OpenAI confidentially files for initial public offering on US stock market

Summary: OpenAI has filed confidentially to go public on the US stock market, with an expected valuation exceeding $850 billion, making it one of the largest IPO (initial public offering, when a private company first sells shares to the public) listings in history. The company announced the filing preemptively because it expected the confidential submission to become public anyway, and stated it has not yet decided on a timeline for going public.


OpenAI confidentially files for IPO, prepping Wall Street for mega AI debut

Summary: OpenAI has confidentially filed for an IPO (initial public offering, where a private company sells shares to the public for the first time) with the Securities and Exchange Commission, joining competitors Anthropic and SpaceX in preparing to go public. The company, valued at over $850 billion, has not decided on a timeline for the IPO but says it could happen as soon as late 2025, though leadership notes some goals may be easier to achieve while remaining private. OpenAI is also planning a tender offer to let employees sell shares at the current valuation to ease pressure for immediate liquidity.

Solution: N/A -- no mitigation discussed in source.


OpenAI files for IPO, following Anthropic

Summary: OpenAI has filed a confidential Form S-1 with the SEC (Securities and Exchange Commission, the US agency that oversees financial markets and public companies), which is a preliminary step toward becoming a publicly traded company. This move follows Anthropic's similar filing in June, as both AI companies compete to go public. The confidential filing keeps sensitive details like executive pay and financial information private for now, rather than making them immediately public.


Apple partnering with Google and Nvidia for most advanced AI model

Summary: Apple announced new AI features at its developer conference, including an improved Siri that can have back-and-forth conversations with users. Unlike some competitors, Apple is partnering with Google and Nvidia to build its most advanced AI model (Apple Foundation Model Cloud Pro) while emphasizing privacy by keeping user data local and using a system orchestrator (a routing component that directs queries to either on-device or cloud processing) to minimize data collection compared to AI services like ChatGPT.


ICYMI: May 2026 @AWS Security

Summary: This AWS security digest from May 2026 covers updates across AI security, infrastructure protection, identity management, and compliance. Key topics include securing agentic AI workflows (AI systems that take actions autonomously) using frameworks like Cedar for authorization, protecting AWS networks with filtering tools like AWS Network Firewall and WAF (web application firewall, which blocks malicious web traffic), and establishing compliance programs for ISO standards. The resources include blog posts, code samples, and workshops to help organizations adopt these security practices.

AWS
Amazon Bedrock
Amazon Bedrock AgentCore
Cedar


Apple debuts revamped ‘Siri AI’ and new child safety features for iPhones and iPads

Summary: Apple announced a major upgrade to Siri at its developer conference, integrating it with Apple Intelligence (Apple's AI tool) and rebranding it as 'Siri AI'. The new voice assistant will function more like AI chatbots (such as ChatGPT or Google Gemini) rather than a traditional web-search question-and-answer tool, with a wide release planned for fall.

Apple
Apple Intelligence
Siri AI
ChatGPT
Google Gemini


GHSA-6ghj-frrj-jjj3: Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Summary: Netty's RedisDecoder (a tool that reads Redis protocol messages) has a vulnerability where an attacker can send malformed Redis messages without proper line endings (`\r\n`) across multiple connections, causing the decoder to buffer data indefinitely and exhaust the server's direct memory pool (memory reserved for direct I/O operations), resulting in a DoS (denial of service) attack that prevents legitimate users from connecting.

io.netty:netty-codec-redis@<= 4.1.134.Final (fixed: 4.1.135.Final)

io.netty:netty-codec-redis@>= 4.2.0.Final, <= 4.2.14.Final (fixed: 4.2.15.Final)


GHSA-3244-j874-rhc2: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Summary: An attacker can crash a server using Netty (a networking library) by sending a malicious Redis message (a command sent to a Redis database) with deeply nested arrays. The RedisArrayAggregator component doesn't limit how many array layers it accepts, so an attacker can send thousands of nested arrays that force the server to create so many state objects that it runs out of memory and crashes.


CVE-2026-11393 - Code Injection via Improper Triple-Quote Escaping in AgentCore CLI Bedrock Agent Import

