All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
A research paper shows that large language models (LLMs) are vulnerable to prompt injection attacks (tricks where attackers hide malicious instructions in text input) because they rely on role tags (formatting markers that separate different instruction blocks) as their main security mechanism, but these tags don't actually reflect how the model processes information internally. The researchers conclude that unless LLMs develop a genuine ability to understand and maintain role boundaries, prompt injection attacks will remain difficult to prevent permanently.
Anthropic, a major AI company, is rapidly expanding its data center operations in Asia-Pacific by hiring 13 people, with eight positions in Australia and Japan, to handle increasing demand for its AI products. The company is building infrastructure in these regions because they offer advantages like renewable energy, political stability, and security benefits, though Australia's copyright laws present a potential obstacle to large-scale expansion.
Agentic AI (AI systems that can work independently on tasks for extended periods, rather than just answering single questions) is transforming how people work by handling longer, more complex tasks instead of short interactions. At OpenAI, a tool called Codex shifted from being used mainly by engineers to becoming the primary AI tool across all departments, including non-technical ones like Legal and Recruiting, with usage growing dramatically over the past year. Users increasingly delegate tasks that would take humans hours or even days to complete, with some users running dozens of hours of parallel agent tasks in a single day.
Anthropic accused Alibaba of carrying out a massive distillation attack (a method where a weaker AI model is trained using outputs from a stronger model) involving 28.8 million exchanges with fraudulent accounts between April and June 2024. Anthropic called for coordinated government and industry action to combat illegal distillation, though Alibaba has not yet responded to the allegations.
Twenty, an open-source CRM platform, had a vulnerability before version 2.9.0 where authenticated users could access other workspaces' AI agent data through IDOR (insecure direct object reference, a flaw where the system doesn't verify that requested data belongs to the user). Attackers with access to a workspace could view other users' chat histories, tool calls, and outputs by knowing their agent or turn IDs, which were visible in the settings page URL.
LlamaIndex v0.14.23 is a maintenance release that updates dependencies (uv and pip, which are Python package managers) across multiple directories and fixes various bugs in the core library. Key fixes include handling empty input sequences, preserving video and document blocks in memory, resolving recursion errors in text splitting, and preventing state mutation issues in workflows.
A vulnerability in Firebase Studio (Google's backend service for building apps) allowed authenticated users to access and download source code and list storage buckets belonging to other users' projects. The vulnerability has already been fixed and deployed to the backend service.
The article explains that while casual prompt testing (trying unusual inputs to see if an AI refuses them) is accessible to anyone, it is insufficient for enterprise AI systems. Enterprise AI is more complex because it includes policies, retrieval pipelines (systems that fetch information from databases), APIs (interfaces allowing programs to communicate), tools, permissions, workflows, and data sources, requiring more rigorous testing approaches.
Warp is an agentic development environment (a tool that helps developers write code with AI assistance) that contained a command injection vulnerability (a flaw where specially crafted input can trick a system into running unintended commands) in its branch selector feature. An attacker who could publish a malicious Git branch name to a repository could cause that branch name to be executed as a shell command (instructions sent directly to the operating system) when a victim selected it from Warp's user interface.
Docling is a tool that converts documents in different formats and connects them with AI systems. Between versions 2.73.0 and 2.91.0, it had a security flaw in how it processed LaTeX files (a document formatting language), where attackers could use path traversal (a technique to access files outside intended directories) to read sensitive files like credentials or configuration data from a system.
Docling is a tool that reads different document formats and connects them to AI systems. Versions 2.13.0 through 2.74.0 had a security flaw in how they read USPTO patent XML files (XML, a format for storing structured data): they didn't protect against XXE attacks (XML External Entity attacks, where specially crafted files trick the parser into reading files from the server or making unwanted network requests). An attacker could use this flaw to steal files, perform SSRF attacks (server-side request forgery, making the server request data it shouldn't), or crash the system.
Docling is a tool that processes documents in different formats and connects with AI systems. Before version 2.91.0, it had a security flaw where it downloaded AI models (EasyOCR) and extracted compressed files (ZIP archives) without checking if the file paths were safe, allowing a Zip Slip attack (a technique where specially crafted archive files extract to unintended locations). If an attacker could intercept or compromise the model download, they could write malicious files anywhere on the system, potentially taking complete control of it.
