- OpenAI Launches Patch the Planet to Accelerate Open-Source Fixes: OpenAI deployed a new program combining AI-assisted vulnerability discovery with security experts from Trail of Bits to identify, fix, and deploy patches for flaws in critical open-source projects like Python, Go, and cURL. The company argues that AI has made vulnerability discovery so fast that security teams are overwhelmed, shifting its Daybreak initiative to prioritize rapid patching over pure research.
- Fake AI Agent Skill Bypassed Security Scanners and Reached 26,000 Agents: Security researchers created a malicious AI agent skill (a bundle of instructions that agents load and execute) that evaded all scanning tools by exploiting a structural flaw where reviewers only check the initial package but attackers can later swap the external webpage it references. The attack leveraged inherited GitHub credibility and targeted advertising, demonstrating that current trust mechanisms and automated scans fail against sophisticated supply-chain attacks.
- Anthropic's Fable 5 Jailbroken Days After Launch: Anthropic's newly released Fable 5 model was successfully jailbroken (tricked into bypassing safety restrictions) shortly after deployment, despite claims of thorough security testing. The incident underscores that even rigorous pre-release evaluation cannot guarantee vulnerabilities will remain undiscovered in production.
- $20 Million AI Regulation Battle Unfolds in New York Primary: Competing super PACs funded by AI companies are flooding a New York congressional race with over $20 million, with OpenAI and Andreessen Horowitz backing lighter regulation while Anthropic supports stricter safety requirements built into models from development. The race has become a proxy war over whether the U.S. government should impose heavy regulatory oversight on the AI industry.
Digest archive
Past daily digests, newest first.
- OpenAI Launches Multi-Billion Dollar Open Source Security Initiative: OpenAI expanded its Daybreak program to systematically find and fix vulnerabilities in critical open-source projects, partnering with Trail of Bits, HackerOne, and Calif to provide free security consulting and AI-powered bug hunting using GPT-5.5-Cyber (a specialized model trained on security tasks). In the first week, engineers discovered hundreds of bugs across 19 major projects including Python, Go, and RustCrypto, with 37 patches already merged.
- US Export Controls Block Anthropic's Fable Model Over Code-Writing Capabilities: The US government placed export controls on Anthropic's Fable AI model, claiming its advanced code-writing capabilities posed a national security threat, while intelligence agencies from the Five Eyes alliance (US, UK, Canada, Australia, New Zealand) warned that AI models capable of severely damaging governments and businesses could arrive within months.
- DNS Rebinding Bypasses SSRF Protection in Budibase: Budibase backend-core contains a time-of-check to time-of-use vulnerability (CVE-2026-54353) where SSRF protections (server-side request forgery defenses that prevent servers from making unintended requests) can be bypassed through DNS rebinding, allowing attackers to return safe IPs during validation checks but malicious internal IPs during actual connections to access localhost or cloud metadata endpoints.
- Multiple Cross-Tenant Data Exposure Flaws in Dify AI Platform: Researchers disclosed four vulnerabilities in Dify (an open-source AI workflow platform) that enabled unauthorized access to private AI conversations and files across different customer accounts due to missing permission checks, allowing attackers to read sensitive chat data without authentication.
- Legacy Infrastructure Gaps Undermine AI Agent Security: Organizations deploying AI agents are exposing themselves to attacks that bypass AI-specific security measures by exploiting unpatched servers, misconfigured Active Directory permissions, and cached credentials in underlying infrastructure, creating a dangerous gap where attackers can access the data and resources AI agents depend on.
- Samsung Deploys ChatGPT Enterprise to All Employees Globally: Samsung Electronics is rolling out ChatGPT Enterprise and Codex (an AI coding assistant) across its Korea and Device eXperience divisions worldwide, marking one of OpenAI's largest enterprise deployments to date. The deployment includes security controls like data protection and access management to enable AI use within corporate policies.
