All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
A UK study by the thinktank Demos found that AI chatbots like ChatGPT gave voters false information in response to 34% of questions about the Scottish election, including made-up scandals and invented candidates. The Electoral Commission has called for new legal controls to regulate AI platforms and prevent this kind of misinformation (false information spread to deceive people).
1Password partnered with OpenAI to protect credentials from being leaked by AI coding agents, which are AI systems that can write and deploy software automatically. The companies created an Environments MCP Server (a module that connects different systems together) for Codex that gives AI agents access to credentials only when needed, without storing them in code, prompts, or the AI model's memory where they could be stolen. Credentials are issued just-in-time, scoped to specific tasks, and kept encrypted in 1Password's vault rather than exposed where attackers could find them.
Tech companies have long promised AI assistants but delivered disappointing results until recently, with OpenClaw, an open-source AI agent platform (software that can perform tasks autonomously), gaining popularity. Google has now announced new AI agents at I/O 2026 that can perform various tasks like gathering information and planning events, running continuously in the background with claimed seamless integration.
Anthropic patched a vulnerability in Claude Code's network sandbox (a restricted environment that controls where the AI can send data) that could have allowed attackers to bypass security controls and steal sensitive information. The vulnerability, called a SOCKS5 hostname null-byte injection issue (a trick where attackers hide a malicious server address using special characters to fool the security filter), was silently fixed in version 2.1.88 released on March 31, 2025, but was never publicly disclosed or assigned a tracking identifier.
A malicious version of Bitwarden CLI was published on npm for 90 minutes in April 2026, stealing developer credentials through a compromised GitHub Action (an automated workflow tool). The incident received a CVE (common vulnerabilities and exposures, an official vulnerability identifier), but the CVE only notified defenders after the fact rather than providing a patch to apply, highlighting how CVE has drifted from its original purpose of identifying code flaws with fixable versions to tracking security incidents.
NVIDIA Triton Inference Server has a vulnerability in its DALI backend (a component that processes data) that allows attackers to cause uncontrolled resource consumption, potentially leading to a denial of service attack (making the service unavailable to legitimate users).
NVIDIA Triton Inference Server has a vulnerability in its DALI backend (a component that processes data) where an attacker could trigger an integer overflow (a bug where a number exceeds the maximum value a system can store). This could allow an attacker to execute malicious code, modify data, or crash the service.
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend (a component that processes data) where an attacker could perform an out-of-bounds read (accessing memory locations outside the intended range). Exploiting this could allow code execution (running malicious commands), data tampering (changing information), denial of service (making the system unavailable), or information disclosure (leaking sensitive data).
NVIDIA Triton Inference Server has a vulnerability where an attacker could cause an integer overflow (a situation where a number exceeds the maximum value a program can store, causing unexpected behavior), potentially leading to denial of service (making a system unavailable to users). The vulnerability has a CVSS 4.0 severity rating (a 0-10 scale measuring how serious a security flaw is).
CVE-2026-24209 is a path traversal vulnerability (a flaw where an attacker manipulates file paths to access files outside their intended directory) in NVIDIA Triton Inference Server that could allow an attacker to cause a denial of service (making a system unavailable to users). The vulnerability has a CVSS 4.0 severity rating, though a full assessment from NIST has not yet been provided.
NVIDIA Triton Inference Server contains a path traversal vulnerability (CWE-22, a flaw where attackers can access files outside the intended directory) that could allow an attacker to cause a denial of service (making the service unavailable). The vulnerability has a CVSS 4.0 severity rating, though a detailed assessment has not yet been provided by NIST.
AI, particularly agentic AI (AI systems that can plan and take actions independently), is making attacks on applications faster, cheaper, and more widespread than ever before. Attackers are now targeting all apps as primary threats rather than some being less important, and apps face hostile attacks within hours of being published online instead of days. Critical sectors like medical devices and automotive apps are seeing the steepest increases in attacks because AI tools have made it easier to reverse engineer (understand how software works by analyzing it) the complex, specialized code that once protected these systems.
Simply using security and privacy benchmarks (standardized tests that measure how well a system performs) is not enough to ensure AI is truly secure, because benchmarks don't accurately measure AI capabilities. Instead of relying on benchmarks alone, organizations should apply proven security engineering practices, such as process-driven standards like BSIMM (Building Security In Maturity Model, a framework that guides companies through security best practices), while staying extra vigilant since AI systems don't have a single reliable security measurement like software does.
