration and exploitation in decision-making) to improve both fairness and robustness against attacks. The approach combines three components: fairness awareness, attack detection, and q-Balance to handle the different challenges involved.


AI Attacks Are No Longer Experimental: Key Findings from the March-April 2026 AI Threat Landscape

Summary: Between December 2025 and February 2026, a single attacker compromised nine Mexican government agencies using AI as the core tool to carry out the entire attack, rather than just a helper tool. The attacker accessed sensitive data including tax records, civil registry information, patient files, and electoral systems, and researchers only discovered the breach after finding materials on the attacker's servers.


The Download: coding’s future, the ‘Steroid Olympics,’ and AI-driven science

Summary: At Anthropic's developer event, nearly half the attendees reported shipping code written entirely by Claude (an AI assistant), with many not reading it first before deploying it live. The article discusses how AI coding tools are becoming increasingly capable and how developers are automating their work, though not everyone agrees this approach is beneficial.

Anthropic
Claude
Code with Claude
Google
Google DeepMind
Gemini
Gemini for Science
Meta
OpenAI


Mega-IPOs could signal market top, say analysts as SpaceX and OpenAI prep record floats

Summary: SpaceX, OpenAI, and Anthropic are planning major initial public offerings (IPOs, where companies sell shares to the public for the first time) in 2026, with SpaceX targeting a $1.75 trillion valuation. However, analysts warn these mega-cap floats resemble the late-1990s dot-com bubble, noting that all three companies are unprofitable and have opaque business models, with SpaceX's only profitable division being its Starlink internet service while its AI and space divisions operate at significant losses.


Why your AI strategy stops where the PLC starts: Hard lessons from the OT frontlines

Summary: AI security strategies often fail in operational technology (OT) environments, like power plants and factories, because critical legacy systems don't send data to AI systems—a maintenance laptop running unpatched Windows 7 is common. AI trained on typical IT data (like web traffic logs) often misclassifies normal industrial traffic as threats, and automated responses can accidentally shut down production lines faster than actual attacks, because in OT systems availability (keeping things running) is more important than the IT security priorities of confidentiality and integrity.

Microsoft Defender for IoT
Nozomi Networks
Claroty


Google folds CodeMender into agent ecosystem amid push for AI-led AppSec

Summary: Google is integrating CodeMender, an AI agent that automatically finds and fixes software vulnerabilities, into its larger Agent Platform ecosystem rather than keeping it as a standalone tool. CodeMender uses Gemini reasoning models (advanced AI that can think through complex problems) to analyze code vulnerabilities, generate fixes, and test them before showing them to developers. This shift suggests Google believes enterprises want autonomous security tools embedded within a governed infrastructure framework with identity and monitoring systems, rather than as isolated products.

Google
Google DeepMind
CodeMender
Gemini


OpenAI named a Leader in enterprise coding agents by Gartner

Summary: OpenAI's Codex, an AI tool that helps developers write and manage code, has been recognized as a Leader by Gartner in enterprise coding agents. Codex goes beyond simple autocomplete (where an AI completes code as you type) by letting developers delegate complex tasks like understanding large codebases, running tests, and preparing work for human review while maintaining security and governance controls. The recognition highlights Codex's strengths in enterprise features like approval gates, RBAC (role-based access control, which limits what different users can do), sandboxing (isolating code in a safe environment), and audit trails.

OpenAI
Codex
GPT-5.5
Cisco
Datadog
Dell Technologies
NVIDIA
Amazon Bedrock


GHSA-j3vx-cx2r-pvg8: Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

Summary: Network-AI v5.4.4 has a critical authentication bypass where the MCP server (a tool that lets AI models call external functions) defaults to an empty secret, causing all authentication checks to pass unconditionally. Additionally, the server allows requests from any origin (CORS wildcard), so an attacker can trick a user into visiting a malicious website that sends commands to their localhost Network-AI server without needing any password, potentially invoking dangerous tools like config_set and agent_spawn.


GHSA-f396-4rp4-7v2j: Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

Summary: Boxlite, a sandbox service for running containers, has a path traversal vulnerability (a security flaw where attackers can access files outside intended boundaries) in how it extracts container images. When processing tar files (compressed archives), Boxlite doesn't validate symlink targets (shortcuts to files or directories), allowing an attacker to create a malicious container image that writes files anywhere on the host system, potentially leading to remote code execution (running unauthorized commands on the computer).

github.com/boxlite-ai/boxlite/sdks/go@< 0.9.0 (fixed: 0.9.0)

@boxlite-ai/boxlite@< 0.9.0 (fixed: 0.9.0)


GHSA-g6ww-w5j2-r7x3: BoxLite: Permission Bypass Allows Modification of Read-Only Files

Summary: BoxLite is a sandbox service that runs untrusted code in lightweight virtual machines (VMs, which are isolated computing environments). It claims to protect host files by mounting directories in read-only mode (preventing writes), but the vulnerability bypasses this: BoxLite tells the underlying VM system (libkrun) to mount directories without actually enforcing read-only restrictions, and it doesn't limit container capabilities (special permissions), so malicious code can remount directories as read-write and modify files that should be protected.


GHSA-cqp8-fcvh-x7r3: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Summary: Pydantic AI had a security flaw where attackers could bypass protections against accessing cloud-metadata endpoints (special internal servers that store sensitive credentials) by encoding the IP address in IPv6 transition forms (IPv4-mapped IPv6, 6to4, or NAT64, which are ways to represent IPv4 addresses using IPv6 format). This flaw only affects applications that explicitly allow local file downloads with the `force_download='allow-local'` setting on URLs that could be influenced by untrusted users.

