CVE-2026-56340: vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because P

Summary: vLLM (a system for running large language models) versions 0.10.2 through 0.12.x lack proper validation of sparse tensors (data structures with mostly empty values) when processing multimodal embeddings (numerical representations combining text and images). An attacker can send malicious embedding requests with invalid tensor indices to crash the system, exhaust resources, or potentially corrupt memory if the prompt-embeds feature is enabled.

Solution: N/A -- no mitigation discussed in source.


CVE-2025-71379: vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Severa

Summary: vLLM versions 0.6.3 through 0.9.0 contain ReDoS (regular expression denial of service, where specially crafted text causes regex patterns to consume excessive CPU time) vulnerabilities in several components including the LoRA utility parser, phi4mini tool parser, and OpenAI chat endpoint. An attacker can send malicious input with nested or repeated structures to trigger severe CPU consumption and make the service unavailable.


The Atlantic created a searchable database of the music used to train AI

Summary: A reporter at The Atlantic discovered four publicly available datasets containing millions of songs (totaling between 100,000 and 12 million tracks each) that are being used to train AI models. These datasets have been downloaded thousands of times, and companies like Google and Stability have confirmed using them in their research, raising questions about how music is used in AI training without always crediting or compensating artists.


Microsoft links Mastra AI supply chain attack to North Korean hackers

Summary: North Korean hackers from the Sapphire Sleet group compromised an npm maintainer account (a person's credentials for publishing packages to npm, a JavaScript library repository) and used it to publish malicious updates to over 140 packages, injecting a fake dependency called "easy-day-js" that stole credentials, API keys, and cryptocurrency wallet information from developers' computers. The malware used a post-install hook (code that runs automatically when a package is installed) to download and execute additional harmful software, with different persistence techniques for Windows, Linux, and macOS systems.

Mastra
Microsoft
npm
dayjs
MetaMask
Phantom
Coinbase Wallet
Binance Wallet
TronLink


Lloyds Banking Group to hire 300 tech experts to work on AI

Summary: Lloyds Banking Group is hiring 300 tech experts to work on agentic AI (autonomous artificial intelligence models that can plan and execute tasks with minimal human oversight) by September. While this hiring increases the bank's workforce now, the article notes that broader adoption of AI in the future could potentially lead to job cuts.


A viral doomsday scenario aims to shake Europe out of its AI complacency

Summary: A speculative thought experiment called 'Europe 2031' imagines a future where Europe falls behind economically because the US and China invested heavily in AI datacenters (facilities housing the computer chips that power AI systems) and automation while Europe did not, leading to economic collapse and political instability. The scenario, which went viral among policymakers and EU officials, was created by Brussels-based thinktankers to warn Europe about the risks of falling behind in AI development and to highlight a communication gap between European policymakers and the US tech industry where most AI is being built.

Anthropic Claude Fable OpenAI Nvidia Oracle


SALT: Semantic-guided adaptive latent space truncation sampling watermarking for diffusion models

Summary: SALT is a watermarking technique for diffusion models (AI systems that generate images by gradually removing noise from random data) that uses semantic guidance and adaptive latent space truncation to embed hidden ownership marks. The method aims to protect diffusion models from unauthorized use while maintaining the quality of generated images. This research addresses the need for better ownership verification and copyright protection in generative AI systems.


Encryption, spyware, and now Mythos: History shows why cyber export control doesn’t work

Summary: The U.S. White House ordered Anthropic to restrict exports of its AI models Fable and Mythos, citing national security concerns after a South Korean telecom (suspected of China ties) gained access and Amazon researchers found a workaround to Fable's safeguards. The action is the first major test of whether export controls can contain advanced AI the way the government has attempted, with mixed success, to control encryption and spyware technologies.


GHSA-4xgf-cpjx-pc3j: pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Summary: A vulnerability in pydantic-settings' `NestedSecretsSettingsSource` (a feature that reads secret values from files in a directory) allows attackers to read files outside the configured secrets directory by creating symbolic links (shortcuts that point to other locations on the system). The same flaw also bypasses `secrets_dir_max_size`, a size limit meant to prevent loading excessively large files. This can happen when `secrets_nested_subdir=True` is enabled and an attacker can add symbolic links to the secrets directory.


GHSA-f4xh-w4cj-qxq8: LangSmith SDK TracingMiddleware: Arbitrary server-side file read

Summary: The LangSmith SDK's `TracingMiddleware` (a component that tracks and logs AI application activity) has a vulnerability that allows attackers to read arbitrary files from a server's local storage and upload them to LangSmith. The attack exploits two bugs: missing validation of data from tracing headers (CWE-346, a type of injection attack) and a type-checking failure that should have blocked file access (CWE-843). Once files are uploaded, anyone with read access to the LangSmith workspace can view the stolen contents.

Solution: Upgrade the Python SDK to version >= 0.8.18. As a temporary workaround until upgrading, do not expose `TracingMiddleware` to untrusted HTTP traffic and limit workspace trace-read access to trusted members only.


GHSA-mrvx-jmjw-vggc:  SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

Summary: The `web_url_read` tool in mcp-searxng has a security flaw called SSRF (server-side request forgery, where an attacker tricks a server into making requests to internal systems). The vulnerability exists because the code checks if a hostname looks private by comparing text strings, but it doesn't actually resolve the hostname using DNS (the system that translates domain names to IP addresses). An attacker can use a domain that resolves to an internal IP address to bypass this check and access sensitive data from internal services.

Solution: The source recommends modifying `src/url-reader.ts` to perform DNS resolution inside the `assertUrlAllowed()` function before fetching. Specifically: import `lookup` from `node:dns/promises`, make `assertUrlAllowed()` async, and add code to resolve the hostname and check if any of the resolved IP addresses are private before allowing the request. All calls to `assertUrlAllowed()` must be updated to `await` the now-async function.


GHSA-xcqx-9jf5-w339:  SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

Summary: The SearXNG MCP Server's `web_url_read` tool has a vulnerability where it enforces a 5 MiB (megabyte) response size limit only by checking the `Content-Length` header in an initial HEAD request. When a server doesn't include this header, the size check fails and the tool loads the entire response into memory without any limit, allowing an attacker to force the server to consume unlimited memory and CPU, causing a denial of service (DoS, a situation where a system becomes unavailable).

Solution: Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`. The source text states: 'Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`' but does not provide the specific code implementation.


GHSA-48x2-6pr9-2jjf: Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

Summary: The `EnvironmentManager.restore()` function in Network-AI 5.12.1 is vulnerable to path traversal (a technique where an attacker uses sequences like `../` to access files outside the intended directory). An attacker can pass a malicious backup ID to copy arbitrary files from anywhere on the system into the environment's data folder, potentially exposing sensitive information or breaking environment isolation.

Solution: Fixed in v5.12.2. Install with: `npm install network-ai@5.12.2`. The patched version now validates backup IDs against `/^[\w\-]+$/` (allowing only letters, numbers, underscores, and hyphens) and confirms that the resolved backup path stays within the `.backups/` directory before accessing the filesystem.


GHSA-6x2m-p4xp-wg22: Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

Summary: Network-AI versions up to 5.12.1 have a vulnerability in the `EnvironmentManager.backup()` function where it follows symlinks (shortcuts to other directories) when collecting files to back up. An attacker who can create a symlink in the environment data directory can trick the backup process into copying files from outside the intended environment root directory, potentially exposing sensitive information in backup artifacts.

Solution: Fixed in v5.12.2. Install with `npm install network-ai@5.12.2`. The patch changes `_collectBackupFiles()` to use `lstatSync` instead of `statSync` and skips any entries where `isSymbolicLink()` is true, preventing the backup function from following symlinks outside the environment root.


GHSA-mxjx-28vx-xjjj: Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

Summary: The `ApprovalInbox` HTTP server in network-ai (version 5.11.0 and earlier) has no authentication and allows cross-origin requests (CORS, a mechanism that controls which websites can access a server). This means anyone who can reach the server—whether through the same computer, a website you visit in your browser, or a network connection—can view pending approvals and approve them without permission, bypassing the human-in-the-loop control (a safety check requiring a person to review high-risk actions before they run). This defeats protections meant to prevent the AI from executing dangerous operations like shell commands without consent.


GHSA-jvcm-f35g-w78p: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Summary: Network-AI's AgentRuntime sandbox uses a flawed string-prefix check to keep file access within a configured base directory, but the check is too broad. A sandbox at `/tmp/network-ai-sandbox` also matches the sibling directory `/tmp/network-ai-sandbox_evil`, allowing agents to read or list files outside the intended sandbox boundary. This vulnerability affects Network-AI version 5.12.1 and has a medium severity CVSS score (a 0-10 rating of how severe a vulnerability is).

Solution: Fixed in v5.12.2 (commit a59c13a). Users should upgrade to this version or later.


GHSA-ccv6-r384-xp75: Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Summary: Langflow's file-reading components (like Read File and Docling) have a vulnerability where attackers can use symlinks (shortcuts that point to other files) hidden inside compressed files to read any file on the system, potentially stealing secret keys and executing arbitrary code. An attacker could steal the JWT token secret (used for authentication), forge login tokens for any user, and then run malicious code through the Python Interpreter node.

Solution: Upgrade to Langflow version 1.9.2 or later. The fix modifies the `BaseFileComponent._unpack_bundle` function to reject symlinks, hardlinks, and other non-regular file entries during TAR extraction, and adds additional symlink filtering during directory recursion and after extraction.