- Cloudflare Enables Anonymous AI Agent Deployments: Cloudflare now allows users to deploy applications on its Workers serverless platform without account creation through temporary 60-minute projects. This reduces friction for testing and prototyping but introduces potential abuse vectors for malicious actors seeking ephemeral infrastructure.
- Microsoft Attributes Major npm Supply Chain Attack to North Korean Hackers: The Sapphire Sleet group compromised an npm maintainer account and poisoned over 140 JavaScript packages with a malicious dependency that exfiltrated credentials, API keys, and cryptocurrency wallets from developer machines. The malware used post-install hooks (code that executes automatically during package installation) and deployed platform-specific persistence mechanisms across Windows, Linux, and macOS.
- Lloyds Banking Group Expands AI Agent Workforce by 300: The bank is hiring 300 technologists by September to build agentic AI systems (autonomous models that plan and execute tasks with minimal human oversight), even as broader AI adoption may eventually reduce headcount elsewhere in the organization.
- Researchers Expose Music Training Data Behind Major AI Models: Four public datasets containing between 100,000 and 12 million songs have been downloaded thousands of times and used by companies including Google and Stability to train AI models, surfacing unresolved questions about artist attribution and compensation in model development.
- Widespread Critical Vulnerabilities in AI Agent Frameworks: Multiple critical command injection and authentication bypass vulnerabilities were disclosed in popular AI agent tools, including Network-AI (CVE-2026-48814, CVE-2026-54051), Langflow (CVE-2026-55255, CVE-2026-55447), and agentic-flow. These flaws allow unauthenticated attackers to execute arbitrary commands, read sensitive files, or hijack other users' workflows, exposing organizations running AI agents to immediate risk of system compromise and data theft.
- Microsoft Identifies AutoJack Attack Chain Targeting AI Browsing Agents: Microsoft disclosed AutoJack, an exploitation technique that weaponizes malicious webpages to achieve RCE (remote code execution, where an attacker can run commands on a system they don't own) on computers running AI agents with web browsing capabilities. The attack chains together weaknesses in AutoGen Studio's Model Context Protocol implementation, allowing hostile pages visited by the agent to execute arbitrary code without credentials or user interaction.
- M365 Copilot SearchLeak Exposes Prompt Injection Attack Surface: Security researchers disclosed SearchLeak, a prompt injection attack (tricking an AI by hiding malicious instructions in its input) targeting Microsoft's M365 Copilot Enterprise Search that exploits URL parameters to exfiltrate sensitive corporate data including emails, documents, and meeting transcripts. While Microsoft patched the specific vulnerability, the disclosure reveals a broader systemic risk called parameter-to-prompt injection that threatens any AI-powered web service with broad access to enterprise assets.
- U.S. Restricts Anthropic AI Models as Munitions Under Export Controls: The White House classified Anthropic's Fable model as a dangerous munition and blocked foreign access after the company released an AI system described as "relentlessly proactive" at achieving difficult goals with minimal guidance, raising concerns about misuse. This marks the first major application of AI export controls, though experts note the open-source community has already demonstrated ability to replicate similar capabilities using cheaper models and improved interface code.
- Enterprise AI Agents Emerge as Unmanaged Identity Crisis: A 2026 survey found 82% of organizations discovered AI agents created without security oversight, and 65% experienced security incidents involving these agents, typically resulting in data exposure. AI agents now function as autonomous identities with privileged access to critical business systems like Salesforce and GitHub, yet most organizations lack visibility or access controls for these non-human actors, creating significant security blind spots.
- PraisonAI File Access Vulnerabilities Expose Systems to Total Compromise: Two critical and high-severity flaws in PraisonAI allow attackers to read or write arbitrary files and trigger SSRF (server-side request forgery, tricking a server into making requests to unintended locations) attacks by manipulating AI agent tool parameters. The `multiedit` tool passes filepaths directly to `open()` without validation, enabling credential theft and system takeover, while search tools accept attacker-controlled `searxng_url` parameters that can reach internal services and cloud metadata endpoints to steal credentials.
