All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
The llm-anthropic version 0.26 update adds three new Claude AI models (Fable 5, Sonnet 5, and Opus 5) and introduces server-side tools for web search, web fetching, and code execution through a command-line interface (-T). The update also changes how the AI's internal reasoning process works, now displaying it as typed events (individual data chunks sent one at a time) and simplifying reasoning controls with a new thinking_effort parameter.
SpaceX generated $2.6 billion in revenue from providing compute (computing power and resources) to AI companies like Anthropic and Google, more than tripling its AI revenue and surpassing its space business revenue. However, SpaceX's AI division lost $1.5 billion this quarter, competing with other cloud computing providers in the AI market.
Kiro IDE and CLI (software tools that help developers write code) for Windows have a vulnerability where an attacker can trick the program into running malicious code by placing a fake executable in a project directory. When a user opens that directory, Windows searches for programs in the wrong order and runs the attacker's file instead of the legitimate one.
Flowise has a security flaw where an unauthenticated endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) can refresh OAuth2 tokens (credentials that allow apps to act on behalf of a user) without requiring login. An attacker who knows a credential ID can call this endpoint to get a fresh access token and use it to impersonate the victim on connected services like Google or Microsoft.
Flowise version 3.1.1 has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) on a CSV Agent node to make the LLM generate malicious Python code that bypasses the security blocklist validator and runs with full system access in an unsandboxed pyodide environment (a Python runtime in JavaScript). This allows remote code execution without requiring authentication.
Flowise has a broken access control vulnerability in its billing endpoints that allows an authenticated attacker to manipulate another organization's Stripe subscriptions. The vulnerable endpoints accept subscription identifiers directly from user input without checking that the subscription belongs to the attacker's organization, enabling unauthorized billing operations like changing subscription plans or seat quantities.
Flowise has a security flaw where the text-to-speech API endpoint doesn't require login and doesn't check if a chatflow is public before allowing access to it. An attacker who knows a chatflow's ID can trick the system into using that chatflow's stored API credentials (like OpenAI or ElevenLabs keys) to generate unlimited audio without permission, costing the real owner money.
Flowise has a missing authorization vulnerability in its execution update endpoint (`PUT /api/v1/executions/:id`). Unlike other execution endpoints that check user permissions, the update endpoint allows any authenticated user to modify any execution record, enabling privilege escalation (gaining higher-level access than intended) where a low-privileged user can change execution data and results.
NVIDIA Triton Inference Server for Linux has a vulnerability where an attacker could read, write, or modify files outside the intended model repository by providing a specially crafted path in the model name to the MLflow plugin. This could lead to denial of service (making a system unavailable) and information disclosure (leaking sensitive data).
Flowise has a security vulnerability in its OAuth2 credential handling where three endpoints look up credentials by ID alone without checking which workspace the user belongs to, and two of these endpoints skip authentication entirely. This allows authenticated users to access credentials from other workspaces, and unauthenticated attackers to inject forged OAuth2 tokens or refresh tokens for any credential in the system.
Flowise has a security flaw where the `GET /api/v1/credentials/:id` endpoint returns sensitive data in plaintext to any authenticated user with permission to view credentials. While a redaction function masks fields marked as `type: 'password'`, many credential types store secrets (like database URLs with passwords, Google service account keys, and AWS access keys) in fields marked as `type: 'string'`, which are returned without any protection.
Flowise has a security flaw in its GET /api/v1/upsert-history endpoint (an API endpoint, or a web address the software exposes for requests) that returns the entire server-wide history of data uploads instead of limiting it to each user's own data. The response exposes sensitive configuration details like database URLs and collection names, which could help attackers target the system more effectively.
Flowise has a cross-workspace credential vulnerability where attackers can access other users' OpenAI API keys if they know the credential ID. The server doesn't check whether credentials belong to the attacker's workspace before using them, allowing unauthorized access to victim OpenAI accounts and vector stores (collections of data used for AI search and retrieval).
