All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Agentic AI (artificial intelligence systems that can independently plan and take actions to accomplish goals) presents significant security risks that organizations need to address, regardless of external attackers. The article argues that the security challenges posed by agentic AI are substantial enough to require a fundamental rethinking of how organizations approach AI safety.
A flaw in Anthropic's Claude Chrome extension allows a malicious extension to trigger Claude's predefined AI workflows by simulating user clicks, potentially abusing Claude's access to Gmail, Google Docs, Google Calendar, and Salesforce. The vulnerability exists because the Claude extension accepts JavaScript-generated click events without verifying they came from a real user by checking the Event.isTrusted property (a browser flag that distinguishes genuine user actions from programmatically created ones). An attacker would need to trick a user into installing a malicious extension that can then execute these workflows without the user's knowledge.
Alphabet's Gemini 3.5 Pro AI model is delayed by months because the company wants to improve its performance, especially its ability to generate software code, which fell short of internal expectations. The delay comes as competitors like OpenAI and Meta have released newer AI models that outperform Google's current offerings at code generation, causing Alphabet's stock to drop 4%.
text-generation-inference (a tool for running AI text models) versions up to 3.3.7 have a server-side request forgery vulnerability (SSRF, where an attacker tricks a server into making requests to places it shouldn't) in its chat feature that lets unauthenticated attackers supply malicious image URLs to make the server fetch data from internal systems, cloud metadata endpoints, or scan ports. The vulnerability exists because the code doesn't validate whether URLs point to private or internal addresses, and the HTTP client automatically follows redirects, letting attackers bypass security checks.
This newsletter covers various business and economic news items, including Fed statements on inflation, United Airlines' earnings warning about high fuel costs, and UnitedHealth Group's investment of $1.5 billion in artificial intelligence to improve operational efficiency. The content does not focus on AI security issues or technical vulnerabilities.
Kiota, a tool that generates HTTP client code from API descriptions, had a security flaw in versions before 1.32.5 where it didn't properly validate file paths when creating plugin files. This allowed attackers to include specially crafted file paths that could access files outside the intended directory (path traversal, where attackers use ../ to escape folders) or include files from unexpected locations when the generated plugin was deployed.
Google is renaming its AI note-taking app from NotebookLM to Gemini Notebook, though it will continue operating as a separate application. The app, originally called Project Tailwind when announced in May 2023, has added features over time that use AI to help organize and summarize notes, including converting them into AI podcasts and video clips.
Andrew Dai, a former Google DeepMind researcher, founded Elorian and raised $55 million at a $300 million valuation to build visual AI models (systems that can understand and reason about images and video). Dai argues that while AI has made strong progress in math, physics, and coding, visual understanding remains an underdeveloped area, and he aims to advance toward visual AGI (artificial general intelligence, a hypothetical AI that can handle any intellectual task). The article focuses on his fundraising strategy and lessons for founders pitching complex AI ideas to investors.
Over one million emails have used a technique called text salting (hiding extra characters or text that humans don't see but can confuse AI systems) to bypass AI-based email security filters, allowing phishing emails (messages designed to trick people into revealing sensitive information) to reach inboxes undetected. The research shows that AI and LLMs (large language models, which are AI systems trained on massive amounts of text) are surprisingly weak against this evasion method.
AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 unintentionally logged sensitive user data in OpenTelemetry span attributes (metadata tags that track operations), which then flowed into CloudWatch Logs (AWS's logging service) where anyone with log access could read them. This meant raw user prompts and AI agent responses were stored unfiltered in logs, exposing sensitive information.
Fix: Upgrade to version 1.5.1 or later. Additionally, users who ran the affected versions should review and purge sensitive content from their aws/spans CloudWatch log groups.
NVD/CVE DatabaseThe Bedrock AgentCore Python SDK (a library for building AI agents on Amazon's platform) has a vulnerability where OpenTelemetry spans (data that tracks what a program is doing) were writing unfiltered user prompts and AI responses to CloudWatch logs (AWS's logging service). This meant that anyone with read access to those logs could see potentially sensitive information. The vulnerability affects versions 1.4.8 and 1.5.0.
Fix: Update Kiota to version 1.32.5 or later, which fixes this issue.
NVD/CVE DatabaseAI agents can perform multi-step tasks across multiple systems without individual human approval for each step, which creates identity and authorization challenges. When agents operate without proper managed identity (a secure way to identify an agent) and least-privilege RBAC (role-based access controls, which limit what each agent can do), they may access or modify sensitive data beyond their intended permissions. Organizations are deploying these agent capabilities faster than their security models can evolve, leading to risks like unauthorized data access, unintended modifications, and gaps in auditability (the ability to track who did what).
Fix: The source recommends treating every agent as a first-class principal: give it a lifecycle-managed identity, assign explicit roles, scope its permissions tightly, and scope tool usage to a preconfigured tools manifest or configuration. The text also states that implementing multiple controls is intended to help reduce potential impact of agent actions while making privilege decisions explicit and supporting accountability. However, the source does not provide specific technical implementation steps, version numbers, or detailed patches beyond these architectural principles.
