- OpenAI Partners with Major Brazilian Publishers for ChatGPT Content: OpenAI has integrated journalism from Folha de S.Paulo and Grupo UOL into ChatGPT, allowing 900 million weekly users to access attributed summaries and articles with links to original reporting. This marks another step in OpenAI's strategy to embed trusted news sources directly into AI-powered interfaces.
- Evolving Jailbreak Techniques Target Chatbot Personality Systems: Attackers are developing more sophisticated methods to exploit chatbot personalities and bypass safety guardrails (content filters and behavioral constraints built into AI systems), moving beyond simple prompt-based jailbreaks (social engineering attacks that trick AI into ignoring safety rules) that required no technical skill.
- Scotland's Data Center Policy Misaligned with AI Energy Demands: Scotland's 2022 green data center policy, designed before the ChatGPT era, fails to account for the substantial carbon emissions generated by AI workloads, raising concerns about the environmental impact of the country's AI investment attraction strategy.
Digest archive
Past daily digests, newest first.
- Anthropic's Claude Mythos Surfaces Over 10,000 Critical Vulnerabilities: Project Glasswing, powered by Anthropic's Claude Mythos Preview model, has automatically discovered more than 10,000 high-severity flaws in widely-used software since launching last month, with 97 already patched and 88 advisories published. The company acknowledges that automated discovery dramatically outpaces remediation capacity, creating a significant backlog challenge for defenders.
- Trump Administration Abandons Pre-Release AI Safety Reviews: President Trump scrapped a planned mandate requiring government safety reviews of new AI models before public release, pivoting hours before signing to prioritize American competitiveness over security vetting. The reversal signals a regulatory approach favoring speed and competition with China despite expert warnings about potential security risks.
- Google's Gemini Now Generates Realistic Deepfake Video from Any Input: Google's latest Gemini model demonstrates effective video generation from simple prompts, with experiments producing convincing synthetic media (deepfakes, or AI-generated videos designed to appear authentic) of everyday objects. The accessibility and quality of these tools intensify concerns about distinguishing legitimate content from misleading AI-generated media.
- Microsoft Embeds Agentic AI in Enterprise Browser with Data Controls: Microsoft is testing AI agents (systems that can autonomously complete multi-step tasks) in Edge for Business to automate routine work like form filling and data gathering, with security features that keep AI prompts within the company's Microsoft 365 tenant (private cloud environment), block sensitive data uploads, and enable corporate auditing.
- Critical Unauthorized Command Execution in Kiro CLI (CVE-2026-9255): Kiro CLI, a tool that lets developers use AI to run code and shell commands, contains a high-severity flaw where it fails to validate input sources before authorizing tool execution, allowing an attacker on the same machine to trigger arbitrary commands by sending crafted data through stdin (the standard input stream).
- First Fully AI-Driven Multi-Agency Breach Documented in Mexico: Between December 2025 and February 2026, a single attacker used AI as the core attack tool (not just an assistant) to compromise nine Mexican government agencies, exfiltrating tax records, civil registry data, patient files, and electoral system information in what researchers call a shift from experimental to operational AI-powered intrusions.
- Google Integrates Auto-Remediation Agent into Governed Platform: Google is folding CodeMender, an AI agent that autonomously discovers and patches software vulnerabilities using Gemini reasoning models (AI capable of complex problem-solving), into its broader Agent Platform rather than offering it standalone, signaling enterprise demand for security automation within centralized identity and monitoring frameworks.
- Microsoft Releases Open-Source Tools for AI Agent Safety: Microsoft launched Rampart and Clarity, two open-source tools designed to identify safety issues in AI agents (software systems that act autonomously) during development. Rampart automates repeated testing for threats like prompt injection (tricking an AI by hiding instructions in its input) and unsafe tool use, while Clarity helps engineers document and validate design assumptions before building.
- Critical Privilege Escalation in LiteLLM Proxy: LiteLLM versions before 1.83.10 contain a vulnerability (CVE-2026-47102) allowing users to elevate their role to proxy_admin through the /user/update endpoint, granting full system control including access to all users, teams, and API keys. Even users with org_admin privileges can exploit this flaw without chaining additional attacks.
- Multiple Critical Vulnerabilities in AI Infrastructure Sandboxes: BoxLite, a sandbox service for running untrusted code in isolated virtual machines, has two critical flaws that bypass security protections. CVE-2026-46695 allows malicious code to remount read-only directories as read-write due to unenforced restrictions, while CVE-2026-46703 enables path traversal (accessing files outside intended boundaries) through unvalidated symlinks during container image extraction, potentially leading to remote code execution on the host system.
- LMDeploy Hardcoded Setting Enables Arbitrary Code Execution: LMDeploy version 0.12.3 and earlier hardcodes `trust_remote_code=True` when loading models from HuggingFace, allowing arbitrary code execution (running any commands) if an attacker can control the model path. The setting permits executing custom Python code from downloaded models, giving attackers the privileges of the LMDeploy server process (CVE-2026-46432).
