All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Machine unlearning is a process that allows AI models to forget the influence of specific training samples, which is important for privacy and safety. Researchers tested whether existing unlearning methods actually work when the training dataset contains similar samples to the ones being removed, and found that most methods fail to completely eliminate a target sample's influence even when compared to retraining from scratch (rebuilding the model from the beginning with the unwanted sample excluded).
This is a browser-based tool that identifies and highlights clichéd phrases commonly found in AI-generated text, such as "no X, no Y" chains and expressions like "sit with that." Users can paste text into the analyzer to spot these patterns, toggle detection on or off, and navigate through matches, with the tool storing data locally in the browser.
The European Commission ordered Google to give rival AI assistants the same access to Android device features that Google's own Gemini assistant has, including the camera, microphone, screen contents, and the ability to control other apps in the background. Google must implement this by August 1, 2027, in Android 18, with some features (like always-on voice detection) delayed to Android 19 by August 1, 2028. The order also requires Google to share anonymized search data with competing search engines and AI chatbots for a cost-based fee.
This article discusses how businesses should measure the success of their AI investments using a metric called 'Useful Intelligence per Dollar' rather than traditional software metrics like adoption or cost per token (the price charged for processing units of text). The key insight is that true AI value comes from measuring the total cost of completing actual work tasks successfully against the value those tasks create, accounting for factors like human review time, retries, and the likelihood of getting the right answer on the first try.
Moonshot AI, a Chinese startup, released its Kimi K3 model, which it claims performs competitively with leading AI systems from OpenAI and Anthropic, though it still trails their most advanced offerings overall. The model, containing 2.8 trillion parameters (adjustable numbers that determine how an AI model behaves), achieved strong performance on benchmarks despite hardware constraints in China. This release reflects intensifying competition between U.S. and Chinese AI companies, as Chinese models are becoming cheaper alternatives and gaining adoption among Western businesses.
The AI Copilot WordPress plugin before version 1.5.4 has a security flaw where OAuth access tokens (temporary credentials that grant access to accounts) are not properly tied to specific WordPress users, allowing attackers who complete the public login process to gain administrator privileges and perform dangerous actions like creating new users or changing user permissions.
Microsoft CEO Satya Nadella criticized Anthropic's Fable AI model for being "editorially controlled," saying it refuses too many user requests and doesn't function like a proper creation tool. Anthropic has acknowledged the issue, stating that its safeguards for Fable flag a slightly higher fraction of harmless requests than intended, and the company said it was trying to reduce false positives when it released Fable 5 in June.
Quicly is a library that implements the QUIC protocol (a modern internet communication standard) for the H2O web server. Before a certain code update, an attacker could send specially crafted network messages that trick the server into allocating huge amounts of memory using very few packets, potentially causing a denial of service (making the service unavailable by exhausting its resources).
Recent attacks on IoT (Internet of Things) devices can analyze side-channel behavioral fingerprints (patterns in wireless communication that reveal what users are doing) to infer private user behaviors over WiFi networks. The paper presents AirMask, a defense system that works at the network level rather than on individual devices, passively sensing these fingerprints and injecting carefully crafted wireless frames to mask them without requiring changes to IoT device firmware or hardware.
Fix: AirMask operates in a predict-inject-assess loop that iteratively adapts to changing traffic patterns, proactively injects principally crafted frames upon prediction of occurring fingerprints, and continuously refines device-specific obfuscation strategies. The system can be deployed in Integrated, TAP, and Air modes for flexible deployment within WiFi networks. According to the paper, AirMask has been implemented as a functional hardware prototype and evaluated on 90 types of IoT devices, confirming defensive effectiveness while incurring negligible bandwidth and latency overhead.
IEEE Xplore (Security & AI Journals)Vision Language Models (VLMs, which are AIs that process both images and text) are vulnerable to jailbreak attacks (techniques that trick an AI into ignoring its safety guidelines). Existing defenses either reduce the model's usefulness or slow it down significantly. SafeSteer is a proposed defense method that uses singular value decomposition (SVD, a mathematical technique for breaking down data into simpler components) at inference time (when the model is running, without changing its internal weights) to identify and remove harmful instructions while keeping the model's normal abilities intact, achieving over 60% reduction in attack success rates with minimal slowdown.
Fix: SafeSteer uses singular value decomposition (SVD) to purify a low-dimensional "safety subspace" from noisy activation differences, then projects the raw steering vector into this subspace to isolate the core safety signal from noise and adaptively remove harmful influences while preserving the model's ability to handle benign inputs. The method is applied at inference time without modifying model weights and avoids iterative response generation.
IEEE Xplore (Security & AI Journals)Researchers discovered a new backdoor attack called Spa that can secretly compromise federated learning systems (distributed AI systems where multiple parties train a model together while keeping their data private). Unlike previous attacks, Spa hides malicious code by blending it with the legitimate learning process and uses adaptive triggers that change over time to avoid detection and remain effective for hundreds of training rounds.
