All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
The U.S. Department of Commerce has approved OpenAI to release its GPT-5.6 model widely, with the rollout expected to begin this week after additional testing and government meetings. This decision reflects the Trump administration's hands-on approach to AI regulation (government oversight of AI system capabilities before release), which has also affected competitors like Anthropic whose Claude models faced temporary suspension.
China's government reported that Anthropic's Claude Code, an AI tool for automated coding, contains a back-door vulnerability (a hidden security flaw that lets attackers access a system they shouldn't be able to reach) that can secretly send sensitive user information like location and identity to a remote server. This warning intensifies tensions in the U.S.-China tech competition, as Chinese companies and individuals have been using this American AI tool despite it not being officially available in China.
Estonia is exploring the creation of state-issued digital identities for AI agents (autonomous programs that can perform tasks without direct human control), which would allow these agents to interact with government services. This initiative positions Estonia as a potential leader in establishing rules and standards for how AI agents can be officially recognized and used in government contexts.
The Simple Coherent Form plugin for WordPress (versions up to 2.4.13) has a vulnerability where attackers can delete any file on the server because the plugin doesn't properly check file paths before deletion. Since anyone can access the deletion feature without logging in, attackers could delete critical files like wp-config.php (the main configuration file) to gain control of the website through remote code execution (running malicious commands on the server).
OpenAI has launched GPT-Live, a new voice AI model that uses full-duplex architecture (the ability to listen and speak simultaneously) to make conversations feel more natural and human-like. Unlike earlier voice systems that processed speech in separate steps or waited for users to finish speaking, GPT-Live can continuously process audio, respond expressively, and delegate complex tasks to more powerful backend models while maintaining conversation flow.
In Home Assistant add-on mode (v7.6.0 and earlier), certain settings routes were accessible at the root port (`:9583`) without authentication (no secret, CSRF token, or origin check), allowing anyone on the local network to read or modify tool configurations, feature flags, backups, restart the add-on, and manage approval policies if enabled. The MCP endpoint itself remained protected, and there was no access to Home Assistant data or credentials.
Kite, a Kubernetes management tool, has a security flaw where authenticated users can bypass role-based access control (RBAC, a system that restricts what users can do based on their assigned roles) to view cluster data they shouldn't access. By using a request header called `x-cluster-name`, a user with permission for only one cluster can retrieve aggregate inventory and resource data (nodes, pods, namespaces, services, CPU, and memory counts) from other clusters they shouldn't be able to see. The vulnerability exists because the `/api/v1/overview` endpoint is registered before the RBAC middleware (code that enforces permission checks) is applied, and it only verifies that a user has at least one role instead of checking if they can access the specific cluster.
mem0 (a software tool) has a critical security flaw where API endpoints lack authentication (verification of user identity), allowing attackers to steal LLM API keys (credentials used to access AI services) stored in plaintext, and exploit SSRF attacks (server-side request forgery, where an attacker tricks a server into making requests to unintended internal systems) by controlling the ollama_base_url parameter. The vulnerability has a CVSS score of 9.2, indicating it is extremely severe.
A security flaw in @better-auth/oauth-provider allows two token requests sent at the same time to both redeem a single authorization code (a temporary token that should only work once), bypassing OAuth security rules. The vulnerability affects versions 1.6.0 through 1.6.10, and similar issues exist in the legacy plugins from better-auth versions 1.4.8-beta.7 through 1.6.0.
Meta has launched Muse Image, a new AI image generation model from its Superintelligence Labs that creates images across Meta AI, Instagram, and WhatsApp (with Facebook and Messenger coming soon). The model is described as "agentic," meaning it works together with another AI model to understand your request, search the web, and plan before generating an image. The article notes the model can pull other Instagram users into AI photos, but does not provide details about how this works or its implications.
9Router versions before 0.4.44 have a critical vulnerability where an unauthenticated attacker can execute arbitrary OS commands through the /api/tunnel/tailscale-install endpoint. The vulnerability exists because the sudoPassword field from user input is passed directly to a shell command without proper validation, and the endpoint lacks authorization checks (middleware matcher protection). An attacker can exploit this when sudo doesn't prompt for a password, such as when the process runs as root or NOPASSWD is configured.
Meta released Muse Image, a new AI model for generating images, making it available free to regular users through Meta AI, WhatsApp, and Instagram Stories, while requiring a paid subscription for creators and power users who want to generate many images. The company is also integrating Muse Image into its advertising tools to help brands create and customize ad designs more easily, reducing Meta's dependence on third-party image-generation services from other companies.