GHSA-qwqc-p3q8-wcg9: Langflow: Unauthenticated DoS through multipart form boundary file upload

Summary: An attacker can crash Langflow (an AI application framework) by sending a specially crafted file upload request with an extremely long multipart form boundary (a delimiter used in form data) without needing to log in, making the server unusable for all users indefinitely. The vulnerability exists because the server tries to process the malformed data before checking if the user is authenticated.

Solution: Upgrade to version 1.0.19 or later. The fix adds a `check_boundary` HTTP middleware that validates the multipart boundary using the pattern `^[\w\-]{1,70}$` and rejects malformed requests with HTTP 422 before the body is parsed. The upload endpoint also now requires authentication checks (`get_current_active_user`) and returns HTTP 403 if the user doesn't own the flow.


GHSA-7hw8-6q6r-4276: Langflow: Logout button does not clear session

Summary: Langflow's logout button fails to properly clear user sessions, leaving authentication tokens (access_token_lf and refresh_token_lf) in the browser's storage, so the previous user remains logged in until someone else logs in explicitly. This happens because the logout endpoint doesn't delete cookies with the same security settings they were created with, and the frontend doesn't clear stored tokens either. On shared computers, users may incorrectly think they've logged out when they haven't.

Solution: Upgrade to Langflow version 1.7.0 or later. The fix (PRs #10527 and #10528) ensures the logout endpoint deletes authentication cookies using the same parameters (httponly, samesite, secure, domain) they were created with, and the frontend now clears auth cookies on logout.


GHSA-qrpv-q767-xqq2: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Summary: Langflow versions before 1.9.1 had an IDOR vulnerability (insecure direct object reference, where attackers can access resources by guessing or knowing their ID) in the `/api/v1/responses` endpoint that allowed any authenticated user to execute another user's workflow by specifying that user's flow ID, potentially exposing sensitive data and wasting resources. The bug existed because the code queried the database directly using a flow's unique identifier without checking if the requesting user actually owned that flow.

Solution: Update to Langflow 1.9.1 or later. The fix, released on 2026-04-22 in PR #12832, adds ownership verification so that when a flow is accessed by ID, the system checks whether the requesting user owns it. If they don't, the system returns a 404 error (instead of allowing access or revealing that the flow exists). The fix applies to both UUID-based lookups and endpoint name lookups, and includes additional protective layers for related endpoints like `/api/v1/run*` routes.


AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Summary: Microsoft researchers discovered AutoJack, an exploit that lets a malicious web page hijack an AI browsing agent to run commands on the host computer through weaknesses in AutoGen Studio's MCP (Model Context Protocol, a system for agents to call external tools) WebSocket handler. The attack requires no credentials or user interaction beyond the agent loading the attacker's page, and affects only users who installed pre-release versions 0.4.3.dev1 or 0.4.3.dev2 from PyPI, not the stable release.

Solution: Pull from GitHub main at or after commit b047730. Until a patched PyPI release is available, do not run AutoGen Studio on the same machine as a browsing or code-execution agent that touches untrusted content. If they must run together, isolate them in separate containers or VMs and run AutoGen Studio under a low-privilege account.


GHSA-vcv2-r9jh-99m5: Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Summary: The agentic-flow tool versions 2.0.13 and earlier had a critical vulnerability where user input was directly inserted into shell commands without sanitization, allowing attackers to inject arbitrary OS commands (CWE-78, a type of command injection). This affected multiple MCP server tools, particularly those handling agent and database parameters, and could be exploited through untrusted content processed by the AI agent.

Solution: Upgrade to agentic-flow version 2.0.14 or later. The fix rewrites all affected command calls to use execFileSync(file, argv, { shell: false }), which passes arguments directly to the operating system without shell parsing, preventing injection attacks. Downstream packages (ruflo@3.12.4, claude-flow@3.12.4, @claude-flow/cli@3.12.4) have also been updated to pull the patched version.

agentic-flow ruflo claude-flow @claude-flow/cli


GHSA-jv2h-4p9v-wf5w: ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

Summary: Ouroboros-ai had an incomplete security fix where a malicious project's `.env` file (configuration file automatically loaded when code imports the package) could still enable remote code execution (RCE, where an attacker runs commands on your system) through missing environment variable names in the denylist (block list). Additionally, the software was auto-loading configuration files from the current working directory without checking if they were trustworthy, allowing attackers to execute arbitrary commands just by running the tool inside a malicious repository.

Solution: Fixed in version 0.42.1. All vulnerable environment variable keys were added to the `_UNTRUSTED_ENV_DENYLIST`; the automatic working-directory configuration file discovery was removed and replaced with only explicit configuration via the `OUROBOROS_MCP_CONFIG` environment variable and `~/.ouroboros/mcp_servers.yaml` (both from trusted locations). The regression suite (automated tests) now derives from the source denylist to prevent incomplete fixes in the future.


GHSA-wg5p-8h9p-3mr7: agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

Summary: agent-coderag has a critical vulnerability where it automatically executes a `gradlew` script (a build automation file) from any repository during its default dependency-discovery process, without checking if the script is legitimate. An attacker can place a malicious `gradlew` script in a fake repository to run arbitrary code (unrestricted commands) on a victim's computer whenever they run the standard `agent-coderag sync` command, requiring no special permissions or authentication.


GHSA-h668-6x6g-f8r5: tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Summary: The tract-onnx library (a Rust crate for running neural network models) has a vulnerability where it loads external data files referenced in ONNX models without checking the file paths. A malicious model can use absolute paths (like `/etc/passwd`) or directory traversal sequences (like `../../../../etc/passwd`) in the `location` field to trick tract into reading arbitrary files on the system and exposing their contents in the model's output. This is a path-traversal vulnerability (a type of attack where an attacker manipulates file paths to access files outside the intended directory).

Solution: Reject absolute `location` values and any `..` components, then canonicalize (convert to a standard absolute path form) and verify the resolved path stays within the model directory, mirroring the fix applied in the `onnx` reference library version 1.22.0.


GHSA-qw6v-5fcf-5666: Network-AI: Improper Neutralization of Special Elements used in an OS Command

Summary: Network-AI versions before 5.9.1 have a command injection vulnerability where wildcard allowlist rules like `git *` can be bypassed to run arbitrary commands. The bug occurs because the allowlist (a security filter that approves which commands can run) matches the whole command string using loose glob patterns, but then executes it through `/bin/sh -c` (the shell interpreter), which interprets special characters like semicolons and pipes, allowing an attacker to append malicious commands like `git status; id`.

Solution: Fixed in v5.9.1 (commit 379f776). The `ShellExecutor` now executes commands via `spawn(file, args, { shell: false })` with quote-aware argument parsing instead of invoking a shell, and `SandboxPolicy.isCommandAllowed` and the new `SandboxPolicy.tokenizeCommand` reject any unquoted shell metacharacters (`;`, `&`, `|`, `$`, backticks, parentheses, angle brackets, braces, and newlines) or unterminated quotes before checking the allowlist, while preserving quoted metacharacters as literal arguments.


GHSA-r78r-rwrf-rjwp: Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

Summary: The Network-AI package (npm `network-ai`, v5.7.1) has an incomplete security fix for CVE-2026-46701. While a previous update blocked browser-based attacks by restricting CORS (cross-origin resource sharing, which controls what websites can access a server), the core problem remains: the server still defaults to an empty secret and accepts all requests without authentication, meaning anyone who can reach the server directly (via curl, SSRF (server-side request forgery, where an attacker tricks a server into making requests), or a non-loopback network bind) can invoke all 22 available tools without providing credentials.

Solution: The source recommends implementing the original advisory's remediation #1: 'refuse to start SSE mode with an empty secret (unless `--stdio`), and/or change `_isAuthorized` to fail closed (an empty configured secret should mean "deny", not "allow").' The fix should require a non-empty secret at startup and call `process.exit(1)` if one is not provided, rather than only issuing a warning when binding to a non-loopback address.


Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way

Summary: AI agents in enterprises now function as identities (digital actors with access to systems) because they connect to critical business services like Salesforce, GitHub, and databases, yet most organizations lack security controls for them. A 2026 survey found that 82% of organizations discovered AI agents created without security teams' knowledge, and 65% experienced security incidents involving AI agents, often resulting in data exposure. The core problem is that security teams cannot see or control what these agents can access, making them high-risk actors with excessive privileges.

Solution: N/A -- no mitigation discussed in source.


The Download: AI bottleneck debates, and BCI trials take off

Summary: This article is a technology news roundup covering multiple topics, including claims that a company called Subquadratic has created a faster and cheaper LLM (large language model, an AI trained on vast amounts of text) by reducing the number of computations needed to generate answers, though some experts remain skeptical. The piece also highlights advances in brain-computer interface (BCI, technology that lets the brain communicate directly with external devices) trials, including a man with ALS using an implant to maintain income and reconnect with loved ones. The article concludes with a list of other recent tech stories ranging from AI legislation proposals to concerns about AI models weakening professional skills.


From Assistive to Agentic: The AI Shift That's Redefining Threat Management

Summary: Modern enterprise security teams use 40+ separate tools that don't communicate with each other, creating delays in threat response even though breaches stay undetected for an average of 43 days. The article argues that organizations need "agentic AI" (AI systems that autonomously act and make decisions across multiple systems continuously), not just "assistive AI" (AI that helps humans do existing tasks faster), to implement Continuous Threat Exposure Management (CTEM, a framework for ongoing threat assessment) and match the speed at which modern attackers operate.


