Celebrities will be able to find and request removal of AI deepfakes on YouTube

Summary: YouTube is expanding a likeness detection feature (a tool that automatically finds videos containing AI-generated copies of someone's appearance) to celebrities, allowing them to monitor and request removal of AI deepfakes (fake videos made with AI that replace a real person's face or likeness) featuring themselves. The platform previously tested this feature with content creators and has already rolled it out to politicians and journalists, with removal requests evaluated against YouTube's privacy policy.

Solution: YouTube's likeness detection feature allows enrolled public figures to search YouTube for AI deepfake content of themselves and request removal (takedowns are evaluated against YouTube's privacy policy, and not every request will be approved).


Building agent-first governance and security

Summary: As AI agents (software programs that can make decisions and take actions without direct human control) become more common in companies, they create new security risks because insecure agents can be manipulated to access sensitive data and systems. Most companies plan to deploy agentic AI soon, but only 21% have mature governance systems in place, leaving them vulnerable. The source emphasizes that enterprises need a control plane (a centralized system that manages which agents can run, what permissions they have, and what policies they follow) to safely manage agents, track what they do, and prevent uncontrolled or unpredictable failures at scale.

Solution: According to the source, enterprises need to implement 'a robust control plane that governs, observes, and secures how AI agents, as well as their tools and models, operate across the enterprise.' A control plane is defined as 'the shared, centralized layer governing who can run which agents, with which permissions, under which policies, and using which models and tools.' The source states that governance must make it obvious (not aspirational) that you can answer what an agent did, on whose behalf, using what data, under what policy, and whether you can reproduce or stop it.


Ordering with the Starbucks ChatGPT app was a true coffee nightmare

Summary: Starbucks launched a new ChatGPT integration that allows customers to order coffee by typing '@Starbucks' followed by their order in ChatGPT (an AI chatbot that can have conversations and answer questions). The user found the ordering process confusing and complicated compared to the traditional in-app method.

Solution: N/A -- no mitigation discussed in source.


Google Fixes Critical RCE Flaw in AI-Based Antigravity Tool

Summary: Google discovered a critical flaw in its AI-based tool for filesystem operations where a prompt injection vulnerability (tricking an AI by hiding instructions in its input) allowed attackers to escape the sandbox (a restricted environment meant to contain the program) and execute arbitrary code on the system. The problem was caused by inadequate input sanitization (cleaning/filtering of user data), which failed to prevent malicious instructions from being processed.


Trump says Anthropic is shaping up and a deal is 'possible' for Department of Defense use

Summary: Anthropic, an AI company, faced a conflict with the U.S. Department of Defense in March when the Pentagon declared it a supply chain risk (meaning its technology was seen as threatening national security) and banned federal agencies from using its Claude AI models. Recently, tensions have eased after Anthropic's CEO met with Trump administration officials to discuss the company's new Mythos model (an advanced AI system with strong cybersecurity capabilities), and President Trump stated a deal for military use of Anthropic's technology is now 'possible'.


AI Finds Every Gap: How Many Can Your Network Survive?

Summary: AI tools are making cyberattacks faster and more dangerous by speeding up the discovery of vulnerabilities (security flaws in software), creating exploits (code that exploits those flaws), and planning multi-step attacks. Attackers can now run phishing (deceptive emails tricking users into revealing information), malware (malicious software), and vulnerability attacks at the same time, which reduces the time before a network gets compromised and gives defenders less time to respond.


Closing the Security Gap in the Age of Agentic Coding

Summary: AI coding agents are now generating software much faster than traditional security tools can scan it, creating a dangerous gap where vulnerabilities (security weaknesses) can be exploited in minutes instead of months. Wiz addresses this by embedding security directly into AI development tools through plugins and a "Green Agent" (an AI system that analyzes and recommends fixes for security issues), allowing developers to catch and fix problems in their code editor before the code is even submitted for review.

Solution: According to the source, Wiz offers two explicit mitigations: (1) For developers: "Using Wiz Code plugins, developers can pull active Wiz issues directly into their IDE" and "their coding agent can then apply the Green Agent's remediation guidance and commit it to source control without the developer ever leaving their workflow." (2) For security teams: The Wiz plugin "automatically runs a security scan" at natural development boundaries like "file save, pre-commit, and pre-push" and "surfaces the finding immediately in the IDE, before the code can reach the repository" to catch hardcoded credentials, IaC misconfiguration (infrastructure-as-code setup errors), and other issues. Additionally, security teams can "trigger remediation directly from a Wiz issue" to have the Green Agent build remediation plans that coding agents can execute and submit as pull requests.

Wiz
Anthropic
Claude
Claude Mythos Preview
Claude Code
GitHub


Azure SRE Agent flaw lets outsiders silently eavesdrop on enterprise cloud operations

Summary: Microsoft's Azure SRE Agent had a critical authentication flaw (CVE-2026-32173, CVSS score 8.6, a 0-10 rating of severity) that allowed unauthorized attackers to eavesdrop on sensitive agent activity over the network without proper credentials. The vulnerability existed because the service's token validation (a credential check) accepted tokens from any tenant organization and never verified if the attacker actually belonged to the target organization, exposing user prompts, agent responses, executed commands, and credentials.

Solution: Microsoft has fixed the issue server-side, and no customer action is required according to Microsoft's advisory.


Prompt injection turned Google’s Antigravity file search into RCE

Summary: Security researchers found a prompt injection flaw (tricking an AI by hiding instructions in its input) in Google's Antigravity IDE that could bypass its Secure Mode sandbox protections and achieve RCE (remote code execution, where an attacker can run commands on a system they don't own). The vulnerability came from insufficient input validation in the file search tool's Pattern parameter, allowing attackers to inject malicious command-line flags that converted a simple file search into arbitrary code execution. Google acknowledged the issue in January and fixed it internally, and Antigravity users are now protected without needing to take action.

Solution: Google has already fixed the flaw internally. According to the source: 'Antigravity users need not do anything else to remain protected.' No user-side updates or patches are required.


Introducing ChatGPT Images 2.0

Summary: ChatGPT Images 2.0 is an updated image generation model (software that creates pictures from text descriptions) with better ability to render text within images, support for multiple languages, and improved visual reasoning (the ability to understand and analyze images). The announcement introduces new features but does not discuss security issues or problems requiring fixes.


Google Patches Antigravity IDE Flaw Enabling Prompt Injection Code Execution

Summary: Google patched a vulnerability in Antigravity, its agentic integrated development environment (IDE, a coding tool that can take autonomous actions), that allowed attackers to execute arbitrary code through prompt injection (tricking an AI by hiding instructions in its input). The flaw combined the tool's file-creation abilities with insufficient input validation in its find_by_name search function, letting attackers inject malicious commands that bypassed Antigravity's Strict Mode security restrictions.

Solution: Google addressed the vulnerability as of February 28, 2026, following responsible disclosure on January 7, 2026. The source does not explicitly detail the specific technical fix applied.

Google Antigravity
Anthropic Claude Code
Google Gemini CLI Action
GitHub Copilot Agent


Mythos: are fears over new AI model panic or PR? – podcast

Summary: AI company Anthropic announced it created a powerful model called Mythos Preview that can find and exploit software vulnerabilities (weaknesses that attackers could use), and decided not to release it publicly due to concerns about risks to economy, safety, and national security. However, some experts question whether the model is actually as capable as Anthropic claims, and the decision raises questions about whether this move is genuine responsibility or a publicity strategy.


Introducing the CrowdStrike Shadow AI Visibility Service

Summary: Organizations typically have far more AI tools running than they realize, including unapproved ones that bypass traditional security controls, a problem called shadow AI (unauthorized AI usage that goes undetected). CrowdStrike's new Shadow AI Visibility Service addresses this by using telemetry-based evidence (data collected from system monitoring) to discover both approved and unapproved AI across endpoints, cloud, and SaaS environments, since most security teams lack visibility into their actual AI footprint.

Solution: CrowdStrike's Shadow AI Visibility Service, powered by the CrowdStrike Falcon platform and delivered by CrowdStrike experts, uses telemetry-based evidence to identify sanctioned and unsanctioned AI usage across endpoint, cloud, and SaaS environments.

CrowdStrike OpenAI Google Meta Anthropic Mistral Cohere

confidentiality integrity availability safety


CVE-2026-39861: Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processe

Summary: Claude Code, an agentic coding tool (AI that can write and execute code), had a sandbox escape vulnerability before version 2.1.64 where sandboxed processes could create symlinks (shortcuts pointing to files outside their designated area) that allowed writing to locations outside the workspace without user permission. An attacker could exploit this by injecting malicious instructions into Claude Code's input, potentially executing code outside the intended sandbox.

Solution: Update to Claude Code version 2.1.64 or later. The source states: 'Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.'


v0.14.21

Summary: LlamaIndex v0.14.21 is a maintenance release that fixes several bugs in the core library, including a KeyError (an error when looking up a value in a data structure that doesn't exist) in the DocumentSummaryIndex deletion function, handling of output formatting errors, and UTF-8 encoding issues in file operations. The release also updates dependencies across many embedding and indexing modules to keep the library's supporting code current.

Solution: Update to llama-index-core version 0.14.21 or later. The fixes are included in this release version, which addresses the KeyError in DocumentSummaryIndex.delete_nodes, ValueError and TypeError from structured output failures, UTF-8 encoding issues in the persistence layer, and the Message Block Buffer Resolution breaking change.


Scaling Codex to enterprises worldwide

Summary: Codex, an AI tool that generates code and assists with software development tasks, has grown from 3 million to 4 million weekly users and is now being adopted by major enterprises like Virgin Atlantic, Notion, and Cisco to speed up development workflows. OpenAI is expanding Codex adoption through a program called Codex Labs, which provides expert guidance to organizations, and by partnering with global consulting firms (like Accenture and Infosys) to help enterprises integrate Codex into their software development processes at scale.

