All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
NSW government officials initially expressed enthusiasm about OpenAI opening a Sydney office, but removed language saying they were "absolutely thrilled" after staff members joked about dystopian AI scenarios similar to the Terminator films' Skynet (a fictional AI system that becomes hostile to humanity). The incident reflects some caution in how government communicates about AI expansion, even as it publicly encourages the technology.
Anthropic announced Claude Science, a new AI workbench (an integrated software environment where scientists can work) that combines fragmented tools and datasets to help scientists generate figures and visuals for research. The company claims this tool can speed up scientific discovery and drug development, and noted it already has biotech and pharmaceutical customers using Claude, with Anthropic itself planning to develop drugs.
Midjourney, an AI company known for image generation, has revealed more details about its experimental medical ultrasound scanner (a device that uses sound waves to create images inside the body) designed for spas, but has not yet provided convincing evidence that it actually works. The scanner combines multiple ultrasound probes with standard computers to attempt cheap, radiation-free medical imaging, though the technology remains largely unproven.
CVE-2026-13341 is a vulnerability in Kong Konnect MCP (Model Context Protocol, a system for standardized communication between AI models and tools) server versions before 1.0.0 that allows remote attackers to perform prompt injection attacks (tricking the AI by hiding malicious instructions in input) and execute unintended API requests (commands to interact with web services).
A threat actor exploited CVE-2025-3248 (a critical missing authentication vulnerability in Langflow, a Python framework for building AI-driven applications) to gain code execution on an exposed server, then used an agentic AI (an AI system designed to autonomously plan and execute multi-step tasks) to conduct reconnaissance, steal credentials, pivot to other systems, and deploy ransomware that encrypted databases. The AI adapted its actions in real time to overcome obstacles, demonstrating how LLM agents can lower the technical barrier for sophisticated cyberattacks.
Two critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549, with CVSS score of 9.8, a 0-10 severity rating) in the Cursor AI code editor could allow attackers to execute code at the operating system level by exploiting the editor's automatic command execution without user approval. The first flaw allows attackers to change the working directory to bypass the sandbox (a restricted environment where code runs safely), while the second uses symbolic links (special files that point to other files) to write files outside the intended project directory and disable sandbox protections.
Anthropic clarified that Claude Fable 5 (its most powerful AI model) will move from subscription plans to usage-based billing (a pay-per-use system where you pay for each query) after July 7, but this is temporary, not permanent. The company plans to restore Fable 5 as a standard subscription feature once it has enough computing capacity to handle the high demand.
Claude Fable, a powerful AI model, was relaunched after a government ban was lifted, but users report it performs worse than before due to overly strict safety guardrails (automated rules that prevent certain outputs). The model frequently switches to a weaker alternative (Opus 4.8) even on tasks that don't seem risky, and it blocks requests containing security-related language, making it less useful for many coding tasks.
CVE-2026-45499 is a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making unwanted network requests) in Azure OpenAI that allows an authorized attacker to gain elevated privileges over a network. The vulnerability has a CVSS score (severity rating from 0-10) that has not yet been assigned by NIST. Microsoft has published information about this vulnerability on their security update page.
CVE-2026-41106 is an open redirect vulnerability (a flaw where a website redirects you to an untrusted site) in Microsoft 365 Copilot that allows an attacker to gain unauthorized elevated privileges (higher access levels) over a network. The vulnerability has a CVSS score (severity rating) of 4.0. This is an exclusive service issue affecting Microsoft 365 Copilot users.
Weaviate versions before 1.38.0 have a security flaw in RBAC (role-based access control, a system that restricts what users can do based on assigned roles) where the system doesn't check if someone assigning a role to themselves or others actually has permission to grant those permissions. This means a user with limited permissions can assign themselves or others powerful admin roles, gaining full control of the database.
Grackle's MCP (Model Context Protocol) tool layer has inconsistent authorization checks that let scoped agents (restricted AI assistants) perform operations they shouldn't be allowed to, like deleting or modifying other agents' tasks or reading data across workspaces (an IDOR vulnerability, where attackers access resources by guessing IDs). The root cause is that the server uses its full API key for all backend requests without passing caller information, making the MCP tool layer the only place where permissions are checked, and some tools skip these checks entirely.