Google and other companies are expanding AI labeling systems like SynthID (invisible watermarking that tags AI-generated images) and C2PA Content Credentials to help people identify fake or AI-generated content online. These technologies aim to combat deepfakes (manipulated videos or images made to look realistic) and other misleading AI content that has been deceiving people on social media.
Fix: 1Password introduced an Environments MCP Server for Codex that implements just-in-time credential access. According to the source, the solution works by: (1) issuing credentials only when needed and scoped to the specific task, (2) keeping secrets outside the model's context window, (3) providing a secure runtime environment where secrets are mounted, used, and discarded with user authentication required at access time, (4) using 1Password's vault technology to keep secrets end-to-end encrypted and centrally managed, (5) limiting access through custom permissions, and (6) injecting required variables directly into the application process at runtime so credentials exist in memory only for the authorized process and only as long as needed. The source states: 'The credentials never appear in code, terminals, or model context.'
SecurityWeekIndustrial Internet of Things (IIoT, which is the network of physical devices and machines used in factories and industries) faces unique security challenges that make existing vulnerability analysis techniques difficult to apply directly. Researchers developed TS-VulA, a framework that uses machine learning (ModernBERT, a neural network trained on text) and network analysis to identify vulnerabilities in three stages: assessing individual device risks, calculating which devices are most important to protect, and prioritizing which vulnerabilities to fix based on both risk and device importance.
This research addresses leaky private information retrieval (L-PIR), a system where a user queries a database while accepting some measurable privacy leakage, quantified using differential privacy (a mathematical framework that bounds how much information an observer can learn about individual data). The researchers developed an improved L-PIR scheme that reduces privacy leakage from O(K) to O(log K) by using cyclic permutations (mathematical rearrangements) and assigning higher probabilities to keys with lower Hamming weights (fewer 1-bits in binary representation), achieving better privacy-to-cost tradeoffs than previous methods.
Model extraction attacks (MEA, where attackers steal the functionality of AI models by creating a clone with similar behavior) are a security threat that defenders counter by using auxiliary data to make the victim model give misleading predictions. However, realistic auxiliary data is hard to obtain, gives inconsistent protection, and doesn't protect all data categories equally. The paper proposes MDV (Model Defense Variational Autoencoder, a machine learning technique that generates synthetic data rather than using real data) to create virtual auxiliary data that effectively addresses all three problems.
Fix: The proposed solution is to use Model Defense Variational Autoencoder (MDV) to generate virtual auxiliary data as a replacement for realistic auxiliary data. MDV combines a Variational Autoencoder (VAE, a machine learning model that generates new synthetic data similar to training data) and a classifier, forcing learned features to follow different statistical distributions by category, then samples synthetic data from low-likelihood regions of these distributions to use as auxiliary data in defense methods.
IEEE Xplore (Security & AI Journals)Researchers have developed a new backdoor attack method called Trigger without Trace (TwT) that can secretly compromise text-to-image diffusion models (AI systems that generate images from text descriptions) while avoiding detection. The method works by using syntactic structures (grammar patterns) as hidden triggers and employing a mathematical technique called Kernel Maximum Mean Discrepancy (KMMD, a way to match statistical distributions) to make malicious samples look identical to legitimate ones, achieving a 97.5% success rate while bypassing three existing defense detection systems.
Vul-CTG is a new AI framework for detecting software vulnerabilities (bugs that create security weaknesses) by combining two approaches: PLMs (pretrained language models, AI systems trained on large amounts of text) and GNNs (graph neural networks, AI systems that analyze connected data structures). The framework improves on existing methods by better combining code text analysis with program graph analysis, using contrastive learning (training the AI to recognize similarities and differences) and handling unreliable training labels, achieving about 3% better accuracy than previous approaches.
This research presents a method to detect deepfakes (AI-generated fake videos or images of faces) by identifying inconsistencies in how image quality degrades between the background and the manipulated face regions. The approach uses a framework that learns to spot these degradation differences through two connected neural networks (deep learning models), one that creates fake images and another that detects them, working together in an adversarial process similar to a GAN (generative adversarial network, where two AI systems compete to improve each other). The method shows better performance when detecting deepfakes created by new, unseen manipulation techniques.
Fix: The vulnerability was fixed in Claude Code version 2.1.88, released on March 31, 2025. According to Anthropic, the fix was included in a public commit to the 'sandbox-runtime' repository on March 27, 2025.
SecurityWeek