Summary:
```json
{
  "summary": "A vulnerability (CVE-2026-11393) exists in AWS AgentCore CLI, a tool for managing AI agents on Amazon Bedrock. An attacker with certain permissions could inject malicious Python code by exploiting improper escaping of triple-quote characters (""") in a specific field, allowing the attacker's code to run if the generated file is executed. The vulnerability affects versions 0.4.0 through 0.14.1 and certain preview versions.",
  "solution": "N/A -- no mitigation discussed in

Solution: N/A — no mitigation discussed in source.


CVE-2026-46480: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluat

Summary: Flowise, a tool that provides a drag-and-drop interface for building customized large language model workflows, had a vulnerability in versions before 3.1.2 that allowed attackers to take over evaluators across different workspaces through mass-assignment (a type of security flaw where an attacker can modify multiple object properties at once that they shouldn't be able to change). The vulnerability has been patched in version 3.1.2.

Solution: Update to version 3.1.2 or later. The issue has been patched in version 3.1.2.


CVE-2026-46479: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluat

Summary: Flowise is a tool with a drag-and-drop interface for building custom AI workflows. Before version 3.1.2, it had a vulnerability where mass-assignment (improperly allowing users to modify system fields they shouldn't access) let attackers take over evaluations across different workspaces, even if they didn't have permission.

Solution: This issue has been patched in version 3.1.2.


CVE-2026-46478: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, Dataset

Summary: Flowise is a visual tool for building customized LLM (large language model) workflows. Before version 3.1.2, it had a mass-assignment vulnerability (a flaw where attackers can modify object properties they shouldn't access) that allowed users to take over dataset rows across different workspaces, with a high severity rating of 7.7.

Solution: This issue has been patched in version 3.1.2. Users should update Flowise to version 3.1.2 or later.


CVE-2026-46477: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, dataset

Summary: Flowise, a drag-and-drop tool for building customized AI workflows, had a vulnerability before version 3.1.2 that allowed attackers to take over datasets across different workspaces through mass-assignment (a flaw where an attacker can modify object properties that shouldn't be exposed). The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 7.7, indicating it is high severity.


CVE-2026-46476: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomT

Summary: Flowise is a drag-and-drop tool for building custom large language model workflows. Before version 3.1.2, it had a mass-assignment vulnerability (a security flaw where unintended data fields can be modified) in its CustomTemplate feature that could let attackers take over templates across different workspaces. This issue has been fixed in version 3.1.2.

Solution: Update to version 3.1.2, which patches this vulnerability.


CVE-2026-46475: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assista

Summary: Flowise is a tool with a drag-and-drop interface for building customized AI workflows. Before version 3.1.2, it had a mass-assignment vulnerability (a type of security flaw where an attacker can modify data they shouldn't have access to) that allowed someone to take over assistants across different workspaces by manipulating how the system creates and updates assistants.

Solution: This issue has been patched in version 3.1.2. Users should update to version 3.1.2 or later.


CVE-2026-46444: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRU

Summary: Flowise, a tool with a drag-and-drop interface for building custom AI workflows, had a security flaw in versions before 3.1.2 where certain endpoints (API routes, which are web addresses that accept requests) for managing OpenAI Assistants Vector Store lacked proper access controls. This meant that even though these endpoints required an API key (a credential for authentication), they didn't actually verify whether users had permission to perform their requested actions.


CVE-2026-46443: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, when cr

Summary: Flowise is a tool with a drag-and-drop interface for building customized workflows with large language models (LLMs, AI systems trained on massive amounts of text). Before version 3.1.2, the software had a bug where sensitive encrypted credential data was being exposed in API responses when users filtered credentials by name, even though the same data was properly hidden when no filter was used. This is a high-severity security issue because it could allow someone with basic access to view encrypted passwords or API keys they shouldn't see.

Solution: Update Flowise to version 3.1.2 or later, where this issue has been patched.


CVE-2026-46442: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /a

Summary: Flowise, a tool for building custom AI workflows with a visual interface, had a vulnerability before version 3.1.2 where any user with API access could submit malicious JavaScript code to a function node. When a security key (E2B_APIKEY) wasn't set up (the typical case), this code could break out of its sandbox (a restricted execution environment) and run system commands on the server hosting Flowise.

Solution: Upgrade to version 3.1.2, which patches this vulnerability.


CVE-2026-46441: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass

Summary: Flowise, a tool for building customized AI workflows through a drag-and-drop interface, has a mass assignment vulnerability (a bug where attackers can modify fields they shouldn't be able to change) in versions before 3.1.2 that lets authenticated users reassign assistants to different workspaces by manipulating the workspaceId field, breaking the isolation between separate user workspaces in multi-user environments.

Solution: Update to version 3.1.2, where this issue has been patched.


CVE-2026-46440: Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the che

Summary: Flowise is a tool with a drag-and-drop interface for building customized AI workflows. Before version 3.1.2, the checkBasicAuth endpoint (a part of the system that checks user login credentials) had a security flaw where it validated passwords in plaintext (unencrypted text) without rate limiting (restrictions on how many attempts someone can make) and compared them directly, making it vulnerable to attacks.


NotebookLM’s Gemini 3.5 upgrade adds a cloud computer and help finding sources

Summary: Google is upgrading NotebookLM, an AI-powered note-taking app, to use Gemini 3.5, a newer and more advanced version of its AI model that will provide more accurate answers. The update lets users start research projects by simply asking questions, and NotebookLM will automatically search the web to find relevant sources rather than requiring users to manually import materials.


Microsoft’s AI chief says superintelligence is near, but won’t take your job

Summary: Microsoft's AI chief Mustafa Suleyman discusses how Microsoft has restructured its AI division to independently pursue superintelligence (AI systems that could surpass human capabilities across all domains), following a renegotiated partnership with OpenAI in October that allows both companies to develop models separately. The interview covers Microsoft's new approach to training frontier models (cutting-edge AI systems at the limits of current technology), the company's relationship with OpenAI, and how AI is being perceived by the public and in politics.


MU-MIA: Machine Unlearning for Membership Inference Attacks

Summary: Researchers developed a new membership inference attack (MIA, a method to determine whether specific data was used to train an AI model) called MU-MIA that uses machine unlearning (a technique to make a model forget specific training samples) to track how a model forgets information about individual samples. The attack works by monitoring changes in the model's behavior as it unlearns each sample and uses a BiLSTM classifier (a type of neural network that analyzes sequences of data) to distinguish between samples that were in the training data versus those that weren't.


Measuring the impact of learning with AI in Sierra Leone and beyond

Summary: A study in Sierra Leone tested whether AI (specifically Google's Gemini) could help students learn math better by acting as a teaching partner rather than replacing teachers. The AI was designed using a 'Socratic' approach, asking guiding questions instead of giving direct answers, and students who used it showed significant learning gains equivalent to 1.2 to 2.5 years of typical progress in just eight weeks, while maintaining high engagement and shifting their own questions toward understanding rather than just seeking solutions.


The Download: how the World Cup ball will fly and OpenAI’s “super app”

Summary: This newsletter covers multiple AI and tech developments, including OpenAI's plans to transform ChatGPT into a 'super app' (an all-in-one application combining multiple tools and services) before going public, Google's $30 billion deal with SpaceX for AI computing power, and concerns about AI's rising energy costs and environmental impact. It also reports on facial recognition tools being deployed by immigration enforcement, fears about 'recursive self-improvement' (AI systems automatically improving their own capabilities), and how machine learning is helping historians analyze historical records while introducing risks of bias and errors.


Anthropic’s Project Glasswing Update

Summary: Anthropic launched Project Glasswing in April to help companies find software vulnerabilities (weaknesses that attackers can exploit) using their AI model, though claims about its superiority over other models are unverified. A status report shows the project is finding many vulnerabilities, including dangerous ones, but almost none have been patched, and Anthropic has not released detailed information about the findings.


Why most enterprise security teams would fail a military readiness test

Summary: Most enterprise security teams are unprepared for real cyberattacks because they treat cybersecurity as a compliance requirement rather than an operational capability that requires constant practice. The military achieves rapid, coordinated responses to cyber incidents through regular, realistic exercises and by assuming attacks are inevitable, while businesses rely on outdated annual tabletop exercises and focus on prevention rather than detection, containment, and recovery.

OpenAI
Anthropic
Google
xAI
Amazon
Scattered Spider
Cisco
Jaguar Land Rover
Asahi Beer


OpenAI Rolling Out ChatGPT Account Security Controls

Summary: OpenAI is expanding two security features for ChatGPT accounts. Lockdown Mode helps prevent data exfiltration (unauthorized data theft) from prompt injection attacks (tricking an AI by hiding instructions in its input) by limiting outbound network requests, though it disables features like web browsing and file downloads. Active Sessions lets users see where their account is logged in and log out of unrecognized sessions.

Solution: OpenAI provides two explicit mitigations: (1) Enable Lockdown Mode in Settings > Security > Advanced Security to limit outbound network requests during prompt injection attacks, and (2) use Active Sessions in Settings > Security to review and log out of unrecognized account sessions. Additionally, OpenAI offers Advanced Account Security, which disables password-based login in favor of physical security keys or passkeys, replaces email/SMS account recovery with backup passkeys and recovery keys, and shortens sign-in sessions to reduce account takeover risk.


Anthropic Urges Industry Coordination to Allow for a ‘Pause’ in AI Development if Risks Grow

Summary: Anthropic is calling for AI companies worldwide to coordinate and create a system to pause or slow development of advanced AI if risks become too serious, warning that AI is improving so rapidly that humans could lose control, particularly through recursive self-improvement (where an AI designs its own successor). The company proposes a verification mechanism to ensure all labs comply with any slowdown, though OpenAI disagrees and argues that democratic governments, not private companies, should make decisions about AI development pace.

Solution: Anthropic proposes that advanced AI labs should establish a coordinated global mechanism to verify that rivals have actually stopped or slowed their work and that "a bad actor could not use the auspices of a coordinated slowdown to jump ahead in secret." The source also mentions that collaboration between companies, government agencies, and academic researchers is needed to develop countermeasures against AI-powered hacking tools.


CVE-2026-11479: A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file ind

