All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Two critical vulnerabilities (CVE-2026-50548 and CVE-2026-50549, with CVSS score of 9.8, a 0-10 severity rating) in the Cursor AI code editor could allow attackers to execute code at the operating system level by exploiting the editor's automatic command execution without user approval. The first flaw allows attackers to change the working directory to bypass the sandbox (a restricted environment where code runs safely), while the second uses symbolic links (special files that point to other files) to write files outside the intended project directory and disable sandbox protections.
Fix: Patches for both vulnerabilities were included in Cursor 3.0, which was released on April 2.
SecurityWeekAnthropic clarified that Claude Fable 5 (its most powerful AI model) will move from subscription plans to usage-based billing (a pay-per-use system where you pay for each query) after July 7, but this is temporary, not permanent. The company plans to restore Fable 5 as a standard subscription feature once it has enough computing capacity to handle the high demand.
Claude Fable, a powerful AI model, was relaunched after a government ban was lifted, but users report it performs worse than before due to overly strict safety guardrails (automated rules that prevent certain outputs). The model frequently switches to a weaker alternative (Opus 4.8) even on tasks that don't seem risky, and it blocks requests containing security-related language, making it less useful for many coding tasks.
CVE-2026-45499 is a server-side request forgery vulnerability (SSRF, a flaw where an attacker tricks a server into making unwanted network requests) in Azure OpenAI that allows an authorized attacker to gain elevated privileges over a network. The vulnerability has a CVSS score (severity rating from 0-10) that has not yet been assigned by NIST. Microsoft has published information about this vulnerability on their security update page.
CVE-2026-41106 is an open redirect vulnerability (a flaw where a website redirects you to an untrusted site) in Microsoft 365 Copilot that allows an attacker to gain unauthorized elevated privileges (higher access levels) over a network. The vulnerability has a CVSS score (severity rating) of 4.0. This is an exclusive service issue affecting Microsoft 365 Copilot users.
Weaviate versions before 1.38.0 have a security flaw in RBAC (role-based access control, a system that restricts what users can do based on assigned roles) where the system doesn't check if someone assigning a role to themselves or others actually has permission to grant those permissions. This means a user with limited permissions can assign themselves or others powerful admin roles, gaining full control of the database.
Grackle's MCP (Model Context Protocol) tool layer has inconsistent authorization checks that let scoped agents (restricted AI assistants) perform operations they shouldn't be allowed to, like deleting or modifying other agents' tasks or reading data across workspaces (an IDOR vulnerability, where attackers access resources by guessing IDs). The root cause is that the server uses its full API key for all backend requests without passing caller information, making the MCP tool layer the only place where permissions are checked, and some tools skip these checks entirely.
The llm-coding-agent is a new Python library that creates a coding agent (an AI system that can perform tasks by using tools) built on top of an LLM (large language model) framework, capable of reading files, editing files, executing shell commands, and searching code to help automate coding tasks. The agent was developed using test-driven development (TDD, a method where you write tests before writing code) and includes features like file operations, command execution with timeouts, and pattern-based file searching. Users can interact with it through command-line options like "llm code --yolo" or a Python API that lets them request specific coding tasks.
Langroid's SQLChatAgent contains a security flaw where its `_validate_query` blocklist (a list of dangerous SQL patterns to reject) fails to block several PostgreSQL file-reading functions like `pg_read_file()` and `pg_ls_logdir()`. An attacker who can influence the SQL queries the AI generates (through direct input or by injecting instructions into data the AI reads) can exploit this to read arbitrary files from the database server, even when the agent is configured to only allow SELECT statements and forbid dangerous operations.
Langroid's ReadFileTool and WriteFileTool have a path traversal vulnerability (a security flaw where attackers use sequences like ../ to access files outside intended boundaries) because they only change the working directory but don't validate that file paths stay within the configured curr_dir (current directory) boundary. An attacker can use paths like ../secret.txt to read or write files outside the intended sandbox directory, potentially compromising applications that rely on curr_dir to restrict file access.
As AI becomes more integrated into business operations, companies that already have strong process management frameworks (like Lean Six Sigma, a methodology focused on reducing errors and improving quality, or BPM, which maps how work flows across departments) are better positioned to succeed. The article argues that AI works best when combined with existing disciplined processes and data-driven decision-making, rather than being added hastily to disorganized operations.
mcp-memory-service has a critical authentication bypass vulnerability where all endpoints under `/api/documents/*` lack authentication checks, allowing unauthenticated attackers to read, write, and delete memories even when the server has API key or OAuth protection enabled. This is particularly dangerous because the `/api/memories` endpoints correctly enforce authentication, creating an inconsistent security boundary that attackers can exploit.
