- OpenAI Launches GPT-5.4-Cyber Model Amid Mythos Controversy: OpenAI announced GPT-5.4-Cyber, a cybersecurity-focused AI model, alongside a three-part risk management strategy, positioning itself against Anthropic's restricted-release Mythos model. Anthropic confirmed it briefed the Trump administration on Mythos, which the company deems too dangerous for public release due to its advanced vulnerability exploitation capabilities that exceed most human expertise.
- Command Injection in GitHub Copilot and VS Code: CVE-2026-23653 is a command injection vulnerability (a flaw where an attacker can insert malicious commands into input that gets executed) in GitHub Copilot and Visual Studio Code that allows an authorized attacker to disclose information over a network. The vulnerability stems from improper neutralization of special command elements.
- Arbitrary Code Execution in OpenAI Codex CLI: CVE-2025-61260 affects OpenAI Codex CLI v0.23.0 and earlier, allowing attackers to execute arbitrary code by planting malicious configuration files (.env and .codex/config.toml) in repositories. When users run the codex command in a compromised repository, the tool automatically loads these files without permission prompts, triggering embedded attacker commands.
- Security Urgency as AI Models Compress Exploit Timelines: AI models are accelerating cyberattacks by dramatically shortening the window between vulnerability discovery and exploitation, with some intrusions now occurring in under 30 seconds. Industry analysts warn that defenders face a limited window to operationalize AI defenses before attackers gain a decisive speed advantage.
Digest archive
Past daily digests, newest first.
- OpenAI Revokes macOS Certificates After Supply Chain Compromise: OpenAI discovered that a GitHub Actions workflow used to sign its macOS applications downloaded a malicious version of the Axios library containing the WAVESHAPER.V2 backdoor on March 31. The company is revoking its signing certificates as a precaution and requiring all macOS users to update to newly-signed versions by May 8, 2026, after which older apps will lose update support.
- Critical Code Execution Flaw in Keras 3.13.0: CVE-2026-1462 allows attackers to execute arbitrary code when loading models in Keras 3.13.0, even with `safe_mode=True` enabled (a setting designed to prevent unsafe operations). The vulnerability exists because the `TFSMLayer` class loads external TensorFlow SavedModels without validating file paths or configuration data.
- Violent Attack on OpenAI CEO Highlights AI Safety Tensions: An individual threw a Molotov cocktail at Sam Altman's residence and later attacked OpenAI headquarters, motivated by beliefs that AI poses an existential threat to humanity. Altman responded by calling for reduced hostile rhetoric in the AI industry.
- Anthropic's Mythos Model Autonomously Discovers and Exploits Vulnerabilities: Anthropic released Claude Mythos Preview, an AI model capable of autonomously finding complex vulnerabilities by chaining multiple bugs and writing working exploits without human assistance. The company is withholding public access while running Project Glasswing to identify and patch vulnerabilities before attackers can exploit them, though experts warn the defender advantage will shrink as similar capabilities proliferate.
- Anthropic Withholds AI Model Over Cybersecurity Concerns: Anthropic announced it has developed a powerful AI model called Mythos but will not release it publicly, citing cybersecurity risks. The move attracted attention from government officials, though skeptics question whether security concerns or investment strategy motivated the decision.
- Missing Authentication in chatgpt-on-wechat CowAgent: Two high-severity vulnerabilities (CVE-2026-6126 and CVE-2026-6129) affect zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4, both involving missing authentication (failure to verify user identity) on administrative HTTP endpoints and Agent Mode Service. Exploits are publicly available, allowing remote attackers to access control interfaces without credentials, and developers have not yet responded.
- OpenAI Expands Policy Influence Efforts: OpenAI opened a Washington DC office with space for non-profits and policymakers and is funding policy papers and think tanks as part of a broader industry strategy to improve AI's public image amid growing disapproval in polls.
- Anthropic's Claude Code Dominates Enterprise AI Conversation: At a major industry conference, Anthropic's coding agent (a tool that autonomously generates, edits, and reviews code) has eclipsed OpenAI as the focus among executives and investors, generating over $2.5 billion in annualized revenue since its May 2025 launch. The company's narrow focus on coding capabilities rather than product sprawl has accelerated enterprise adoption despite ongoing legal tensions with the Department of Defense.
- Spotify Confronts Large-Scale AI Impersonation Campaign: AI-generated music is being uploaded to Spotify under the names of legitimate artists, including prominent musicians like Jason Moran and Drake, prompting the platform to remove over 75 million spammy tracks in the past year. Spotify is developing a pre-publication review tool that will allow artists to approve releases before they appear on the platform, addressing what amounts to identity fraud at scale.