Summary: A vulnerability (CVE-2026-11479) was found in grepai version 0.35.0 that involves the use of weak hash functions (a cryptographic method that doesn't adequately scramble data) in the file indexer/chunker.go, which is part of the Qdrant Backend component. The vulnerability is difficult to exploit and requires remote access with user credentials, though the exploit details have been publicly disclosed.

Solution: N/A -- no mitigation discussed in source. The source only mentions that a pull request to fix this issue awaits acceptance, but does not provide details about an available patch, update version, or workaround.


Built to benefit everyone: our plan

Summary: This document outlines OpenAI's vision for AI development, arguing that AI should be widely accessible and beneficial to humanity rather than concentrated among a few entities. The text emphasizes that AI's value comes from what people can do with it (like learning new skills or starting businesses), and that safe, powerful AI systems must remain aligned with human intent and subject to human control, with humans ultimately deciding what is worth doing.


Introducing the OpenAI Economic Research Exchange

Summary: OpenAI launched the Economic Research Exchange, a program that provides researchers access to OpenAI tools and datasets to conduct rigorous, independent studies on how AI affects workers, businesses, and the economy. The program aims to generate credible evidence about AI's economic impacts while maintaining privacy protections and data governance safeguards, with applications open through July 5, 2026.


Billions spent and hypothetical returns: the AI boom explained with six charts

Summary: Major AI companies like OpenAI, Anthropic, and SpaceX are seeking massive valuations and going public, reflecting a rapid increase in spending on AI infrastructure like datacenters. However, there are growing concerns about whether these investments will actually generate profitable returns, as companies work to find practical uses that justify the enormous amounts of money being spent on AI development.

SpaceX
Elon Musk
Anthropic
Claude
OpenAI
ChatGPT


‘A driver of political violence’: how the breakneck AI boom is fueling anti-tech extremism

Summary: Recent attacks by anti-tech extremists, including attempted arson at OpenAI and violent incidents motivated by anti-AI ideology, are raising alarm among researchers, tech companies, and law enforcement. These attacks follow a pattern similar to earlier techno-pessimist (people who believe technology will cause harm) militant movements, suggesting a growing trend of violence driven by opposition to AI and data infrastructure.


‘Poisoned’ AI: the ChatGPT shopping scams that lead to fake websites

Summary: ChatGPT can recommend fake shopping websites that impersonate real stores, tricking users into thinking they are buying from legitimate retailers. When users follow AI recommendations to purchase items like bags, they may end up on fraudulent sites designed to look official, resulting in financial loss for buyers.


OpenAI unveils Lockdown Mode to protect sensitive data from prompt injection attacks

Summary: OpenAI introduced Lockdown Mode, a new security feature designed to protect against prompt injection attacks (when malicious instructions are hidden in webpages or uploaded content to manipulate an AI's responses). The feature disables several ChatGPT capabilities including live web browsing, image retrieval, deep research, and agent mode to reduce the risk of sensitive data being exposed, though OpenAI acknowledges that prompt injections could still occur through cached content or uploaded files.

Solution: OpenAI's explicit mitigation is Lockdown Mode, which "will disable live web browsing (so you can only access cached content), the retrieval and display of images from the web (you can still generate images), deep research, and agent mode." The feature is being rolled out to ChatGPT Business accounts and eligible personal accounts. OpenAI states the goal is "to reduce the likelihood that sensitive data gets shared in the process."


SemAlign-PFL:Exploring stealthy and persistent backdoor attacks against personalized federated learning

Summary: Researchers discovered a new type of backdoor attack (hidden malicious code inserted into AI systems) that works against personalized federated learning (a privacy-focused method where multiple computers train an AI model together without sharing raw data). The attack is designed to be stealthy and persistent, meaning it can hide from detection and remain in the system over time.


Meta made its own AI-generated clickbait news feed

Summary: Meta has added a 'For You' section to its standalone Meta AI app that generates clickbait-style news articles using AI, complete with AI-created topics, images, and text. The app previously featured a 'Discover' feed showing AI-generated images and conversations from users who were sometimes unaware their content was public, but this has been replaced with a standard chatbot interface.


New ChatGPT Lockdown Mode Limits Tools That Could Enable Data Exfiltration

Summary: OpenAI has launched Lockdown Mode, a security feature for ChatGPT that reduces the risk of data exfiltration from prompt injection attacks (tricking an AI by hiding malicious instructions in its input) by limiting tools that connect to external services. The mode disables features like web browsing, image retrieval, file downloads, and certain agent capabilities to block potential pathways attackers could use to steal sensitive data, though it does not completely eliminate all exfiltration risks.

Solution: OpenAI recommends enabling Lockdown Mode, described as "an optional advanced security setting that limits many tools and capabilities in OpenAI products that can connect to the web or external services." The feature specifically disables live web browsing, image support, deep research agent mode, canvas networking, and file downloads. Additionally, OpenAI has launched a new account management feature that enables users to "review active ChatGPT sessions and log out of individual or all sessions if signs of unauthorized account activity are detected."


Here comes new Siri again

Summary: Apple is preparing to reintroduce an updated version of Siri at WWDC, building on a redesign first shown in 2024 that included a new visual appearance, additional voice options, and the ability to route questions to ChatGPT (a large language model made by OpenAI). Apple has faced criticism because promised AI features under the "Apple Intelligence" branding were delayed, and the company is now settling a lawsuit over misleading marketing around these capabilities.

Apple
Apple Intelligence
Siri
ChatGPT
OpenAI


Crypto-Funded Chinese Peptide Labs Are Booming

Summary: Meta has embedded dormant face recognition code (technology that identifies people by matching their faces to stored images) called NameTag in over 50 million phones through its Ray-Ban and Oakley smart glasses app, despite previously abandoning this technology after settling biometric privacy lawsuits. Additionally, Meta's AI-powered account support tool, which was introduced in March to automate functions like password resets, has been discovered by hackers who can exploit it to take over user accounts.

Meta
Ray-Ban
Oakley
xAI
Grok
Google
Android
Google Dialer


AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs

Summary: An AI security agent discovered 21 previously unknown vulnerabilities (zero-days, or security flaws unknown to the public) in FFmpeg, a widely-used media library, while Google released Chrome 149 with a record 429 security patches in a single update. The article highlights how AI tools are finding vulnerabilities faster and cheaper than before, forcing security teams and software maintainers to work harder to keep up with the increased pace of bug discoveries.

Solution: For FFmpeg: pull the fixed upstream build or your distribution's security update as soon as it lands, and prioritize patching anything that processes untrusted RTSP (Real Time Streaming Protocol, a video streaming standard) or AV1-over-RTP (video compression format over network packets). Also check and patch embedded FFmpeg copies in Python packages, container images, and appliances. For Chrome: update to version 149.0.7827.53 on Linux or 149.0.7827.53/54 on Windows and macOS, or confirm auto-update has completed.

depthfirst
Google
Anthropic
Big Sleep
Mythos


OpenAI Help: Lockdown Mode

Summary: OpenAI has released Lockdown Mode, a security feature that prevents the final stage of data exfiltration (stealing and sending sensitive information) from prompt injection attacks (tricking an AI by hiding malicious instructions in its input) by blocking outbound network requests. However, Lockdown Mode does not stop prompt injections from appearing in the content ChatGPT processes, meaning attackers can still manipulate the AI's responses through cached web content or uploaded files.

Solution: Enable Lockdown Mode, which is rolling out to eligible personal accounts (Free, Go, Plus, and Pro tiers) and self-serve ChatGPT Business accounts. According to the source, Lockdown Mode uses deterministic mechanisms (fixed, rule-based processes) to restrict exfiltration vectors, rather than relying on AI systems to detect attacks.


Trump administration, OpenAI discussing possible government stake in the AI startup

Summary: OpenAI CEO Sam Altman and the White House are discussing a possible government stake in OpenAI, with talks ongoing for over a year. As part of the potential agreement, OpenAI could donate equity to create a 'Public Wealth Fund' that would invest in long-term assets and allow citizens to share in the financial benefits of AI growth. No official investment terms have been decided, and all details remain subject to change.

Solution: N/A -- no mitigation discussed in source.


CVE-2025-31133, CVE-2025-52565, CVE-2025-52881 - runc container issues

Summary: Three security vulnerabilities (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) were found in runc, a component used by container management systems (tools that package and run isolated software environments). AWS says these issues don't create cross-customer risk because AWS doesn't rely on containers as a security boundary (a protective barrier between different users). AWS customers using containers to isolate their own internal workloads should contact their operating system vendor for updates.

Solution: AWS recommends applying all security patches and software version updates as a best practice. Customers using containers to isolate workloads within their own environments should contact their operating system vendor for any updates or instructions necessary to mitigate these issues.

AWS
Amazon Linux
Bottlerocket
Amazon ECS
Amazon EKS
AWS Elastic Beanstalk
Finch
AWS Deep Learning AMI
AWS Batch
Amazon SageMaker


Security Findings in SageMaker Python SDK

Summary: AWS discovered two security vulnerabilities in the SageMaker Python SDK (a library for machine learning on Amazon's platform). The first flaw exposes HMAC keys (cryptographic secrets that verify data hasn't been tampered with) through an API, allowing attackers to forge fake data in cloud storage. The second flaw disables SSL certificate verification (the security check that confirms you're connected to a legitimate server), affecting all encrypted connections when a certain model component is used.

Solution: Update SageMaker Python SDK to v3.2.0 or later for the HMAC vulnerability, or v2.256.0 or later if using v2. Update to v3.1.1 or later for the TLS vulnerability, or v2.256.0 or later if using v2.

AWS SageMaker
Amazon SageMaker Python SDK


CVE-2026-0830 - Command Injection in Kiro GitLab Merge Request Helper

Summary: A vulnerability (CVE-2026-0830) in Kiro IDE, a desktop application that helps developers with code tasks, allows attackers to run arbitrary commands (command injection, where an attacker executes unauthorized code) on a user's computer by tricking them into opening a workspace with specially crafted folder names. This bug affects Kiro versions before 0.6.18.

Solution: Update to Kiro version 0.6.18 or later.


Amazon Q Developer and Kiro – Prompt Injection Issues in Kiro and Q IDE plugins

Summary: Amazon Q Developer and AWS Kiro, which are AI tools that help developers write code, have security vulnerabilities related to prompt injection (tricking the AI by hiding malicious instructions in files or suggestions). Attackers could potentially execute commands or steal sensitive information without the developer's knowledge. AWS has released multiple software updates that require human confirmation before executing risky commands.

Solution: For Amazon Q Developer: upgrade to Language Server v1.22.0 or later (released July 17, 2025) to require human confirmation for find, grep, and echo commands; upgrade to Language Server v1.24.0 or later (released July 29, 2025) to require human confirmation for ping and dig commands. For AWS Kiro: upgrade to version 0.1.42 or later (released August 1, 2025), which requires human confirmation for risky actions when configured in Supervised mode.