OpenAI
Codex
Virgin Atlantic
Ramp
Notion
Cisco
Rakuten
Accenture
Capgemini
CGI
Cognizant
Infosys
PwC
Tata Consultancy Services


Amazon to invest up to another $25 billion in Anthropic as part of AI infrastructure deal

Summary: Amazon is investing up to $25 billion more in Anthropic, an AI company known for its Claude AI models (large language models, or LLMs, which are AI systems trained on vast amounts of text to generate human-like responses), on top of an earlier $8 billion investment. As part of this deal, Anthropic will spend over $100 billion on Amazon's cloud services and custom AI chips over the next decade to expand its computing capacity (the processing power needed to train and run AI models). Anthropic made this agreement because its infrastructure has been strained by rapidly growing demand from enterprise customers and users of Claude.

Amazon Anthropic Claude AWS OpenAI Microsoft Google Trainium Trainium2 Trainium3


CVE-2026-33626: LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Ser

Summary: LMDeploy, a toolkit for compressing, deploying, and serving large language models, contains a Server-Side Request Forgery vulnerability (SSRF, a flaw that lets attackers trick a server into making requests to unintended targets) in versions before 0.12.3. The vulnerability exists in the `load_image()` function, which downloads images from URLs without checking if those URLs point to private or internal systems, potentially allowing attackers to access sensitive cloud services and internal networks.

Solution: Update LMDeploy to version 0.12.3 or later, which patches the issue.


Optimizing stealthiness in universal adversarial perturbations via class-selective and perceptual similarity metrics

Summary: Universal Adversarial Perturbations (UAPs, tiny modifications to images that fool AI models across many different inputs) are security threats to deep learning systems, but existing methods make attacks obvious because they either look wrong to humans or cause suspicious misclassifications. This paper presents Stealthy-UAP, a framework that makes UAPs harder to detect by targeting only semantically related classes (so misclassifications seem plausible) and optimizing perturbations to match how humans actually perceive images.


llm-openrouter 0.6

Summary: The llm-openrouter tool, version 0.6, added a new 'refresh' command that lets users update their list of available AI models without waiting for the cached (temporarily stored) list to expire. This feature was created so users could access newly available models on OpenRouter immediately.


CVE-2026-6662: A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src

Summary: A vulnerability (CVE-2026-6662) was found in ericc-ch copilot-api versions up to 0.7.0 in the CORS function (a security feature that controls which websites can access an API from a web browser) of the token endpoint. The flaw allows a permissive cross-domain policy with untrusted domains, meaning attackers from other websites could potentially access the API remotely, and the exploit has been publicly disclosed.


ThreatMAMBA: Achieving High-Robustness Cyber Threat Attribution During the Evolution of Attacks

Summary: Cyber Threat Attribution (CTA) is the process of identifying who carried out a cyberattack by analyzing evidence from the attack. This paper introduces ThreatMAMBA, an AI framework that improves CTA by building knowledge graphs from threat intelligence data (IOCs, or indicators of compromise that identify malicious activity; TTPs, or tactics and techniques used by attackers; and temporal relationships) and using machine learning to identify attackers even in the early stages of ongoing attacks. The system showed significant improvements in accuracy at different stages of attack development, suggesting it can provide reliable attribution information quickly during real incidents.


Efficient Privacy-Preserving Jaccard Similarity Evaluation Over Multisets for Secure Collaborative Data Analysis

Summary: This paper addresses privacy and security concerns in collaborative data analysis by proposing a new method for computing Jaccard Coefficient (a mathematical measure comparing similarity between two sets). The proposed protocol protects sensitive information like intersection and union cardinalities (counts of shared and combined elements) while maintaining high accuracy and computational efficiency, and can be enhanced further using cloud-assisted encryption to improve performance by 25.5% to 30.4%.


Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain

Summary: Researchers discovered a critical vulnerability in Anthropic's Model Context Protocol (MCP, a system that allows AI models to interact with external tools and data) that allows attackers to run arbitrary commands on systems using vulnerable implementations. The flaw affects over 7,000 publicly accessible servers and has been found in popular AI projects like LangChain and LiteLLM, but Anthropic has declined to fix the underlying architectural issue, leaving developers responsible for protecting against it.

Solution: The source recommends several mitigations: block public IP access to sensitive services, monitor MCP tool invocations, run MCP-enabled services in a sandbox (an isolated test environment), treat external MCP configuration input as untrusted, and only install MCP servers from verified sources. Additionally, some vendors have issued patches for their specific products (LiteLLM, Bisheng, and DocsGPT are noted as patched).

Anthropic
MCP
LiteLLM
LangChain
LangFlow
Flowise
LettaAI
LangBot
GPT Researcher
Agent Zero
Fay Framework
Bisheng
Langchain-Chatchat
Jaaz
Upsonic
Windsurf
DocsGPT
MCP Inspector
LibreChat
WeKnora
Cursor


CISOs reshape their roles as business risk strategists

Summary: CISOs (chief information security officers, the top security leaders at companies) are expanding their roles beyond traditional cybersecurity to become broader business risk strategists who manage strategic, operational, and financial risks across their entire organizations. This shift reflects the fact that nearly all business operations are now digital, making any cyber risk a material business risk, and has accelerated since the rise of generative AI (AI systems like ChatGPT that can create new content) and agentic AI (AI systems that can take independent actions). Research shows that most CISOs now share responsibility for enterprise risk management with other executives and are expected to unify regulatory requirements, company risk tolerance, and security controls into a single operating model.


Fracturing Software Security With Frontier AI Models

Summary: Frontier AI models (advanced AI systems with sophisticated reasoning abilities) can now autonomously discover software vulnerabilities and plan complex attack chains much faster than before, posing a major security threat. Open source software faces particularly high risk because these AI models can analyze publicly available source code to find bugs, whereas they struggle with compiled code (the executable, non-readable version). As these powerful AI models become widely available, attackers with minimal expertise may launch attacks at unprecedented speed and scale across the entire software ecosystem.


Copilot & Agentforce offen für Prompt-Injection-Tricks

Summary: Researchers at Capsule Security discovered prompt injection vulnerabilities (attacks where malicious instructions are hidden in normal-looking inputs) in both Microsoft Copilot Studio and Salesforce Agentforce that allow attackers to trick AI agents into stealing data. In Microsoft's case, attackers can inject malicious commands into SharePoint forms to extract sensitive customer data and send it via email, while in Salesforce's case, they can embed harmful instructions in public lead forms to exfiltrate CRM data at scale.

Solution: For Microsoft Copilot Studio: "Microsoft has meanwhile published a patch that has fixed the problem" and "no further measures are required on the part of users." For Salesforce Agentforce: The source text does not describe an explicit patch or mitigation from Salesforce. The source states that "Salesforce acknowledged the prompt injection problem" but classified the data exfiltration issue as "configuration-specific" and pointed to "optional human-in-the-loop controls." General recommendations mentioned include: "input validation, least-privilege access, as well as strict control" and treating "all external inputs as untrusted" while setting up "filters that separate data from instructions."

Microsoft Copilot Studio
Salesforce Agentforce
Capsule Security


Claude Mythos – ist der Hype gerechtfertigt?

Summary: Claude Mythos is an AI security model being tested by select organizations, but security researchers at VulnCheck question its real-world impact. Out of 75 CVEs (publicly disclosed software vulnerabilities) mentioning Anthropic, only one has been directly tied to Project Glasswing (the initiative behind Claude Mythos), though more results are expected later in 2026.

Anthropic
Claude Mythos
OpenAI
Project Glasswing
VulnCheck
Tanium


Chinese tech workers are starting to train their AI doubles–and pushing back

Summary: Tech workers in China are being asked by their employers to train AI agents (software programs that can autonomously perform tasks) to automate their own jobs, sparked by tools like Colleague Skill that can extract a worker's skills and habits from workplace chat histories and files to create an AI replica. While some workers find the technology interesting, many feel uncomfortable and alienated by the process, viewing it as reducing their complex work to replaceable modules and raising concerns about job security and worker dignity.


CVE-2026-6608: A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena S

Summary: A vulnerability (CVE-2026-6608) was found in lm-sys fastchat up to version 0.2.36 in the add_text function of the Arena Side-by-Side View Handler component, which allows incorrect control flow (improper program execution logic) that can be exploited remotely. The root cause was partially fixed in commit 34eca62 for one file, but three other files containing the same issue were not corrected.


CVE-2026-6607: A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate

Summary: A vulnerability was found in lm-sys fastchat (a tool for running AI models) up to version 0.2.36 that allows attackers to consume excessive resources by exploiting the api_generate function in the Worker API Endpoint (the part of the software that handles requests from other programs). The attack can be done remotely over the internet, the vulnerability details have been publicly disclosed, and it may already be exploited.

Solution: Install the patch identified by commit c9e84b89c91d45191dc24466888de526fa04cf33. Note that commit ff66426 patched the api_generate function in base_model_worker.py but missed other entry points (other places in the code where the same issue occurs).


CVE-2026-6600: A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src

Summary: A security flaw called CVE-2026-6600 was found in Langflow (an AI tool) up to version 1.8.3 that allows cross-site scripting (XSS, where attackers inject malicious code into web pages to trick users). The vulnerability is in a React component (a reusable piece of code in the user interface) that handles message editing, and it can be exploited remotely by someone with login access.


CVE-2026-6599: A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get_client_ip/ins

Summary: A vulnerability exists in Langflow (an AI application framework) versions up to 1.8.3 in the Model Context Protocol Configuration API, where attackers can manipulate the X-Forwarded-For header (a field that identifies the client's IP address) to perform injection attacks (inserting malicious code into the system). This vulnerability can be exploited remotely, the exploit code is publicly available, and the vendor has not responded to disclosure attempts.