Text-to-image models (AI systems that generate images from written descriptions) sometimes memorize harmful concepts that need to be removed, but existing removal techniques accidentally damage the model's ability to generate similar concepts. Researchers propose SCPC, a framework that erases target concepts while protecting semantically similar ones, using a technique called semantic-agnostic knowledge distillation (matching the erased model's output to the original model's output without relying on concept meaning).
Vision-Language Pre-training Models (VLPMs, which are AI systems trained to understand both images and text together) are vulnerable to adversarial attacks (input tricks designed to fool AI systems). This research shows that simpler attack methods can actually work better than complicated ones, and proposes SimVLA (Simple Vision-Language Attack), a streamlined approach that improves how well attacks transfer between different models while using less computing power.
Deep learning models that classify point clouds (3D data made of many points in space) are vulnerable to adversarial attacks (carefully crafted inputs designed to fool AI systems). This paper proposes PANDA, a two-stage defense that uses diffusion models (neural networks that gradually transform noisy data into clean data) to purify attacked data and then retrains the classifier to work well with the purified data, addressing limitations in existing diffusion-based defenses.
Fix: PANDA combines two components: PANDA-P, which uses a dual-branch diffusion training strategy that optimizes on both clean-to-clean and adversarial-to-clean paths to improve purification, and PANDA-A, which fine-tunes the classifier using a consistency-driven learning objective to reshape the classifier's feature space and recalibrate decision boundaries for the purified data.
IEEE Xplore (Security & AI Journals)This research addresses a weakness in malicious JavaScript detection systems: they fail to reliably identify harmful code when it has been obfuscated (disguised through code transformation techniques to hide its true purpose). The authors propose SeGra, a new detection method that uses data flow features (how data moves through the program) and random walk techniques to better identify malicious JavaScript even in obfuscated code, achieving up to 99.5% accuracy on lightly obfuscated code and 67.1% on heavily obfuscated code.
This research proposes a new method for multi-agent reinforcement learning (a type of AI where multiple independent agents learn to make decisions together) in electricity trading systems that protects user privacy while maintaining system efficiency. The approach uses dynamic differential privacy (a mathematical technique that adds controlled noise to data to hide individual information), personalized privacy assessments, and a denoising network (a neural network that removes the noise added for privacy) to balance each user's different privacy needs with the overall performance of the trading system.
This podcast features an interview about agentic AI (AI systems that can autonomously plan and execute tasks) and governance challenges in cybersecurity. The discussion includes the MindStone Agent, an open-source project that adds persistent memory and identity to AI assistants, and demonstrates how autonomous AI agents can coordinate incident response (the process of identifying and fixing security breaches) and recovery with minimal human oversight.
Google Cloud has built an agentic defense platform (a system that uses AI agents to automatically handle security tasks) that incorporates technology from Wiz to detect and fix threats from AI-based attacks. The approach aims to automate both finding and responding to threats faster than attackers can operate.
Fix: Google must create a Qualified AI Assistant Programme that uses independent Trusted Certification Authorities (TCAs) to certify third-party AI assistants for access to restricted features, and must accept these certifications without adding extra conditions. Google can set reasonable and non-discriminatory terms for the TCA programme but must get Commission approval two months before any changes. For the six unrestricted features (microphone input, hotword detection, camera, screen contents, location, and sensors), Google cannot decide who is allowed to access them, though it can require process isolation and encryption. Google can request the Commission move a feature to the restricted list by filing a reasoned request showing good cause.
The Hacker NewsFix: Update the AI Copilot WordPress plugin to version 1.5.4 or later.
NVD/CVE DatabaseSenior executives are using shadow AI (unapproved AI tools not officially authorized by their company) at nearly twice the rate of lower-level employees, even though most know it creates security and data privacy risks. The problem stems not from ignorance but from executives choosing speed over compliance, and from approved tools being less useful than mainstream alternatives.
Fix: According to the source, IT leaders should focus on "providing secure AI tools that people actually want to use" through "executive alignment, clear governance, and providing secure AI tools that people actually want to use." Additionally, organizations need to "pair governance with usability" and ensure that "the secure path the easiest path" by providing approved tools that "grant users full access to the necessary systems and data, eliminating the need to choose between a capable but ungoverned tool and a safe but limited one."
CSO OnlineThis academic paper describes a security system designed to protect data stored across multiple cloud providers by combining certificateless cryptography (a encryption method that doesn't require digital certificates), blockchain (a distributed ledger technology), and deduplication (removing duplicate copies of data). The scheme aims to resist backdoors (hidden access points inserted by attackers) while allowing organizations to verify that their data hasn't been modified.
Fix: This issue has been fixed by commit 8b178e6.
NVD/CVE Database