Microsoft Security BlogTeens are increasingly using AI tools like ChatGPT for learning and productivity, and denying them access would leave them unprepared for a defining technology of their time. OpenAI has implemented protections specifically for teens, including automated guardrails (safety rules that trigger automatically), age prediction, parental controls, and learning features like Study Mode (a tool that guides students through problems step-by-step with questions rather than just giving answers) to help them benefit from AI safely.
Fix: OpenAI has introduced several protections for teens: (1) automatic age-appropriate experience adjustments when the system estimates a user is under 18, (2) Study Mode designed with teachers and learning experts to encourage active engagement through guided questions and structured explanations rather than direct answers, (3) Parental Controls allowing parents to enable Study Mode by default for linked teen accounts, (4) education-focused starter prompts for common learning tasks, (5) interactive learning experiences for math and science topics, and (6) a pronunciation feature using audio for language learning.
OpenAI BlogxAI, Elon Musk's AI company, has sued a South Carolina man for allegedly misusing their AI system called Grok to create child sexual abuse material. This is one of the first lawsuits an AI company has filed against a user for this type of misuse, with xAI claiming the user violated their terms of service.
AI has made developers and security teams more productive, but the same capabilities that make AI useful for legitimate work also make it powerful for attackers. Check Point's 2026 AI Security Report highlights that organizations should appreciate AI's benefits while being realistic about the security risks it introduces.
AI agents have broken traditional enterprise security approaches because they act autonomously, acquire access across multiple systems, and change behavior based on context, making environments harder to predict and manage. Unlike ordinary applications that operate at human speed, AI agents can borrow credentials, disappear before security scans detect them, and some already have direct access to production data. Security teams now need to decide which security layers to own themselves rather than relying on fixed vendor workflows that cannot anticipate the specific risks in each organization's unique cloud, SaaS, and AI deployment setup.
This article discusses how organizations can safely use AI agents (AI systems that can take actions autonomously) to find and fix security vulnerabilities in software. The key challenge is that vulnerabilities are being exploited faster than patches can be created, so companies want to automate vulnerability discovery, but deploying AI agents with high system access introduces new security risks. The article recommends establishing operational safeguards by combining AI with deterministic controls (fixed, rule-based systems) and human oversight, following frameworks like NIST's AI Risk Management Framework and Google's Secure AI Framework.
Fix: The source explicitly recommends several mitigations: (1) enforce data security before the prompt reaches the model, using non-production environments with synthetic data for testing; (2) deploy a hybrid defense-in-depth model with Layer 1 deterministic policy engines as chokepoints and Layer 2 specialized guard models (such as Model Armor) to filter sensitive data and block prompt injections before reaching the agent; (3) treat the codebase itself as untrusted input and perform input sanitation to prevent indirect prompt injections hidden in source code comments or dependencies; (4) establish clear rules of engagement and authorized testing agreements with cloud providers to navigate acceptable use policies; (5) enforce strict zero data retention (ZDR) agreements with LLM providers to ensure proprietary code and discovered vulnerabilities are never used to train external models; (6) execute agent workloads in strictly isolated, unprivileged containers with dynamically limited privileges and robust sandboxing to prevent privilege escalation.
Google Threat IntelligenceDeep neural networks deployed across cloud storage, CI/CD pipelines (automated software deployment systems), and edge devices face parameter attacks, where attackers directly modify the model's internal weights and settings rather than just manipulating input data. Unlike previous defenses that require retraining or reduce accuracy significantly, this research presents ParDef, a defense system that protects model parameters by obscuring sensitive directions, adding error-correction capabilities through QC-LDPC quantization (a compression technique with built-in redundancy), and stabilizing predictions when attacks occur.
Fix: The source presents ParDef as the solution, which "integrates keyed channel reparameterization, which obscures sensitive parameter directions, QC-LDPC quantization, which embeds redundancy and supports error correction, and adaptive robust inference, which stabilizes predictions under uncertainty." The paper demonstrates this defense "consistently reduces attack success rates across different parameter attacks while maintaining high model performance and incurring only moderate deployment overhead."
IEEE Xplore (Security & AI Journals)This paper presents a new system for identifying Wi-Fi devices based on their radio frequency fingerprints (unique hardware characteristics that devices emit when transmitting wireless signals), using techniques that remove channel effects (distortions caused by the physical environment and distance between devices). The system uses spectrum averaging (combining signal measurements from multiple antennas to reduce environmental interference) and high-order difference algorithms (mathematical operations that isolate hardware-specific features) to achieve 90.28% accuracy in identifying devices, outperforming previous methods.
Connected vehicles face security threats like malicious injection attacks on the CAN bus (the network that lets different car components communicate) and eavesdropping on in-vehicle communications. Researchers propose CROSS-TEE, a distributed trusted execution environment (TEE, a secure area of a system isolated from regular software) architecture that protects vehicle systems by isolating trusted applications, checking CAN bus requests before they run, and encrypting data sent over networks.