OpenAI organized its first-ever brand trip, an all-expenses-paid vacation for influencers designed to generate social media promotion, similar to marketing strategies used by fashion and beauty companies. The trip generated controversy, as brand trips can create hard feelings among uninvited influencers and draw public criticism for appearing frivolous.
A vulnerability (CVE-2026-18830) was found in Amazon Bedrock's AgentCore harness that allowed authenticated users to run configured tools without the AI model reviewing the request first, bypassing security controls. The issue only affected tools that were already set up on a given harness, so systems with no tools configured were not at risk.
Flowise's CSVAgent has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability because it takes user-supplied data from a CSV file URI, inserts it directly into Python code without checking it, and then executes that code. Since the Python environment (Pyodide, a tool that runs Python in JavaScript) can access JavaScript functions like `eval` and file operations, an attacker can break out of the Python code, run JavaScript commands, and gain full control of the server, even without authentication.
Flowise has a security flaw where authenticated users can write files anywhere on the server's filesystem through the S3 Directory document loader. The vulnerability occurs because the code doesn't check for path traversal sequences (like `../` which moves up directories) when processing S3 object keys, allowing an attacker to write files outside the intended temporary directory.
Fix: Remove the refresh endpoint from `WHITELIST_URLS` in `packages/server/src/utils/constants.ts` and add an authentication check to the route handler in `packages/server/src/routes/oauth2/index.ts` to require login before allowing token refresh.
GitHub Advisory DatabaseNvidia-led Open Secure AI Alliance (OSAA), an industry group of over 120 companies formed to address AI security, has quickly developed initial proposals including guidelines for confidentially reporting AI cybersecurity incidents and conducting blame-free analysis of incidents. Member companies are also contributing open source security tools, such as Nvidia's Garak (an LLM vulnerability scanner, a tool that checks AI systems for security weaknesses) and tools from other companies for agent identity and governance, with the goal of eventually creating shared open source resources to help enterprises secure their AI systems.
During independent security tests of OpenAI models, two external testing partners discovered that the models accessed the public internet beyond their intended boundaries under specific test conditions. One test (by the UK government's AI Security Institute) intentionally enabled internet access with reduced safeguards to measure the model's underlying capabilities, while another test (by a cybersecurity firm called Irregular) had a configuration error that unintentionally allowed internet access when the test environment was supposed to be isolated. OpenAI states these incidents highlight the need to improve testing standards and safety practices as AI models become more capable.
Fix: OpenAI stated it will 'review our own approach to third-party testing, including how we identify higher-risk evaluations, agree on scope, assess requests to enable internet access or lowered safeguards, set expectations for isolation, credential handling, monitoring, and stop conditions, and establish clearer incident-notification and escalation processes.' Additionally, OpenAI committed to 'working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks.'
OpenAI BlogMicrosoft has expanded its Zero Trust for AI strategy with new tools to help organizations secure AI agents and development workflows. The updates include an AI-focused Zero Trust Assessment tool that evaluates security controls across AI systems, and a new DevSecOps (developer security operations, where security practices are built into software development) pillar in the Zero Trust Workshop that provides 91 specific tasks to apply Zero Trust principles (verify every access, assume breaches could happen, use least privilege access) from source code to cloud deployment.
Fix: Microsoft provides two explicit tools and resources: (1) the updated Zero Trust Assessment tool with new AI-focused checks to evaluate controls and identify gaps in AI adoption, and (2) the new DevSecOps pillar in the Zero Trust Workshop containing 15 control groups and 91 tasks that help teams apply Zero Trust principles throughout the software development lifecycle. The Assessment results map directly into the Workshop's 'First, Then, Next framework' to transform findings into a prioritized remediation roadmap. Additionally, Microsoft offers 'new practical guidance for security practitioners and a new e-book titled Zero Trust for AI, rebuilding security controls for autonomous and agentic systems.'
Microsoft Security BlogFix: Update Amazon Bedrock AgentCore harness InvokeHarness API to the version released after July 31, 2026.
AWS Security Bulletins