- Anthropic's Mythos Model Sparks Government-Led Banking Sector Security Briefing: U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened major bank CEOs to discuss cybersecurity risks from Anthropic's Claude Mythos, an AI model capable of autonomously discovering zero-day vulnerabilities (previously unknown security flaws) and creating working exploits in operating systems and browsers. Anthropic is limiting access through Project Glasswing while warning that similar capabilities will likely become publicly available within 12-18 months, requiring security teams to adopt new AI-focused defense strategies.
- Critical RCE in PraisonAI Browser Server Enables Session Hijacking: PraisonAI's browser bridge server accepts WebSocket connections (two-way communication channels between client and server) without authentication checks, allowing network attackers to hijack legitimate browser extension sessions and intercept all commands and responses without credentials. (GHSA-8x8f-54wf-vv92, critical severity)
- LiteLLM Remote Code Execution via Guardrails Endpoint: LiteLLM versions through April 8, 2026 contain a vulnerability allowing remote attackers to execute arbitrary code through bytecode rewriting (modifying compiled code) at the /guardrails/test_custom_code endpoint, potentially enabling internet-based attackers to take control of affected systems. (CVE-2026-40217, high severity)
- AI Browser Extensions Present Enterprise Blind Spot: AI browser extensions are 60% more likely to have known vulnerabilities, 3 times more likely to access cookies, and 6 times more likely to increase permissions over time compared to regular extensions, yet they bypass traditional security monitoring tools like DLP (data loss prevention, which blocks sensitive information from leaving networks) while 99% of enterprise users have at least one installed with minimal organizational visibility.
- OpenAI Pauses UK Stargate Project Over Regulatory and Energy Concerns: OpenAI halted its planned deployment of up to 8,000 GPUs (specialized hardware for training and running AI models) in the U.K., citing high industrial energy costs and uncertainty around new regulations governing AI's use of copyrighted material. This is a significant setback for Britain's strategy to position itself as an AI development leader.
- Critical RCE in PraisonAIAgents Multi-Agent System: PraisonAIAgents versions before 1.5.128 contain a critical vulnerability where user-controlled commands pass directly to subprocess.run() with shell=True, allowing attackers to inject shell metacharacters (special characters like pipes and semicolons that the shell interprets as instructions) and execute arbitrary code. Attackers who gain file-write access through prompt injection (tricking an AI by hiding malicious instructions in its input) can modify configuration files to achieve automatic code execution. (CVE-2026-40111)
- PraisonAI WebSocket Endpoint Enables Unauthorized API Credit Drain: PraisonAI versions before 4.5.128 have an unauthenticated /media-stream WebSocket endpoint (a connection protocol for real-time communication) that automatically opens OpenAI API sessions using the server's credentials. With no connection or message limits, attackers can exhaust server resources and deplete victims' OpenAI API credits. (CVE-2026-40116)
- LangChain F-String Template Validation Bypass Allows Code Execution: LangChain versions before 0.3.84 and 1.2.28 failed to properly validate f-string templates (a Python feature for inserting variables into text), allowing dangerous expressions including attribute access and nested replacement fields hidden in format specifiers that should have been blocked. This could enable attackers to access unintended data or execute unwanted code. (CVE-2026-40087)
- Anthropic's Claude Mythos Exposes Critical Capability Jump in AI-Powered Vulnerability Discovery: Anthropic announced Project Glasswing featuring Claude Mythos, which has already discovered thousands of high-severity zero-day vulnerabilities (previously unknown security flaws) in major operating systems and browsers and demonstrated autonomous sandbox escape capabilities. The company is restricting access to a small group of major tech organizations because these powerful offensive security capabilities emerged unexpectedly from improvements to coding and reasoning skills rather than explicit training.
- Critical Command Injection and Sandbox Escape Vulnerabilities in PraisonAI: PraisonAI has two critical vulnerabilities allowing attackers to inject arbitrary shell commands through YAML workflow files and LLM-generated tool calls via `subprocess.run()` with `shell=True`, and a separate sandbox escape (CVE-2026-39888) where attackers can chain exception handling attributes (`__traceback__`, `tb_frame`, `f_back`, `f_builtins`) to access Python builtins and execute arbitrary code. Both flaws enable complete system compromise through different attack vectors.
- Microsoft Releases Agent Governance Toolkit Addressing OWASP AI Agent Risks: Microsoft released an open-source Agent Governance Toolkit that adds runtime security controls (protective software running during execution) to monitor and control AI agents in production, addressing ten major OWASP (Open Worldwide Application Security Project) security risks including prompt injection (tricking AI by hiding instructions in input), goal hijacking, and code execution vulnerabilities. The toolkit provides seven modular components across multiple programming languages and integrates with existing AI frameworks without requiring code rewrites.