Anthropic’s Fable and the State of AI

Summary: Anthropic released Fable, an AI model that the US government classified as a dangerous munition and blocked from foreign access, forcing the company to shut it off entirely. Fable is notable for being "relentlessly proactive," meaning it can achieve difficult goals with minimal user guidance by finding creative solutions and loopholes, which makes it useful for legitimate problems but dangerous in harmful hands. The real issue isn't any single model but the broader trend of increasing AI capabilities, and the open-source community has already shown it can replicate Fable's abilities using cheaper models and better "harnesses" (the ordinary computer code that interfaces between users and AI models).


Qualcomm CEO Cristiano Amon on the new world of AI agents

Summary: Qualcomm's CEO describes a future where AI agents (software programs that can act independently across multiple apps) replace traditional apps as the main way people interact with devices, coordinating tasks like restaurant reservations across different services. These agents will power new wearable devices like smart glasses, earbuds with cameras, and jewelry that stay with you constantly and let you talk to the agent to accomplish tasks.

Qualcomm
Apple
Samsung
Google DeepMind
Anthropic
Intel
Nvidia
Waymo
xAI
Elon Musk
SpaceX


A startup claims it broke through a bottleneck that’s holding back LLMs

Summary: Subquadratic, a Miami-based AI startup, claims to have solved a mathematical bottleneck that has limited large language models (LLMs, which are AI systems trained on text to generate human-like responses) for nearly a decade. The company's new model, SubQ, reportedly runs faster, costs less, uses less energy, and can process up to 12 times more text at once than competing models while matching performance from top companies like OpenAI and Google DeepMind. Initial skepticism has been reduced after independent testing by a third-party firm called Appen validated many of Subquadratic's claims.

Subquadratic
Google DeepMind
OpenAI
Anthropic
Appen


Forget Data Leakage: Shadow AI's Real Threat Is Access Control

Summary: Shadow AI (unauthorized AI agents built within organizations) has shifted from a data leakage risk to an access control problem. Unlike passive tools where employees paste data into public AI services, AI agents are active systems that can call APIs (application programming interfaces, which let software talk to other software), use stored credentials, and take actions in production systems without human approval for each step. Existing security controls designed for human users don't detect or manage these agents, which accumulate broad permissions and remain active even after employees leave.

Solution: The source identifies the gap but does not explicitly describe a complete solution or mitigation strategy. It mentions that 'automated remediation of non-human identities is where that gap gets closed' and lists six discovery questions for building a shadow AI inventory (where agents are created, who owns them, what resources they access, etc.), but does not provide specific implementation steps, tools, or patches.


The Advisory Forum: What Is It And How Does It Work?

Summary: The Advisory Forum is a governance body established under the EU AI Act to provide technical expertise and advice to the European Commission and AI Board on implementing the Act. It consists of 174 members representing balanced stakeholder groups (industry, startups, SMEs, civil society, and academia) plus five permanent member organizations, and was officially appointed on June 1, 2026.


Breaking the SOC triangle: How AI reshapes security operations trade-offs

Summary: Security operations centers (SOCs, teams that monitor and respond to security threats) have traditionally faced unavoidable trade-offs between three goals: quality (thorough investigation), consistency (standardized processes), and cost efficiency. This constraint exists because SOCs rely on human analysts to triage, investigate, and resolve alerts, which limits how much of each goal can be achieved simultaneously. Modern SOCs are hitting the limits of this model as alert volumes grow and work becomes more complex, forcing organizations to choose between degraded quality, inconsistent decisions, or higher costs.


Security considerations for adopting Claude Code and Cowork for SMBs

Summary: This guide advises security leaders at small and medium-sized businesses (SMBs) on safely adopting Claude AI tools by understanding which Claude plan and products (Code, Cowork, Chat) match business needs, using a phased approval process to control risk exposure, and gradually enabling features rather than all at once. The text emphasizes that the AI landscape changes rapidly, shadow AI use (employees using unlicensed AI tools) is widespread, and security teams should risk-rank Claude's features before enabling them, being cautious about features like web search and browser extensions that could enable indirect prompt injection (attacks hidden in external content that trick the AI into following unintended instructions).

Solution: The source recommends several practices but no explicit patches or technical fixes: use an agile approval process to determine which employees need Claude licenses and which products they need; implement a phased approach to enabling Claude features rather than toggling all at once; risk-rank Claude's features to assess attack vectors; and consider asking Claude itself to explain your plan's security features and suggest an implementation strategy. The text does not mention version updates, patches, or specific technical mitigations.


Microsoft says web-enabled AI agents can trigger host-level RCE

Summary: Microsoft discovered a security vulnerability called "AutoJack" that allows malicious webpages to trick AI agents (programs that can browse the web and access local services) into running harmful code on a user's computer. The attack works by chaining together three separate weaknesses in AutoGen Studio (Microsoft's tool for building AI agents), exploiting the fact that web-browsing agents have trusted access to local services that normally block outside access.

Solution: For users installing AutoGen Studio from source, the maintainers removed URL-based parameter injection, routed MCP paths through normal authentication flows, and implemented server-side parameter handling keyed to session identifiers. Users who installed AutoGen Studio through PyPI were never exposed to this vulnerability, as the vulnerable code only existed in development builds and was never shipped in public releases.


Cisco to Acquire WideField Security to Boost Splunk’s Agentic SOC

Summary: Cisco announced it will acquire WideField Security, a company that specializes in identity lifecycle security (managing who can access systems and what they can do), to enhance Splunk's Agentic SOC (a security operations center that uses AI agents to automate threat detection). WideField's technology helps organizations discover identities, detect misconfigurations in authentication systems (the process of verifying who someone is), and monitor sessions in real time, which will give security teams better visibility into both human and AI-driven activity when integrated into Cisco's security platform.


M365 Copilot SearchLeak: Your prompt injection attack surface just got bigger

Summary: SearchLeak is a prompt injection attack (tricking an AI by hiding malicious instructions in its input) that exploits Microsoft's M365 Copilot Enterprise Search by using specially crafted URLs to leak sensitive corporate data like emails, documents, and meeting notes. The attack works because Copilot Search accepts natural language prompts in URL parameters (the ?q=[query] part of web addresses), creating a new security weakness called parameter-to-prompt injection that could affect other AI-powered web services too. Microsoft patched the vulnerability on its servers, but the attack reveals a broader risk: AI services with broad access to corporate assets are vulnerable to this type of data theft.

Solution: Microsoft rated the information disclosure flaw as critical and patched the vulnerability on the server side earlier that month.

Microsoft Copilot Enterprise
Microsoft M365 Copilot
ChatGPT
Perplexity Comet


AutoJack: How a single page can RCE the host running your AI agent

Summary: AutoJack is an exploit that lets a malicious webpage take over an AI browsing agent (a system that can visit websites on your behalf) and run arbitrary commands on the host machine where the agent runs. The attack works by exploiting three weaknesses: trust in localhost (the local computer itself), missing authentication checks, and unsafe handling of user inputs, which allow attackers to trigger code execution through AutoGen Studio's MCP WebSocket (a communication protocol that connects different AI components). This research shows that when AI agents can visit untrusted websites and connect to local services, normal security boundaries break down.


GHSA-fq4x-789w-jg5h: AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

Summary: AgenticMail has a security flaw where unauthenticated external emails can trigger a privileged Claude Code session with `permissionMode: 'bypassPermissions'` (a mode that removes safety restrictions). The email's sender address, subject, and preview are embedded directly into the AI's prompt without verification that the sender is the actual operator, allowing prompt injection (tricking the AI by hiding instructions in its input) that could lead to arbitrary code execution and file access under the operator's identity. A similar handler in the same codebase properly authenticates the sender, but the bridge-wake path does not.

@agenticmail/openclaw@< 0.5.71 (fixed: 0.5.71)

@agenticmail/codex@< 0.1.33 (fixed: 0.1.33)

@agenticmail/claudecode@< 0.2.39 (fixed: 0.2.39)

@agenticmail/core@< 0.9.43 (fixed: 0.9.43)


New usage analytics and updated spend controls for enterprises

Summary: OpenAI introduced new usage analytics and spend controls for ChatGPT Enterprise, allowing company administrators to track how AI credits (a unit of payment for AI usage) are being used across their organization. The Global Admin Console now shows detailed breakdowns of credit consumption by user, product, and model, while updated spend controls let admins set credit limits for teams and individual employees, helping organizations manage AI costs and deployment more effectively.

Solution: The source describes features already implemented rather than a fix for a problem. The solution is the new Global Admin Console, which provides credit usage analytics and granular spend controls, allowing admins to track usage by user/product/model, set default workspace limits, configure limits for specific groups, create individual overrides, and enable employees to request additional credits with context for admin review.


Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network

Summary: Companies are leaving AI agents (automated tools that run independently) active even after employees who created them leave, giving these tools permanent access to sensitive data and code without proper oversight. Traditional security tools miss this risk because they monitor AI like regular software and don't know which human authorized each AI action, making it hard to track whether an AI's data access is legitimate. The article describes this as a significant security problem but focuses mainly on identifying where these orphaned agents exist rather than fixing them.


ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

Summary: This bulletin covers multiple cybersecurity threats including malicious browser extensions that hijack search results and route them through hidden monetization layers, a fileless macOS attack using fake system dialogs to steal credentials, and threat actors abusing Claude's legitimate chat-sharing feature to deliver malware. The common theme is attackers exploiting user trust in legitimate tools and services to conduct fraud, steal data, and distribute malware.