- OpenAI Progress on 80-Year-Old Mathematics Problem: OpenAI's AI model disproved the long-standing assumption that square grids provide the optimal solution to the planar unit distance problem by discovering new mathematical arrangements that perform better. While mathematicians validated the work, humans were significantly involved in refining the AI's original proof.
- NVIDIA Triton Inference Server Hit by Multiple Critical Vulnerabilities: NVIDIA disclosed several high and critical severity flaws in Triton Inference Server, including two authentication bypass vulnerabilities (CVE-2026-24207, CVE-2026-24206) that could allow attackers to execute code, escalate privileges, or steal data, plus additional flaws enabling integer overflows, out-of-bounds reads, and path traversal attacks across the DALI backend and core server components.
- GitHub Confirms Major Internal Source Code Breach via Malicious VS Code Extension: GitHub disclosed that attackers compromised an employee's device through a poisoned VS Code extension (a malicious add-on for the code editor), leading to theft of code from approximately 3,800 internal repositories. The breach was contained quickly with no confirmed customer data exposure.
- Anthropic Quietly Patches Claude Code Sandbox Escape Vulnerability: Anthropic silently fixed a SOCKS5 hostname null-byte injection vulnerability in Claude Code's network sandbox (a restricted environment controlling where the AI can send data) that could have allowed attackers to bypass security controls and exfiltrate sensitive information, releasing the patch in version 2.1.88 on March 31 without public disclosure or CVE assignment.
- Microsoft Open-Sources RAMPART and Clarity for AI Agent Security Testing: Microsoft released two open-source tools to help developers secure AI agents during development: RAMPART, a testing framework for finding vulnerabilities like cross-prompt injections (when untrusted data reaches an AI indirectly through sources like emails) and data exfiltration (unauthorized data leakage), and Clarity, a planning tool that guides security-focused design decisions before coding begins.
- Diffusers Library Vulnerable to TOCTOU Remote Code Execution Bypass: The `diffusers` package contains a time-of-check-time-of-use (TOCTOU, where verification happens at one moment but actual data comes from a different moment) vulnerability in its model loading function that allows attackers to bypass the `trust_remote_code` security check by updating a HuggingFace repository between two download calls, enabling arbitrary code execution without user approval (CVE-2026-45804).
- Guardrails-ai Supply Chain Attack Detected and Neutralized Within Hours: A malicious version of guardrails-ai (a library for validating LLM outputs) was published to PyPI but removed within two hours with no evidence of data theft, demonstrating both the risk of supply chain attacks (where attackers corrupt widely-used packages) and the effectiveness of rapid detection. (CVE-2026-45758)
- Critical RCE in MLflow Assistant Exploits Cross-Origin Validation Flaw: MLflow 3.9.0 contains a critical vulnerability where improper origin validation in /ajax-api endpoints allows attackers to execute arbitrary commands through the Claude Code sub-agent by sending cross-origin requests from a malicious webpage. (CVE-2026-2611)
- Multiple MCP Servers Exposed to RCE via Authentication Failures: Several Model Context Protocol (MCP, a standard for AI tool integration) implementations shipped with critical flaws, including 9router's 40+ unprotected API endpoints allowing unauthenticated command execution, PenPot's REPL server binding to 0.0.0.0 with no authentication on its /execute endpoint (CVE-2026-45805), and auth-fetch-mcp's unvalidated URL handling enabling SSRF (server-side request forgery, tricking servers into making unintended requests) and disk exfiltration.
- OpenAI and Google Deploy Content Provenance Standards for Generated Media: OpenAI is implementing C2PA conformance (a cryptographic metadata standard for content authentication), partnering with Google to embed invisible SynthID watermarks in images, and releasing public verification tools, while Google simultaneously integrates deepfake detection into Chrome and Search to identify manipulated content.
- Anthropic Tops CNBC Disruptor List as Industry Competition Intensifies: Anthropic ranked first on CNBC's 2026 Disruptor 50 list with reported 80x revenue growth, while separately facing a federal lawsuit after the DOD blacklisted it as a "supply chain risk" requiring defense contractors to stop using Claude models, a designation that judges questioned as potential "spectacular overreach."
- OpenAI and Dell Partner on Private Codex Deployment: OpenAI and Dell Technologies are partnering to bring Codex (an AI tool that writes and understands code) to hybrid and on-premise enterprise environments, allowing companies to use the system in their own data centers rather than only in the cloud. This addresses security concerns for organizations that need to keep sensitive data on their own infrastructure while still accessing AI coding capabilities.
