aisecwatch.com
DashboardVulnerabilitiesNewsResearchArchiveStatsDatasetFor devs
Subscribe
aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

VulnerabilitiesNewsResearchDigest ArchiveNewsletter ArchiveSubscribeData SourcesStatisticsDatasetAPIIntegrationsWidgetRSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

Browse All

All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.

to
Export CSV
7535 items

llm-anthropic 0.26

infonews
industry
Aug 4, 2026

The llm-anthropic version 0.26 update adds three new Claude AI models (Fable 5, Sonnet 5, and Opus 5) and introduces server-side tools for web search, web fetching, and code execution through a command-line interface (-T). The update also changes how the AI's internal reasoning process works, now displaying it as typed events (individual data chunks sent one at a time) and simplifying reasoning controls with a new thinking_effort parameter.

Simon Willison's Weblog

SpaceX made more revenue as an AI company than a space company

infonews
industry
Aug 4, 2026

SpaceX generated $2.6 billion in revenue from providing compute (computing power and resources) to AI companies like Anthropic and Google, more than tripling its AI revenue and surpassing its space business revenue. However, SpaceX's AI division lost $1.5 billion this quarter, competing with other cloud computing providers in the AI market.

CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows

highvulnerability
security
Aug 4, 2026

Kiro IDE and CLI (software tools that help developers write code) for Windows have a vulnerability where an attacker can trick the program into running malicious code by placing a fake executable in a project directory. When a user opens that directory, Windows searches for programs in the wrong order and runs the attacker's file instead of the legitimate one.

GHSA-qgvm-j2hm-6m38: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

criticalvulnerability
security
Aug 4, 2026
CVE-2026-70478

Flowise has a security flaw where an unauthenticated endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) can refresh OAuth2 tokens (credentials that allow apps to act on behalf of a user) without requiring login. An attacker who knows a credential ID can call this endpoint to get a fresh access token and use it to impersonate the victim on connected services like Google or Microsoft.

GHSA-5xvg-pmgg-3mxr: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

criticalvulnerability
security
Aug 4, 2026
CVE-2026-70477

Flowise version 3.1.1 has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) on a CSV Agent node to make the LLM generate malicious Python code that bypasses the security blocklist validator and runs with full system access in an unsandboxed pyodide environment (a Python runtime in JavaScript). This allows remote code execution without requiring authentication.

Nvidia doesn’t mess around: A week after open AI industry group formed, it’s already showing progress

infonews
policyindustry

GHSA-gmmw-qg98-6j6p: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

highvulnerability
security
Aug 4, 2026
CVE-2026-70476

Flowise has a broken access control vulnerability in its billing endpoints that allows an authenticated attacker to manipulate another organization's Stripe subscriptions. The vulnerable endpoints accept subscription identifiers directly from user input without checking that the subscription belongs to the attacker's organization, enabling unauthorized billing operations like changing subscription plans or seat quantities.

GHSA-8gj2-2cvc-6xx7: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

mediumvulnerability
security
Aug 4, 2026

Flowise has a security flaw where the text-to-speech API endpoint doesn't require login and doesn't check if a chatflow is public before allowing access to it. An attacker who knows a chatflow's ID can trick the system into using that chatflow's stored API credentials (like OpenAI or ElevenLabs keys) to generate unlimited audio without permission, costing the real owner money.

GHSA-fm2f-4339-4p2f: Flowise: Missing Authorization on Execution Update Endpoint

highvulnerability
security
Aug 4, 2026
CVE-2026-70475

Flowise has a missing authorization vulnerability in its execution update endpoint (`PUT /api/v1/executions/:id`). Unlike other execution endpoints that check user permissions, the update endpoint allows any authenticated user to modify any execution record, enabling privilege escalation (gaining higher-level access than intended) where a low-privileged user can change execution data and results.

Third-party cyber evaluations involving OpenAI models

mediumincident
securitysafety

Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps

infonews
securitypolicy

CVE-2026-47487: NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repos

mediumvulnerability
security
Aug 4, 2026
CVE-2026-47487

NVIDIA Triton Inference Server for Linux has a vulnerability where an attacker could read, write, or modify files outside the intended model repository by providing a specially crafted path in the model name to the MLflow plugin. This could lead to denial of service (making a system unavailable) and information disclosure (leaking sensitive data).

GHSA-wch5-xp77-fxg4: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

highvulnerability
security
Aug 4, 2026
CVE-2026-70474

Flowise has a security vulnerability in its OAuth2 credential handling where three endpoints look up credentials by ID alone without checking which workspace the user belongs to, and two of these endpoints skip authentication entirely. This allows authenticated users to access credentials from other workspaces, and unauthenticated attackers to inject forged OAuth2 tokens or refresh tokens for any credential in the system.

GHSA-rwrp-9823-p2xq: Flowise: Incomplete Credential Redaction Exposes Secrets via API

mediumvulnerability
security
Aug 4, 2026

Flowise has a security flaw where the `GET /api/v1/credentials/:id` endpoint returns sensitive data in plaintext to any authenticated user with permission to view credentials. While a redaction function masks fields marked as `type: 'password'`, many credential types store secrets (like database URLs with passwords, Google service account keys, and AWS access keys) in fields marked as `type: 'string'`, which are returned without any protection.