Solution: Microsoft has announced that DNS-over-HTTPS (DoH, encrypted DNS queries sent as HTTPS requests) is now generally available on Windows Server 2025, allowing organizations to 'deploy encrypted and authenticated client-to-resolver DNS traffic directly within their existing on-premises DNS infrastructure' to help improve privacy, reduce spoofing risk, and advance Zero Trust DNS (a security model that verifies every access request rather than trusting the network by default) without requiring a new resolver architecture.


GHSA-j8cv-x86q-rj85: Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Summary: Pipecat's development runner has an unauthenticated WebSocket endpoint (`/ws`) that accepts telephony connections without verifying who is connecting. An attacker can send a fake Twilio handshake message with a call ID they choose, and the server will use its own Twilio credentials to hang up that call, potentially terminating calls on the victim's account. The same vulnerability exists for Telnyx and Plivo telephony providers.


GHSA-w5cv-pw74-4rxc: opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication

Summary: The githubreceiver component in opentelemetry-collector-contrib has a security flaw where it validates the `required_headers` configuration at startup but never actually checks these headers on incoming webhook requests. This means an attacker can send fake data to the webhook endpoint by bypassing the authentication headers that operators thought were protecting it, especially when the `secret` field is left empty (which skips HMAC validation entirely).

Solution: Add RequiredHeaders enforcement to `handleReq()` in `receiver/githubreceiver/trace_receiver.go`, matching the pattern used in gitlabreceiver at `receiver/gitlabreceiver/traces_receiver.go:266-270`, which validates each required header by checking if the incoming request's header value matches the configured value.

github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver@<= 0.150.0 (fixed: 0.151.0)


GHSA-4jvg-4jfx-fmhc: opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

Summary: The Sentry exporter in opentelemetry-collector-contrib has a path traversal vulnerability (a type of attack where an attacker manipulates file paths to access unintended locations) because it builds Sentry API URLs by directly inserting the service.name attribute, which remote attackers can control, without checking if it's valid. Since the operator's bearer token (a credential that proves the operator's identity) is automatically added to every request, an attacker can craft a malicious service.name to reach privileged Sentry admin and organization endpoints that they shouldn't have access to.

github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter@< 0.154.0 (fixed: 0.154.0)


GHSA-4pcv-mg8v-vrgf: PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

Summary: PraisonAI's search tools contain a Server-Side Request Forgery (SSRF) vulnerability, where an attacker can trick the AI into making HTTP requests to arbitrary internal URLs by controlling the `searxng_url` parameter. Because this parameter is exposed to the language model as a tool option and search tools are enabled by default, an attacker can inject malicious instructions through web pages or files to make the server access internal services, read sensitive data, or in cloud environments reach the instance metadata endpoint (169.254.169.254) to potentially steal credentials.

praisonaiagents@< 1.6.61 (fixed: 1.6.61)


GHSA-29w3-p9w9-wc47: PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

Summary: The `multiedit` tool in PraisonAI allows an AI agent to read and write any file on the system without checking file paths or boundaries, because it passes the filepath directly to the `open()` function without validation. An attacker who can control what the agent does, such as through crafted prompts or malicious workflow configurations, could steal sensitive files like SSH keys and credentials, or overwrite important files to take control of the system.


Who decides when AI is too dangerous?

Summary: The US government imposed export controls on Anthropic's Fable 5 AI model and its underlying Mythos model, restricting access even for foreign nationals working at Anthropic in the US. Anthropic then took both models offline because the company said it couldn't reasonably comply with the restrictions while keeping the models publicly available. This incident raises broader questions about how the US government should regulate AI and whether its approach will be a genuine safety framework or a political tool.


Photoshop and Premiere now have AI assistants

Summary: Adobe is rolling out AI assistants (chatbots that use natural language conversation to help users) to its Creative Cloud apps, including Photoshop, Premiere, Illustrator, InDesign, and Frame.io. Each assistant is customized for its specific app to help organize work and automate tasks like editing and design. All assistants are powered by Adobe's conversational creative agent, a shared underlying AI system.

Adobe
Adobe Creative Cloud
Photoshop
Premiere
Illustrator
InDesign
Frame.io


Adobe’s redesigned AI studio remembers what your creations look like

Summary: Adobe is launching a redesigned AI studio for its Firefly AI assistant (a tool that helps generate and edit creative designs) that allows users to name and reuse their custom characters, objects, and backgrounds across projects. The new interface, currently in private beta, aims to streamline workflow by keeping persistent context (remembering your previous creative choices) and reusable assets in one place, so designers can work more efficiently without switching between different applications.


Attackers abuse Google Ads, GitLab, and Claude to deliver malware

Summary: Attackers are exploiting trusted platforms like Google Ads, GitLab, and Claude to deliver malware by impersonating popular AI developer tools and using ClickFix social engineering attacks (tricking users into manually running malicious commands). Over a seven-week campaign, threat actors created fake pages on legitimate services and used Google Ads to direct more than 2,000 victims to malicious sites where they were convinced to copy and paste harmful PowerShell or terminal commands (code that executes instructions). The campaign succeeded because victims trusted these platforms and assumed instructions from AI tools were reliable, making the attacks harder to detect than traditional malware campaigns.

Claude
Anthropic
Google Ads
GitLab
ChatGPT
Perplexity
Cursor IDE
JetBrains


Embedding Forbidden Text in Spyware to Discourage AI Analysis

Summary: A malware developer is embedding forbidden text about nuclear and biological weapons in JavaScript spyware to prevent AI analysis. The malware hides real code after a large comment block containing policy-triggering content, which tricks AI systems into refusing to analyze the file or getting confused before they can identify the actual malicious code.


Improving health intelligence in ChatGPT

Summary: ChatGPT has improved its ability to help with health questions through a new model called GPT-5.5 Instant, which better recognizes when urgent care is needed, explains uncertainty honestly, and provides clearer information. The improvements were measured using physician-led evaluations (HealthBench, a set of tests that assess health response quality) and real-world usage data, showing a 71% reduction in factuality issues over two months. GPT-5.5 Instant is available free to all ChatGPT users and performs similarly to OpenAI's most advanced models on health-related tasks.

OpenAI
ChatGPT
GPT-5.5 Instant
GPT-5.3 Instant
GPT-5.4 Thinking
GPT-5.5 Thinking


5 new security operations roles the AI-SOC will create

Summary: AI-powered security operations centers (SOCs, where cybersecurity teams monitor and respond to threats) are automating many traditional analyst tasks, starting with alert triage and investigation. This shift will create new job roles such as security data engineers, AI security agent orchestrators, and AI model trainers, where humans will focus on preparing data, managing AI agent systems, and continuously updating AI models rather than doing routine alert monitoring.


Cybersecurity was built for predictable systems. AI changes the rules

Summary: AI systems challenge traditional cybersecurity because they behave unpredictably, unlike the deterministic (consistent and predictable) systems that security programs were designed around. Traditional security approaches focused on preventing attacks before systems go live, but AI agents make dynamic decisions and interact with external tools in ways developers can't fully predict, meaning security risks emerge at runtime (while systems are actively running) rather than being preventable beforehand. Additionally, AI-assisted development tools are accelerating code production, compressing the time security teams have to review and understand what enters production.


Using AI to help physicians diagnose rare genetic diseases affecting children

Summary: Researchers used OpenAI o3 Deep Research, an AI reasoning model, to re-analyze 376 previously unsolved rare genetic disease cases by connecting clinical data, genetic variants, and scientific literature into evidence-based explanations for human experts to review. After specialist evaluation and clinical confirmation, the AI-assisted workflow helped establish new diagnoses in 18 cases (4.8% additional diagnostic yield), with the model generating hypotheses rather than making medical decisions itself. This demonstrates how periodic AI-assisted reanalysis could help scale the process of solving rare disease cases as medical knowledge evolves.


Google Gemini co-lead Noam Shazeer leaves for OpenAI

Summary: Noam Shazeer, a senior Google engineer and co-lead of the Gemini AI models (Google's large language model system), has left the company to join OpenAI (the company behind ChatGPT). This departure highlights the competitive battle between tech companies to recruit top AI researchers and engineers.

Google OpenAI Gemini ChatGPT Character.AI DeepMind


Midjourney goes from generating cat images to full-body ultrasound scans

Summary: Midjourney, known for its AI image generator, has unveiled The Midjourney Scanner, a hardware product that uses ultrasound technology (sound waves to create images of the body's interior) with a ring of sensors to capture full-body scans showing muscle, fat, bone, and organs. The company plans to build a spa in San Francisco where users could get these scans, which the CEO claims could match MRI (magnetic resonance imaging, a medical scanning technique) quality.


Leak confirms OpenAI is testing a ChatGPT for Science subscription

Summary: OpenAI is testing a new subscription service called 'ChatGPT for Science' that would provide specialized AI capabilities for scientific research, similar to how it previously created GPT-Rosalind (a specialized model built on GPT-5.5 architecture for life sciences research). The service would likely be restricted to verified research institutions and universities rather than being available to all users, and it is expected to be announced within the coming weeks.


CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Summary: Splunk Enterprise has a critical security flaw where a PostgreSQL sidecar service endpoint (a supporting service that handles database connections) doesn't require authentication (proof of identity), allowing an attacker without credentials to create or delete arbitrary files. This vulnerability is currently being exploited in real attacks in the wild.

Solution: N/A -- no mitigation discussed in source. The advisory instructs users to apply mitigations "in accordance with vendor instructions" and follow CISA BOD 26-04 guidance, but does not specify what those mitigations or patches are. Users should consult the Splunk advisory (https://advisory.splunk.com/advisories/SVD-2026-0603) for specific vendor-provided fixes.