- Critical Code Injection in ChromaDB Allows Unauthenticated RCE: ChromaDB versions 1.0.0 and later contain a pre-authentication code injection vulnerability allowing unauthenticated attackers to execute arbitrary code on the server by sending a malicious model repository to a specific API endpoint, earning a critical CVSS score of 10.0. (CVE-2026-45829)
- Supply Chain Attack Compromises Mistral AI PyPI Package: Version 2.4.6 of the mistralai package on PyPI contained malicious code that executes a dropper (a program designed to download and run harmful payloads) when imported on Linux systems, downloading and executing files from a remote server. The compromised version has been removed, with versions 2.4.5 and earlier unaffected.
- MLflow Permissions Flaw Enables Local Code Execution: MLflow versions before 3.11.0 create temporary directories with overly permissive access settings, allowing local attackers in shared environments like Databricks to modify model files and execute arbitrary code when those files are loaded. (CVE-2026-4137)
- Anthropic Briefs Financial Regulators on Claude Mythos Exploit Discovery Capabilities: Anthropic is briefing global financial regulators on Claude Mythos, an AI model with advanced capabilities in discovering zero-day vulnerabilities (previously unknown security flaws), with the UK's AI Security Institute finding the latest version completed a difficult autonomous hacking test that no prior model had solved. Rather than releasing Mythos publicly, Anthropic has restricted access to selected tech companies and banks.
- Google Launches Gemini Omni Flash for Video Generation: Google introduced Gemini Omni Flash, a model that generates and edits videos from combined text, image, audio, or video inputs using physics-based reasoning. Users can iteratively edit outputs through conversational natural language instructions while maintaining consistency across characters and scene elements.
- Critical Path Traversal in Bert-VITS2 AI Voice Model: CVE-2026-8756, a high-severity path traversal vulnerability (manipulating file paths to access files outside intended directories) affects fishaudio Bert-VITS2's Gradio interface. The flaw in the generate_config function can be exploited remotely via the data_dir argument, and the exploit is publicly available.
- South Korea Tests Deepfake Regulation in Elections: South Korea is using its upcoming local elections to evaluate whether laws can effectively curb deepfakes (AI-generated fake videos or audio) in political campaigns, serving as a real-world regulatory experiment.
- GenAI Feedback Motivates but Devalues Workers: A study of 350 MBA students and 42 graduates found that generative AI feedback increases confidence and motivation but simultaneously makes workers feel replaceable, while creating prompt engineering convergence (reducing diverse work to repetitive prompting tasks) that fails to provide traditional job satisfaction.
- Cerebras IPO Signals Concentration Risk in AI Investment: Cerebras Systems' shares surged 70% on debut, but the success highlights how impending trillion-dollar IPOs from SpaceX, OpenAI, and Anthropic are monopolizing investor attention and starving smaller AI companies of capital.
- Survey Maps Attack Surface of Embodied AI Systems: A new survey examines vulnerabilities in embodied AI (AI systems controlling physical robots or devices), cataloging security risks when machine learning models interface with real-world hardware and environments.
- OpenAI Suffers Supply Chain Attack via TanStack Compromise: Two OpenAI employee devices were infected through a supply chain attack on TanStack (a web development framework), allowing attackers to steal code-signing certificates (digital keys that verify software is authentic) for OpenAI's iOS, macOS, Windows, and Android applications. OpenAI revoked the compromised certificates and is requiring macOS users to update ChatGPT Desktop, Codex App, Codex CLI, and Atlas before June 12, 2026, though no customer data or production systems were affected.
- NCSC Warns Organizations to Deploy Agentic AI Cautiously: The NCSC and international partners issued guidance urging organizations to adopt agentic AI (AI systems that can plan, make decisions, and take actions autonomously) carefully due to significant security risks including broader system access, unpredictable behavior, and difficulty explaining AI actions. The guidance recommends starting with low-risk tasks, deploying incrementally with tight controls, and maintaining human oversight before connecting agents to real systems or data.
- Multiple High-Severity Access Control Flaws in Open WebUI and Microsoft APM: Open WebUI, a self-hosted AI platform, had three high-severity vulnerabilities (CVE-2026-44556, CVE-2026-44563, CVE-2026-45401) allowing authenticated users to bypass model access controls and exploit HTTP redirects to access internal systems. Microsoft APM, a dependency manager for AI agents, had multiple path traversal and symlink vulnerabilities (CVE-2026-44641, CVE-2026-45539, CVE-2026-46383) that could let malicious plugins read or write arbitrary files on developers' machines during installation.
- SSRF Vulnerabilities Exposed in AI Automation Tools: Budibase's AI Extract File automation step (CVE-2026-45548) and Pipecat's development runner (CVE-2026-44716) both contained high-severity flaws allowing SSRF attacks (server-side request forgery, where a server is tricked into making requests to unintended locations). The Budibase flaw bypassed IP blacklist validation to access cloud metadata and internal networks, while Pipecat's path traversal vulnerability let attackers read arbitrary files like SSH keys using URL-encoded slashes.