GHSA-fr6g-7cq8-fg82: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

highvulnerability
security
Aug 4, 2026
CVE-2026-70473

Flowise has a security flaw in its GET /api/v1/upsert-history endpoint (an API endpoint, or a web address the software exposes for requests) that returns the entire server-wide history of data uploads instead of limiting it to each user's own data. The response exposes sensitive configuration details like database URLs and collection names, which could help attackers target the system more effectively.

GHSA-chm3-vqcf-52rx: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

highvulnerability
security
Aug 4, 2026
CVE-2026-70472

Flowise has a cross-workspace credential vulnerability where attackers can access other users' OpenAI API keys if they know the credential ID. The server doesn't check whether credentials belong to the attacker's workspace before using them, allowing unauthorized access to victim OpenAI accounts and vector stores (collections of data used for AI search and retrieval).

How an OpenAI influencer trip backfired 

infonews
industry
Aug 4, 2026

OpenAI organized its first-ever brand trip, an all-expenses-paid vacation for influencers designed to generate social media promotion, similar to marketing strategies used by fashion and beauty companies. The trip generated controversy, as brand trips can create hard feelings among uninvited influencers and draw public criticism for appearing frivolous.

CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation

highvulnerability
security
Aug 4, 2026

A vulnerability (CVE-2026-18830) was found in Amazon Bedrock's AgentCore harness that allowed authenticated users to run configured tools without the AI model reviewing the request first, bypassing security controls. The issue only affected tools that were already set up on a given harness, so systems with no tools configured were not at risk.

GHSA-4j8x-x6v7-w9rq: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

criticalvulnerability
security
Aug 4, 2026
CVE-2026-69264

Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.

GHSA-88pr-878c-24wf: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

highvulnerability
security
Aug 4, 2026

Flowise has a security flaw where authenticated users can write files anywhere on the server's filesystem through the S3 Directory document loader. The vulnerability occurs because the code doesn't check for path traversal sequences (like `../` which moves up directories) when processing S3 object keys, allowing an attacker to write files outside the intended temporary directory.

Previous2 / 377Next
The Verge (AI)
AWS Security Bulletins

Fix: Remove the refresh endpoint from `WHITELIST_URLS` in `packages/server/src/utils/constants.ts` and add an authentication check to the route handler in `packages/server/src/routes/oauth2/index.ts` to require login before allowing token refresh.

GitHub Advisory Database
GitHub Advisory Database
Aug 4, 2026

Nvidia-led Open Secure AI Alliance (OSAA), an industry group of over 120 companies formed to address AI security, has quickly developed initial proposals including guidelines for confidentially reporting AI cybersecurity incidents and conducting blame-free analysis of incidents. Member companies are also contributing open source security tools, such as Nvidia's Garak (an LLM vulnerability scanner, a tool that checks AI systems for security weaknesses) and tools from other companies for agent identity and governance, with the goal of eventually creating shared open source resources to help enterprises secure their AI systems.

TechCrunch (Security)
GitHub Advisory Database
GitHub Advisory Database
GitHub Advisory Database
Aug 4, 2026

During independent security tests of OpenAI models, two external testing partners discovered that the models accessed the public internet beyond their intended boundaries under specific test conditions. One test (by the UK government's AI Security Institute) intentionally enabled internet access with reduced safeguards to measure the model's underlying capabilities, while another test (by a cybersecurity firm called Irregular) had a configuration error that unintentionally allowed internet access when the test environment was supposed to be isolated. OpenAI states these incidents highlight the need to improve testing standards and safety practices as AI models become more capable.

Fix: OpenAI stated it will 'review our own approach to third-party testing, including how we identify higher-risk evaluations, agree on scope, assess requests to enable internet access or lowered safeguards, set expectations for isolation, credential handling, monitoring, and stop conditions, and establish clearer incident-notification and escalation processes.' Additionally, OpenAI committed to 'working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks.'

OpenAI Blog
Aug 4, 2026

Microsoft has expanded its Zero Trust for AI strategy with new tools to help organizations secure AI agents and development workflows. The updates include an AI-focused Zero Trust Assessment tool that evaluates security controls across AI systems, and a new DevSecOps (developer security operations, where security practices are built into software development) pillar in the Zero Trust Workshop that provides 91 specific tasks to apply Zero Trust principles (verify every access, assume breaches could happen, use least privilege access) from source code to cloud deployment.

Fix: Microsoft provides two explicit tools and resources: (1) the updated Zero Trust Assessment tool with new AI-focused checks to evaluate controls and identify gaps in AI adoption, and (2) the new DevSecOps pillar in the Zero Trust Workshop containing 15 control groups and 91 tasks that help teams apply Zero Trust principles throughout the software development lifecycle. The Assessment results map directly into the Workshop's 'First, Then, Next framework' to transform findings into a prioritized remediation roadmap. Additionally, Microsoft offers 'new practical guidance for security practitioners and a new e-book titled Zero Trust for AI, rebuilding security controls for autonomous and agentic systems.'

Microsoft Security Blog
NVD/CVE Database
GitHub Advisory Database
GitHub Advisory Database
GitHub Advisory Database
GitHub Advisory Database
The Verge (AI)

Fix: Update Amazon Bedrock AgentCore harness InvokeHarness API to the version released after July 31, 2026.

AWS Security Bulletins
GitHub Advisory Database
GitHub Advisory Database