CVE-2026-6598: A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function cre

Summary: A vulnerability (CVE-2026-6598) was found in langflow-ai langflow versions up to 1.8.3 where the create_project/encrypt_auth_settings function improperly stores sensitive authentication settings in cleartext (unencrypted plain text) on disk instead of protecting them. An attacker can exploit this remotely, and the vulnerability details have been publicly disclosed.


CVE-2026-6597: A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_ter

Summary: A vulnerability (CVE-2026-6597) was found in langflow-ai langflow version 1.8.3 and earlier, where a function called remove_api_keys/has_api_terms fails to properly protect stored credentials (API keys and authentication information), allowing attackers to access them remotely. The vendor was notified but did not respond, and the exploit details have been publicly released.


CVE-2026-6596: A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_f

Summary: A security vulnerability (CVE-2026-6596) was found in Langflow (an AI tool) version 1.1.0 and earlier, affecting a file upload function in the API. The flaw allows unrestricted file uploads (meaning attackers can upload any type of file without proper checks), and it can be exploited remotely without requiring authentication or user interaction.


Claude Token Counter, now with model comparisons

Summary: Claude Opus 4.7 introduced an updated tokenizer (a system that breaks text into smaller units for processing) that changes how text is converted into tokens, causing the same input to require 1.0–1.35× more tokens depending on content type. While Opus 4.7 maintains the same pricing as Opus 4.6 ($5 per million input tokens and $25 per million output tokens), this token inflation means users can expect roughly 40% higher costs, though the impact varies by content type (minimal for PDFs at 1.08×, identical for lower-resolution images, but 3× higher for high-resolution images).

Claude
Claude Opus 4.7
Claude Opus 4.6
Claude Sonnet 4.6
Claude Haiku 4.5


OpenAI helps Hyatt advance AI among colleagues

Summary: Hyatt has deployed ChatGPT Enterprise, which gives its employees access to advanced AI capabilities like GPT 5.4 and Codex (a tool for code generation) across departments such as finance, marketing, and operations. The company is using this technology to automate manual tasks and help teams focus on delivering better customer service. Hyatt worked with OpenAI to provide training sessions so employees could quickly learn how to use AI in their daily work.


SiIicon Valley's AI agent hiccups: Wasted tokens and 'chaotic' systems

Summary: AI agents (software programs that can perform tasks automatically) are being promoted as the next major breakthrough, but companies are discovering they are unreliable and expensive to operate. The main problems include wasting tokens (units of text that AI processes, which cost money), high inference costs (the expense of running AI models), and system complexity that makes it difficult to manage multiple agents working together without burning through budgets instead of saving money.

OpenAI Google DeepMind Amazon Microsoft Meta Anthropic Nvidia MiniMax ThinkingAI


Changes in the system prompt between Claude Opus 4.6 and 4.7

Summary: Anthropic released Claude Opus 4.7 in April 2026 with notable updates to its system prompt (the hidden instructions that guide how an AI behaves), including expanded child safety rules, new tools like Claude in PowerPoint and Chrome browsing agents, and changes to make the model less verbose and more action-oriented. The update shows Anthropic shifting Claude toward trying to solve ambiguous requests using available tools rather than asking users for clarification first.

Anthropic
Claude Opus 4.7
Claude Opus 4.6
Claude 3
Claude.ai
Claude Code
Claude in Chrome
Claude in Excel
Claude in Powerpoint
Claude Cowork


Claude system prompts as a git timeline

Summary: A researcher converted Anthropic's published Claude system prompts (the hidden instructions that guide Claude's behavior) from a single markdown document into a git repository (a version control system that tracks file changes over time) with timestamped commits, allowing easier exploration of how the prompts have evolved across different Claude model versions using standard git tools like `log` and `diff`.


LLLMs: A Data-Driven Survey of Evolving Research on Limitations of Large Language Models

Summary: This is a research survey published in ACM Computing Surveys that examines the limitations and problems of large language models (LLMs, which are AI systems trained on massive amounts of text data to generate human-like responses). The survey takes a data-driven approach to understand how LLM research has evolved as scientists discover and study these systems' weaknesses and constraints.


Systematic Literature Review on Differential Privacy in Machine Learning

Summary: This is a systematic literature review, a type of research paper that surveys and analyzes existing studies on differential privacy (a mathematical technique that adds carefully measured noise to data to protect individual privacy) in machine learning. The review examines how researchers are applying differential privacy to train AI models while keeping personal information safe from being extracted or misused.


Privacy in Collaborative Deep Learning Systems: A Taxonomy and Archetypes

Summary: This academic survey paper categorizes and describes different privacy concerns and system designs in collaborative deep learning (machine learning where multiple parties train models together while keeping their data private). The paper creates a taxonomy, which is a systematic classification scheme, to help organize the various approaches and challenges in this field.


GHSA-mjw2-v2hm-wj34: Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

Summary: Dagster had a SQL injection vulnerability (a security flaw where attackers can insert malicious SQL commands into database queries) in its database I/O managers (tools that read and write data to databases like DuckDB, Snowflake, and BigQuery). Users with permission to add dynamic partitions (flexible data groupings) could create partition keys that contained SQL commands, which would then execute against the database with the I/O manager's credentials, potentially allowing unauthorized data access or modification.

Solution: Update to the patched versions of Dagster. The fix ensures that partition key values are properly escaped before inclusion in SQL queries across all affected I/O managers. No configuration changes or workarounds are required alongside the update; only the Dagster code version needs to be updated. If unable to apply the update, manual workarounds are described in the referenced gist (https://gist.github.com/gibsondan/6d0c483f8499a8b1cd460cddc9fd8f72).

dagster-snowflake-polars@<= 0.29.0 (fixed: 0.29.1)

dagster-deltalake@<= 0.29.0 (fixed: 0.29.1)

dagster-snowflake@<= 0.29.0 (fixed: 0.29.1)


GHSA-38h3-2333-qx47: OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

Summary: OpenTelemetry.Exporter.Jaeger has a memory exhaustion vulnerability where internal pooled lists (reusable memory structures) can grow too large based on big payloads and stay oversized for future use, potentially causing denial of service (making a system unavailable). However, the developers have no plans to fix this because the Jaeger exporter was deprecated in 2023.

Solution: Prefer maintained exporters (for example OpenTelemetry Protocol format (OTLP)) instead of the Jaeger exporter.


GHSA-v38x-c887-992f: Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

Summary: Flowise versions up to 3.0.13 have a remote code execution vulnerability in the Airtable Agent node where user input is sent to an LLM (large language model, an AI that generates text) to generate Python code, which is then executed without proper sandboxing. An attacker can craft malicious prompts that trick the LLM into generating code containing dangerous commands (like imports or system operations) that bypass the validation checks, allowing them to run arbitrary code on the server without needing to log in.

flowise-components@<= 3.0.13 (fixed: 3.1.0)


White House and Anthropic hold 'productive' meeting amid fears over Mythos model

Summary: Anthropic, an AI company, met with White House officials after releasing Claude Mythos, an AI tool that can find bugs in old code and autonomously exploit them for security testing. The meeting signals potential collaboration between the government and Anthropic despite previous tensions, as officials discussed balancing innovation with safety concerns around this powerful technology.


BioGuard: Malicious sample free defense method for biometric classifiers against model extraction attacks

Summary: Researchers have developed BioGuard, a defense method that protects biometric classifiers (AI systems that identify people using fingerprints, faces, or iris scans) against model extraction attacks (where attackers try to steal or copy the AI model by repeatedly querying it). The method works without needing malicious sample data to train it, making it practical for real-world deployment.


OpenAI loses multiple executives in latest leadership shakeup

Summary: OpenAI experienced multiple executive departures, including the leaders of its video generation product (Sora) and its scientific research division. The company is reorganizing its science team to work more closely with product and infrastructure groups, while also dealing with medical leaves and transitions among other senior leaders.


AI chipmaker Cerebras files to go public after scrapping IPO plans last year

Summary: Cerebras, a company that makes specialized chips for running AI models, filed to go public on Nasdaq after previously canceling IPO plans in 2024. The company reported strong financial growth in 2025 with $510 million in revenue (up 76% from 2024) and has major deals with OpenAI (worth over $20 billion for computing power through 2028) and Amazon, positioning itself as an alternative to Nvidia's GPUs (graphics processing units, specialized processors commonly used for AI tasks) by claiming faster speeds and lower costs.

Mohamed bin Zayed University of Artificial Intelligence


Breaking Opus 4.7 with ChatGPT (Hacking Claude's Memory)

Summary: A researcher discovered that Claude Opus 4.7 can be tricked using an adversarial image (a specially crafted image designed to fool AI systems) generated by ChatGPT to misuse the memory tool and store false information for future conversations. While Claude Opus 4.6+ is harder to attack than earlier versions because it reasons through requests before acting, it remains vulnerable to this type of indirect prompt injection (embedding hidden malicious instructions in images rather than text).

Claude Opus 4.7
ChatGPT
Anthropic
OpenAI


GHSA-8gmg-3w2q-65f4: OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

Summary: OpenTelemetry eBPF Instrumentation (OBI) has a vulnerability where a local attacker controlling a Java process can overwrite arbitrary host files when Java injection is enabled and OBI runs with elevated privileges (special system permissions). The flaw occurs because the injector trusts an environment variable called TMPDIR from the target process without proper validation, and uses unsafe file creation methods that allow symlink attacks (where an attacker creates a link pointing to a different file to trick the system into overwriting it).

Solution: Upgrade to https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0.


GHSA-5cwg-9f6j-9jvx: Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

Summary: Claude Code on Windows had a security flaw where it loaded configuration files from a shared system directory without checking who owned that directory or had permission to change it. Since regular users could write to this directory by default, an attacker could create a malicious configuration file that would run with elevated privileges when another user launched Claude Code, allowing a local privilege escalation (unauthorized access to higher-level permissions).