- LLM-Generated Passwords Structurally Predictable and Cryptographically Weak: Research from Irregular and Kaspersky demonstrates that frontier LLMs (large language models, AI systems trained on massive text) generate passwords that are fundamentally insecure because they assign high probability to plausible next characters based on learned patterns rather than using equal probability across all possibilities like cryptographic random number generators. When Claude Opus 4.6 generated passwords 50 times, only 30 distinct passwords emerged with one appearing 36% of the time, proving models retrieve training data patterns rather than creating true randomness.
- Flowise AI Platform Under Active Exploitation: Flowise, an open-source AI agent builder, has a critical vulnerability (CVE-2025-59528, CVSS 10.0) in its CustomMCP node that allows attackers to execute arbitrary JavaScript code without validation by simply using an API token. Over 12,000 exposed instances are vulnerable and the flaw is being actively exploited in the wild, potentially leading to full system compromise.
- Anthropic Launches Claude Mythos Under Restricted Access: Anthropic released Claude Mythos Preview, an AI model with exceptional vulnerability discovery capabilities that has reportedly identified thousands of high-severity zero-day vulnerabilities in major software including a 27-year-old bug in OpenBSD. The model is only available to over 40 partner organizations through Project Glasswing rather than being publicly released, due to concerns that its exploit development capabilities could be weaponized by attackers.
- Multiple Critical Vulnerabilities in AI Infrastructure: HuggingFace Transformers' Trainer class allows arbitrary code execution via malicious checkpoint files because it calls `torch.load()` without the `weights_only=True` safety parameter (CVE-2026-1839). Text-generation-webui versions before 4.3 contain multiple high-severity flaws including SSRF (server-side request forgery, tricking a server into making requests to unintended locations) in RAG extensions that can steal cloud IAM credentials, and path traversal vulnerabilities allowing unauthenticated file access (CVE-2026-35486, CVE-2026-35485). NVIDIA Triton Inference Server has several denial-of-service vulnerabilities stemming from uncaught exceptions and improper input validation (CVE-2026-24175, CVE-2026-24146, CVE-2026-24173, CVE-2026-24174).
- GrafanaGhost Enables Zero-Click Data Theft: A critical vulnerability in Grafana uses indirect prompt injection (tricking an AI by hiding malicious instructions in data it processes) to exfiltrate sensitive enterprise data without requiring authentication or user interaction. The attack chains multiple exploits including bypassing URL validation and AI safety guardrails to force Grafana's AI features into sending confidential information to attacker-controlled servers.
- Anthropic Claude CLI and SDK Hit with Multiple Critical Command Injection Flaws: Three vulnerabilities (CVE-2026-35022, CVE-2026-35020, CVE-2026-35021) allow attackers to execute arbitrary commands by manipulating authentication helpers, environment variables like TERMINAL, or injecting shell metacharacters (special characters that command interpreters treat as instructions) into file paths. All three affect Anthropic's Claude Code CLI and Agent SDK, enabling credential theft and unauthorized code execution with user privileges.
- Broadcom Secures Expanded AI Chip Deals with Google and Anthropic: Broadcom will produce AI chips for Google and provide Anthropic access to approximately 3.5 gigawatts of compute capacity using Google's custom TPUs (tensor processing units, specialized processors designed for AI workloads), reflecting surging infrastructure demand for running generative AI at scale.
- Text-Generation-WebUI Flaw Enables Code Execution via Extension Settings: CVE-2026-35050, a critical vulnerability in the open-source LLM interface text-generation-webui (versions before 4.1.1), allowed attackers to save malicious extension settings as Python files that could overwrite core application files like 'download-model.py' and execute arbitrary code when users attempted model downloads.
- Attackers Pivot to 'Living Off the AI Land' Techniques: Threat actors are increasingly abusing legitimate AI services rather than deploying traditional malware, including poisoning MCP servers (tools connecting AI assistants to external services) in supply chains, using platforms like Claude as command-and-control channels (hidden communication pathways for sending instructions to compromised systems), and hijacking AI agents to exfiltrate data or perform destructive actions.
- Google Integrates Gemini into Maps for Itinerary Planning: Google has embedded its Gemini AI assistant directly into Google Maps to suggest locations and plan daily itineraries, moving beyond navigation into autonomous planning of user activities.
- OpenClaw AI Assistant Surges in China Amid Western Tool Restrictions: OpenClaw, an open-source AI assistant, became widely adopted in China because users can customize it to work with domestic AI models, compensating for blocked access to Western tools like ChatGPT and reflecting Beijing's push for AI self-sufficiency.