Anthropic is expanding access to Claude Cowork, an AI collaboration platform (a tool where users can work together with AI), beyond its desktop-only availability to iOS, Android, and web versions starting this week. The mobile and web versions will have reduced features compared to the desktop app, though cloud-based sessions will allow users to continue their work across different devices.
A flaw called 'GitLost' in GitHub's agentic workflows (AI systems that automatically perform tasks) allows an attacker to create a fake issue in a public repository and use it to secretly access data from private repositories without needing to log in. This means private data can be leaked even though the attacker never had official access to those repositories.
ONNX has a null pointer dereference (a crash caused by accessing invalid memory) in its version converter when processing Upsample nodes that have zero inputs. The converter checks that required attributes exist but fails to verify that the node actually has inputs before trying to access them, causing a crash (SIGSEGV) when converting models from opset version 6 to 7.
Fix: According to China's cybersecurity platform, users should uninstall or upgrade from the affected Claude Code versions 2.1.91 to 2.1.196 (released from April 2 to June 29). The latest version as of the report date is 2.1.204.
CNBC TechnologyU.S. lawmakers are investigating why American companies are adopting Chinese AI models, which are becoming competitive with American alternatives while costing less. Concerns focus on whether these models could advance China's political interests or pose cybersecurity risks, though using Chinese AI models is not currently banned for U.S. companies (unlike some government departments).
Fix: Fixed in PR homeassistant-ai/ha-mcp#1508: root-mounted add-on routes are now restricted to Home Assistant ingress (requests from the Supervisor at `172.30.32.2`), with all other callers receiving a `403` (forbidden) response. Direct and remote access continue to use the protected settings UI under the MCP secret path. The fix ships in the next stable add-on release and is available now in the dev channel (add-on dev build `7.6.0.dev393` or later).
GitHub Advisory DatabaseFix: Upgrade to @better-auth/oauth-provider@1.6.11 or later, or upgrade better-auth to 1.6.11 or later if using the legacy plugin paths. The fix replaces the unsafe find-then-delete sequence with an atomic claim-and-return primitive (consumeVerificationValue) that ensures only the first request successfully claims the authorization code, causing concurrent requests to receive an invalid_grant error instead.
GitHub Advisory DatabaseFix: Update 9Router to version 0.4.44 or later.
NVD/CVE DatabaseAmazon Bedrock allows organizations to control whether prompts and model outputs are retained after processing through different data retention modes (none, some, inherit, or provider_data_share). To enforce consistent data retention policies across multiple accounts, especially when using models that require data sharing with third parties like Claude Fable 5, organizations can use Amazon Bedrock Projects and service control policies (SCPs, which are rules that limit what actions users in an organization can perform). The key principle is that your configured retention mode sets a ceiling (upper limit) on retention, not a guarantee, so models that support zero retention will still use zero retention even if your account allows higher retention.
Fix: The source mentions tools for enforcing data retention policies: use Amazon Bedrock Projects to isolate workloads with different retention needs on compatible models, and write and deploy an SCP that prevents anyone in your organization from enabling data sharing. The source also states you should consult the model's terms for specific retention details and verify your configuration is working correctly, but does not provide explicit code or step-by-step implementation instructions beyond describing these tools.
AWS Security BlogResearchers discovered that attackers can trick GitHub Agentic Workflows (AI agents that automate tasks based on plain English instructions) into leaking private repository data by opening a public issue with hidden malicious instructions. This attack, called GitLost, exploits indirect prompt injection (when an AI cannot distinguish between legitimate instructions and hidden commands embedded in content it reads), and only requires the attacker to create a normal-looking public issue if the organization has given the agent read access to private repositories.
This research evaluates nine different dataset watermarking methods (techniques for embedding hidden markers into training data to prove ownership of AI models) by testing how well they preserve prediction accuracy, verify ownership, and resist attacks. The study finds that while most watermarking methods cause minimal overall accuracy loss, they can significantly harm performance on specific classes, fail completely when training data is mixed together, and have various other robustness vulnerabilities.
The US Cybersecurity and Infrastructure Security Agency (CISA, the federal agency responsible for protecting government computer systems) is using Anthropic's Mythos AI model to scan government software code for security vulnerabilities (flaws that attackers could exploit). The AI-driven audits have already uncovered a large number of vulnerabilities, though specific details about their severity and which agencies were affected have not been publicly disclosed.
Fix: All affected adapters, including the Upsample_6_7 adapter, have been fixed in PR #7813. A full audit of all ~45 adapters identified eight adapters with the same unguarded indexed access vulnerability (cast_9_8, softmax_12_13, softmax_13_12, upsample_6_7, upsample_9_10, group_normalization_20_21, broadcast_forward_compatibility, upsample_9_8), and all have been corrected.
GitHub Advisory Database