aisecwatch.com
DashboardVulnerabilitiesNewsResearchArchiveStatsDatasetFor devs
Subscribe
aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

VulnerabilitiesNewsResearchDigest ArchiveNewsletter ArchiveSubscribeData SourcesStatisticsDatasetAPIIntegrationsWidgetRSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

Browse All

All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.

to
Export CSV
9614 items

OpenAI unveils first chip as part of Broadcom deal in effort to 'build the full stack'

infonews
industry
Jun 24, 2026

OpenAI and Broadcom unveiled Jalapeño, OpenAI's first custom AI chip designed for inference (the process of running trained AI models to generate responses for users). The chip is an ASIC (application-specific integrated circuit, a processor built for one particular job rather than general computing), which is cheaper and more efficient than standard graphics processors but less flexible, and OpenAI designed it in nine months with help from its own AI models to address extreme demand for computing power.

CNBC Technology

OpenAI reveals its first AI processor: Jalapeño

infonews
industry
Jun 24, 2026

OpenAI has announced a new chip called Jalapeño, an ASIC (application-specific integrated circuit, a processor designed for one particular job) built with Broadcom to power AI servers. The chip is specifically designed for AI inference (the process where a trained AI model processes user requests and generates responses), rather than AI training (where models learn from large amounts of data).

CVE-2026-12537: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1)

criticalvulnerability
security
Jun 24, 2026
CVE-2026-12537

A critical vulnerability (CVE-2026-12537) exists in Google Gemini CLI versions before 0.39.1 and the run-gemini-cli GitHub Action before version 0.1.22 that allows attackers to run malicious code on a host system before sandbox protections activate by creating a specially crafted .gemini/.env file (improper neutralization is a failure to filter dangerous characters from user input before using it in system commands). This affects headless CI (continuous integration, automated testing environments) platforms and has a maximum severity rating of 10.0.

AI Has Moved From Assistance to Action. Is Your Security Model Ready?

infonews
securitypolicy

Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey

inforesearchPeer-Reviewed
security

Metrics for Privacy-Preserving Generative Models: A Comprehensive Survey

inforesearchPeer-Reviewed
research

Stripe, Anthropic, and OpenAI are backing an effort to stop respiratory infections

infonews
industry
Jun 24, 2026

Intercept, a new nonprofit backed by Stripe, Anthropic, and OpenAI, has been funded with $500 million to develop ways to prevent respiratory infections like the common cold and flu. The organization will pursue multiple approaches, including vaccines, RNA drugs (medicines made from genetic material), antibodies (proteins that fight viruses), and large-scale air-cleaning systems using ultraviolet light to inactivate viruses in shared spaces like schools and offices.

Agentic AI Security: Wrong Context, Wrong Decisions at Machine Speed

infonews
safetysecurity

The emergence of the web data infrastructure layer for AI

infonews
industry
Jun 24, 2026

AI systems need access to large amounts of current, structured data to work effectively, but the web was not designed for the automated data retrieval that AI applications require. Companies face a challenge: traditional training methods using old data snapshots are insufficient, and they need infrastructure that can continuously retrieve real-time, trustworthy information from millions of websites to keep AI outputs current and reduce hallucinations (when AI generates false information).

Meta pauses employee tracker for AI training amid privacy concerns

infonews
privacysafety

Dawn of the Apex Agentic Adversary

infonews
securitysafety

Embedding Forbidden Text in Spyware to Discourage AI Analysis

mediumnews
securitysafety

How a malicious AI agent skill passed security checks and reached 26,000 users

highnews
securitysafety

‘You can’t make billions without hurting people’: Cory Doctorow on Elon Musk, the AI bubble and bosses’ cruel fantasies

infonews
policy
Jun 24, 2026

This article discusses how AI is being used to create 'reverse centaurs' (humans forced to serve as assistants to machines rather than being assisted by them), such as warehouse workers meeting algorithm-set targets or lawyers checking AI outputs like Gemini (a large language model, or LLM, made by Google). The author argues that despite tech leaders' warnings about AI's dangers, the real promise being sold is job elimination and loss of human autonomy, which benefits those in power.