The llm-coding-agent is a new Python library that creates a coding agent (an AI system that can perform tasks by using tools) built on top of an LLM (large language model) framework, capable of reading files, editing files, executing shell commands, and searching code to help automate coding tasks. The agent was developed using test-driven development (TDD, a method where you write tests before writing code) and includes features like file operations, command execution with timeouts, and pattern-based file searching. Users can interact with it through command-line options like "llm code --yolo" or a Python API that lets them request specific coding tasks.
Langroid's SQLChatAgent contains a security flaw where its `_validate_query` blocklist (a list of dangerous SQL patterns to reject) fails to block several PostgreSQL file-reading functions like `pg_read_file()` and `pg_ls_logdir()`. An attacker who can influence the SQL queries the AI generates (through direct input or by injecting instructions into data the AI reads) can exploit this to read arbitrary files from the database server, even when the agent is configured to only allow SELECT statements and forbid dangerous operations.
Langroid's ReadFileTool and WriteFileTool have a path traversal vulnerability (a security flaw where attackers use sequences like ../ to access files outside intended boundaries) because they only change the working directory but don't validate that file paths stay within the configured curr_dir (current directory) boundary. An attacker can use paths like ../secret.txt to read or write files outside the intended sandbox directory, potentially compromising applications that rely on curr_dir to restrict file access.
As AI becomes more integrated into business operations, companies that already have strong process management frameworks (like Lean Six Sigma, a methodology focused on reducing errors and improving quality, or BPM, which maps how work flows across departments) are better positioned to succeed. The article argues that AI works best when combined with existing disciplined processes and data-driven decision-making, rather than being added hastily to disorganized operations.
mcp-memory-service has a critical authentication bypass vulnerability where all endpoints under `/api/documents/*` lack authentication checks, allowing unauthenticated attackers to read, write, and delete memories even when the server has API key or OAuth protection enabled. This is particularly dangerous because the `/api/memories` endpoints correctly enforce authentication, creating an inconsistent security boundary that attackers can exploit.
Large Language Models are vulnerable to prompt injection attacks (tricking an AI by hiding malicious instructions in its input), which poses security risks during deployment. This paper proposes BUUAS, a framework that uses Bayesian-inspired belief updates and a belief-weighted contextual multi-armed bandit mechanism (a decision-making approach that learns which security checks to prioritize) to detect prompt injection attacks more efficiently by focusing on high-risk user requests in edge-cloud networks (systems that process data both locally on edge devices and in remote data centers).
Environmental illusions like shadows and tire marks can trick autonomous driving systems into misreading lanes, a safety problem that hasn't been studied much until now. Researchers created LanEvil++, a benchmark (a test suite for measuring performance) with 90,000+ images showing 14 types of illusions to evaluate how well lane detection models handle these challenges. The study found that shadows cause the most problems, reducing model accuracy by 5-10%, and proposes the Multimodal Illusion Defense Approach (MIDA, a training method using difficult examples) to improve robustness.
Fix: The source proposes the Multimodal Illusion Defense Approach (MIDA), which uses hard examples to improve illusion resistance. According to the text, 'MIDA achieves substantial gains under challenging conditions, boosting robustness by 4.23% on LD models and 3.82% on ADVLMs.'
IEEE Xplore (Security & AI Journals)New large language models (LLMs, AI systems trained on massive amounts of text) from Chinese companies are becoming competitive with leading US models. The article raises questions about whether cybersecurity defenders should be concerned about this development, though specific security implications are not detailed in the provided content.
Fix: Patches for both vulnerabilities were included in Cursor 3.0, which was released on April 2.
SecurityWeekFix: Update to Weaviate version 1.38.0 or later.
NVD/CVE DatabaseFix: Upgrade `@grackle-ai/mcp` to a version later than 0.132.1. The advisory explicitly states that versions "0.132.1 and earlier" are affected, indicating a fix is available in a subsequent release.
GitHub Advisory DatabaseFix: The source text does not explicitly describe a fix, patch, or version where this vulnerability was resolved. N/A -- no mitigation discussed in source.
GitHub Advisory Database