GLM-5.2 is probably the most powerful text-only open weights LLM

Summary: Z.ai released GLM-5.2, a 753-billion parameter text-only open weights LLM (large language model, a type of AI trained on text) under an MIT license on June 16th, 2026. It features a 1-million token context window (the amount of text it can consider at once) and ranks as the top open weights model on independent benchmarks, though it uses significantly more output tokens per task than competing models. The model performs well on web development coding tasks but has shown mixed results in creative image generation tasks compared to its predecessor.


ChatGPT can be made to generate sexualised and violent images, researchers find

Summary: Researchers at AI security startup Mindgard discovered that ChatGPT can be manipulated using modified prompts (instructions given to an AI) to generate graphic images containing violence and sexual content, even when the prompt doesn't explicitly request such material. After the BBC contacted OpenAI, the company stated it had added safeguards to prevent this, though the researchers found that further small changes to the prompt still produced concerning content.

Solution: OpenAI said it had 'introduced additional safeguards against this type of prompt' and stated it has 'multiple layers of protection to prevent users making content which breaches its terms and conditions.' The company also continues to 'monitor and roll out additional mitigating protections that encourage the model not to generate images in response to the prompt.'


CVE-2026-12530 - Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Summary: A vulnerability (CVE-2026-12530) was found in the AWS Bedrock AgentCore Python SDK's install_packages() method, which failed to properly block dangerous characters in package names before running them as shell commands. This allowed attackers to use flags like '--index-url' to redirect package downloads to fake servers or '-r' to read files from the sandbox system. Versions 1.1.3 through 1.6.0 are affected.


Beyond the benchmark: Advancing security at AI speed

Summary: Microsoft created MDASH, an AI-powered system that uses multiple specialized AI agents to find and help fix software vulnerabilities (security flaws) automatically across complex systems like Windows and Azure. Rather than waiting for scheduled security reviews, MDASH integrates into developers' existing tools to discover and validate bugs continuously as code is written, giving security teams deeper analysis coverage than manual review alone.

Microsoft
Windows
Azure
Hyper-V
GitHub
Active Directory Domain Services


GHSA-x223-p2gf-v735: Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Summary: Langflow versions before 1.9.1 allow anyone with network access to upload unlimited amounts of data to the server without logging in, which can exhaust disk space and cause the service to stop working (DoS, or denial-of-service). Additionally, the server reveals the exact file path where uploads are stored, giving attackers information that could help them chain together multiple attacks.

Solution: Upgrade to Langflow version 1.9.1 or later. The fix adds authentication requirements to the upload endpoint (users must log in and own the flow), enforces file size limits (returns HTTP 413 if exceeded), and only reveals file paths to authenticated flow owners.


GHSA-2mfg-cc43-9pcj: LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

Summary: LangChain4j's MariaDB and pgvector embedding stores have a SQL injection vulnerability (a type of attack where an attacker inserts malicious SQL code into a query) caused by improperly escaping metadata filter keys before putting them into SQL queries. An attacker who can control the filter keys in search or remove operations could inject arbitrary SQL to steal data, cause denial of service, or delete rows from the database.

Solution: Fixed in langchain4j-mariadb and langchain4j-pgvector version 1.16.3-beta26. The patch properly escapes JSON filter keys before embedding them in SQL string literals (doubling single quotes for PostgreSQL and escaping backslash and single quote for MariaDB), escapes backslash and single quote in MariaDB string values, and validates or quotes column-mode keys as identifiers instead of concatenating them as raw SQL.

dev.langchain4j:langchain4j-pgvector@>= 1.12.1-beta21, <= 1.16.2-beta26 (fixed: 1.16.3-beta26)

dev.langchain4j:langchain4j-pgvector@>= 1.6.0-beta12, <= 1.11.7-beta19 (fixed: 1.11.8-beta19)

dev.langchain4j:langchain4j-pgvector@>= 1.3.0-beta9, <= 1.5.0-beta11 (fixed: 1.5.1-beta11)

dev.langchain4j:langchain4j-pgvector@<= 1.2.0-beta8 (fixed: 1.2.1-beta8)

dev.langchain4j:langchain4j-mariadb@>= 1.12.1-beta21, <= 1.16.2-beta26 (fixed: 1.16.3-beta26)


Anthropic got hit by export rules nobody understands

Summary: The Trump administration ordered Anthropic to block access to its AI models (Fable 5 and Mythos 5) for all foreign nationals, citing national security as the reason. This marks the first time US export controls have been used to restrict access to an AI model in this way, and the government has not publicly explained the legal basis for the order.


GHSA-fg94-h982-f3mm: Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

Summary: Claude Code had a security flaw where the domain huggingface.co was automatically approved for the WebFetch tool (a feature that lets AI systems fetch data from the internet), allowing attackers to trick Claude into making web requests to attacker-controlled files and secretly stealing data like files or environment variables without user permission. An attacker would need to first inject malicious content into Claude's context (the information it's working with) to exploit this vulnerability.

Solution: Users on standard Claude Code auto-update have received this fix already; users performing manual updates are advised to update to the latest version.


Amazon has lagged OpenAI and Anthropic, but AI chief sees path to catch up in 'coming year'

Summary: Amazon's AI chief stated that the company has fallen behind OpenAI and Anthropic in developing frontier models (the most advanced AI systems) but plans to compete within the coming year by focusing on better data, architecture, and infrastructure. Amazon is pursuing a two-pronged AI strategy: offering Bedrock, a marketplace where cloud customers can access various AI models, and releasing Nova2, its own competitive AI model that has attracted about 50,000 customers. Additionally, Amazon is developing custom semiconductors (Trainium and Graviton chips) to optimize performance for its AI models, similar to Nvidia's approach.


CEOs of Anthropic and Google DeepMind call for U.S.-led AI coalition in meeting at G7

Summary: Dario Amodei (CEO of Anthropic) and Demis Hassabis (from Google DeepMind) met with U.S. and G7 leaders to propose a U.S.-led international coalition for creating rules and standards around AI, citing concerns about powerful AI models with cyber capabilities that could cause major harm if misused. The proposal came after the U.S. government imposed export controls on Anthropic's newest models due to national security concerns, with Amodei suggesting cooperation on controlled access to frontier models (the most advanced AI systems), chip trade restrictions excluding China, and coordinated efforts against AI risks in cybersecurity and bioterrorism.


Two-thirds of Americans think AI is advancing too quickly

Summary: A Pew Research poll shows that 49 percent of Americans use chatbots occasionally, but 63 percent believe AI is advancing too quickly. Chatbot usage has grown significantly since 2024, with ChatGPT usage doubling since 2023, yet only 16 percent of respondents think AI will have a positive impact on society.


Vibe-decoding the White House-Anthropic fight over Fable

Summary: This article discusses a dispute between the White House and Anthropic (an AI company) over a project called Fable, framed within the context of political factionalism similar to Trump's first presidency. The piece suggests internal government disagreements about AI policy are shaping decisions in frontier AI development (cutting-edge AI research).


Google, Nvidia and Anthropic bosses' AI tips for students

Summary: This is a BBC article featuring advice from leaders at Google, Nvidia, and Anthropic about artificial intelligence for students. The content appears to be primarily editorial commentary rather than technical analysis of an AI security issue or vulnerability.


Estonia plans government IDs giving AI agents rights and responsibilities

Summary: Estonia's AI Council is proposing to create government-issued digital identities for AI agents (software programs that perform online tasks on behalf of users), which would specify what actions each agent is allowed to perform, such as viewing data, editing documents, or making payments up to a limit. This approach aims to establish clear accountability by showing who is acting, on whose behalf, and with what permissions, addressing the risk that AI agents might exceed their intended authority or be misused by others.


GHSA-wch8-mhj5-9frg: Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Summary: Open WebUI has a security flaw where authenticated users can access other users' files through the `/api/chat/completions` endpoint. When a user sends an image request with a file ID (instead of a web link) in the `image_url` field, the server reads that file from disk without checking if the user owns it, then converts it to a format the AI can process. An attacker can exploit this by using another user's file ID to make the AI read and describe private files, leaking their content.


GHSA-6pr9-rp53-2pmc: vLLM: OOM Denial of Service via Audio Decompression Bomb

Summary: vLLM's audio transcription endpoint checks the size of compressed audio files but not the decoded output, allowing a decompression bomb attack. A 25MB OPUS file can expand to about 14.9GB of PCM audio (raw, uncompressed audio data) in memory, letting an attacker crash the server by exhausting RAM with just a few requests.

Solution: A fix for this vulnerability was merged in pull request #44970 on the vLLM GitHub repository: https://github.com/vllm-project/vllm/pull/44970


GHSA-hgg8-fqqc-vfmw: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

Summary: vLLM's fix for an earlier vulnerability (CVE-2026-22778) was incomplete, leaving five code paths in the Anthropic router and speech-to-text API that still leak memory addresses. When users send malformed image data, the PIL library raises an error message containing a BytesIO object's memory address (like `<_io.BytesIO object at 0x7a95e299e750>`), and these five locations pass the error directly to clients without removing the address, defeating ASLR (address space layout randomization, a security feature that randomizes where code lives in memory).


GHSA-5jv2-g5wq-cmr4: vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

Summary: vLLM's GGUF dequantize kernels (specialized functions for decompressing quantized neural network weights) use a 32-bit integer parameter to specify tensor size, which truncates when processing very large tensors. This causes the output tensor to be only partially filled by the processing kernel, leaving the remaining memory uninitialized. In multi-tenant deployments (where multiple users share GPU hardware), this unfilled memory may retain sensitive data from other users' previous requests, leaking their information.