CVE-2025-69134 is a vulnerability in the OpenAI Chatbot for WordPress Helper plugin (version 1.1.4 and earlier) that allows attackers without authentication to delete arbitrary content from WordPress sites. The flaw stems from missing authorization checks (CWE-862, a weakness where code doesn't properly verify if a user should be allowed to perform an action).
Microsoft fixed a bug where Copilot buttons were disappearing from Classic Outlook for Windows users with the Copilot Chat (Basic) license. The affected users could not see Copilot in various locations within the email client, though the feature remained available through other access points like Outlook on the web.
Fix: Update to Weaviate version 1.38.0 or later.
NVD/CVE DatabaseFix: Upgrade `@grackle-ai/mcp` to a version later than 0.132.1. The advisory explicitly states that versions "0.132.1 and earlier" are affected, indicating a fix is available in a subsequent release.
GitHub Advisory DatabaseFix: The source text does not explicitly describe a fix, patch, or version where this vulnerability was resolved. N/A -- no mitigation discussed in source.
GitHub Advisory DatabaseThis research analyzed 183 studies to compare how organizations can get employees to follow information security policies (rules about protecting data and systems). The study found that informal controls, like peer influence and self-motivation, are more effective than formal controls like rules and monitoring. Formal controls work indirectly by helping employees develop informal controls through learning and accepting the organization's values.
This research examines how information systems can build trust in global hydrogen supply chains, which connect energy sources in the Global South and Australia to customers in the Northern Hemisphere. The study identifies five key trust-building techniques: transparency and traceability (making information visible and trackable), economic risk coordination, scenario planning, knowledge sharing, and communication. The findings suggest that information systems can play an important role in making hydrogen a reliable energy source by addressing trust concerns among organizations working together in these emerging supply chains.
In early 2024, Google's Gemini AI model generated historically inaccurate and racially offensive images, such as depicting non-White figures in Nazi-era settings, exposing failures in AI training and ethical oversight. The root cause was a flawed "diversity injection" mechanism (a technique meant to reduce bias in training data) that lacked safeguards to understand historical context, resulting in distorted outputs. The incident caused significant financial and reputational damage to Google and raised broader questions about how to build fairness and accuracy into generative AI systems.
AI systems used by organizations often appear reliable but actually suffer from algorithmic fragility, a persistent instability caused by how machine learning interacts with complex real-world environments, leading to biased outputs and performance drift (a decline in accuracy over time). Organizations manage this instability through stabilization work, which involves three practices: buffering (absorbing problems), reframing (reinterpreting failures), and patching (fixing issues), that become routine organizational processes to maintain the appearance of reliability. The paper argues that algorithmic fragility is a structural condition of AI systems rather than a temporary bug, and that effective AI governance requires continuous practice-based management rather than one-time technical fixes.
RAG (retrieval-augmented generation, where an AI pulls in external documents to answer questions) systems can be attacked by poisoning the documents they retrieve, which amplifies biases (systematic unfairness) in AI outputs even when the original question seems neutral. For example, a compromised RAG system might retrieve documents that show women as domestic violence victims, causing the AI to generate biased responses about gender. The paper demonstrates this attack using a framework called BRRA and shows that a dual stage defense mechanism can help reduce these attacks' impact.
Fix: The paper mentions that 'a dual stage defense mechanism' can 'effectively mitigate the impacts of the attack,' but the source text does not explicitly describe what this defense mechanism is or how to implement it.
IEEE Xplore (Security & AI Journals)IBM and Red Hat are investing significant resources (20,000 engineers) into Project Lightwell, a new service aimed at fixing bugs in open-source software (publicly available code that anyone can use and modify). This initiative was sparked by findings from Anthropic's Mythos research, which demonstrated that AI can discover security vulnerabilities (weaknesses that attackers could exploit) in open-source code, raising concerns about how to better protect the supply chain (all the software components and processes used to build applications).
Fix: Microsoft addressed the issue with a service change on June 29, 2026. Users can restart their email client to get the change immediately, or update to the latest build by selecting File > Office Account > Update Options > Update Now. Those unable to upgrade can work around the issue by reverting to the previous Current Channel build (16.0.20026.20168) or using the new Outlook or Outlook Web Access (OWA, the web version of Outlook).
BleepingComputer