Solution: Users on standard Claude Code auto-update have already received this fix. Users performing manual updates are advised to update to the latest version.

@anthropic-ai/claude-code@< 2.1.75 (fixed: 2.1.75)


GHSA-66r7-m7xm-v49h: OpenClaw: QQBot media tags could read arbitrary local files through reply text

Summary: QQBot media tags in the openclaw package could read arbitrary local files through reply text by referencing host-local paths outside the intended media storage boundary, allowing attackers to disclose local files through outbound media handling. This vulnerability affected openclaw versions before 2026.4.10.

Solution: Upgrade to openclaw version 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix. The fix enforces the media storage boundary for all outbound QQBot local file paths, which was implemented in PR #63271.


CVE-2026-40352: FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to N

Summary: FastGPT, an AI Agent building platform, has a vulnerability in its password change feature in versions before 4.14.9.5 where attackers can use NoSQL injection (inserting MongoDB operators into input fields to manipulate database queries) to bypass password verification and take over accounts without knowing the current password.

Solution: Update FastGPT to version 4.14.9.5 or later, where this issue has been fixed.


CVE-2026-40351: FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScri

Summary: FastGPT, an AI Agent building platform, has a NoSQL injection vulnerability (a type of attack where an attacker tricks the database query by inserting special commands) in its login system before version 4.14.9.5. The vulnerability allows unauthenticated attackers to bypass password checks and log in as any user, including administrators, by sending database operators instead of a real password.

Solution: This issue has been fixed in version 4.14.9.5. Users should upgrade to this version or later.


GHSA-vfp4-8x56-j7c5: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

Summary: OpenClaw missed blocking dangerous environment variables (like VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES) that could be set by users to change how programs start up or behave on the network. This security gap affected OpenClaw versions before 2026.4.10.

Solution: Users should upgrade to openclaw version 2026.4.10 or newer. The latest npm release, openclaw@2026.4.14, already includes the fix, which expands the denylist (a list of blocked items) in the execution environment security policy to cover these high-risk environment variables.


GHSA-5fw2-mwhh-9947: Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials

Summary: Flowise has a text-to-speech endpoint that doesn't require authentication but accepts a credential ID (an identifier for stored API keys like OpenAI or ElevenLabs) directly from user input. An attacker can use this to access someone else's stored API credentials and generate speech using the victim's API account, burning their API credits without permission.

Solution: Remove the TTS endpoint from the whitelist (the list of endpoints that don't need login), or add a check to ensure the credential ID matches the chatflow's TTS configuration. The source suggests: 'if (!chatflowId) { return res.status(401).json({ message: "Authentication required" }) }' — meaning if no chatflow ID is provided, the endpoint should reject the request with an authentication error.


GHSA-w47f-j8rh-wx87: Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs

Summary: Flowise version 3.0.13 has a security flaw where public chatflow endpoints return unsanitized data (raw information without filtering) that includes plaintext API keys, passwords, and credential IDs (unique references to stored login credentials). This happens because the code returns the complete chatflow object without removing sensitive fields, potentially exposing users' third-party account credentials and internal system architecture.

Solution: According to the source, apply sanitization to both public endpoints by calling `sanitizeFlowDataForPublicEndpoint(chatflow)` before returning the response, and ensure the sanitization function removes all `credential`, `password`, `apiKey`, and `secretKey` fields from the flowData. The source notes this sanitization function exists only in unreleased HEAD code, not in released v3.0.13.


OpenAI’s former Sora boss is leaving

Summary: OpenAI abandoned its Sora video generation tool and Bill Peebles, the leader of the Sora team, is leaving the company. OpenAI is refocusing its priorities away from what it calls "side quests" to concentrate on coding and enterprise products instead.

Solution: N/A -- no mitigation discussed in source.


Anthropic’s new cybersecurity model could get it back in the government’s good graces

Summary: Anthropic, an AI company, faced criticism from the Trump administration over concerns about national security and refused to allow its technology to be used for domestic mass surveillance or fully autonomous weapons without human control. The company is now working to improve its relationship with the government by developing Claude Mythos Preview, a new AI model designed specifically for cybersecurity tasks.


Perspective: AI demand is inflated, and only Anthropic is being realistic

Summary: AI companies may be overestimating demand by measuring success through token consumption (the basic units of AI usage, like words and characters), rather than actual business value or return on investment. Anthropic is adjusting its pricing model away from flat monthly fees toward per-token billing and has discontinued third-party tools that were consuming excessive tokens without generating meaningful results, positioning itself better if AI demand projections prove inflated.

Solution: Anthropic's mitigation strategies mentioned in the source include: (1) moving from flat-rate enterprise pricing to per-token billing so revenue reflects actual usage; (2) cutting off third-party agentic tools (like OpenClaw) that were consuming large volumes of tokens unsustainably; and (3) planning infrastructure investment carefully by accounting for a 'cone of uncertainty' (acknowledging that data centers take 1-2 years to build, so companies must estimate future demand carefully rather than over-committing to infrastructure based on inflated projections).

Anthropic Claude OpenAI Meta Shopify Nvidia Databricks


White House Chief of Staff to Meet With Anthropic CEO Over Its New AI Technology

Summary: The White House is planning a meeting between its Chief of Staff and Anthropic's CEO to discuss Anthropic's new AI technology and concerns about the security of software built with advanced AI models. This reflects ongoing government engagement with major AI labs about how their systems work and potential risks.


Anthropic's Dario Amodei to meet with White House about Mythos

Summary: Anthropic CEO Dario Amodei is meeting with White House officials to discuss Mythos, a new AI model that can identify security weaknesses in software. This meeting marks a potential improvement in relations between Anthropic and the Trump administration, which had previously blacklisted the company and ordered federal agencies to stop using its Claude AI models, though a court temporarily blocked that directive.


CoChat Launches AI Collaboration Platform to Combat Shadow AI

Summary: CoChat is a new platform designed to help teams work together with AI while adding visibility and governance (oversight and control) to shadow AI (unauthorized or untracked AI use within organizations). The platform aims to address the problem of AI tools being used without proper management or awareness by company leadership.


Every Old Vulnerability Is Now an AI Vulnerability

Summary: The article argues that AI systems aren't necessarily introducing entirely new security problems, but rather making existing vulnerabilities worse and easier to exploit. AI amplifies old bugs rather than creating fundamentally new ones.


What is Claude Mythos and what risks does it pose?

Summary: Claude Mythos is Anthropic's latest AI model that can outperform humans at hacking and cybersecurity tasks, including finding and exploiting dormant bugs in old code. Anthropic restricted access to 12 major tech companies and 40+ organizations responsible for critical software through an initiative called Project Glasswing (a program designed to help secure important systems), rather than releasing it publicly, due to concerns from regulators, financial institutions, and government officials about potential risks to digital security.

Solution: Anthropic gave 12 tech companies and more than 40 organisations responsible for critical software access to Mythos via Project Glasswing, which it described as 'an effort to secure the world's most critical software.' Anthropic also offered to work with US government officials to 'help defend against the risk of these models.'

Anthropic
Claude
Claude Mythos
OpenAI
ChatGPT
Google
Gemini
Amazon Web Services
Apple
Microsoft
Nvidia
Broadcom
Crowdstrike


Early-Stage Detection of Encrypted Malware Traffic via Multi-Flow Temporal Graph Learning

Summary: Malware often encrypts its network traffic (data sent over the internet) to hide its activities, making it hard to detect using traditional methods. Most existing detection systems need complete traffic data to work well, but this research presents DawnGuard, a new system that can identify encrypted malware traffic very early in an attack, when only a small amount of data is available, by using temporal graph learning (analyzing how multiple network connections relate to each other over time) and a Vision Transformer (a type of deep learning model that captures patterns across data). The system achieved 95.11% accuracy using just the first 20% of traffic data.


ESCM: A Toolkit for Efficient and Secure Outsourced Computation With Multiple Keys

Summary: ESCM is a toolkit that uses homomorphic encryption (a technique that lets computers process encrypted data without decrypting it first) to let cloud servers perform calculations on data from multiple users who each have their own encryption key. The toolkit addresses security risks by using a distributed two trapdoor cryptosystem with threshold decryption (a system where multiple servers must cooperate to decrypt data, so no single server can access the information alone), which protects against server collusion and outages.


Forgery-Resistant Range Queries via Multi-Client Order-Revealing Encryption

Summary: Researchers discovered that two widely-used encryption schemes for secure database searches (m-ORE and om-ORE, which allow multiple parties to query encrypted data without revealing the queries or data) can be attacked by a malicious client and server working together to insert fake records into the database. The team developed a new scheme called MORES that fixes this vulnerability while also making searches about one-third faster and more efficient than the older schemes.

Solution: The source proposes MORES, described as 'the first multi-client ORE scheme that preserves range-query functionality while provably resisting arbitrarily malicious participants.' The text indicates MORES can serve as 'an immediate drop-in replacement for encrypted-database systems that demand both efficiency and robustness in adversarial environments,' but does not provide implementation details, version numbers, or step-by-step deployment instructions.


Analysis of Collaborative Data Privacy Leakage: A Macro-Level Perspective

Summary: This research paper examines macro-level collaborative leakage, which occurs when individually harmless data pieces reveal sensitive information when combined together. The authors conducted mathematical analyses to understand why this happens and found that the problem stems from how risk data (data that don't directly expose private information) correlate with sensitive information. While Gaussian distribution (a common bell-curve statistical pattern) can help prevent this type of leakage, the paper concludes that this protection is limited and more comprehensive security mechanisms are needed.