Solution: Upgrade to Pydantic AI version 1.99.0 or later, which extends the blocklists to cover IPv6 transition forms that route to blocked IPv4 endpoints and adds protection for additional IANA-reserved IP ranges. For unpatched versions, avoid using `force_download='allow-local'` on URLs influenced by untrusted input, or resolve hostnames manually and validate them against your own blocklist including IPv6-encoded forms before creating the FileUrl.


Unpatched ChromaDB flaw leaves servers open to remote code execution

Summary: ChromaDB, a popular vector database used in AI applications, has a critical vulnerability (CVE-2026-45829) that allows unauthenticated attackers to run arbitrary code on servers. The flaw exists because ChromaDB checks authentication after it has already downloaded and executed a malicious model from Hugging Face, meaning attackers can trick the system into running their code by uploading a malicious model and requesting ChromaDB to use it.

Solution: Until a patch becomes available, researchers advise: (1) deploy ChromaDB using the Rust implementation instead of the Python FastAPI server, as the Rust version is not affected, and (2) restrict network access to the ChromaDB port to trusted IP addresses only.


GHSA-7p85-w9px-jpjp: Twig: PHP code injection via `{% use %}` template name

Summary: Twig (a PHP template engine) has a vulnerability where template names in `{% use %}` tags aren't properly escaped, allowing attackers to inject arbitrary PHP code that executes when the template cache loads. This bypasses Twig's security sandbox, giving attackers remote code execution (the ability to run commands on the server).

Solution: `Compiler::string()` now escapes single quotes in addition to the characters it previously escaped, preventing template names from breaking out of the surrounding PHP string context.

LangChain (indirect via Twig dependency)


CVE-2026-47102: LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint c

Summary: LiteLLM versions before 1.83.10 have a vulnerability where users can change their own role to proxy_admin (an administrative role) through the /user/update endpoint, giving them full control over the system including all users, teams, and API keys. Even users with org_admin privileges can exploit this flaw without needing to chain it with other attacks.

Solution: Update LiteLLM to version 1.83.10 or later.


CVE-2026-47101: LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role

Summary: LiteLLM versions before 1.83.14 have a privilege escalation vulnerability (a security flaw that lets someone gain higher-level permissions than they should have) where authenticated internal users can create API keys (credentials for accessing the system) that grant access to admin-only routes without proper verification. This allows attackers to bypass role-based access controls (the system that restricts what different users can do) and gain full admin privileges.

Solution: Update LiteLLM to version 1.83.14 or later.


How CISOs Should Prep for Agentic-Ready AI BOMs

Summary: This article discusses how security leaders (CISOs, or Chief Information Security Officers) should prepare for AI systems that can take independent actions (agentic AI). The key challenge is creating an AI bill of materials (AI BOM, a detailed list of all components and dependencies in an AI system) that documents both what components make up the AI system and how those components actually behave when running.

Solution: N/A -- no mitigation discussed in source.


Roundtables: Can AI Learn to Understand the World?

Summary: This is a discussion panel about how AI companies are working to build systems that understand the physical world, moving beyond the current limitations of LLMs (large language models, which are AI systems trained on text). The conversation explores recent developments in world models, which are AI systems designed to understand and predict how the physical world works.


GHSA-cr22-wjx7-2w6m: MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement

Summary: The `mcp-server-kubernetes` tool had a security flaw where access control settings (environment variables that limit which Kubernetes operations are available) only worked when listing tools, but not when actually running them. This meant an attacker or misconfigured AI agent could bypass these restrictions and run any Kubernetes command, like deleting pods or accessing containers, even if they were supposed to be blocked.

Solution: The fix applies the same filtering logic from the tool listing layer to the tool execution layer in the `CallToolRequestSchema` handler, so that restricted tools return an error when called directly. This was fixed in v3.6.0.

mcp-server-kubernetes@< 3.6.0 (fixed: 3.6.0)

mcp-server-kubernetes
Claude (via MCP integration)


Anthropic, Microsoft in talks for AI chip deal after $5 billion investment

Summary: Microsoft is negotiating to supply its custom Maia AI chips to Anthropic, a company that makes Claude, a popular AI assistant. This deal would help Microsoft compete with Amazon and Google in providing specialized AI hardware to clients, while Anthropic seeks to address its computing capacity challenges after experiencing rapid growth in demand for its AI tools.

Microsoft Anthropic OpenAI Amazon Google Nvidia SpaceX


GHSA-7hh5-prp2-mfh5: Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Summary: Amazon SageMaker Python SDK has a vulnerability where it stores an HMAC signing key (a cryptographic secret used to verify that model files haven't been tampered with) in plaintext as an environment variable that can be read by anyone with access to certain AWS APIs. An attacker with the right permissions could steal this key, use it to forge valid model files, and run malicious code on the system running the model.

Solution: Upgrade to Amazon SageMaker Python SDK v2.257.2 or v3.8.0. According to the source: 'AWS recommend upgrading to the latest version and rebuilding any models previously created with ModelBuilder using the updated SDK.' As a temporary workaround if upgrading is not immediately possible: 'users can manually remove the SAGEMAKER_SERVE_SECRET_KEY environment variable from existing SageMaker models by recreating the model without this variable in the container environment configuration.'

Amazon SageMaker
TorchServe
Multi-Model Server
TensorFlow Serving
Triton