Microsoft identifies seven new ways AI agents can be hacked

Summary: Microsoft has identified seven new ways that agentic AI systems (AI programs that can take actions autonomously) can fail or be attacked, building on previous research. These vulnerabilities include attacks where adversaries manipulate agent behavior through natural language, redirect an agent's goals, trick agents communicating with each other, exploit visual interfaces, contaminate data to bias reasoning, abuse plugins and protocols, and cause agents to leak internal information.

Solution: Microsoft advises security teams to: inventory their supply chain and generate a software bill of materials (SBOM, a detailed list of all components in deployed agents); verify agent identity using cryptographic credentials issued at provisioning rather than relying on position or location; add the seven new failure modes to their red-team coverage matrix (security testing that simulates attacks); and audit the human-in-the-loop user experience (where humans review or approve agent actions) as a security control.


Model routing is a fix for AI overspending. That's a problem for OpenAI and Anthropic

Summary: Companies are implementing model routing, a technique that directs simple tasks to cheaper AI models and complex tasks to expensive ones, to control skyrocketing AI costs. This shift is forcing major AI providers like OpenAI and Anthropic to reconsider their business models, since they previously earned revenue from all queries regardless of task complexity, but now may only get paid for the most difficult work that requires their most powerful models.

Solution: Model routing is presented as the emerging solution: according to the source, routing is a tool that matches the job to the model, sending hard problems to expensive frontier models (advanced, state-of-the-art AI systems) and easy ones to cheaper, faster alternatives. The article also mentions that Cognition announced an AI productivity guarantee, where if their Devin agent delivers less engineering value than a customer pays for, Cognition will fund usage up to $10 million until performance improves, framing this as a way to measure return on investment (value delivered) rather than just activity metrics like tokens consumed.

OpenAI Anthropic Cognition Devin Glean Cisco


Apple's WWDC: Tim Cook's AI legacy at stake in his final developer conference as CEO

Summary: Apple is preparing to unveil major improvements to Siri, its voice assistant, at its upcoming developer conference, with the goal of finally delivering the AI experience it promised two years ago. The improvements are expected to include a more powerful standalone chatbot-style app, personal context awareness, and the ability to handle multi-step commands, potentially routing to outside AI models like Google's Gemini. However, Apple faces a critical challenge: Siri must become reliably agentic (able to independently execute complex tasks across multiple apps) to justify Apple's current stock valuation, which depends on developers adopting Apple's App Intents system (the framework that lets Siri perform actions inside third-party apps) before consumers have proven they will actually use the improved features.

Apple Google Siri Gemini Microsoft Alphabet Amazon Meta Uber Amazon Temu YouTube WhatsApp Facebook Threads AllTrails


Securing CI/CD in an agentic world: Claude Code Github action case

Summary: Microsoft Threat Intelligence found that Anthropic's Claude Code GitHub Action could expose sensitive credentials when AI agents process untrusted GitHub content (like issue descriptions and comments) because the Read tool wasn't properly sandboxed, allowing it to access /proc/self/environ and steal API keys. Attackers exploited this by hiding prompt injection (tricking an AI by hiding instructions in its input) attacks in HTML comments within GitHub issues to manipulate the AI agent into executing malicious operations like planting code into repositories.

Solution: Anthropic mitigated this issue in Claude Code version 2.1.128 by blocking access to sensitive /proc files. Microsoft also recommends that defenders treat AI workflows processing untrusted GitHub content as high-risk, especially when they have access to secrets, file-read tools, or external communication channels.

Anthropic
Claude Code
Claude Code GitHub Action
GitHub Actions


GHSA-x9f6-9rvm-mmrg: Improper Access Control in vantage6 node

Summary: A security flaw in vantage6 node (a distributed computing platform) allows malicious algorithms (computational programs) to improperly access input and output files that belong to other algorithms running on the same node. This is an access control vulnerability, meaning the system fails to properly restrict who can view what data.

Solution: Verify and restrict the algorithm containers (isolated software packages) that are allowed to run on your node, with instructions available in the vantage6 security documentation.


This is your laptop… on AI

Summary: Major technology companies like Nvidia, Microsoft, and Google are promoting AI as a transformative force that will fundamentally change how we use laptops and computing devices, with new hardware and software being announced at developer conferences. However, the article questions whether users actually want or need these AI-focused products and changes.

Nvidia
Microsoft Build
Google I/O
Gemini


GHSA-7p8g-6c6g-h9w7: praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

Summary: PraisonAI Platform has an IDOR (insecure direct object reference, a flaw where users can access resources they shouldn't by guessing object IDs) vulnerability in its agent management endpoints. A user who belongs to any workspace can read, modify, or delete agents from other workspaces by guessing their agent IDs, because the code checks if the user belongs to *some* workspace but never verifies the agent actually belongs to that workspace.

praisonai-platform@< 0.1.4 (fixed: 0.1.4)


GHSA-6mx4-4h42-r8vh: MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration

Summary: The `kubectl_generic` tool in `mcp-server-kubernetes` accepts any kubectl flags without validation, allowing an attacker to inject flags like `--server=https://attacker.com` and `--insecure-skip-tls-verify=true`. When a privileged operator uses the MCP server and an AI agent follows injected instructions in logs, kubectl sends the operator's Kubernetes bearer token (authentication credential) to the attacker's server, which can then be replayed to gain full cluster access.

mcp-server-kubernetes@<= 3.6.2 (fixed: 3.7.0)

mcp-server-kubernetes
Claude Haiku
Anthropic


Anthropic says the world should have option to ‘pause’ on AI

Summary: Anthropic, a US AI company, has proposed that the world consider a temporary pause on AI development and plans to bring together policymakers to discuss the risks of advanced AI. The company released details about its Claude model's progress toward recursive self-improvement (the ability for an AI to automatically create better versions of itself), which AI safety researchers worry could lead to superintelligent AI (an AI system far more intelligent than humans) with potentially serious consequences.


Adaptive, Agentic AI Worms Loom as Next Enterprise Threat

Summary: Researchers warn that AI worms (self-replicating malicious programs that can adapt and move between systems on their own) represent a serious upcoming threat to businesses, with these intelligent threats expected to appear within the next year. Unlike traditional worms, these AI-powered versions can learn new environments, find security weaknesses on their own, and spread autonomously.


NSA said to be readying Anthropic’s Mythos for use in cyber operations

Summary: Anthropic has reportedly deployed engineers to the NSA to help the intelligence agency use Mythos, an AI model designed for cybersecurity tasks. This partnership is noteworthy because the Department of Defense previously banned the NSA from using Anthropic's technology, labeling the company a supply-chain risk after Anthropic refused to allow government use of its models for mass surveillance and autonomous weapons.


AI is designing OpenAI's next model in a sign of 'superintelligence': SoftBank's Masayoshi Son to CNBC

Summary: OpenAI is using AI models to design its own next models, according to SoftBank CEO Masayoshi Son, which he describes as a step toward "superintelligence" (AI vastly smarter than humans). However, Anthropic warned that this recursive self-improvement (RSI, where an AI system can autonomously design and develop its own successor) could increase risks of humans losing control over AI systems.

Solution: Anthropic stated that a coordinated effort between AI labs to slow down the development of recursive self-improvement technology "would likely be a good thing," though no specific technical fixes or implementation details are provided in the source text.

OpenAI
Sam Altman
ChatGPT
GPT-5.3-Codex
SoftBank
Anthropic
Claude


What 2026 DBIR Confirms: Attacks Are Living in the Browser

Summary: The 2026 Verizon Data Breach Investigations Report reveals that attackers are increasingly operating through web browsers, where traditional security tools fail to detect them. Key risks include shadow AI (unauthorized use of services like ChatGPT with corporate data), credential theft in browsers (which accounts for 41% of browser-based attacks but goes undetected by network and endpoint security tools), and malicious browser extensions (13% classified as high or critical risk, often disguised as 'productivity' tools). The report shows that browser-layer attacks are largely invisible to conventional defenses like network proxies and DNS filters, creating a significant detection gap in enterprise security.


AI Worm

Summary: Researchers have created a prototype of an AI-powered internet worm, which is malware (malicious software that spreads itself) that carries its own LLM (large language model, a type of AI trained on text data) and runs it on computers it has broken into. This design closely matches the original concept of computer worms from 1975, but now enhanced with AI capabilities.


NCorr-FP: A Neighbourhood-Based Correlation-Preserving Fingerprinting Scheme for Intellectual Property Protection of Structured Data

Summary: NCorr-FP is a data fingerprinting (embedding hidden recipient-specific marks into data to track ownership) technique designed to protect structured tabular data in shared environments. The method preserves the statistical quality of data while embedding fingerprints using local record similarity and density estimation, and can detect these fingerprints even after substantial data modification or deletion attacks.


CVE-2026-11329: A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key

Summary: A vulnerability exists in ONNX MLIR (a tool that converts machine learning models to code) versions up to 0.5.0.0 where the generate_hash_key function uses a weak hash (a simple algorithm for converting data into a fixed-length code that is easy to reverse or predict). The vulnerability requires local access to exploit and is difficult to execute in practice.

Solution: Apply patch 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4 to resolve this issue.


In Other News: Anthropic Maps AI Threats, Unpatched Comodo Flaw, Palantir Chief Eyed for CISA

Summary: This cybersecurity news roundup covers several major threats: attackers are poisoning AI chatbot search results to trick users into downloading malware that hijacks computer power for cryptocurrency mining; the Grandoreiro banking trojan continues targeting financial institutions despite being a decade old; and a ransomware group called The Gentlemen uses self-propagating malware to automatically encrypt entire networks. Additionally, Let's Encrypt is preparing to adopt Merkle Tree Certificates (a more efficient way to batch multiple digital certificates under one signature) to handle the larger file sizes of post-quantum cryptography, with a test environment launching in late 2026.

Solution: Disconnect Automatic Tank Gauge (ATG) systems from the public internet immediately, according to warnings from CISA, the FBI, the NSA, and other US agencies. For post-quantum cryptography concerns, Let's Encrypt plans to launch a staging environment for Merkle Tree Certificates in late 2026, followed by full production rollout in 2027.

Anthropic
Microsoft
WatchGuard
Let's Encrypt
CISA
FBI
NSA
Palantir
IBM
Ultrahuman


The Download: AI hacking beyond Mythos, and chatbots’ impact on our brains

Summary: Attackers exploited Meta's AI customer support agent by tricking it into linking Instagram accounts to email addresses they controlled, showing that AI security risks extend beyond sophisticated attacks to simple social engineering exploits. Psychologist Gloria Mark warns that relying on AI chatbots like ChatGPT and Claude may weaken human attention spans, critical thinking, and emotional intelligence by deferring cognitive work to machines.

Meta Instagram Anthropic Mythos ChatGPT Claude


Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver

Summary: Despite rapid adoption of AI tools in security operations centers (SOCs, teams that monitor and respond to security threats), only 10% report excellent value from these investments. The problem is structural: most SOCs deploy off-the-shelf AI without customization or best practices, and individual AI tools don't share information with each other, so analysts still face fragmented workflows even though individual tasks run faster.


The Tech Download: Anthropic’s IPO sets up first big test of AI boom valuations

Summary: Anthropic, an AI company, has filed for an initial public offering (IPO, the process of selling company shares to the public for the first time) with a $965 billion valuation and $47 billion revenue run rate, setting up a major test of whether sky-high valuations for AI companies are justified. Analysts say the key metric determining Anthropic's success won't be its valuation but its gross margin (the percentage of revenue left after paying the costs to provide AI services), which the company has kept secret and will likely reshape how the entire industry is valued. The filing could have major impacts on competitors and how enterprises price AI services going forward.


The Meta hack shows there’s more to AI security than Mythos

Summary: Attackers exploited Meta's AI customer support agent by simply asking it to link Instagram accounts to email addresses they controlled, allowing them to steal accounts including a high-profile one. The hack shows that while AI security discussions often focus on powerful AI systems attacking computer infrastructure, the real vulnerability here was that the AI agent itself became a target through direct, straightforward manipulation that should have been caught before deployment.

Solution: The source explicitly mentions two mitigations: (1) Companies can use traditional software to build guardrails that make sure agents follow strict rules, such as always asking for answers to security questions before sending sensitive account information to a new email address. (2) Agents should undergo rigorous red-teaming, a process of testing systems by simulating attacks to find vulnerabilities before they're deployed to users.


Claude Code has an MCP security problem — and your developers are already using it

Summary: Claude Code, Anthropic's AI coding assistant, stores OAuth tokens (security credentials that prove access permission) in plaintext in a configuration file, and researchers discovered an attack where malicious npm packages (JavaScript libraries) can silently redirect these tokens to attacker-controlled servers before they reach legitimate services like GitHub or Jira. The attack is difficult to detect because the requests appear legitimate in audit logs, and Anthropic has not released a patch despite knowing about the vulnerability since April.

Anthropic
Claude Code
Model Context Protocol
Jira
Confluence
GitHub


AI tools becoming hot commodities on ransomware marketplaces

Summary: AI tools are being sold increasingly on underground ransomware marketplaces, with sales growing from 38 posts in December 2025 to 1,486 in February 2026. These tools include weaponized LLMs (large language models without safety protections), deepfakes for identity fraud, AI-enhanced malware, and stolen AI accounts, making it easier for criminals to launch attacks at scale. The source notes that while criminal security is weaker than it appears and criminals sometimes steal from each other, ransomware attacks have grown 20% since 2023 and become significantly more profitable.


New claimants seek to sue Elon Musk’s xAI after Labour MP’s test case

Summary: A UK Labour MP has launched a legal case against Elon Musk's company xAI over harmful content created by their Grok AI tool (a chatbot), including fake sexual images and videos of her. Following this test case, other potential victims have contacted her lawyer to pursue similar legal action against the company.


China may move toward U.S. path on AI as firms poach employees

Summary: A former OpenAI researcher is now leading AI development at Chinese tech company Tencent, aiming to build AGI (artificial general intelligence, or AI with human-level or above capabilities), marking a shift in how Chinese companies approach AI compared to the U.S. Previously, Chinese firms focused on practical applications while U.S. companies pursued AGI, but as China recruits top talent from Silicon Valley, the companies are adopting the same long-term AGI goals. This contrasts with caution emerging in the U.S., where companies like Anthropic are calling for slower AI development due to safety concerns.

OpenAI Anthropic Alphabet DeepMind Tencent Baidu


3 Principles to Safely Scale Agentic AI

Summary: As AI systems evolve from simple assistants into autonomous agents (AI systems that can make decisions and execute tasks independently), organizations face new security risks because these agents access sensitive systems and data at speeds humans cannot match. The article outlines three principles for secure AI deployment: treat AI agents as privileged identities (accounts with special access permissions) requiring continuous monitoring, secure the entire AI lifecycle from development through production rather than just the initial build phase, and use AI-powered analytics to detect threats in real time across multiple systems.


CVE-2026-11326: OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site s

Summary: OpenAI Atlas versions before 1.2025.288.15 had a security flaw where privileged browser APIs (special functions that control browser features) were exposed to web content on OpenAI domains, and a cross-site scripting vulnerability (a type of attack where malicious code is injected into a website) on forum.openai.com could be exploited to access browser history and control tabs. The vulnerability was caused by improper access control (failing to properly restrict who can use certain functions).

Solution: Users should upgrade to OpenAI Atlas version 1.2025.288.15 or later, which narrows access to these APIs to only the *.chatgpt.com domain.


US government report slams NIST for NVD backlog

Summary: A US Commerce Department report criticizes NIST (National Institute of Standards and Technology) for a growing backlog of unprocessed vulnerabilities in the NVD (National Vulnerability Database, a catalog of known security flaws). The backlog has worsened due to budget cuts, increased vulnerability discoveries from AI tools, and inefficient coordination between NIST and CISA (Cybersecurity and Infrastructure Security Agency), including duplicated work and failure to share data despite having access to the same public information.

Solution: The report states that 'NIST must improve the efficiency of enrichment processes to ensure sustainability' and notes that 'before system updates and subsequent process changes were completed in March 2025, NIST refused to use CISA's data.' The source indicates technical updates to the NVD system were needed 'to incorporate CISA's enrichment data because the system lacked the capability to attribute data to specific sources,' and these updates were completed in March 2025, allowing NIST to leverage CISA's data to expedite backlog reduction.


CVE-2026-47644: Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Micr

Summary: CVE-2026-47644 is an injection vulnerability (a flaw where specially crafted input is not properly filtered before being used by another part of the system) in Microsoft Edge's Copilot Chat that allows an attacker to disclose information over a network without authorization. The vulnerability involves improper neutralization of special elements in output, meaning the system doesn't properly clean or validate data before passing it to other components.


CVE-2026-45497: Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an autho

Summary: CVE-2026-45497 is a command injection (a flaw where special characters in user input are not properly filtered, allowing an attacker to insert and run unintended commands) vulnerability in Microsoft Copilot that lets an authorized attacker execute code over a network. The vulnerability has not yet received a CVSS score (a 0-10 rating of how severe a vulnerability is) from NIST.


CVE-2026-42824: Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthoriz

Summary: CVE-2026-42824 is a command injection vulnerability (a flaw where an attacker inserts malicious commands into user input that gets executed by the system) in Microsoft 365 Copilot that allows an unauthorized attacker to disclose information over a network. The vulnerability stems from improper neutralization of special elements in commands. A CVSS score (a 0-10 rating of how severe a vulnerability is) has not yet been assigned by NIST.


CrowdStrike CEO says AI security fears will become a bigger tailwind in coming quarters

Summary: CrowdStrike CEO George Kurtz stated that growing concerns about AI-powered cyber threats are creating business opportunities for his company, as enterprises seek security solutions to safely deploy AI across their organizations. He noted that demand for CrowdStrike's AI Detection and Response platform (a tool that finds and responds to AI-related security attacks) is accelerating, with the company's second quarter pipeline exceeding $50 million and growing 250% sequentially. Kurtz argued that AI is actually increasing the need for cybersecurity by making attackers more sophisticated, rather than reducing it.


AI needs a 'brake pedal', warns Anthropic co-founder

Summary: Anthropic co-founder Jack Clark warns that AI is advancing so rapidly it could soon develop without human control, and he calls for a regulatory 'brake pedal' (a way to slow or pause AI progress) to keep society in control of these increasingly powerful systems. He notes that Anthropic's Claude chatbot already writes 80% of its own code, and reaching 100% is possible within two years, which would have major implications for society.


4 Critical Threats Where Attackers Have the Advantage

Summary: Gartner analysts warn about four critical threats where attackers currently have an advantage, including deepfakes (AI-generated fake videos or images) and prompt injection (tricking an AI by hiding malicious instructions in its input). The analysts are urging organizations to strengthen their security defenses against these emerging threats.


Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us

Summary: Microsoft's AI Red Team updated their taxonomy of failure modes in agentic AI systems (AI systems that can autonomously perform tasks) from v1.0 to v2.0 based on 12 months of real-world security testing. The update added seven new failure mode categories, including agentic supply chain compromise (injecting malicious instructions into tool registries), goal hijacking (redirecting an agent's objectives through disguised commands), and inter-agent trust escalation (one compromised agent deceiving others about its permissions). The revision was driven by rapid adoption of open-source agentic frameworks, widespread vulnerabilities in tool ecosystems, and the emergence of computer-use agents that interact with graphical interfaces.


GHSA-wc3v-3457-c8cm: OpenMeter: SQL injection through meter creation

Summary: OpenMeter has a SQL injection vulnerability (a flaw that lets attackers insert malicious database commands) in its meter creation endpoint. An authenticated tenant can inject arbitrary SQL through the `valueProperty` or `groupBy` fields, bypassing validation and executing commands against the shared ClickHouse database (the system that stores event data for all tenants), allowing any tenant to read or modify other tenants' metering data.

Solution: Replace `fmt.Sprintf` string interpolation with `sb.Var()`, which appends the value to the builder's args list and emits a `?` placeholder. Specifically, change: `sb.Select(fmt.Sprintf("JSON_VALUE('{}', '%s')", sqlbuilder.Escape(d.jsonPath)))` to `sb.Select(fmt.Sprintf("JSON_VALUE('{}', %s)", sb.Var(d.jsonPath)))`.

github.com/openmeterio/openmeter@< 1.0.0-beta.228 (fixed: 1.0.0-beta.228)


OpenAI responds to White House executive order on AI governance

Summary: OpenAI has proposed a federal governance framework for frontier AI (the most advanced AI systems) that requires mandatory evaluations by a government body before public release, but stops short of giving regulators the power to block deployments. The proposal also includes broader requirements like third-party audits, transparency reports, incident reporting, and whistleblower protections for frontier AI developers, arguing that voluntary commitments alone are insufficient as AI systems become more capable.


CVE-2026-10814: A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file int

Summary: A vulnerability exists in Milvus (a vector database software) versions up to 2.6.13 where the Grantee ID Hash Handler component uses weak hash (a cryptographic function that is easy to break). An attacker would need local access to the system and would face high complexity in exploiting it, though the vulnerability details have been publicly disclosed.