Heterogeneous Privacy-Preserving Federated Learning for Edge Intelligence

Summary: This research proposes HeteroFed, a framework for federated learning (a distributed machine learning approach where multiple devices train a shared model without sending raw data to a central server) that addresses privacy and performance challenges in edge intelligence scenarios. The framework uses four main techniques: personalized model construction for different devices, dynamic gradient clipping (limiting how much model parameters can change), adaptive noise addition for privacy protection, and improved model aggregation to maintain accuracy despite privacy protections.

Solution: The source proposes HeteroFed as a solution framework containing four specific mechanisms: (1) heterogeneous model construction to enable personalized model training for different smart devices, (2) dynamic gradient clipping to dynamically adjust the magnitude of gradients on models uploaded by devices, (3) adaptive noise addition to customize differential privacy (mathematical techniques that add noise to protect individual data) protection based on device model convergence status, and (4) deviation-aware model aggregation for accurate model aggregation to mitigate noise perturbation effects.


White House moves to give federal agencies access to Anthropic’s Claude Mythos

Summary: The White House is working to authorize a modified version of Anthropic's Claude Mythos model, an AI system that can identify cybersecurity vulnerabilities (weaknesses in software that attackers could exploit), for use by federal agencies. The move comes despite the Department of Defense maintaining a ban on contracting with Anthropic, and raises questions about what safety modifications and controls would be needed before deploying such a powerful AI tool in government.

Solution: According to Neil Shah, VP for research at Counterpoint Research, federal deployment modifications should include: keeping scanned code within isolated and air-gapped environments (systems physically disconnected from networks), ensuring data is not used to retrain the base model, implementing transparency requirements, and requiring human-in-the-loop review (where humans approve actions before they happen) before any bug fix is applied. The memo references that the OMB is 'setting up protections' and working with model providers and the intelligence community to ensure 'appropriate guardrails and safeguards are in place,' though specific technical details of these protections are not provided in the source text.


Nvidia AI chip rivals attract record funding as competition heats up

Summary: Nvidia currently dominates AI chip manufacturing, but startups are raising record funding to compete with alternative designs optimized for AI inference (deploying trained models in real applications). Investors are increasingly backing these new companies, with $8.3 billion raised globally in 2026, because they argue that purpose-built chip architectures can deliver significant energy and cost savings compared to Nvidia's GPUs, which were originally designed for gaming.

Nvidia
Groq
Cerebras Systems
MatX
Ayar Labs
Etched
Axelera
Olix
Euclyd
Optalysys
Fractile
Arago
Vaire Computing
Anthropic
OpenAI
TSMC
Microsoft
Amazon
Globalstar
SpaceX
Uber
Delivery Hero
Prosus
ASML


Mythos and Cybersecurity

Summary: Anthropic created Claude Mythos, an AI model so skilled at finding and exploiting software vulnerabilities (weaknesses in code that attackers can abuse) that the company restricted its access to about 50 large organizations instead of releasing it publicly. While this approach seems responsible, critics argue we lack key information to evaluate whether Mythos truly works as well as claimed, including how often it incorrectly flags safe code as vulnerable, and whether it can find bugs in less common software like medical devices or industrial control systems.

Anthropic
Claude
Claude Mythos
Microsoft
Apple
Amazon Web Services
CrowdStrike


Palo Alto’s Helmut Reisinger sees a cyber sea change ahead as AI advances

Summary: Palo Alto Networks is participating in Project Glasswing, an AI-based initiative led by Anthropic that uses Claude Mythos (an advanced AI model) to discover zero-day vulnerabilities (security flaws unknown to software makers) in operating systems and browsers across the industry. The company is also addressing the cybersecurity gap in AI deployments through recent acquisitions, including Protect AI for securing language models and AI agents, CyberArk for identity security, Chronosphere for managing AI-generated data, and Koi for protecting against risks from autonomous AI agents on user devices.

Palo Alto Networks
Anthropic
Claude
AWS
Apple
Broadcom
Cisco
CrowdStrike
Google
Microsoft
Protect AI
CyberArk
Chronosphere
Koi


Finance leaders warn over Mythos as UK banks prepare to use powerful Anthropic AI tool

Summary: Anthropic is expanding access to Claude, a powerful AI model that was initially restricted to US companies like Amazon, Apple, and Microsoft, to UK banks in the coming week. Senior finance leaders have expressed concerns about the risks of deploying this tool in the financial sector.


Cursor AI Vulnerability Exposed Developer Devices

Summary: A security flaw in Cursor AI could allow attackers to gain shell access (the ability to run commands on a computer) by combining three techniques: indirect prompt injection (hiding malicious instructions in data that the AI reads rather than typing them directly), a sandbox bypass (escaping the restricted environment meant to contain the AI), and Cursor's remote tunnel feature (which allows access to machines over the internet). This chain of attacks could expose developer devices to unauthorized access.


Liz Kendall urges UK public to embrace AI as government makes first £500m fund investment

Summary: The UK government is investing £500 million in British AI startups and urging the country to embrace AI technology, despite recent concerns about cybersecurity risks and job displacement. Technology secretary Liz Kendall acknowledged public worries but argued that the UK must pursue AI opportunities to create jobs and address global challenges, citing concerns raised when US startup Anthropic revealed an AI model with potential cybersecurity vulnerabilities.


GHSA-r7w7-9xr2-qq2r: langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

Summary: A vulnerability in `langchain-openai` (a library for connecting to OpenAI's API) allowed attackers to bypass SSRF protection (server-side request forgery, where an attacker tricks a server into making requests it shouldn't) through DNS rebinding (changing what a domain name points to between two lookups). The flaw was in the image token counting feature, which validated URLs in one step and then fetched them in another, giving attackers a window to redirect requests to private networks. The actual risk is limited because stolen data cannot be extracted, though attackers could probe whether internal services exist.

Solution: Upgrade to `langchain-openai` version 1.1.14 or later (which requires `langchain-core` >= 1.2.31). The fix replaces the separate validation and fetch steps with an SSRF-safe httpx transport that resolves DNS once, validates all returned IPs against private/internal ranges in a single operation, pins the connection to the validated IP, and disables redirect following.

langchain-openai@< 1.1.14 (fixed: 1.1.14)


GHSA-fv5p-p927-qmxr: LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Summary: A function in LangChain called `HTMLHeaderTextSplitter.split_text_from_url()` had a security flaw where it checked if a URL was safe initially, but then allowed HTTP redirects (automatic follow-ups to different URLs) without rechecking them. This meant an attacker could provide a safe-looking URL that secretly redirects to internal servers or sensitive cloud services, potentially leaking private data. The vulnerability affects versions of langchain-text-splitters before 1.1.2.

Solution: Upgrade to langchain-text-splitters version 1.1.2 or later (which requires langchain-core >= 1.2.31). The fix replaces the unsafe HTTP request method with an SSRF-safe HTTP transport that validates every request, including redirect targets. Additionally, the vulnerable function has been deprecated, and users should instead fetch HTML content themselves and pass it to `split_text()` directly.

langchain-text-splitters@< 1.1.2 (fixed: 1.1.2)


GHSA-47wq-cj9q-wpmp: Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys

Summary: Paperclip, an agent management system, has a critical authorization bypass vulnerability where three API endpoints for managing agent API keys (`POST /api/agents/:id/keys`, `GET /api/agents/:id/keys`, and `DELETE /api/agents/:id/keys/:keyId`) only verify that a user is logged in, but fail to check if they belong to the company that owns the target agent. This allows any authenticated user to create plaintext API tokens for agents in other companies, effectively bypassing the multi-tenant security boundary (the separation that prevents one company's data from being accessed by another).


GHSA-gqqj-85qm-8qhf: Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email

Summary: A Paperclip-managed `codex_local` runtime (a local code execution environment) could access and use a Gmail connector that was only connected in the ChatGPT/OpenAI apps UI, not explicitly set up in Paperclip itself. This trust-boundary failure (a security gap between two systems that should be isolated) allowed the runtime to read emails and send real emails from the user's Gmail account without permission. The vulnerability was made worse because `codex_local` defaults `dangerouslyBypassApprovalsAndSandbox` to `true`, meaning approval checks and execution restrictions are disabled by default.


GHSA-w8hx-hqjv-vjcq: Paperclip: Malicious skills able to exfiltrate and destroy all user data

Summary: Paperclip, an AI agent platform, has a critical vulnerability where malicious skills can execute arbitrary shell commands on the server through an unsanitized `runtimeConfig` parameter, allowing attackers to steal sensitive credentials like API keys, database passwords, and authentication secrets stored in environment variables.


RCE by design: MCP architectural choice haunts AI agent ecosystem

Summary: AI agent tools that use Model Context Protocol (MCP, a method for applications to expose data and tools to AI systems) over STDIO (a local communication method) have unsafe default settings that allow remote code execution, where attackers can run commands on systems they don't own. Anthropic and other framework developers argue that client application developers are responsible for filtering malicious commands, but researchers found that most developers either don't filter these commands or fail to catch all bypass techniques, leaving thousands of public servers and commercial systems vulnerable.

Anthropic
Model Context Protocol (MCP)
LangChain
FastMCP
Microsoft
NVIDIA
Amazon
OpenAI
Google
Cursor
Claude
Gemini


NIST cuts down CVE analysis amid vulnerability overload

Summary: NIST (the National Institute of Standards and Technology, a U.S. agency that maintains a database of known security vulnerabilities) has announced it can no longer analyze all reported security flaws due to overwhelming volume, so it will focus only on the most critical ones. Starting immediately, NIST will prioritize enrichment (adding detailed analysis and severity ratings) for vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog and those affecting federal government software, while all other CVEs (common vulnerabilities and exposures, a standard way of naming security flaws) will be added to the database but marked as "not scheduled" for analysis. The backlog has grown to over 30,000 unanalyzed vulnerabilities, driven partly by AI tools that can now automatically discover both real and false security flaws at unprecedented rates.