AI-SPM buyer’s guide: 14 tools to secure your AI infrastructure

infonews
securityindustry

OpenAI and Broadcom unveil LLM-optimized inference chip

infonews
industry
Jun 24, 2026

OpenAI and Broadcom have unveiled Jalapeño, a specialized AI accelerator chip (a processor designed to speed up artificial intelligence computations) built specifically for LLM inference (the process of running trained AI models to generate outputs). Early testing shows the chip delivers significantly better performance per watt (computational power relative to energy use) than current alternatives, and it will be deployed in data centers starting in 2026.

The Identity Problem Hiding in AI Agent Deployments

infonews
securitypolicy

Anthropic’s Mythos Model Found Vulnerabilities in Classified US Government Systems, Official Says

infonews
securitypolicy

Meta pauses employee monitoring program after data protections fail

highnews
securityprivacy

Hole in widely-used FFmpeg codec could crash media servers or enable RCE

infonews
security
Jun 23, 2026

A critical vulnerability called PixelSmash (CVE-2026-8461) was found in FFmpeg, a widely-used media processing framework, that can crash applications or enable RCE (remote code execution, where an attacker can run commands on a system they don't own) through a heap out-of-bounds write (a memory safety error where code writes data outside its intended memory region) in the MagicYUV decoder. The bug affects hundreds of applications including media servers, video players, and cloud services, and can be triggered by uploading a malicious media file.

Previous164 / 481Next
The Verge (AI)

Fix: Update Google Gemini CLI to version 0.39.1 or later, and update the run-gemini-cli GitHub Action to version 0.1.22 or later.

NVD/CVE Database
Jun 24, 2026

AI systems in businesses are shifting from passive assistants that answer questions to active agents that take real actions like retrieving data, calling APIs (application programming interfaces, which let software communicate with other software), and executing workflows. This change requires a new approach to security, moving beyond simple data governance rules about what employees can share with AI tools.

Check Point Research
research
Jun 24, 2026

This academic survey examines harmful fine-tuning attacks (methods where attackers modify an AI model's training process to make it behave dangerously) and the defenses designed to stop them. The paper reviews different types of attacks, how they work, and various protection strategies researchers have developed to keep large language models safe from this threat.

ACM Digital Library (TOPS, DTRAP, CSUR)
privacy
Jun 24, 2026

This academic survey paper examines metrics, or measurement methods, used to evaluate privacy-preserving generative models (AI systems that create new data while protecting personal information). The paper provides a comprehensive overview of different ways researchers measure how well these models protect privacy while still functioning effectively.

ACM Digital Library (TOPS, DTRAP, CSUR)
MIT Technology Review
Jun 24, 2026

Agentic AI (autonomous AI systems designed to achieve specific goals) relies heavily on having accurate context (the complete information about your systems, assets, and threats) to make good security decisions. If given incomplete or wrong context, agentic AI will still act quickly and confidently but make bad decisions at machine speed, potentially causing catastrophic harm like shutting down critical business systems without understanding their importance.

SecurityWeek
MIT Technology Review
Jun 24, 2026

Meta paused an employee monitoring program called the Model Capability Initiative that tracked workers' keystrokes, mouse clicks, and screen content to collect data for training AI models (computer programs that learn patterns from data). After over 1,600 employees signed a petition and a security report revealed the collected data was accessible to anyone inside the company, Meta confirmed it was pausing the program while investigating potential privacy breaches.

Fix: Meta stated: 'We're pausing it while we investigate.' The company also noted it had 'carefully designed this program with privacy safeguards,' though no explicit fix, remediation steps, or timeline for resolution beyond the pause was mentioned in the source text.