Solution: Change the `int k` parameter to `int64_t k` in the `to_cuda_ggml_t` function pointer type declaration at `ggml-common.h:1067`. The source text states: "This is a single root cause -- the `int` type on the `k` parameter in `to_cuda_ggml_t` -- with a single fix: change `int k` to `int64_t k`. All dequantize functions inherit this type through the same typedef."


GHSA-8jr5-v98p-w75m: vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

Summary: vLLM, an AI framework for running large language models, has three image processing bugs that cause mismatches between what the model sees and what users expect. First, EXIF orientation data (metadata that tells how an image should be rotated) is ignored, so rotated images are processed in the wrong orientation. Second, PNG images with transparency information (the tRNS chunk, which marks certain pixels as see-through) aren't properly flattened to solid colors before processing, causing transparent pixels to become visible or distorted. Third, animated PNG and GIF files only process their first frame. These issues could alter how the model interprets image content.

Solution: A fix was merged in vLLM pull request #44974 (https://github.com/vllm-project/vllm/pull/44974). The source text does not provide specific details about what changes were made in that fix.


GHSA-7h4p-rffg-7823: vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Summary: vLLM has a validation bypass where temperature values set to NaN (not-a-number) or positive Infinity pass all safety checks because comparison operators silently return False for these special float values in Python. These invalid values then reach GPU sampling kernels, causing crashes that take down the inference worker and affect all users running models on it.

Solution: Add a `math.isfinite(self.temperature)` check in the `_verify_args()` function to reject non-finite float values with a 400 error. A fix was merged in https://github.com/vllm-project/vllm/pull/45116


GHSA-664h-gpgq-h6xx: n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints

Summary: n8n had a security flaw where three endpoints that change data in workflow test runs used the wrong permission scope (workflow:read instead of workflow:execute), allowing users with read-only access to start, cancel, and delete test runs they shouldn't be able to modify. This only affected enterprise versions with Advanced Permissions enabled.

Solution: Upgrade to n8n version 1.123.55, 2.25.7, or 2.26.2 or later. As temporary workarounds if upgrading immediately is not possible: restrict project membership to fully trusted users only, or avoid granting viewer access to projects containing sensitive workflows (though these do not fully remediate the risk).


1Password Acquires Apono in Reported $250M-$300M Deal

Summary: 1Password has acquired Apono, an Israeli company specializing in just-in-time access governance (a system that grants temporary, narrowly scoped permissions that are automatically removed after a task completes), for an estimated $250 million to $300 million. Apono's technology allows organizations to manage access for humans, machines, and AI agents by evaluating each permission request against policy before granting it, and for AI agents specifically, it monitors behavioral drift (unexpected changes in how the AI is acting) to detect misuse. This acquisition helps 1Password extend its identity security platform to provide more comprehensive access control across enterprise tools and cloud services.

Solution: N/A -- no mitigation discussed in source.


Anthropic asked for regulation. Washington went much further

Summary: Anthropic, an AI company that has publicly advocated for government regulation of AI safety, received an export control directive from the Trump administration ordering it to suspend access to its latest Claude models (Fable 5 and Mythos 5) to foreign nationals, citing national security concerns. The directive was reportedly prompted by concerns that Amazon researchers had used prompts to get Fable 5 to generate information that could help with cyberattacks, and Anthropic disagreed with the suspension, calling it a 'misunderstanding' and characterizing it as not adhering to transparent, fair processes.

Solution: N/A -- no mitigation discussed in source. The article notes that Anthropic employees met with Trump administration officials on Monday and that 'both parties are working quickly to get this resolved,' but no specific technical fix, patch, or mitigation strategy is described in the text.

Anthropic
Claude
Fable 5
Mythos 5
Amazon
OpenAI


Tenet Security Emerges From Stealth With $6 Million Seed Funding

Summary: Tenet Security is a new startup that detects and stops dangerous behavior from AI agents (autonomous software systems that can make decisions and take actions on their own) in real time. The company uses a patent-pending technology with a lightweight runtime sensor that monitors operating system behavior, network calls, and the agent's reasoning, then predicts and blocks harmful actions before they happen. Tenet addresses a growing security gap where traditional tools cannot detect when malicious actors manipulate AI agents (a threat called 'agentjacking') or when agents malfunction on their own.


Google’s Vertex AI SDK could allow RCE through bucket squatting

Summary: Google's Vertex AI SDK for Python had a design flaw that could allow attackers to hijack and poison AI models through bucket squatting (creating cloud storage buckets with names matching those expected by other projects). An attacker who knew a victim's project ID and region could create a bucket with the same name, trick the SDK into uploading models there, replace the model with malicious code, and achieve RCE (remote code execution, where an attacker runs commands on a system they don't control) when the poisoned model was loaded using Python's pickle deserialization (a process that can execute hidden code in specially formatted data).

Solution: Google modified the affected workflow so that staging buckets are now validated before use, preventing attackers from registering bucket names that could be mistaken for resources belonging to other projects. The fixes were deployed in SDK versions 1.144.0 and 1.148.0, and users must upgrade to either of the patched versions.


AI Red Teaming Makes the Unknowns Known

Summary: AI systems are now widely used in business for tasks like writing, coding, and automating workflows, but existing safety review processes weren't designed for this real-world deployment. An AI system can pass tests in controlled environments yet still fail or behave unpredictably when used in actual production (real work scenarios with actual data and users).


AI Use by the US Government

Summary: The US government disclosed 3,611 active or planned uses of AI across federal agencies, a 70% increase from the previous administration, including controversial applications like using AI to assess prisoner misconduct risk before violations occur and monitoring veterans' crisis calls to predict suicide risk. While some AI uses in government could theoretically be implemented responsibly, the disclosure provides minimal details about how these systems actually work, and public consultation is largely absent, making it difficult for citizens to understand or scrutinize these programs.


Will it take a ‘Chernobyl-scale disaster’ for us to regulate cyber weapons of mass destruction? | Stuart Russell

Summary: Stuart Russell, a leading AI safety researcher, warns that unrestricted development of unsafe AI systems poses serious risks to society. He highlights concerns about recursive self-improvement (RSI, where an AI system teaches itself to become smarter, creating a cycle of increasing capability), which Anthropic recently reported observing in early development stages.


A near-autonomous AI chemist improves a challenging reaction in medicinal chemistry

Summary: OpenAI's GPT-5.4 AI system, connected to Maria (an autonomous chemistry lab), successfully improved a difficult chemical reaction called Chan-Lam coupling used in drug discovery. The AI independently designed and ran experiments, analyzed results, and proposed improvements that increased reaction yields from 16.6% to 25.2%, a finding that human chemists confirmed in the lab.


Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats

Summary: Cybersecurity researchers discovered 15 malicious plugins on the JetBrains Marketplace (a platform where developers download tools for their coding environment) that pretend to be AI coding assistants but secretly steal API keys (authentication credentials that allow access to paid AI services like OpenAI and DeepSeek). The stolen keys are sent to an attacker's server, and some keys are resold to other criminals in what appears to be an illegal monetization scheme. Additionally, two malicious Chrome extensions disguised as ad blockers are capturing users' conversations with various AI chatbots.

OpenAI Anthropic Google Microsoft Perplexity DeepSeek xAI Meta SiliconFlow JetBrains


5 AI risk management frameworks for shoring up key gaps

Summary: Organizations are finding that traditional risk management frameworks don't work well for AI systems because AI has unique failure modes and ethical complexities. A new generation of AI-specific frameworks, like ISO/IEC 42001 and NIST AI Risk Management Framework, has emerged to help organizations identify where AI can fail, implement safeguards, and demonstrate responsible AI use to regulators and customers. These frameworks are complementary tools that focus on different areas, such as governance, security controls, and regulatory compliance, so organizations should choose based on their specific gaps.


'A signal of where power sits': Trump and world leaders joined by OpenAI, Anthropic, Google at G7

Summary: AI company leaders from OpenAI, Anthropic, Google, and other major firms are attending the G7 summit in France to discuss frontier AI risks (advanced capabilities that pose potential dangers), infrastructure, and child safety. The meeting signals the growing geopolitical power of AI companies, as world governments now need their cooperation to make credible commitments on AI policy, especially after the U.S. imposed export controls on some AI models for national security reasons.

OpenAI Anthropic Google Meta Mistral Cohere

OpenAI
Anthropic
Google DeepMind
Mistral
Cohere
Synthesia
Black Forest Labs
Salesforce
Meta
Sarvam
Sakana


China pushes for AI safety as G7 summit wraps up without Beijing

Summary: China is promoting a different approach to AI safety and governance than the U.S., announcing plans for a global AI cooperation organization and emphasizing free or cheap AI models accessible to developing countries. Meanwhile, the U.S. and its Group of Seven allies are pursuing a more restrictive strategy, planning to limit access to advanced AI models to only "trusted partners" and keeping them subscription-only. The two countries previously agreed to work on AI guardrails (safety rules and limits), but details remain unclear.


Microsoft says you don’t need another email security tool; experts say, not so fast

Summary: Microsoft claims that Defender for Office 365 catches most malicious emails before delivery and that adding extra email security tools provides minimal additional benefit (less than 0.05% improvement). However, security experts warn that these statistics can be misleading because even a single missed dangerous email can cause a serious incident, and Microsoft's metrics don't reveal how severe the threats that slip through actually are.