- Unauthenticated Email Triggers Privileged AI Code Execution in AgenticMail: A high-severity flaw in AgenticMail allows any external sender to trigger a Claude Code session running in `bypassPermissions` mode (removing safety restrictions) by sending an email whose contents are embedded directly into the AI prompt without sender verification. This enables prompt injection (tricking the AI by hiding instructions in its input) leading to arbitrary code execution and file access under the operator's identity.
- Adobe Expands AI Assistant Access Across Creative Cloud Suite: Adobe is deploying conversational AI assistants to Photoshop, Premiere, Illustrator, InDesign, and Frame.io, each customized for its specific application to help organize workflows and automate editing and design tasks. The rollout represents a significant expansion of AI agent capabilities into professional creative tools used widely across enterprises.
- Attackers Weaponize Trusted Platforms for AI Tool Impersonation Campaign: A seven-week campaign abused Google Ads, GitLab, and Claude to deliver malware to over 2,000 victims by impersonating popular AI developer tools and using ClickFix social engineering (tricking users into manually running malicious commands). The attacks succeeded because victims trusted these legitimate platforms and assumed instructions from AI tools were reliable, making detection harder than traditional malware distribution.
- AI-Assisted Reanalysis Solves Previously Unsolvable Rare Disease Cases: Researchers using OpenAI o3 Deep Research re-examined 376 unsolved rare genetic disease cases, establishing 18 new diagnoses (4.8% additional yield) by connecting clinical data, genetic variants, and scientific literature into evidence-based hypotheses for specialist review.
- Anthropic Hit by Unprecedented AI Export Controls: The Trump administration ordered Anthropic to block all foreign nationals from accessing its Fable 5 and Mythos 5 models, marking the first time U.S. export controls have restricted an AI model in this way, reportedly triggered by concerns that Amazon researchers prompted the model to generate information useful for cyberattacks. Anthropic disagreed with the suspension and criticized the process as lacking transparency, while the government has not publicly explained the legal basis for the order.
- Critical Unauthenticated File Upload Flaw in Langflow: Langflow versions before 1.9.1 allow anyone with network access to upload unlimited data without authentication, exhausting disk space to cause DoS (denial of service, making the system unavailable) and leaking exact file paths that could enable attackers to chain multiple exploits together (CVE-2026-55450, critical severity).
- SQL Injection in LangChain4j Embedding Stores: LangChain4j's MariaDB and pgvector embedding stores improperly escape metadata filter keys before inserting them into SQL queries, allowing attackers who control filter keys to inject arbitrary SQL commands that could steal data, cause denial of service, or delete database rows (CVE-2026-55405, high severity).
- Malicious JetBrains Plugins Harvest AI API Keys: Researchers discovered 15 malicious plugins on the JetBrains Marketplace disguised as AI coding assistants that steal API keys (authentication credentials for paid AI services like OpenAI and DeepSeek) and send them to attacker servers, with some credentials being resold to other criminals in an apparent monetization scheme.
- Tenet Security Launches Real-Time AI Agent Defense Platform: Tenet Security emerged from stealth with $6 million in funding to address a critical security gap, using patent-pending technology with lightweight runtime sensors that monitor OS behavior, network calls, and agent reasoning to predict and block harmful actions from AI agents (autonomous software that makes decisions and takes actions) before they execute, defending against both agentjacking (malicious manipulation of AI agents) and autonomous agent malfunctions.
- Critical vLLM and LiteLLM Authentication Bypasses via Host Header Injection: Multiple LLM inference platforms contain critical authentication bypass vulnerabilities where attackers can craft malicious Host headers (the part of a web request specifying which server is contacted) with special characters to circumvent API key checks. vLLM (CVE-2026-48746) and LiteLLM (CVE-2026-49468) both fail to properly validate requests before authentication, allowing unauthorized API access on directly exposed instances.
