All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Anthropic Claude Desktop has a security flaw in versions v1.1348.0 through v1.2278.0 where it boots a VM (virtual machine, a simulated computer) without checking that the root filesystem image hasn't been tampered with. An attacker with basic access to a user's Mac can modify this image file, and the software will trust and run the modified version on the next boot, giving the attacker persistent control inside the VM and access to files shared with the host computer.
An unprivileged process (a program running without special administrator permissions) can cause the ebpf-profiler agent to stop working by triggering a denial of service attack. The attack blocks a background worker thread indefinitely in an `openat2` syscall (a system call that opens files), preventing the profiler from analyzing new executable files and rendering it non-functional.
Multiple major film studios, including Netflix, A24, and Warner Bros., have reportedly declined to distribute a biographical film about OpenAI CEO Sam Altman, with Amazon MGM also pulling out despite the film being nearly complete. The rejections suggest that Hollywood studios may be hesitant to produce critical stories about large tech companies like OpenAI.
OpenClaw is an AI agent that runs third-party skills from ClawHub marketplace, but these skills have broad access to local systems, creating supply chain risks (where attackers compromise software distribution to spread malware). Between February and May 2026, researchers found five malicious skills that evaded ClawHub's existing defenses, including infostealers (malware that steals information), evasion techniques, and novel agentic threats like runtime injection and front-running attacks designed for financial gain.
rtk is a tool that filters and compresses command outputs before sending them to an LLM (large language model). Before version 0.42.2, rtk's permission splitter (the part that checks if commands are allowed) failed to properly detect certain shell constructs (special syntax that Bash uses to execute commands), allowing attackers to hide unauthorized commands behind allowed ones like "git". This meant dangerous commands could run without user approval.
Daytona is a platform for running code created by AI systems in a secure way. Before version 0.185.0, it had a flaw where a user who owned any organization could change or delete roles (permission sets) from a completely different organization if they knew the role's ID, because the system didn't properly verify that the role belonged to the organization being modified.
Daytona is a platform for running code created by AI in a secure, isolated environment (sandbox). In versions 0.101.0 through 0.184.0, when sandbox previews were changed from public to private, they could still be accessed without a password for a short time because the system's cached record of who could see the sandbox was not updated.
Daytona is a platform for running code created by AI in a secure way. Before version 0.184.0, there was a security flaw where someone could accept organization invitations without verifying their email address, potentially allowing an attacker to join an organization with high-level permissions by using a fake email account.
Daytona is a platform that runs code generated by AI in a controlled environment (sandbox, which is an isolated space). Before version 0.186, it had a path-traversal vulnerability (a weakness where an attacker can use special character sequences like '../' to access files outside intended directories) that could let someone access files outside the intended storage volume directory by manipulating the volume reference sent to the runner.
A vulnerability called 'Cordyceps' exploits weaknesses in CI/CD workflows (automated systems that test and deploy code changes) to inject malicious pull requests (code change proposals) into popular developer tools like Azure Sentinel, Google's AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python's Black. Attackers can use this method to compromise the software supply chain, potentially affecting many developers who use these tools.
Daytona is a platform that runs code generated by AI safely and efficiently. Before version 0.185.0, it had a cross-tenant authorization flaw (a security problem where access controls between separate organizations failed), which let any logged-in user listen to another organization's real-time notifications and see their events without permission.
Daytona, a tool for running AI-generated code safely, had a security flaw before version 0.185.0 where it didn't verify TLS certificates (the security credentials that prove a website is authentic) when cloning Git repositories (copying code from remote servers). This meant an attacker intercepting the connection could steal Git credentials (login information) and replace the real code with fake, harmful code.
Open WebUI, a self-hosted AI platform that runs offline, had a vulnerability before version 0.9.6 where authenticated users could bypass access controls by manipulating a url_idx parameter (a number used to select which backend server to use). This allowed them to reach Ollama backends (the AI model servers) they shouldn't have access to, including internal or admin-disabled ones, because the system only checked if they could use a model but not which backend server they were routed to.