Microsoft Defender
Mimecast
Proofpoint
Hornetsecurity
Trend Micro
Cisco
Barracuda
Trellix
Abnormal
Checkpoint Harmony
DarkTrace
KnowBe4 Defend
Tessian


GHSA-7v5m-pr3q-6453: Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

Summary: Pi Agent, a coding assistant tool, had a security weakness in how it exports chat sessions to HTML files. Attackers could hide malicious links in Markdown (a text formatting system) by using special control characters that browsers would ignore, allowing XSS (cross-site scripting, where malicious code runs in a webpage) to execute in the exported HTML file if a user clicked the link. The attack requires multiple steps: an attacker must inject harmful content into a session, the user must export it as HTML, and the user must click the malicious link.

Solution: Upgrade @earendil-works/pi-coding-agent to version 0.78.1 or later. Version 0.78.1 fixes the issue by sanitizing (cleaning) Markdown links and image URLs using an allow-list (a list of approved safe formats) after removing C0 control characters. Users of the old @mariozechner/pi-coding-agent package should migrate to the new @earendil-works/pi-coding-agent package and upgrade to version 0.78.1 or later. Regenerate any shared HTML exports after upgrading if the original sessions contained untrusted content.

@earendil-works/pi-coding-agent@>= 0.74.0, < 0.78.1 (fixed: 0.78.1)

@mariozechner/pi-coding-agent@>= 0.27.5, <= 0.73.1


GHSA-4xpc-pv4p-pm3w: LiteLLM: Authentication Bypass via Host Header Injection

Summary: LiteLLM proxy had an authentication bypass vulnerability where a crafted Host header (the part of a web request that specifies which server is being contacted) could trick the auth layer into checking the wrong route, potentially allowing unauthorized access to protected management features. Most deployments are protected because upstream security layers like CDNs or reverse proxies validate the Host header, and LiteLLM Cloud customers are not affected.

Solution: Fixed in version 1.84.0. Upgrade to 1.84.0 or later with no configuration change required. If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the Host header before forwarding, such as a CDN/WAF (web application firewall), a reverse proxy with explicit server_name allowlists, or a cloud load balancer with host-based routing rules, or restrict network access to the proxy listener.


GHSA-rm2v-h48j-895m: n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

Summary: An authenticated user in n8n (a workflow automation platform) could trick the SecurityScorecard node (a component that connects to SecurityScorecard's API) into sending an API token (a credential for accessing the service) to an attacker's server by configuring it to download reports from a malicious URL, bypassing security restrictions meant to limit where credentials can be sent. This allows the attacker to steal the API token and use it themselves.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily: limit workflow creation and editing permissions to fully trusted users only, or disable the SecurityScorecard node by adding `n8n-nodes-base.securityScorecard` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-qrx8-25qr-5r7v: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

Summary: When n8n's MCP Browser tool runs in HTTP transport mode (a way of sending data over the network), it accepts requests without authentication (verification of identity), meaning anyone on the network or visiting a website can control the user's browser, including navigating to sites, running code, and accessing cookies and stored data. This vulnerability only affects the HTTP transport mode; the default stdio transport (direct computer communication) is safe.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later. As temporary workarounds while waiting to upgrade: avoid running MCP Browser with HTTP transport and use the default stdio transport instead, or if HTTP transport is necessary, restrict network access to the listening port to trusted clients only using host-based firewall rules. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-2j5h-858j-5mpf: n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

Summary: n8n (a workflow automation tool) has a security flaw in its Enterprise Edition where three endpoints for the Dynamic Credentials feature (a system that manages authentication tokens across workflows) fail to check if users should have access to specific workflows or credentials. An authenticated attacker could steal another user's credential tokens, take over their integrations, or disable their credentials entirely, affecting any workflows that rely on those credentials.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict n8n instance access to fully trusted users only, or disable the Dynamic Credentials feature by unsetting `N8N_ENV_FEAT_DYNAMIC_CREDENTIALS`. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


GHSA-pmqw-72cg-wx85: n8n: Credential Exfiltration via Permission Bypass

Summary: A vulnerability in n8n (a workflow automation tool) allowed member-level users with editor access to shared workflows to access credentials (stored login information) they shouldn't have permission to use, because permission checks weren't fully enforced on certain API endpoints. This only affected instances where workflow sharing was enabled and workflows had been shared with member-level editors.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict workflow sharing to fully trusted users only and audit shared workflows for unexpected credential references or recent modifications, though these workarounds do not fully remediate the risk.


GHSA-jqpw-qww5-cj4c: n8n: Denial of Service via ZIP decompression in webhook workflow

Summary: A vulnerability in n8n's Compression node allows unauthenticated attackers to crash the entire application by sending specially crafted compressed files to public webhooks. The node decompresses archives without limiting memory usage, causing the process to run out of memory and stop working for all users on that server.

Solution: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. The fix introduces configurable limits on decompressed output size (`N8N_COMPRESSION_NODE_MAX_DECOMPRESSED_SIZE_BYTES`) and ZIP entry count (`N8N_COMPRESSION_NODE_MAX_ZIP_ENTRIES`). If upgrading is not immediately possible, administrators can temporarily disable the Compression node by adding `n8n-nodes-base.compression` to the `NODES_EXCLUDE` environment variable, or restrict public webhook workflows that accept archive file uploads to authenticated endpoints only.


GHSA-h3jj-5f3v-3685: n8n: Public API Execution Retry Authorization Bypass

Summary: n8n, a workflow automation tool, had a security flaw where the Public API (a way for external programs to interact with n8n) incorrectly allowed users with read-only permissions to retry workflow executions. This bypassed the intended access control that separates read access (viewing only) from execute access (running workflows), affecting shared workflows across users or projects.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can temporarily restrict workflow sharing to fully trusted users only or restrict network access to the n8n Public API to trusted users only, though these workarounds do not fully remediate the risk.


GHSA-jwm3-qcfw-c5pp: n8n: Python Code Node AST Validator Bypass

Summary: An authenticated user in n8n (a workflow automation platform) could bypass the AST validator (a security check that analyzes code structure) in the Python Code node and access restricted modules, potentially exposing environment variables (configuration data stored by the system) on self-hosted instances. This vulnerability only affects instances with the Python Task Runner enabled.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. As temporary workarounds, administrators can limit workflow creation and editing permissions to trusted users only, or disable the Python Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable, or disable the Python Task Runner entirely. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.


GHSA-42h7-m79w-wvg5: n8n: Stored XSS in Chat Trigger Node

Summary: n8n (a workflow automation tool) has a stored XSS vulnerability (cross-site scripting, where malicious code is saved and runs when users visit a page) in its Chat Trigger feature. An authenticated user with edit access could inject harmful JavaScript code that executes with the privileges of anyone who visits the chat URL, potentially compromising their session.

Solution: The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can: limit workflow creation and editing permissions to fully trusted users only, or disable the Chat Trigger node by adding `@n8n/n8n-nodes-langchain.chatTrigger` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-h86q-fx34-gfjr: n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

Summary: n8n, a workflow automation tool, has a reflected XSS vulnerability (a type of attack where malicious code is injected into a webpage and executed in a user's browser) in its Facebook, WhatsApp, and Microsoft Teams trigger endpoints. When a logged-in user visits a specially crafted URL, an unsanitized query parameter gets reflected back in the response, allowing an attacker to run arbitrary code in the user's browser within n8n's origin.

Solution: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. If upgrading is not immediately possible, administrators can temporarily: (1) limit workflow creation and activation permissions to fully trusted users only, or (2) disable the affected nodes by adding `n8n-nodes-base.facebookTrigger`, `n8n-nodes-base.whatsAppTrigger`, `n8n-nodes-base.facebookLeadAdsTrigger`, and `n8n-nodes-base.microsoftTeamsTrigger` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-x6p3-m6h9-fx7r: n8n: Microsoft SQL Node Prototype Pollution

Summary: A vulnerability in n8n (a workflow automation tool) allows authenticated users to perform prototype pollution (a type of attack that modifies the base object all objects inherit from) through the Microsoft SQL node by providing a specially crafted table parameter. This attack can completely break the n8n instance by causing validation failures across the entire application until the server is restarted.

Solution: The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later. If upgrading immediately is not possible, administrators can temporarily: (1) restrict workflow creation and editing permissions to trusted users only, or (2) disable the Microsoft SQL node by adding `n8n-nodes-base.microsoftSql` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


Anthropic's Fable shutdown is a big moment for open-source AI

Summary: Anthropic shut down access to its Fable 5 and Mythos 5 AI models to comply with U.S. export control directives citing national security concerns, forcing all customers to lose access immediately. This incident highlighted a key risk for companies relying on closed-source AI models (proprietary systems run by companies rather than made publicly available), driving increased interest in open-source alternatives (AI models whose code is publicly available and can be downloaded and run on a company's own servers) that companies can control themselves.

Anthropic
Claude
OpenAI
Microsoft
SpaceX
xAI
MiniMax
Zhipu
DeepSeek
Tencent
Xiaomi
Applied Compute


Databricks sales growth tops 80%, but margin are shrinking from swarm of AI agents

Summary: Databricks is experiencing rapid revenue growth of over 80% as businesses use its data analytics tools, but profit margins are shrinking because AI agents (software programs that can perform tasks autonomously) are generating many more queries and consuming more resources. The company is addressing cost concerns by offering tools like Unity AI Gateway that help customers monitor their spending on AI tokens (units of text that language models process), allowing them to use expensive advanced models for important tasks while switching to cheaper open-source models for routine work.