- Langflow RCE in Shareable Playgrounds Allows Unauthenticated Code Execution: Langflow's Shareable Playground feature contains a critical vulnerability (CVE-2026-48519) where unauthenticated attackers can execute arbitrary Python code by modifying the code field in API requests to `/api/v1/build_public_tmp`, achieving complete RCE (remote code execution, where attackers run commands on systems they don't own) without any credentials.
- Google Vertex AI SDK Hijacking Enables Cross-Tenant Model Poisoning: Researchers discovered a critical flaw in Google Cloud's Vertex AI SDK for Python (versions 1.139.0 and 1.140.0) that allows attackers to hijack model uploads through bucket squatting (exploiting predictable cloud storage bucket names). By predicting and pre-creating a victim's storage bucket using their public project ID, attackers can inject malicious code that executes when the poisoned model deploys, achieving cross-tenant RCE.
- U.S. Export Controls Shut Down Anthropic's Advanced Models Over Vulnerability Research Capabilities: Anthropic pulled its Claude Fable 5 and Mythos 5 models offline to comply with U.S. government directives restricting foreign national access, citing the models' advanced ability to discover and exploit software vulnerabilities. Security executives have publicly challenged the ban, arguing that similar capabilities already exist in competing models and that restricting one vendor is ineffective when open-source alternatives will develop equivalent features within months.
- One-Click Microsoft 365 Copilot Vulnerability Enabled Complete Data Exfiltration: A critical vulnerability chain in Microsoft 365 Copilot (now patched as CVE-2026-42824) allowed attackers to steal emails, calendar data, and MFA codes through a single malicious link by exploiting parameter-to-prompt injection (inserting malicious instructions via URL parameters), an HTML rendering race condition, and SSRF (server-side request forgery, tricking a server into making requests to unintended locations) through Bing. The attack required no password entry or additional user interaction beyond the initial click.
- U.S. Government Orders Shutdown of Anthropic's Latest Models Over Unspecified Security Concerns: The Trump administration issued an export control directive forcing Anthropic to disable global access to its Fable 5 and Mythos 5 models, citing national security risks from a potential jailbreak (method to bypass AI safety restrictions), prompting dozens of cybersecurity experts to publish an open letter arguing the ban removes critical defensive tools while adversaries retain access to similar capabilities in other widely available models. Anthropic is meeting with administration officials to resolve the dispute after complying with the shutdown order.
- Critical LiteLLM Gateway Vulnerability Chain Grants Full Admin Access: LiteLLM, a widely-deployed open-source AI gateway (routing system for AI requests), contains three chained vulnerabilities (CVSS 9.9) that allow low-privilege users to escalate to admin, bypass authorization, and execute arbitrary code on servers, exposing all provider API keys, encrypted credentials, and transit data including prompts and responses (CVE-2026-47101, CVE-2026-47102, CVE-2026-40217). The compromise enables attackers to manipulate AI responses in real time and maintain persistent access.
- Attackers Weaponize AI Safety Mechanisms for Denial-of-Service: Researchers discovered that AI agent guardrails (safety systems checking AI behavior) can be exploited by inserting malicious content into documents, causing security mechanisms to enter extended reasoning loops that slow systems up to 148 times normal speed or crash shared AI infrastructure entirely. This reasoning-extension DoS attack targets the safety layer itself rather than attempting jailbreaks, and works across multiple AI frameworks and LLM families.
- Meta's $14.3 Billion Pivot to Proprietary AI Models: Meta hired Alexandr Wang and his team to build the Muse Spark model, marking a departure from its open-source Llama strategy after failing to attract developers. The company now faces the challenge of convincing investors it can monetize AI beyond its advertising business, which still generates 98% of revenue.
- White House Restricts Anthropic's Mythos Model Over China Access Concerns: Export controls were reportedly imposed on Anthropic's Mythos AI model after suspected access by a China-linked group. Officials fear adversaries could use distillation (training a simpler model to mimic a more advanced one's behavior) to reverse engineer the system's capabilities.