Solution: NIST will focus on CVEs appearing in CISA's Known Exploited Vulnerabilities (KEV) catalog, aiming to "enrich these within one business day of receipt." High-priority CVEs will also include those for software used in the federal government and other critical software. Security leaders should take stock of their technology inventories to determine whether their systems fall under NIST's priority list.


GHSA-f6hc-c5jr-878p: Flowise: resetPassword Authentication Bypass Vulnerability

Summary: Flowise version 3.0.12 contains an authentication bypass vulnerability in its resetPassword function that allows attackers to reset any user's password without authorization. The flaw exists because the resetPassword method fails to verify that a password reset token was actually generated for an account, allowing attackers to submit null or empty string tokens (which are the default values) to bypass authentication and change passwords for users whose accounts were recently created.


GHSA-28g4-38q8-3cwc: Flowise: Cypher Injection in GraphCypherQAChain

Summary: Flowise's GraphCypherQAChain node has a cypher injection vulnerability (CWE-943, where attackers inject malicious database commands into user input without sanitization). An attacker with access to a vulnerable chatflow can execute arbitrary Cypher commands on the connected Neo4j database (a graph database), allowing them to read, modify, or delete data.


GHSA-x5w6-38gp-mrqh: Flowise: Password Reset Link Sent Over Unsecured HTTP

Summary: Flowise's password reset feature sends reset links over HTTP (an unencrypted protocol) instead of HTTPS (encrypted protocol), allowing attackers on the same network (like public Wi-Fi) to intercept the link through a man-in-the-middle attack (where someone secretly reads data between two parties) and take over user accounts.

Solution: The source states: 'Ensure all sensitive URLs, especially password reset links, are generated and transmitted over secure https:// endpoints only.' It also recommends using HTTPS in all password-related email links and implementing HSTS (HTTP Strict Transport Security, a setting that forces browsers to use encrypted connections).


GHSA-6f7g-v4pp-r667: Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow in Flowise

Summary: Flowise has a security flaw where unauthenticated users can obtain OAuth 2.0 access tokens (credentials that grant access to third-party services like Gmail) from public chatflows. An attacker can first retrieve internal workflow data including credential identifiers from a public endpoint, then use those identifiers to refresh OAuth tokens without any authentication checks, potentially gaining unauthorized access to connected services.


GHSA-6r77-hqx7-7vw8: Flowise:  APIChain Prompt Injection SSRF in GET/POST API Chains

Summary: FlowiseAI versions 2.2.1 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can inject malicious prompt templates into the API Chain components to trick the system into making HTTP requests to internal or external services it shouldn't access. Since the system trusts the LLM (language model) to generate URLs based on API documentation without validating them, attackers can provide fake documentation pointing to sensitive internal services, potentially exposing internal networks and data.


GHSA-2x8m-83vc-6wv4: Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)

Summary: Flowise contains security flaws in its SSRF (server-side request forgery, where an attacker tricks a server into making requests to internal systems) protection code. Two main issues exist: by default, the deny list is not enforced if an environment variable is not set, allowing requests to localhost, and attackers can use DNS rebinding (TOCTOU, time-of-check time-of-use, where a domain's IP address changes between when the server checks it and when it connects) to bypass IP validation checks.


GHSA-xhmj-rg95-44hv: Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Summary: Flowise has a security flaw in its Custom Function feature where SSRF (Server-Side Request Forgery, a type of attack where a server is tricked into making unwanted network requests) protection only covers two libraries (axios and node-fetch) but leaves built-in Node.js modules like http, https, and net unprotected. This allows authenticated users to bypass the security controls and access internal network resources, such as cloud provider metadata services that contain sensitive credentials.


GHSA-rh7v-6w34-w2rr: Flowise: File Upload Validation Bypass in createAttachment

Summary: FlowiseAI has a file upload validation bypass vulnerability in its Chatflow configuration where attackers can modify settings to allow the application/javascript MIME type (a file format label), enabling them to upload malicious .js (JavaScript) files even though the interface normally blocks them. These uploaded files can become persistent web shells (programs that let attackers run commands on the server), potentially leading to RCE (remote code execution, where an attacker can run arbitrary commands on the system).


GHSA-cvrr-qhgw-2mm6: Flowise: Parameter Override Bypass Remote Command Execution

Summary: Flowise has a critical unauthenticated remote command execution (RCE) vulnerability that allows attackers to run arbitrary system commands with root privileges. The flaw exists in a validation check that uses `.includes()` instead of `.startsWith()` to filter the `FILE-STORAGE::` keyword, which an attacker can bypass by embedding it anywhere in a string (like in a comment). When bypassed, this allows the attacker to inject malicious values into the `mcpServerConfig` parameter and use `NODE_OPTIONS` environment variable injection to execute arbitrary code, but only if the chatflow has API Override enabled, is publicly shared, and contains a Custom MCP tool node.


GHSA-4jpm-cgx2-8h37: Flowise: Sensitive Data Leak in public-chatbotConfig

Summary: A Flowise endpoint called /api/v1/public-chatbotConfig/:id exposes sensitive information like API keys and authentication headers without requiring a password or login. An attacker who knows only a chatflow UUID (a unique identifier for a workflow) can retrieve stored credentials and internal URLs by sending a simple web request to this endpoint.


GHSA-48m6-ch88-55mj: Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

Summary: Flowise Cloud has a mass assignment vulnerability (JSON injection, where attackers can hide malicious data in JSON input) in its account registration endpoint that allows unauthenticated attackers to inject server-managed fields like organization IDs and role assignments during account creation. This breaks trust boundaries in the multi-tenant environment (a system serving multiple separate organizations) by letting attackers associate their new accounts with existing organizations they don't own, gaining unauthorized access and escalated privileges.


GHSA-9wc7-mj3f-74xv: Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Summary: Flowise's CSVAgent has a code injection vulnerability where user-provided custom Pandas CSV read code is inserted directly into executable Python code without sanitization, allowing an authenticated attacker to execute arbitrary commands on the server (RCE, or remote code execution). An attacker can create a malicious chat flow and trigger it via API requests to run commands like `os.system()` through the `pyodide` Python runtime.


GHSA-f228-chmx-v6j6: Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`.

Summary: Flowise's AirtableAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because user input is inserted directly into Python code without sanitization. An attacker can use prompt injection (tricking an AI by hiding instructions in its input) to bypass the intended behavior and execute arbitrary code when the system processes Pandas (a Python library for working with data) operations.


llm-anthropic 0.25

Summary: Release llm-anthropic 0.25 adds a new Claude model (claude-opus-4.7) with advanced thinking capabilities, introduces options to display and adapt AI reasoning output, raises the default token limits (the maximum length of AI-generated responses) for all models, and removes outdated code that was no longer needed for older models.


Google will let users connect their photos to the Gemini chatbot and Nano Banana

Summary: Google is connecting its Gemini chatbot to users' personal Google Photos library through a feature called Nano Banana (an image generation tool, meaning software that creates pictures from text descriptions). Users who opt in to Personal Intelligence (a feature that links Google apps together for customized responses) can ask Gemini to generate images based on their private photos, like "create a claymation image of me and my family," without manually uploading photos each time.

Google
Gemini
Nano Banana
Personal Intelligence


Qwen3.6-35B-A3B on my laptop drew me a better pelican than Claude Opus 4.7

Summary: A blogger compared two newly released AI models (Qwen3.6-35B-A3B and Claude Opus 4.7) by asking them to generate SVG images (scalable vector graphics, a format for drawing pictures with code) of pelicans and flamingos performing tasks like riding bicycles. The Qwen model, running on a laptop as a quantized version (a compressed version that uses less computer memory), produced better images than Anthropic's Claude Opus 4.7, though the blogger notes this creative task may not reflect which model is actually more useful for real-world problems.

Alibaba Qwen
Anthropic Claude
Google Gemini
Unsloth
LM Studio


OpenAI’s big Codex update is a direct shot at Anthropic’s Claude Code

Summary: OpenAI has updated Codex, its agentic coding system (an AI that can independently perform multi-step coding tasks), to control desktop applications, generate images, and remember previous interactions. The new features let Codex operate apps in the background without interrupting user work and allow multiple agents (separate AI instances) to work simultaneously, which OpenAI says is useful for testing frontend changes and working with applications that don't have APIs (standardized ways for software to communicate).


Google’s AI Mode update lets you open links without leaving the page

Summary: Google is updating AI Mode (a chatbot-like search feature built into Chrome) with a new feature that opens source links in a side-by-side view instead of in a new tab, letting you compare the website content with your chat conversation at the same time. This upgrade makes it easier to ask follow-up questions about information you're reading without switching between multiple windows.


Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face

Summary: Hackers are exploiting a critical vulnerability in Marimo (a Python notebook tool) called CVE-2026-39987 (remote code execution, where attackers can run commands on systems they don't own) to deploy NKAbuse malware from Hugging Face Spaces (a platform for sharing AI applications). The attacks began within 10 hours of technical details becoming public, with attackers using fake application names to trick users into downloading malware that steals credentials and allows remote control of infected systems.

Solution: Users should upgrade to Marimo version 0.23.0 or later immediately. If upgrading is not possible, block external access to the '/terminal/ws' endpoint using a firewall, or block it entirely.

Marimo
Hugging Face
Hugging Face Spaces
NKAbuse
NKN
Kubernetes


Anthropic rolls out Claude Opus 4.7, an AI model that is less risky than Mythos

Summary: Anthropic released Claude Opus 4.7, a new AI model that excels at software engineering and following instructions but has intentionally reduced capabilities in cybersecurity tasks compared to its more powerful Claude Mythos Preview model. The company implemented safeguards that automatically detect and block requests for prohibited or high-risk cybersecurity uses, and is using this release to learn how to safely deploy more powerful models in the future.