Open WebUI, a self-hosted AI platform that runs offline, had a security flaw in versions before 0.9.6 where access controls (ACL, rules that restrict who can access what) could be bypassed when a database feature called Milvus multitenancy mode was enabled. An attacker could exploit this by using a specially crafted collection name that wasn't properly cleaned before being used in a database query, allowing them to access data they shouldn't be able to reach.
Gogs (a git hosting service) has a security flaw in its LFS (large file storage, a system for storing large files in git repositories) implementation where the deduplication shortcut skips hash verification, allowing any user with write access to one repository to claim ownership of LFS objects from private repositories they cannot access. An attacker can bind a file OID (object identifier, a unique hash) from a private repo to their own repo and download the private content through their own download endpoint.
Gogs (a Git service) has a bug where password-reset tokens use the account-activation lifetime instead of the configured reset-password lifetime. The token's expiration time is baked into the token itself when it's created, so changing the reset-password timeout setting has no effect, and attackers who intercept a reset token can use it far longer than administrators intended.
Gogs (a self-hosted Git service) has three API endpoints that incorrectly allow write-level collaborators to change admin-only repository settings. These endpoints use `reqRepoWriter()` middleware instead of `reqRepoAdmin()`, meaning users with basic write access can disable the issue tracker or wiki, inject malicious external URLs that redirect visitors, or trigger mirror sync operations. The web interface correctly requires admin access for these same operations, creating a security inconsistency.
Immunologist Derya Unutmaz used GPT-5 Pro in late 2025 to solve a three-year-old mystery about how glucose affects T cell development (immune cells that fight disease). His lab had run an experiment in 2022 showing that deoxyglucose (a glucose-like molecule that disrupts a cell's energy production) caused T cells to become inflammatory-response cells at much higher rates than low glucose alone, but they couldn't explain why. GPT-5 Pro analyzed the data and suggested that deoxyglucose interfered with IL-2 protein construction, which normally prevents T cells from becoming inflammatory cells, thereby explaining the unexpected results.
Midjourney, an AI company known for its image generator, announced a new medical imaging product: an experimental ultrasound scanner that would immerse users in water to produce detailed body images similar to MRI (magnetic resonance imaging, a medical scanning technique). Medical imaging experts expressed skepticism about the technology, saying Midjourney has not yet shown sufficient public evidence to support its claims that the system could match or exceed MRI capabilities.
Fix: Fixed in commit 234b685cab31c2cb2f79e966caeab168bcc489e4. The fix is included in version 0.0.202622 of opentelemetry-ebpf-profiler.
GitHub Advisory DatabaseFix: ClawHub integrated VirusTotal and ClawScan for proactive screening of skills and code-level analysis. OpenClaw is now collaborating with NVIDIA to provide documentation of what each skill does and to run NVIDIA's analysis tool on all skills published to the platform.
Palo Alto Unit 42Fix: This vulnerability is fixed in version 0.42.2.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.185.0.
NVD/CVE DatabaseFix: Update to version 0.184.0, where this vulnerability is fixed.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.184.0. Users should update Daytona to this version or later.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.186. Users should upgrade to this version or later.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.185.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 0.185.0.
NVD/CVE DatabaseFix: This vulnerability is fixed in 0.9.6.
NVD/CVE DatabaseFix: Update Open WebUI to version 0.9.6 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: The source text suggests two fixes: (1) In `LocalStorage.Upload`, when the file already exists on disk, hash the request body using `io.TeeReader` and return `ErrOIDMismatch` if the hash doesn't match the claimed OID, using the same verification code path as new file uploads. (2) As an optional second layer, in `serveUpload`, refuse to create the LFS object binding unless the OID is referenced by an LFS pointer in the requesting repository's refs (git history).
GitHub Advisory DatabaseAI companies are spending over $20 million in a New York congressional race between AI safety advocate Alex Bores and two other candidates, with competing super PACs (political action committees, groups that raise unlimited money for political causes) backing different approaches to AI regulation. Leading the Future, backed by companies like OpenAI and Andreessen Horowitz, opposes Bores and favors lighter regulation, while Public First Action, funded by Anthropic, supports Bores and advocates for stricter safety requirements built into AI models from the start. This race has become a proxy battle over whether the U.S. government should heavily regulate the AI industry or allow it to develop with fewer restrictions.