Solution: Apply the patch identified as 3d932f1c3e065351c4440c27abe1e6479752544d to fix this issue.


Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories

Summary: A security flaw in Anthropic's Claude Code GitHub Action allowed attackers to hijack repositories by opening a single malicious GitHub issue that exploited a broken permission check and indirect prompt injection (tricking an AI by hiding instructions in its input). The vulnerability let attackers steal credentials needed to gain write access to code and workflows, potentially poisoning the Claude Code Action itself for downstream projects that use it.

Solution: Update to claude-code-action v1.0.94 or later. Then audit any workflow that lets users without write access or bots trigger Claude: if it takes untrusted input, limit secrets to only the Anthropic API key and GITHUB_TOKEN, and remove tools and permissions that could be used for stealing data.

Anthropic
Claude Code
Claude GitHub Action
Cline


Agentic AI Is Transforming Defense, But Only Secure IT Infrastructure Will Maximize It

Summary: Agentic AI (AI systems that can take independent actions across networks) is being deployed in U.S. defense networks, but security risks are growing just as fast, especially after an unauthorized group reportedly accessed Anthropic's Claude Mythos model within hours. The article emphasizes that AI is only as trustworthy as the data it uses, the networks it connects to, and the security controls protecting it, requiring careful attention to what data enters the model, who can access it, and where the AI sends requests.

Solution: N/A -- no mitigation discussed in source.


Offroad Emerges From Stealth With $7 Million to Tackle Enterprise Identity Risk

Summary: Offroad, a new startup, uses agentic AI (AI systems that can take autonomous actions) to help organizations find and fix identity risks across their systems. The company addresses a growing problem where identities (human users, machines, and AI agents) are spreading across many systems, making it difficult for security teams to manually manage access and permissions, especially as AI agents operate at scales and speeds humans cannot match.

Solution: Offroad's approach, as described in the source, is to 'use its own autonomous agents to find the issue, gather the context necessary to understand the problem, and then fix it.' The system either reports details to a human for review or takes autonomous action wherever safe. Additionally, Offroad has launched ohauth.ai, described as 'A community catalog of OAuth apps (third-party applications with delegated access) with over-privileged scopes, dead publisher domains, and silent permission drift' to help organizations identify risky applications.

Google Workspace
GitHub
OpenAI
1Password


Willow Raises $7 Million for Securing Autonomous AI Agents

Summary: Willow, an Israeli startup, launched a platform that manages identity and access for AI agents (autonomous systems that perform tasks independently) in enterprises, securing tools like Claude and ChatGPT through centralized control. The platform assigns verified identities to each AI agent, restricts which systems they can reach using least-privilege access (allowing only the minimum permissions needed), and detects unauthorized AI usage across a company's network. With $7 million in funding, Willow aims to let companies safely deploy AI agents without giving them unrestricted access to sensitive systems and data.

Willow Claude Gemini ChatGPT Okta Entra Slack Wix


AI Threat Readiness Pillar 1: Reduce Critical Exposures & Scan with AI

Summary: AI is making it faster for attackers to turn newly discovered vulnerabilities into working exploits, with exploitation timelines shrinking from days or weeks to just hours. Security teams are overwhelmed with too many vulnerability alerts to handle, so they need to focus on identifying which exposures actually matter by evaluating reachability (can attackers access it?), exploitability (can it be compromised?), and business impact. To address this, organizations should use AI-powered scanning tools to find complex attack chains and prioritize vulnerabilities based on real-world risk rather than just volume.

Solution: The source mentions that organizations should use Wiz Attack Surface Management (ASM), which combines external visibility of internet-facing assets with internal cloud context to help identify and reduce critical exposures. However, the text is cut off and does not provide specific implementation details or complete mitigation steps beyond recommending this tool approach.


ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories

Summary: This security bulletin covers multiple threats: Cisco released patches for a high-severity SSRF vulnerability (server-side request forgery, where attackers trick a server into making unwanted requests) in Unified Communications Manager that could let unauthenticated attackers write files and gain root access; Russia's FSB reported foreign intelligence services deployed spyware on officials' mobile devices to steal data and conduct surveillance; threat actors are using social engineering to distribute VIP Keylogger through JavaScript, batch, and VBS loaders disguised as business communications; and the U.S. Treasury sanctioned Iran's largest cryptocurrency exchange for facilitating payments linked to terrorist activities and ransomware actors.

Solution: Cisco has addressed the SSRF vulnerability in Unified CM and Unified CM SME Release versions 14SU6 and 15SU5.


Gemini Voice Assistant Hijacked via Messaging Notifications

Summary: Researchers discovered a critical vulnerability in Google's Gemini voice assistant where attackers could inject malicious commands through messaging notifications (WhatsApp, Slack, SMS) using a technique called Fake Context Alignment, allowing them to control smart home devices, make calls, and manipulate the assistant without the user knowing. The attack exploited prompt injection (tricking an AI by hiding instructions in its input) by embedding hidden commands in foreign languages or muted links that Gemini would process but not read aloud. Google patched the vulnerability in November 2025 with content classifier improvements (software filters that categorize and block harmful content).

Solution: Google patched the vulnerability in mid-November 2025 with content classifier improvements.

Google
Gemini
Google Home
Google Workspace
WhatsApp
Slack
Zoom


CVE-2026-10804: A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/r

Summary: Streamlit versions up to 1.53.0 contain a vulnerability in the hashing function (a process that converts data into a fixed-size code for security purposes) within its caching system that uses weak cryptographic methods. The vulnerability is difficult to exploit as it requires local access (being on the same computer) and high technical complexity, though it has been disclosed publicly.


CVE-2026-10803: A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflo

Summary: MLflow versions up to 3.10.0 contain a vulnerability in the dataset digest computation function that uses weak cryptographic hashing (a mathematical function that converts data into a fixed-size code, but this version uses an insecure version). The flaw requires local access to exploit and is difficult to execute, but a working exploit has been published.


AI leaders call for tougher protections against AI-aided bioweapons

Summary: Major AI company leaders, including those from Anthropic, OpenAI, and Microsoft, have sent an open letter to US lawmakers calling for stronger rules to prevent their AI systems from being used to develop biological weapons. They argue there is a serious gap in biosecurity (protections against biological threats) that could allow people to use AI to help create dangerous genetic material for harmful purposes, potentially causing a global pandemic.


Hugging Face Transformers RCE flaw enables stealthy compromise via AI model configs

Summary: A high-severity vulnerability in Hugging Face Transformers (a popular Python library for running AI models) allows attackers to execute malicious code on systems even when developers use the trust_remote_code=false setting, which is meant to block remote code execution. The attack works by hiding malicious instructions in a fake configuration parameter called _attn_implementation_internal that looks like a normal internal setting, leaving no warning messages or traces. This vulnerability affects versions 4.56.0 through 5.2.x and is particularly dangerous because the Transformers library is downloaded millions of times per week and used widely in enterprise environments.

Solution: The vulnerability was silently patched in Transformers version 5.3.0, released on March 3. Users should update to this version or later to receive the fix.


How Endava is redesigning software delivery around AI agents

Summary: Endava, a global technology services company, transformed its software delivery by adopting AI agents (AI systems that can autonomously perform tasks) as a core part of daily work across all business functions, not just engineering. The company made OpenAI its enterprise platform and embedded AI throughout its entire DavaFlow lifecycle (their software development process), from requirements gathering to deployment, which accelerated delivery and reduced manual work. Key to their success was treating AI adoption as a behavior change requiring leadership commitment and hands-on experimentation, rather than simply rolling out new software tools.


Hacking Meta’s AI Chatbot

Summary: Hackers discovered a way to take over Instagram accounts by tricking Meta's AI support chatbot into resetting passwords for accounts that weren't theirs. The attacker would use a VPN (a tool that masks your location) to hide their location, then convince the chatbot to send a password reset code to an email address they controlled, allowing them to take over the victim's account. Meta said the specific exploit was fixed, but security experts warned that chatbots are fundamentally unreliable for account security tasks.

Solution: Instagram spokesperson Andy Stone stated that 'the issue was now fixed' on Monday.

Meta
Meta AI Support Assistant
Instagram


Dreaming: Better memory for a more helpful ChatGPT

Summary: OpenAI is rolling out an improved memory system called "Dreaming" for ChatGPT that automatically learns user preferences and context from conversations over time, addressing problems with older memory features that became outdated or incorrect. Unlike the previous "saved memories" system that only worked when users explicitly asked ChatGPT to remember something, Dreaming runs in the background to continuously synthesize and update memories from chat history, making ChatGPT more personalized without requiring manual input. Users can view and edit their stored memories through a memory summary page, and this update is being released to Plus and Pro users in the US with broader rollout planned.


Beware the ‘son of Mythos,’ security experts warn

Summary: Major AI companies like Anthropic and OpenAI are expanding access to frontier AI models (cutting-edge AI systems) for vulnerability discovery tools like Claude Mythos, which can identify security weaknesses in software. Security experts warn that these tools are becoming cheaper and more capable, and that attackers are already using similar AI systems, so organizations need to prepare for more advanced threats including the ability to chain together multiple medium-severity vulnerabilities into high-impact attacks.

Solution: According to Paul Chichester from the UK's National Cyber Security Centre, "Organisations should improve cybersecurity by hardening access controls and running incident response exercises." Additionally, organizations should "use AI to write better code and look for vulnerabilities" themselves, and ensure their teams can "rapidly validate, prioritize, and remediate the issues being discovered before attackers find them first."

Anthropic
Claude
OpenAI
GPT-5.5 Cyber
Google


WhatsApp, Slack Notifications Could Hijack Google Gemini on Android

Summary: A vulnerability in Google Gemini's Android voice assistant could be hijacked through poisoned notifications from apps like WhatsApp or Slack, allowing attackers to manipulate what Gemini says, open windows, fake messages, or launch apps without needing malicious software on the phone. The attack works by treating hostile notification text as instructions the assistant should follow. Google has already patched this vulnerability, and there is no evidence it was exploited in the real world.

Solution: Google has since patched it.

Google Gemini
WhatsApp
Slack
SMS
Signal
Instagram
Messenger
Google Home
Zoom

integrity confidentiality availability safety


xAI Asks Court to Strip Alleged Grok Deepfake Nudes Victims of Anonymity

Summary: Elon Musk's AI company xAI is asking a court to force four people who claim Grok (an AI chatbot) was used to create sexual deepfake images of them to reveal their real names in a lawsuit, despite their concerns about harassment and privacy. The plaintiffs, currently identified by pseudonyms like "South Carolina Doe," say they already suffered emotional distress from the deepfakes, including one targeting a child, and fear further harm if their identities become public.