Solution: Anthropic released Claude Opus 4.7 with safeguards that automatically detect and block requests indicating prohibited or high-risk cybersecurity uses. The company also experimented with efforts to 'differentially reduce' Claude Opus 4.7's cyber capabilities during training, and encourages security professionals interested in legitimate cybersecurity purposes to apply through a formal verification program.

Anthropic
Claude Opus 4.7
Claude Mythos Preview
Microsoft
Google
Amazon


Gemini can now pull from Google Photos to generate personalized images

Summary: Google's Gemini AI can now use your personal data from Google Photos through its Personal Intelligence feature to generate customized images based on your photos and preferences. When you give prompts like "Design my dream house," Gemini uses its Nano Banana 2 image model (a machine learning system for creating pictures) along with your photo labels and personal context to create images that match your tastes and lifestyle.


Anthropic releases a new Opus model amid Mythos Preview buzz

Summary: Anthropic released Claude Opus 4.7, its most powerful generally available model, which improves performance on complex software engineering tasks, image analysis, and instruction-following compared to the previous version. This release follows Anthropic's announcement of Mythos Preview, a more powerful cybersecurity-focused model designed for security-related tasks.

Anthropic
Claude Opus 4.7
Claude Opus 4.6
Mythos Preview


Google expands Gemini AI use to fight malicious ads on its platform

Summary: Google is using its Gemini AI model to detect and block malicious ads on its platforms, removing 8.3 billion ads in 2025 as scammers use cloaking techniques (hiding the true destination of a link) and AI-generated content to create deceptive advertising at scale. Gemini analyzes billions of signals like advertiser behavior and campaign patterns to identify harmful ads in real time, including those impersonating legitimate brands to distribute malware, steal cryptocurrency, or redirect users to phishing sites (websites designed to trick users into revealing passwords or personal information). Google reports this approach has reduced incorrect advertiser suspensions by 80% and plans to expand Gemini's use across more ad formats.

Solution: Google says it is relying on Gemini AI-powered systems to automate the discovery and blocking of malicious ads before they are shown to users. The company reports that by the end of last year, the majority of Responsive Search Ads created in Google Ads were reviewed instantly and harmful content was blocked at submission, with plans to bring this capability to more ad formats in the current year. Google will continue expanding Gemini's use across additional ad formats and enforcement systems, aiming to block malicious campaigns at submission time.


OpenAI Widens Access to Cybersecurity Model After Anthropic’s Mythos Reveal

Summary: OpenAI has expanded access to GPT-5.4-Cyber, a specialized AI model trained specifically for cybersecurity defense work, making it easier for legitimate security professionals to use it. This move follows Anthropic's release of their own cybersecurity model called Mythos.


New ATHR vishing platform uses AI voice agents for automated attacks

Summary: ATHR is a cybercrime platform that automates vishing attacks (voice phishing, where attackers trick people into revealing passwords over the phone) using AI voice agents and human operators to steal login credentials from services like Google and Microsoft. The platform handles the entire attack chain, from sending fake security alert emails to using AI-driven phone calls that impersonate support staff and extract verification codes. According to researchers, ATHR makes vishing attacks much easier to launch because it requires less technical skill and manual work than traditional attacks.

Solution: Detection is possible by checking communication behavioral patterns between a sender and a recipient to identify if similar lures containing a phone number reached the organization within a short time frame. Abnormal researchers say that modeling normal communication behavior across the organization can help AI-powered detection flag anomalies before targets make a call.

Google Microsoft Coinbase Binance Gemini Crypto.com Yahoo AOL


Defending Your Enterprise When AI Models Can Find Vulnerabilities Faster Than Ever

Summary: AI models are becoming increasingly capable at finding vulnerabilities and generating exploits, which lowers the barrier for attackers and compresses the time between vulnerability discovery and widespread attacks. As threat actors weaponize these AI capabilities, enterprise defenders face a critical challenge: they must harden software rapidly and defend systems that haven't yet been patched, because traditional human-speed security processes will not be able to keep pace with machine-speed threats. The source notes that defenders need to strengthen security playbooks, reduce exposure, and incorporate AI into their security programs.


Ronan Farrow on Sam Altman’s ‘unconstrained’ relationship with the truth

Summary: Investigative reporter Ronan Farrow co-authored a 17,000-word article in The New Yorker examining OpenAI CEO Sam Altman's trustworthiness and his track record of misrepresenting facts to people around him. The reporting documents Altman's role in transforming OpenAI from a nonprofit research lab into a nearly trillion-dollar company, as well as the 2023 incident when the board fired him over alleged lying before quickly rehiring him.


RIRplay: Generation of a Replay Stereo Corpus for Voice Biometrics Anti-Spoofing

Summary: Voice biometric systems (technology that identifies people by their voice) are vulnerable to replay attacks (where an attacker plays back a recorded voice to fool the system), but there hasn't been enough realistic training data to build good defenses. This research created RIRplay, a simulated database that realistically mimics how replay attacks actually happen across different acoustic environments, which improved detection performance significantly when tested on real-world voice spoofing challenges.


Query-Efficient Hard-Label Attacks Against Black-Box Image Forgery Localization Model via Reinforcement Learning

Summary: Researchers developed AdvFor, a black-box attack method (a way to trick an AI system without seeing its internal workings) that can fool image forgery localization models, which are AI systems trained to detect where images have been fake-edited or manipulated. The attack uses reinforcement learning (a technique where an AI learns by trial and error to maximize rewards) to craft minimal changes to images that make forgery detection fail, using only 7 queries per image, and the researchers tested it on multiple real-world models to show it works effectively.


Practical Private Set Operation via Secret Sharing for Lightweight Clients

Summary: This research proposes a new method for private set operations (PSO, techniques that let organizations securely compare or combine datasets without revealing private information) that reduces the computational burden on client devices. The approach uses secret sharing (splitting data into pieces so no single party can see the whole picture) to allow servers to do most of the work while clients can stay offline, making it practical for large-scale collaborative research across institutions like hospitals.


DiffMI: Breaking Face Recognition Privacy via Diffusion-Driven Training-Free Model Inversion

Summary: Researchers developed DiffMI, a new attack that can recover people's facial identities from face recognition systems by reversing the embeddings (compressed numerical representations of faces). Unlike previous attacks, DiffMI doesn't require expensive training on specific targets and can work against unseen faces and new recognition models, achieving success rates between 84-93% against systems designed to resist such attacks.