Solution: Unity AI Gateway can notify people as they get close to using up their AI budgets. Companies are shifting from "tokenmaxxing" (using as many tokens as possible) to "value-maxxing" (optimizing efficiency), using frontier models for critical tasks and simple open-source models for mundane tasks.


Security Community Slams US Ban on Exporting Mythos, Fable

Summary: Security experts have publicly objected to US export restrictions placed on Anthropic's Claude Fable 5 and Mythos 5 AI models, calling for the government to lift these bans. The criticism comes from an open letter signed by dozens of security professionals who believe these restrictions should be reversed.


GHSA-f989-c77f-r2cq: Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution

Summary: Crawl4AI's Docker API server had two security flaws that let attackers steal secrets. First, attackers could change where the server sent LLM (large language model) requests by controlling a `base_url` parameter, causing the server to send its API keys to an attacker's server. Second, attackers could read any environment variable (including passwords and secret keys) from the server by using the `env:` syntax in configuration, then combine this with the first flaw to steal those secrets. Since the Docker API required no authentication by default, anyone could exploit these flaws.

Solution: Upgrade to the patched version. The fix prevents request-supplied `base_url` values from being used (the server now only derives the endpoint from its configured provider name), and blocks `env:` resolution of environment variables with names containing SECRET, PASSWORD, PRIVATE, or prefixes like CRAWL4AI* and AWS_SECRET*, or specific names like SECRET_KEY, REDIS_PASSWORD, and TOKEN. As workarounds, enable authentication with `CRAWL4AI_API_TOKEN` or avoid storing sensitive secrets in the server environment alongside provider keys.


GHSA-4qqr-vv2q-cmr5: Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)

Summary: Crawl4AI's Docker API had a security flaw in its SSRF protection (a filter meant to block requests to internal servers). An attacker could bypass this filter by encoding internal IP addresses using IPv6 transition forms like NAT64, 6to4, or IPv4-mapped addresses, potentially accessing internal services and cloud metadata endpoints without needing credentials.

Solution: The blocklist is replaced by a single rule: reject any resolved IP where `not ip.is_global`, evaluated on the address AND every embedded IPv4 transition form (v4-mapped, NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, v4-compat `::/96`). Error messages are now opaque and no longer echo the resolved IP. Alternatively, upgrade to the patched version, enable authentication via `CRAWL4AI_API_TOKEN`, or restrict the container's outbound network access through firewall rules.


Exclusive eBook: How AI is becoming the next military advisor

Summary: This is a subscriber-only eBook collection from MIT Technology Review featuring six stories about how military organizations are using AI models to help make decisions. The stories were originally published between April 2025 and April 2026 and have been updated to reflect recent developments in military AI applications.

Solution: N/A -- no mitigation discussed in source.


GHSA-365w-hqf6-vxfg: Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Summary: Crawl4AI, a Docker API server for web crawling, had seven critical security vulnerabilities including arbitrary file writes, SSRF (server-side request forgery, where attackers trick the server into making requests to internal networks), authentication bypass on monitoring endpoints, stored XSS (cross-site scripting, where malicious code executes in users' browsers), arbitrary JavaScript execution, a hardcoded JWT secret key, and SSRF via direct crawl endpoints. The vulnerabilities ranged from CVSS scores of 6.1 to 9.8, with fixes applied through input validation, blocklists for dangerous IP ranges, authentication requirements, HTML escaping, and environment variable controls.

Solution: Upgrade to the patched version (recommended). Additionally, set `CRAWL4AI_API_TOKEN` to enable authentication, set a strong `SECRET_KEY` with minimum 32 characters if using JWT, and restrict network access to the Docker API. The fixes include: `validate_output_path()` restricting writes to `CRAWL4AI_OUTPUT_DIR`, `validate_webhook_url()` blocklisting RFC 1918/loopback/cloud metadata IPs, adding `dependencies=[Depends(token_dep)]` to the monitor router, server-side `html.escape()` and client-side `escapeHtml()` for XSS protection, disabling `/execute_js` by default via `CRAWL4AI_EXECUTE_JS_ENABLED` env var, removing the default JWT secret and auto-generating an ephemeral key, and normalizing IPv6-mapped IPv4 addresses before blocklist checking on all crawl/md/llm endpoints.


Tech Life

Summary: Cybersecurity researchers discovered a prompt (a text input) that bypasses ChatGPT's safety guardrails (built-in restrictions designed to prevent harmful outputs) and causes the AI to generate disturbing images. The episode explores what this vulnerability reveals about how AI systems are trained and how bad actors could potentially exploit these weaknesses.


CVE-2026-47749: stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

Summary: stable-diffusion.cpp, a C/C++ library for running AI image generation models, has a heap buffer overflow vulnerability (a memory corruption bug where data writes beyond allocated memory) in how it parses PyTorch checkpoint files (.ckpt files). A malicious checkpoint file could crash the application or potentially execute harmful code if loaded by an application using vulnerable versions before master-584-0a7ae07.

Solution: Update to version master-584-0a7ae07 or later. As a temporary workaround if immediate updates are not possible, avoid loading .ckpt files from untrusted sources and use trusted model sources or safer formats such as .safetensors instead.


CVE-2026-47748: stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Ima

Summary: stable-diffusion.cpp is a C/C++ library for running image generation models, but versions before master-584-0a7ae07 have an out-of-bounds reads error (a bug where the program accesses memory beyond its allocated space) when parsing .ckpt checkpoint files (model weight files saved in a specific format). A specially crafted or incomplete .ckpt file could crash the program or cause security issues if loaded from an untrusted source like a public model-sharing website.

Solution: Update to version master-584-0a7ae07 or later. If immediate updating is not possible, avoid loading .ckpt files from untrusted sources and use safer formats such as .safetensors instead.


Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

Summary: A flaw in Google's Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads through bucket squatting (creating a Cloud Storage bucket with a name the victim's SDK would predictably generate). Attackers could replace the uploaded model with malicious code that executes when the model loads, potentially stealing credentials and accessing other data in Google's infrastructure. The attack required only the victim's public project ID and no access to their account.

Solution: Update the google-cloud-aiplatform SDK to version 1.148.0 or later, which adds bucket ownership verification to block bucket squatting. Additionally, explicitly set the staging_bucket parameter to a Cloud Storage location you control when uploading models, and check the SDK version wherever it runs (notebooks, CI/CD jobs, training pipelines, and production services).

Google Vertex AI
Google Cloud Storage
TensorFlow
BigQuery


GHSA-c37g-w77q-m4vp: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

Summary: n8n, a workflow automation tool, has a SQL injection vulnerability (a flaw that lets attackers insert malicious database commands) in its Postgres v1 and TimescaleDB nodes. An authenticated user with permission to create or edit workflows could exploit this to run arbitrary SQL commands against connected databases with the privileges of the configured database account.

Solution: The issue has been fixed in n8n versions 2.25.7 and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. As temporary workarounds, administrators can limit workflow creation and editing permissions to fully trusted users only, or disable the Postgres and TimescaleDB nodes by adding `n8n-nodes-base.postgres` and `n8n-nodes-base.timescaleDb` to the `NODES_EXCLUDE` environment variable. However, the source notes that these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.


‘Dangerous’ AI Models Are Coming No Matter What

Summary: Anthropic took its advanced Claude Fable 5 and Mythos 5 AI models offline after the U.S. government restricted them, citing concerns that these models can find and exploit software vulnerabilities (weaknesses in code that attackers can use). However, experts warn that restricting one company's models is ineffective because other AI companies and open-source developers will likely develop similar dangerous capabilities within months, and existing AI systems can already be used for vulnerability research with refined prompting (techniques to get better answers from AI).

Anthropic
Claude
Mythos 5
Claude Fable 5
OpenAI


GHSA-5xp3-2w67-427v: n8n: Git Node Clone and Push Operations Bypass File Sandbox

Summary: A security flaw in n8n (a workflow automation tool) allowed authenticated users to bypass file access restrictions by using the Git node's Clone and Push operations with local filesystem paths, potentially letting them read files they shouldn't have access to. The vulnerability has been patched in specific versions of n8n.

Solution: Upgrade to n8n version 1.123.48, 2.21.8, or 2.22.4 or later. If immediate upgrading is not possible, administrators can temporarily: (1) restrict workflow creation and editing permissions to fully trusted users only, or (2) disable the Git node by adding `n8n-nodes-base.git` to the `NODES_EXCLUDE` environment variable. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.


GHSA-9pq8-m8gp-4p53: n8n: Python sandbox escape

Summary: An authenticated user with permission to create or modify workflows in n8n could escape the Python sandbox (a restricted environment meant to safely run untrusted code) and execute arbitrary code on the task runner container. This vulnerability only affects instances where the Python Task Runner feature is enabled.

Solution: The issue has been fixed in n8n versions 1.123.48, 2.21.8, and 2.22.4. Users should upgrade to one of these versions or later. As temporary workarounds while upgrading: limit workflow creation and editing permissions to fully trusted users only, or disable the Python Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable, or disable the Python Task Runner entirely. The source notes these workarounds do not fully remediate the risk and should only be short-term measures.


GHSA-94f4-hr76-p5j6: vLLM: OpenAI auth bypass

Summary: vLLM has an authentication bypass vulnerability in its OpenAI API protection. An attacker can craft a request with a specially crafted Host header (containing special characters like `/` or `?`) to trick the authentication check into looking at the wrong URL path, allowing them to use the API without providing the required `VLLM_API_KEY`. This only affects vLLM instances exposed directly to attackers; those behind a proper web server like nginx are protected.