Unveiling the black box: A multi-layer framework for explaining reinforcement learning-based cyber agents

Summary: This research paper presents a framework for understanding how reinforcement learning-based cyber agents (AI systems trained to make decisions by trial and error in cybersecurity contexts) make their decisions. The authors developed a multi-layer approach to explain the "black box" problem (the difficulty in understanding why AI systems reach certain conclusions), which is important for security experts to verify that these AI agents are operating correctly and safely.


Labour MP sues Elon Musk’s AI company over fake sexualised images

Summary: A UK Labour MP is suing Elon Musk's AI company after its Grok tool (a generative AI chatbot) was used to create non-consensual sexualized images of her, part of a broader problem of fake intimate images being generated and shared on X. The MP described seeing herself depicted in inappropriate ways without permission as deeply violating.


As AI gets better, it reveals an empty promise

Summary: Google's new Gemini AI agent called Spark demonstrates impressive capability by accessing personal information like pet names and family members' identities without users explicitly sharing them, raising privacy concerns. The article argues that while AI companies promote these tools as solutions to improve productivity, they may be missing more important societal problems that actually need fixing.


OpenAI CEO Sam Altman to meet with lawmakers, Trump officials in DC

Summary: OpenAI CEO Sam Altman is meeting with U.S. lawmakers and Trump administration officials in Washington, D.C. to discuss a new executive order requiring AI companies to voluntarily give the government access to their models for up to 30 days before release. Altman publicly supports the order, saying it strikes the right balance between developing safe AI models and providing cybersecurity tools to trusted defenders.


Former police officer in hiding after being falsely linked to Henry Nowak arrest

Summary: A former police officer named Christi Hill was falsely identified on social media and AI platforms, including Grok (an AI chatbot), as being involved in an arrest related to a murder case, forcing her to go into hiding. The false identification spread across multiple platforms, demonstrating how AI systems can amplify misinformation by misidentifying people in real-world situations.


Morgan Stanley will soon open its trillion-dollar wealth management funnel to AI agents

Summary: Morgan Stanley is opening its wealth management platforms (ShareWorks and Equity Edge) to AI agents (autonomous software that can make decisions and take actions without human input) from corporate clients, allowing these agents to access data directly without using traditional human-focused interfaces. The bank plans to expand this access to 3,400 clients by next year, using the Model Context Protocol (an open-source standard that lets AI models connect to data sources). This move reflects Wall Street's shift toward AI agents handling tasks that software users currently perform manually.

Morgan Stanley
OpenAI
JPMorgan Chase
Goldman Sachs


Microsoft and OpenAI broke up — now they’re ready to fight

Summary: Microsoft announced new AI initiatives at its Build conference, including in-house reasoning models (AI systems designed to work through problems step-by-step) and AI agents (software that can perform tasks autonomously), signaling it is moving toward independence in the AI market. The company's partnership with OpenAI, which previously dominated Microsoft's AI strategy, effectively ended in late April, though Microsoft still provides cloud computing services (the remote servers that store and process data) to OpenAI.


Meta is trying to sell AI agents to businesses in latest effort to diversify away from ads

Summary: Meta is launching Meta Business Agent, an AI tool that helps businesses of any size respond to customer questions, recommend products, and book appointments through WhatsApp, Messenger, and Instagram. The feature will be available through a paid subscription tier as Meta tries to reduce its dependence on advertising (which currently makes up 98% of its revenue) and compete with other AI companies like OpenAI and Google.

Meta
Meta AI
WhatsApp
Messenger
Instagram
OpenAI
Anthropic
Google
Amazon
Microsoft
Nvidia
OpenClaw


Introducing new capabilities to GPT-Rosalind

Summary: OpenAI introduced an updated GPT-Rosalind model designed specifically for life sciences research at enterprise scale, combining advanced coding abilities with stronger performance in drug discovery areas like medicinal chemistry and genomics. The update was evaluated using LifeSciBench, a new benchmark that tests AI performance across six key research workflows including evidence analysis, scientific reasoning, and experimental design. The content also includes detailed technical feedback on limitations in a micro-dystrophin research study, with specific recommendations for improving experimental methods.

Solution: For the micro-dystrophin expression study's identified problems, the source explicitly recommends: (1) for Western blot quantification, "use a recombinant micro-dystrophin standard and an orthogonal method that distinguishes transgene from endogenous dystrophin, such as targeted mass spectrometry or a transgene-specific/epitope-specific assay"; (2) for immunofluorescence, "repeat IF with an antibody against an epitope present in the transgene but absent from revertant dystrophin" and "quantify transgene-positive fibers separately from revertant fibers"; (3) for surrogate endpoint validity, "empirically validate the relationship between micro-dystrophin mass-percent, sarcolemmal localization, downstream functional restoration, and clinical benefit before treating expression as a surrogate endpoint"; and (4) for biopsy design, use matched bilateral sampling strategies that account for spatial variability and disease progression.


Security of 100 AI Agents Tested and Ranked – What You Need to Know

Summary: A security study of 100 AI agents found that only 11 are both capable and well-defended, with 98% suffering from the 'lethal trifecta' (private data access combined with exposure to untrusted content combined with ability to take outbound actions, creating too much power with too little control). Computer agents and coding agents pose the greatest security risks because they have wide system access and users cannot see or reliably control what actions they actually take between receiving a task and completing it.


Uber Caps Usage of AI Tools Like Claude Code to Manage Costs

Summary: Uber has implemented a $1,500 monthly spending cap per employee on agentic coding tools (AI systems that can independently write and execute code, like Claude Code and Cursor) to control costs after exhausting its 2026 AI budget in just four months. The policy limits spending on each tool separately, meaning an employee can spend up to $1,500 on one tool and another $1,500 on a different tool, which works out to roughly 11% of a typical software engineer's yearly salary in AI tool costs.

Solution: Uber instituted monthly spending limits of $1,500 per employee per AI coding tool. According to the source, these limits 'have been instituted in recent months' and apply specifically to agentic coding software such as Cursor and Claude Code, with separate budgets maintained for each tool.


Malicious Notifications Could Trick Google Gemini Users

Summary: Google Gemini's voice assistant had a prompt injection flaw (a vulnerability where attackers hide malicious instructions in input data) that allowed attackers to embed harmful commands in notifications. This could trick users into performing unwanted actions through social engineering (manipulating people into revealing information or taking harmful actions).


How Wasmer used Codex to build a Node.js runtime for the edge

Summary: Wasmer engineers used Codex (an AI code generation tool) to build Edge.js, a JavaScript runtime that runs Node.js workloads inside WebAssembly (a low-level code format that runs in sandboxes for security and portability). What would have taken one year to build was completed in two weeks, allowing a small team to tackle a project previously only feasible at large companies.


Microsoft wants to put AI agents on a short leash

Summary: Microsoft has released new security tools to control autonomous AI agents (software programs that can independently take actions like accessing files and running code) as companies adopt them in development workflows. The main offering is Microsoft Execution Container (MXC), a sandbox (an isolated environment that restricts what a program can do) that lets developers set boundaries on what resources and files agents can access. Microsoft also updated MDASH (a vulnerability research system using multiple AI agents to find security flaws) and introduced open-source governance tools to address risks from agents having too much autonomy.

Solution: Microsoft Execution Container (MXC) is positioned as the primary mitigation. According to the source, "MXC is a sandboxed code execution system for running untrusted code (model output, plugins, tools) on Windows, Linux, and macOS" that "provides multiple containment backends — from OS-native process sandboxes to full VMs — behind a unified JSON configuration schema and TypeScript SDK." The source states MXC is "a policy-driven execution workflow that lets developers specify what an AI agent can access, such as files, networks, resources, credentials, and then enforces those boundaries at runtime." Integration with Agent 365 will bring additional controls from Defender, Entra, Intune, and Purview to agent environments.

Microsoft
OpenAI
NVIDIA
Agent 365
Windows 365
OpenClaw
OpenShell
Defender
Entra
Intune
Purview


France's Macron invites Sam Altman to attend G7, OpenAI tells CNBC

Summary: Sam Altman, CEO of OpenAI, has been invited by French President Macron to attend the G7 conference in June 2026, where AI is expected to be a major topic of discussion. OpenAI plans to focus on youth safety, frontier AI risks (particularly cyber and biological threats), and getting tech companies to make voluntary commitments to responsible AI development. This invitation is part of Macron's broader effort to attract major tech companies and investment to France's AI infrastructure.

OpenAI
Sam Altman
ChatGPT
Anthropic
Dario Amodei
Google
SoftBank


The sorry state of skill distribution

Summary: Public marketplaces for AI skills (specialized add-ons that extend AI agent capabilities) are being flooded with malicious skills that steal passwords and data. Security companies have released skill scanners to detect these threats, but researchers found that these scanners are easy to bypass, sometimes in under an hour, because they rely on static detection methods that attackers can repeatedly modify to evade.

Anthropic OpenAI Google Cisco Vercel VirusTotal OpenClaw Gen Socket Snyk ClawHub


As the tech mega-IPO race heats up, has OpenAI missed its moment?

Summary: OpenAI, the company behind ChatGPT (a conversational AI system), is facing competitive pressure as rival AI companies race to go public through IPOs (initial public offerings, where companies sell shares to the public for the first time) and raise large amounts of investment money. The article notes that OpenAI's CEO Sam Altman has scaled back earlier predictions about building super intelligence and reshaping society, and the company has struggled to generate revenue from ads and specialized chatbots.


AI may finally unlock the cyber budgets CISOs have wanted for years

Summary: AI systems, particularly agentic AI (autonomous software that makes decisions and takes actions with minimal human oversight), are creating new security risks in enterprises by operating across systems at machine speed and collapsing traditional security boundaries. Security leaders now have board-level urgency and increased budgets to address these threats, though organizations still lack reliable ways to monitor what these AI agents are accessing and whether their actions align with company policies.


OpenAI public policy agenda

Summary: OpenAI has published its public policy agenda centered on ensuring that artificial general intelligence (AGI, highly capable AI systems that can perform many tasks) benefits all of humanity through five core principles: democratization, empowerment, universal prosperity, resilience, and adaptability. The document outlines OpenAI's policy priorities, including a focus on frontier AI safety (protecting against risks from the most advanced AI models, particularly regarding CBRN weapons like cyber or biological threats) and support for state and federal frameworks that emphasize transparency, safety incident reporting, and developer accountability.