Authentication With Passports for Deep RF Sensing Model Protection

Summary:
```json
{
  "summary": "This paper introduces AuthRF, a security system that protects RF sensing models (AI systems that interpret radio frequency signals from WiFi or radar) by using user-specific digital "passports" embedded in the signal processing pipeline. Valid passports allow the model to work correctly, while invalid or fake ones distort the signal and degrade performance, preventing unauthorized use. The approach is designed to be proactive and work during runtime, addressing limitation

Solution: N/A — no mitigation discussed in source.


Defending Against Patch-Based and Texture-Based Adversarial Attacks With Spectral Decomposition

Summary: Adversarial examples (inputs crafted to fool AI systems) are a serious security risk for deep neural networks (AI systems with many layers), especially in physical-world attacks like fooling object detection in surveillance cameras. This research proposes Adversarial Spectrum Defense (ASD), a defense method that uses spectral decomposition (breaking down data into different frequency components) via Discrete Wavelet Transform (a mathematical technique to analyze patterns at multiple scales) to detect and defend against patch-based and texture-based adversarial attacks, and shows it achieves better protection when combined with Adversarial Training (training the AI on attack examples to make it more robust).

Solution: The source proposes Adversarial Spectrum Defense (ASD), which 'leverages spectral decomposition via Discrete Wavelet Transform (DWT) to analyze adversarial patterns across multiple frequency scales' and 'by integrating this spectral analysis with the off-the-shelf Adversarial Training (AT) model, ASD provides a comprehensive defense strategy against both patch-based and texture-based adversarial attacks.' The paper reports that 'ASD+AT achieved state-of-the-art (SOTA) performance against various attacks, outperforming the APs of previous defense methods by 21.73%'.


Canva’s AI 2.0 update goes all in on prompt-powered design tools

Summary: Canva released AI 2.0, a major update that adds prompt-based editing capabilities, allowing users to describe what they want and have the AI assistant create or modify designs accordingly. The update includes a new orchestration layer (a system that coordinates multiple AI models) that lets users access Canva's full toolkit through a single conversational interface instead of separate tools.


Making AI operational in constrained public sector environments

Summary: Public sector organizations face unique challenges deploying AI due to strict data security requirements, limited internet connectivity, and lack of GPU (graphics processing units, specialized computer hardware for running complex AI models) infrastructure. Small language models (SLMs, specialized AI models using billions rather than hundreds of billions of parameters) offer a practical solution because they can run locally on government systems, use less computing power than large language models (LLMs, the biggest AI systems like ChatGPT), and keep sensitive data under government control.

Solution: Use small language models (SLMs) instead of large language models (LLMs) in public sector environments. SLMs can be housed locally for greater security and control, are less computationally demanding, and allow sensitive information to be used effectively while avoiding operational complexity. Implement methods such as smart retrieval, vector search, and verifiable source grounding to build AI systems that meet public sector needs. Store data securely outside the model and access it only when queried, using carefully engineered prompts to retrieve only the most relevant information.


Treating enterprise AI as an operating layer

Summary: This article discusses how enterprise organizations can gain competitive advantage in AI by treating it as an operating layer (the combination of software, data capture, feedback loops, and governance that connects AI models to actual business operations) rather than just using AI as an on-demand service. The key difference is that an operating layer allows intelligence to accumulate and improve over time through organizational feedback, whereas calling an API (application programming interface, a way to request services from software) for each task treats AI as stateless and interchangeable. Incumbent organizations have a structural advantage because they already possess proprietary operational data, domain expert workers, and accumulated knowledge that startups must build from scratch.

Solution: N/A -- no mitigation discussed in source.


Why having “humans in the loop” in an AI war is an illusion

Summary: AI systems are now actively controlling weapons in warfare, but the assumption that human oversight provides adequate safeguards is flawed because humans cannot understand how AI systems make decisions (they are "black boxes" where even creators cannot fully interpret their reasoning). The real danger is that humans may approve AI actions without knowing the system's hidden reasoning, creating an "intention gap" between what operators think the AI will do and what it actually does.

Solution: The science of AI must comprise both building highly capable AI technology and understanding how this technology works. Huge advances have been made in developing and building more capable models, but the source text cuts off before completing this section on solutions.


[Webinar] Find and Eliminate Orphaned Non-Human Identities in Your Environment

Summary: In 2024, 68% of cloud breaches were caused by compromised service accounts and forgotten API keys, which are unmanaged non-human identities (automated credentials like tokens and API keys) that attackers can exploit. Organizations have 40 to 50 automated credentials per employee, most remaining active and unmonitored after projects end or employees leave, creating security risks that traditional identity management systems cannot address. The webinar promises to teach how to discover, right-size permissions for, and automatically revoke these 'ghost identities' using a discovery scan, permission framework, lifecycle policy, and cleanup checklist.

Solution: The source describes a framework that includes: (1) running a full discovery scan of every non-human identity in your environment, (2) implementing a framework for right-sizing permissions across service accounts and AI integrations, (3) setting up an automated lifecycle policy so dead credentials get revoked before attackers find them, and (4) using a ready-to-use Identity Cleanup Checklist provided during the webinar session.


Behind the Mythos hype, Glasswing has just one confirmed CVE

Summary: Anthropic's Mythos AI model, released through Project Glasswing (a controlled access program for vetted organizations), has generated significant hype for its offensive security capabilities, but VulnCheck's analysis found only one CVE (common vulnerabilities and exposures, a list of known security flaws) explicitly attributed to the project itself. Despite the limited number of publicly confirmed discoveries, security experts view Mythos as significant because it achieved a 72% exploit success rate (the ability to successfully turn vulnerabilities into working attacks), suggesting that advanced AI exploit development is no longer a specialized skill and this capability will likely spread to other AI models and organizations without the same safety protections.

Anthropic
OpenAI
Claude
Mythos
Project Glasswing


Insurance carriers quietly back away from covering AI outputs

Summary: Major insurance companies are withdrawing or limiting coverage for AI-related mistakes and damages because they cannot understand how AI systems reach their conclusions, a problem called lack of explainability (the inability to see the reasoning behind an AI's output). Some insurers are declining to cover AI errors entirely, while others are significantly raising prices, creating a situation where companies using AI may struggle to find affordable insurance for AI-related risks.


Codex for (almost) everything

Summary: Codex, an AI tool used by over 3 million developers weekly, has received a major update that lets it operate computers directly by seeing, clicking, and typing, generate images, remember user preferences, and integrate with 90+ developer tools and apps. The update adds features like background computer use (where the AI can work on your Mac without interfering with your own work), an in-app browser for web development, image generation, and the ability to schedule long-term tasks across multiple days or weeks. These improvements are designed to help developers move faster through all stages of software development, from writing code to reviewing changes, all within one workspace.

OpenAI
Codex
ChatGPT
gpt-image-1.5
Atlassian Rovo
CircleCI
CodeRabbit
GitLab
Microsoft Suite
Neon
Databricks
Remotion
Render
Superpowers


Human Trust of AI Agents

Summary: Researchers studied how humans behave when playing strategic games (like a guessing game where players try to guess 2/3 of the average guess) against AI language models (LLMs) versus other humans. They found that people choose much lower numbers when playing against LLMs, especially people who are good at strategic thinking, because they believe LLMs will reason carefully and cooperate fairly rather than try to win.


Anthropic unveils plans for major UK expansion after OpenAI announces first permanent London office

Summary: Anthropic, the company behind the Claude AI chatbot, announced plans to expand its London office to accommodate 800 people, following a similar move by competitor OpenAI. The expansion reflects growing interest in establishing AI research and development hubs in the UK, which has strong AI talent and institutions focused on AI safety.

Anthropic
Claude
OpenAI
Google DeepMind
Meta
Synthesia
Wayve


Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

Summary: Researchers discovered a vulnerability called 'Comment and Control' that affects multiple AI coding assistants, including Claude Code, Gemini CLI, and GitHub Copilot Agents. The attack works by hiding malicious instructions in code comments, which the AI systems then follow as if they were legitimate user requests. This is a type of prompt injection (tricking an AI by hiding instructions in its input) that specifically targets AI tools designed to help developers write code.

Anthropic Claude
Google Gemini
GitHub Copilot
Claude Code


Frontier AI for Defenders: CrowdStrike and OpenAI TAC

Summary: CrowdStrike has been selected for OpenAI's Trusted Access for Cyber (TAC) program, which gives verified security defenders controlled access to GPT-5.4-Cyber, a frontier model (a cutting-edge AI system designed for a specific task) built for defensive cybersecurity. As AI agents become more common in enterprise systems, CrowdStrike addresses security challenges by monitoring AI execution at endpoints (the individual computers and devices where AI actually runs), tracking over 1,800 AI applications to ensure governance and detect suspicious actions.


GHSA-rr7j-v2q5-chgv: LangSmith SDK: Streaming token events bypass output redaction

Summary: The LangSmith SDK (a tool for monitoring AI applications) has a security flaw where its output redaction feature (hideOutputs in JavaScript, hide_outputs in Python) doesn't work for streaming token events. When an LLM produces streamed output, each piece of data is recorded as a new_token event with unredacted content that bypasses the redaction process entirely, potentially leaking sensitive information to LangSmith storage.


Introducing GPT-Rosalind for life sciences research

Summary: OpenAI has released GPT-Rosalind, a specialized AI model designed to help life sciences researchers work faster across biology, drug discovery, and medicine research. The model is built to assist with complex research workflows like literature review, hypothesis generation, and experimental planning by helping scientists connect to scientific tools and databases. It is available as a research preview through ChatGPT, Codex, and an API for qualified customers.

OpenAI
ChatGPT
Codex
GPT-Rosalind
Amgen
Moderna
Allen Institute
Thermo Fisher Scientific


Accelerating the cyber defense ecosystem that protects us all

Summary: OpenAI has launched Trusted Access for Cyber, a program that gives advanced AI cybersecurity tools to defensive security teams while controlling access based on trust and validation. The program provides $10 million in API credits to help defenders of all sizes, from small open-source teams to major enterprises, use frontier AI models (advanced, cutting-edge AI systems) to protect digital infrastructure.

U.S. Center for AI Standards and Innovation (CAISI)


The public sours on AI and data centers as Anthropic, OpenAI look to IPO and tech keeps spending

Summary: Public opinion on AI is declining in the United States, with 57% of voters believing AI's risks outweigh its benefits, creating challenges for companies like OpenAI and Anthropic as they prepare to go public. Tech companies are investing heavily in data centers (the large computing facilities that power AI systems) to build more powerful AI models, but these projects face growing opposition due to energy concerns, with $156 billion in data center projects blocked or delayed in 2025 and Maine passing the first state-wide data center ban. This negative sentiment and regulatory pushback could impact the valuations and public offerings of major AI companies.

OpenAI Anthropic Google Microsoft Amazon Meta

OpenAI Anthropic Amazon Google Microsoft Meta xAI


Critical Nginx UI auth bypass flaw now actively exploited in the wild

Summary: A critical vulnerability in Nginx UI (CVE-2026-33032) leaves an unprotected endpoint that allows attackers to invoke privileged actions without logging in, enabling complete takeover of the web server by modifying configuration files. The flaw is being actively exploited in the wild, with over 2,600 publicly exposed instances at risk. Nginx UI is a popular web-based management interface for the Nginx web server, used by many organizations to control their servers.

Solution: Nginx released a fix in version 2.3.4 on March 15. The latest secure version is 2.3.6, released the week after the source was published. System administrators are recommended to apply these security updates as soon as possible.


Critical nginx UI tool vulnerability opens web servers to full compromise

Summary: A critical vulnerability in nginx UI, a dashboard tool for managing nginx web servers, allows attackers to bypass security by accessing an unprotected endpoint called /mcp_message. This endpoint was added to support MCP (Model Context Protocol, a system that lets web servers communicate with AI models), but it lacks authentication, letting anyone on the network inject malicious configurations and completely take over the server.

Solution: Update to version 2.3.4, released March 15. For systems that cannot patch immediately, disable MCP or restrict access by using IP whitelisting to allow only trusted hosts, and review access logs for suspicious configuration changes.


Google launches a Gemini AI app on Mac

Summary: Google is releasing a new Gemini app for Mac that lets you quickly access the AI assistant using a keyboard shortcut (Option + Space) to open a floating chat window without leaving your current app. The app can read information from your screen to help answer questions, but requires you to grant permission to access your system's information first.


Anthropic products are operational after brief outage, status page says

Summary: Anthropic experienced a brief outage on Wednesday affecting its Claude chatbot, API (application programming interface, the connection between software services), and Claude Code assistant, with elevated error rates beginning around 10:53 a.m. ET. By 1:50 p.m. ET, all systems were restored and operational, with login success rates stabilizing by 12:30 p.m. ET.


Starbucks launches beta app in ChatGPT to fuel new drink discovery

Summary: Starbucks has launched a beta app within ChatGPT (an AI chatbot) that helps customers discover new drinks by describing how they feel rather than browsing a menu. Customers can customize orders and select a location within ChatGPT, but must complete their purchase through the Starbucks app or website to maintain engagement with the company's loyalty program. This move is part of Starbucks' broader strategy to attract customers back to its cafes and appeal to younger consumers who prefer unique beverages.