The Guardian Technology
Jun 24, 2026

Advanced AI agents (agentic models, which are AI systems that can autonomously test and execute code) emerging in 2026 are compressing the time between discovering a vulnerability and launching attacks from weeks to seconds, making traditional security catalogs obsolete. These AI-powered attackers can now move laterally across converged IT and OT (operational technology, the systems controlling physical infrastructure like factories) networks at machine speed, potentially causing physical damage before humans even detect the breach.

The Hacker News
Jun 24, 2026

Malware developers are embedding forbidden text about weapons into spyware code to trick AI analysis tools into refusing to analyze it. The malicious code hides real instructions in comments (lines ignored by the computer) and uses obfuscation (making code hard to read) to confuse AI-powered security scanners that feed code directly to language models without treating it as untrusted input.

Schneier on Security
Jun 24, 2026

Researchers demonstrated that a malicious AI agent skill (a reusable tool that extends an AI agent's capabilities) passed security scanners and reached 26,000 users by exploiting a gap in how skills are reviewed. The attack worked by hiding malicious instructions behind a fake website domain that redirected to a legitimate site during security checks, then changed its content after approval to collect user data, showing that one-time security scans cannot detect skills that behave differently after they gain trust.

CSO Online
The Guardian Technology
Jun 24, 2026

As organizations increasingly adopt AI across their operations, they face growing security challenges because AI systems touch critical infrastructure and data in complex ways. AI security posture management (AI-SPM, tools that monitor and assess the security of AI models, data, and applications) has emerged as an important category to address these risks, especially since many enterprises run AI agents without proper security oversight or governance strategies. Security teams need to carefully evaluate AI-SPM tools to match their organization's maturity level and avoid duplicating existing security tools or leaving coverage gaps.

CSO Online
OpenAI Blog
Jun 24, 2026

AI agents deployed in organizations need access to sensitive systems, but current OAuth tokens (standardized digital credentials that verify identity and permissions) cannot properly track both the agent's identity and the user it represents, making it impossible to enforce proper access controls or detect misuse. The problem grows as agents become more autonomous and can act on behalf of multiple users, invoke other agents, and operate without human oversight. OAuth tokens were designed for single-principal scenarios (one actor), but AI agents operate in complex multi-principal situations that the industry has not yet standardized.

CrowdStrike Blog
Jun 23, 2026

Anthropic's Mythos AI model identified vulnerabilities in classified U.S. government computer systems within hours during a security testing initiative called Project Glasswing, according to a U.S. official. The testing was conducted in cooperation with U.S. intelligence agencies to assess potential security risks the model could pose. In response, the Trump administration issued a directive requiring Anthropic to prevent foreign nationals from accessing its latest models (Fable 5 and Mythos 5), and Anthropic disabled these models for all customers to comply.

Fix: Anthropic disabled the Mythos and Fable models for all of its customers to comply with the Trump administration's directive requiring the company to prevent foreign nationals from using its latest artificial intelligence models, known as Fable 5 and Mythos 5.

SecurityWeek
Jun 23, 2026

Meta paused an employee monitoring program called the Model Compatibility Initiative (MCI) after employees bypassed its security protections to access restricted data, and then did so again even after Meta claimed to fix the vulnerability. The program collected sensitive data including keystrokes, mouse movements, screen content, private conversations, and performance information to train AI models. Security experts criticized Meta for deploying inadequate access controls (security measures that limit who can view data) on such highly sensitive information, even though the company had the resources to implement stronger protections.

Fix: According to Meta vice president Stephane Kasriel, the unauthorized access discovered on June 18 was closed "within four hours," but "the initial fix didn't stick, and access to the data had to be further locked down." Meta stated in an email that the program is "pausing it while we investigate."

CSO Online

Fix: Users of FFmpeg should upgrade to the patched version (8.1.2) as soon as possible. Additionally, if the MagicYUV decoder is not needed, developers can disable it at build time to prevent exploitation.

CSO Online