Solution: OpenAI supports state-level legislative efforts such as California SB 53, the New York RAISE Act, and Illinois SB 315, which emphasize transparency, public reporting around catastrophic-risk evaluations and safety incidents, whistleblower protections, and enforceable accountability for developers. OpenAI also supports Congressional action to establish a comprehensive federal framework that leverages state frontier safety laws, strengthens the Center for AI Standards and Innovation (CAISI) as the primary federal institution for frontier AI safety, and mobilizes a broader resilience plan across government to address national security and public safety challenges.


A blueprint for democratic governance of frontier AI

Summary: This document proposes a strategy for the U.S. government to create lasting institutions that oversee frontier AI (the most advanced AI systems being developed). The plan has three main parts: build a national framework based on state laws already in place, strengthen CAISI (the federal organization responsible for frontier AI safety) as the main federal institution, and develop a broader government-wide plan to address national security and public safety risks from advanced AI.


Google adds Android protection against AI deepfake scam calls

Summary: Google is rolling out a new Android security feature called 'fake call detection' that protects users from AI deepfake scam calls where scammers impersonate someone's contacts. The feature works by having a user's device send an encrypted confirmation signal when receiving a call, and if that signal is missing, it pings the actual contact's phone to verify the call is real, warning the user to hang up if the contact's device confirms they're not calling.

Solution: Google's mitigation is built into the new 'fake call detection' feature, which is rolling out globally this month to Android 12 and later devices (starting with Pixel devices) and enabled by default. The feature requires Phone by Google, Contacts, and Google Messages (with RCS, or Rich Communication Services, enabled) to be installed. Google also stated: 'If your device uses a different app, you can install Phone by Google from the Play Store and set it as your default phone app to help protect yourself from fake calls.'

Google
Android
Phone by Google
Google Messages


Google must let publishers opt out of AI Search features, rules UK

Summary: The UK's Competition and Markets Authority has ruled that Google must allow website publishers to opt out of AI Search features, including AI Overviews (summaries generated by AI) and prevent their content from being used to train Google's AI models. This new rule gives publishers, especially news organizations, more control over how their content is used by AI systems.


Debapt: Ontology-driven multi-agent debate for APT adversary profile construction from cyber threat intelligence

Summary: Debapt is a system that uses multiple AI agents (independent AI programs that work together) debating with each other to build profiles of APT (advanced persistent threat, a sophisticated type of cyberattack) adversaries by analyzing cyber threat intelligence (information about security threats). The system uses an ontology (a formal structure that defines how concepts relate to each other) to organize this debate process. This research proposes a new way to understand and track advanced attackers by having AI agents discuss and reason through threat data together.


Anthropic grants Project Glasswing access to 150 more companies, with a focus on critical infrastructure

Summary: Anthropic expanded its Project Glasswing (an AI-based vulnerability hunting initiative that finds security bugs in software) to 150 more companies, especially those in critical infrastructure like power and healthcare. However, security experts warn this creates a bottleneck problem: if AI finds vulnerabilities 10 or more times faster than before, companies may not be able to validate, prioritize, patch, and deploy fixes quickly enough, potentially overwhelming security teams rather than actually improving defense.

Anthropic Amazon Apple Google Microsoft NVIDIA

Anthropic
AWS
Apple
Broadcom
Cisco
CrowdStrike
Google
JPMorganChase
Linux Foundation
Microsoft
NVIDIA
Palo Alto Networks
Okta


Deepfake detection with dual-mode swin transformer: Multi-scale feature learning and local ambiguity mitigation

Summary: This research paper presents a method for detecting deepfakes (synthetic videos or images created by AI to look realistic) using a dual-mode Swin Transformer, which is a type of neural network architecture. The approach uses multi-scale feature learning (analyzing visual details at different zoom levels) and local ambiguity mitigation (reducing confusion in uncertain areas) to improve detection accuracy. This is a technical contribution to security research, not a response to an existing vulnerability or security incident.


Palo Alto CEO says customer meeting requests have surged amid AI security concerns

Summary: Palo Alto Networks CEO Nikesh Arora reported a surge in customer meetings, with the company fielding roughly 1,200 inquiries in recent weeks from organizations seeking guidance on AI security risks. The article notes that AI-powered attacks are becoming more sophisticated, making cybersecurity more important for companies, and that earlier investor concerns about AI disrupting cybersecurity companies appear to have been overblown.


CVE-2026-44654: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a sha

Summary: LibreChat (a ChatGPT-like tool that connects to multiple AI providers) has a security flaw in versions up to 0.8.3 where someone with editing access to a shared agent can delete files globally, breaking the owner's separate private agents that use the same files. This is a cross-agent integrity violation, meaning one agent's access should not affect another agent's files.

Solution: Version 0.8.4 contains a patch.


CVE-2026-44653: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users

Summary: LibreChat, a ChatGPT-like application supporting multiple AI providers, has a vulnerability in versions up to 0.8.3 where users with limited VIEW access can retrieve encrypted admin passwords and API keys through specific API endpoints, exposing credentials that should remain secret. This happens because the API returns plaintext sensitive values instead of hiding them from non-admin users.

Solution: Version 0.8.4 contains a patch. The source also recommends these additional approaches: never return decrypted admin-managed secrets to non-owners; redact apiKey.key and oauth.client_secret from all API responses; consider returning only boolean presence indicators for secrets (true/false flags showing whether a secret exists, similar to the auth-values route pattern); and if owners need to edit configs without re-entering secrets, preserve secrets server-side and return placeholders instead of plaintext values.


CVE-2026-32625: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the M

Summary: LibreChat, a ChatGPT-like tool that works with multiple AI providers, has a vulnerability in versions up to 0.8.3 where it unsafely replaces environment variable placeholders (like ${VAR}) when validating user-provided server URLs. An authenticated attacker can create a malicious server configuration that tricks LibreChat into sending sensitive secrets like encryption keys and database credentials to an attacker-controlled server, compromising the entire installation without needing admin access.

Solution: This is patched in version 0.8.4-rc1.


CVE-2026-31942: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an In

Summary: LibreChat, a ChatGPT-like application supporting multiple AI providers, has an IDOR vulnerability (insecure direct object reference, where an attacker can access or modify resources belonging to other users) in its API key management system in versions up to 0.7.6. An authenticated attacker can inject a userId parameter to overwrite another user's API keys, potentially stealing their API key configurations or blocking their service.

Solution: This vulnerability is patched in version 0.8.3-rc1.


OpenAI upgrades GPT-5.5, as it plans to retire legacy ChatGPT models

Summary: OpenAI has upgraded GPT-5.5 Instant to respond more accurately with more natural, human-like language and shorter responses, while retiring older models like o3 (August 26) and GPT-4.5 (June 27) to focus resources on newer capabilities. The company is also adding a job search tool to ChatGPT that integrates with job boards like Indeed and Upwork to help users find positions and tailor resumes.


Microsoft's new MAI models

Summary: Microsoft announced two new text-based LLMs (large language models, AI systems trained on text data): MAI-Thinking-1, a 35-billion-parameter model (parameters are the adjustable values that make up a neural network) designed for reasoning tasks, and MAI-Code-1-Flash, a smaller 5-billion-parameter model built specifically for code generation in GitHub Copilot and VS Code. Both models were trained on licensed data rather than web scrapes, and Microsoft claims MAI-Thinking-1 outperforms Claude's Sonnet 4.6 model despite its smaller size.

Microsoft
MAI-Thinking-1
MAI-Code-1-Flash
GitHub Copilot
VS Code
Anthropic Sonnet 4.6


HP Poly VoIP vulnerability sets the stage for executive voice deepfakes

Summary: HP released patches for a critical buffer overflow vulnerability (a coding flaw where too much data is written into a fixed-size memory container) in its Poly Voice conference phones that could allow attackers without authentication to gain root access (complete control of the operating system) and record conversations for voice deepfakes (AI-generated fake audio impersonations). The flaw exists in code that processes ICE (Interactive Connectivity Establishment, a feature for establishing direct network connections) requests and affects multiple Poly phone models.

Solution: HP has fixed the vulnerability in Poly Unified Communications Software (UCS) versions 6.4.8 for VVX devices, 8.1.7 for Trio 8300, and 7.2.8 for Trio 8500 and 8800 phones. Additionally, HP advises administrators to disable the ICE feature if it is not needed, since it is not enabled by default on HP Poly devices.


Microsoft unveils new AI models to lessen reliance on OpenAI and lower costs for developers

Summary: Microsoft announced new AI models including MAI-Code-1-Flash (a model that generates source code from written descriptions) and MAI-Thinking-1 (a reasoning model) to reduce dependence on OpenAI and lower costs for developers. These models run on Microsoft's own Azure cloud infrastructure, allowing the company to avoid paying third parties while offering developers lower token costs (tokens are the basic units that an AI model reads and processes). Microsoft is positioning itself to compete directly with proprietary models from OpenAI and Google by building its own AI capabilities across multiple layers of the technology stack.

Microsoft
OpenAI
Anthropic
Google
GitHub Copilot


Trump Signs Executive Order That Invites Vetting of Top AI Models for National Security Risks

Summary: President Trump signed an executive order establishing a voluntary framework for the federal government to review the national security risks of the most advanced AI systems (models built by companies like OpenAI and Google that represent the cutting edge of AI development) before their public release, with a 30-day review period. The order aims to balance security concerns with concerns about slowing innovation, and it allows frontier labs to voluntarily share their most advanced models to help secure critical infrastructure and strengthen government cyber defenses.


The Meta AI Account Recovery Incident Wasn’t Just a Chatbot Problem

Summary: Hackers reportedly used Meta's AI support chatbot to take over high-profile Instagram accounts by tricking it into changing email addresses linked to those accounts, affecting pages associated with the Obama White House, Sephora, and other notable figures. The incident wasn't simply a case of prompt injection (tricking an AI by hiding instructions in its input), but rather revealed a deeper problem with how the AI chatbot was designed to handle account recovery requests.


Microsoft Build 2026: The 7 biggest announcements

Summary: Microsoft held its Build 2026 conference with announcements from CEO Satya Nadella covering new hardware and AI updates, including a Surface RTX Spark Dev Box designed to help developers run local AI models (machine learning systems that operate on a user's own device rather than in the cloud) on their computers. The event also featured updates to Microsoft's own AI models and an always-on personal assistant feature.


Securing AI Agents Before They Go Rogue Is Next to Impossible

Summary: AI agents (systems that can act independently to complete tasks) with high autonomy and broad permissions are very difficult to secure and pose a serious risk to enterprises. The article warns that companies need to take action now to prevent AI agents from causing major problems in the future.