Docling is a tool that processes different document formats and connects them to AI systems. In versions 2.82.0 through 2.90.0, if HTML rendering was turned on, an attacker could create malicious HTML documents that run unauthorized JavaScript code or access internal network services, potentially leading to SSRF attacks (where the server makes unintended requests to internal systems), data theft, or RCE (remote code execution, where attackers run commands on a system they don't own).
This article discusses Broadcom's stock performance and mentions a new AI chip called Jalapeno that was co-designed with OpenAI. The article suggests this chip development could be a significant business opportunity for Broadcom.
CIOs face pressure to rapidly adopt AI across their organizations to prove business value, but must balance this speed with managing new security and governance risks. AI introduces unique challenges because its behavior is indeterminate (unpredictable and hard to verify like traditional technology) and employees are eager to use it without oversight, creating what's called shadow use (unauthorized use of tools that bypasses IT controls). Organizations should clarify their specific business goals and conduct a risk assessment before implementing AI rather than adopting it out of fear of falling behind.
A new malware called Gaslight, created by North Korea-aligned hackers, targets macOS systems and uses prompt injection (tricking an AI by hiding instructions in its input) to disrupt AI tools that analyze malware. The malware embeds fake system-failure messages designed to confuse AI-assisted analysis tools, while also stealing sensitive data like browser histories and passwords through a command-and-control (C2, a server that lets attackers remotely control infected computers) channel powered by Telegram.
PTC Windchill and FlexPLM contain an improper input validation vulnerability (a failure to check user input for malicious content) that allows an unauthenticated attacker to run arbitrary code (commands of the attacker's choosing) on a remote system by sending a specially crafted request. This vulnerability is actively being exploited by real attackers.
Fix: Apply mitigations according to vendor instructions at https://www.ptc.com/en/support/article/CS473270, following CISA's BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance. If mitigations are unavailable, discontinue use of the product. Organizations must evaluate their systems' internet exposure and meet BOD 26-04 patching deadlines by 2026-06-28.
CISA Known Exploited VulnerabilitiesCisco Unified Communications Manager contains an SSRF vulnerability (server-side request forgery, where an attacker tricks the server into making requests on their behalf) that allows unauthenticated remote attackers to write files to the operating system, potentially leading to root-level access. This vulnerability is currently being exploited in real attacks. The vulnerability affects both standard Unified CM and Unified CM SME (Session Management Edition) versions.
Fix: Apply mitigations in accordance with vendor instructions from Cisco at https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html, ensuring compliance with CISA's BOD 26-04 guidance. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-06-28.
CISA Known Exploited VulnerabilitiesFix: This issue is fixed in version 2.9.0.
NVD/CVE DatabaseA U.S. Congresswoman claimed her staff used AI only for "spellcheck" when writing a summary of a defense bill amendment, not for drafting the actual legislation. Screenshots shared online showed what appeared to be Claude (an AI assistant) being used to generate the amendment summary, prompting the congresswoman to deny that AI was used to write any actual laws.
Fix: No action is required as the fix has been deployed. As a precautionary measure, users who stored sensitive information such as API keys (secret codes that grant access to services) in their Firebase Studio workspace may choose to rotate these keys by following instructions in the Firebase Studio troubleshooting guide.
Fix: This vulnerability is fixed in version 0.2026.05.06.15.42.stable_01. Users should update Warp to this version or later.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 2.91.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 2.74.0.
NVD/CVE DatabaseFix: Update to Docling version 2.91.0 or later. The vulnerability is fixed in 2.91.0.
NVD/CVE DatabaseFix: Upgrade to version 2.91.0, where the vulnerability is fixed.
NVD/CVE DatabaseAI agents that can autonomously access websites, emails, and files are vulnerable to 'traps' - maliciously designed information that tricks them into wrong actions. These traps include content injection (hiding malicious instructions in webpage code or metadata), semantic manipulation (using repetition and emotional language to guide decisions), and cognitive state attacks (poisoning databases that agents rely on for memory), with research showing such attacks succeed 57-90% of the time depending on the type.