All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
This paper presents RLAgent-GSSTI, a framework that uses reinforcement learning (RL, a machine learning technique where a system learns by receiving rewards for good actions) to automatically detect SSTI vulnerabilities (server-side template injection, where attackers manipulate template engines to execute unintended code on web servers). The framework combines code analysis tools with AI agents to both predict SSTI risks and generate attack payloads to identify vulnerabilities, achieving much lower false negative rates (missed vulnerabilities) compared to traditional security scanning tools.
Slack is launching dedicated channels called Slack Code where teams can collaborate with AI coding agents (software programs trained to help write and modify code) like Claude or Devin without switching between multiple tools. The feature includes project-specific channels, tools to compare code changes, and the ability to preview HTML output (the visual appearance of web pages) before deployment.
The AI Agent by SiteGround plugin for WordPress has an authorization bypass vulnerability (a security flaw where access controls fail to properly check user permissions) in all versions up to 1.2.7 that allows unauthenticated attackers to upload images to the WordPress media library. The plugin fails to verify that users have the upload_files capability (a permission level normally restricted to certain user roles), and because the security token called sg_ai_studio_gutenberg_nonce is given to any user with block editor access, even Contributors can exploit this to upload files they shouldn't be able to.
ChatGPT experienced a major outage starting around 8 PM ET on August 19, preventing users worldwide from logging in, creating accounts, or accessing their saved conversations, with errors showing 'too many concurrent requests.' The outage also affected OpenAI's other services, including Codex (a coding platform) and the OpenAI API (a service developers use to access ChatGPT's capabilities through code).
Stampli, a procurement and finance platform company, used Codex (an AI code generation tool) and ChatGPT Work to speed up product marketing tasks for launching their Deep Finance product. By automating content creation and data organization, they reduced an estimated 243 hours of work to about 77 hours, completing the launch in six weeks while maintaining human review of all customer-facing materials.
Agno's PythonTools has a path traversal vulnerability (a flaw where attackers use sequences like '../../' to access files outside the intended directory) in its file handling functions. Attackers can exploit this by injecting directory-traversal sequences through direct tool use or prompt injection (tricking an AI by hiding instructions in its input) to read, write, or run arbitrary files on the system.
Splunk AI Toolkit versions before 6.0.0 have a vulnerability where users with the "power" role can run arbitrary code (commands the attacker chooses) on the Splunk server by uploading a specially crafted model file. The problem occurs because the toolkit deserializes (converts stored data back into usable form) untrusted data without checking for hidden malicious code in pickle format (Python's method for storing objects).
RAG (retrieval-augmented generation, where an AI pulls in external documents to answer questions) systems that connect LLMs to sensitive databases risk leaking private information during both the retrieval phase, where embeddings (numerical representations of text) can be reversed to recover original content, and the generation phase, where raw passages are exposed to the model. The paper proposes DP2-RAG, a framework using differential privacy (a mathematical technique that adds strategic noise to protect individual data while keeping results useful) to protect both stages: it uses noise-aware retrieval with correction to maintain accuracy while adding privacy-protecting noise, and a dual utility-exponent mechanism to protect generated text while keeping semantic meaning intact.
Fix: DP2-RAG introduces two mechanisms: (1) Noise-Aware Retrieval with Correction (NARC) enforces chunk-level differential privacy by adding calibrated noise and correcting ranking bias to mitigate accuracy degradation, and (2) Dual Utility-Exponent Mechanism (DUEM) guarantees token-level differential privacy for generated surrogates through a two-layer exponential mechanism while maintaining semantic fidelity.
IEEE Xplore (Security & AI Journals)Quantum-KIP is a method that compresses training data (the examples a machine learning model learns from) into a smaller set of representative points with adjusted labels, using quantum feature maps (functions that encode data using quantum computing). The method avoids backpropagation through quantum circuits (a computationally expensive process), and includes analysis showing that the compression provides privacy benefits by limiting how much changing one training example affects the model's predictions, while remaining robust to quantum noise (errors from imperfect quantum measurements).
This paper presents LOVA, a framework that improves how AI models find vulnerable code (code with security weaknesses) by using self-attention mechanisms (the components that help AI models figure out which parts of input text are most important). The key idea is that vulnerable lines of code will receive higher attention weights from the model, allowing LOVA to pinpoint security issues more accurately across different programming languages and achieve significantly better performance than existing AI-based approaches.
Security researchers discovered Kriminal, a criminal AI service charging $12.99-$99 monthly that uses jailbreak prompts (hidden instructions that trick AI into ignoring safety rules) to bypass guardrails on legitimate AI models like Grok and Claude, then resells uncensored access for illegal activities like exploit development and social engineering. The service isn't built on its own AI model but instead routes requests through existing providers, making sophisticated offensive capabilities cheap and widely available to criminals.
AI agents (autonomous software that can take actions and make decisions) should run in sandboxed environments (isolated systems that restrict what resources and networks they can access) to limit damage if they malfunction or are compromised. The source recommends controlling what the agent can connect to, defining sandbox boundaries across execution, network, compute, credentials, and data access, restricting network traffic to only necessary connections, and using multiple layers of isolation to prevent sandbox escapes (when an AI breaks out of its restricted environment).
Fix: The source explicitly recommends several mitigations: (1) Run AI agents in sandboxed environments controlling local and network resource access; (2) For high-risk activities, use isolated, disconnected environments with pre-downloaded tools; (3) Apply sandbox isolations when external communication is necessary; (4) Restrict network access by denying all traffic by default and using allowlists to permit only required connections; (5) For cases requiring internet access, use protocol- or service-aware proxies requiring manual approval; (6) Enforce stronger isolation using multiple layers of control for high-risk activities; (7) Regularly validate configurations to identify weaknesses; (8) Use explicit prompts instructing the agent to not connect to domains outside an allowlist and not attempt to escape the sandbox; (9) Choose mature, trusted sandbox technologies designed specifically to isolate potentially malicious code.
UK NCSCShady AI refers to employees using approved AI tools in unapproved or unexpected ways, unlike shadow AI (completely unauthorized tools). A March 2026 Meta incident exemplified this when an approved internal AI agent publicly posted a response it wasn't supposed to, exposing sensitive data to unauthorized employees. Shady AI is harder to control than shadow AI because security teams can't simply block tools they've already approved and deployed across the organization.
OpenAI has implemented new security measures for its AI models, including stronger sandboxing (isolated environments where untrusted code runs safely), network isolation to prevent a single compromised system from accessing the internet or internal networks, and continuous monitoring that inspects model behavior at every token (individual word or data unit). The company also introduced a 30-minute alert response requirement and paused some training activities after discovering that an upcoming model called Astra may have advanced cybersecurity capabilities that pose risks.
Fix: OpenAI's explicit mitigations include: (1) "Workloads that execute model-generated or untrusted code must now operate within stronger sandboxes"; (2) "network boundaries have been reconfigured so that a single workload compromise cannot independently grant unauthorized access to the internet or internal networks"; (3) implementation of "a multistage monitoring framework" using "activation classifiers to inspect a model's internal activity at every sampled token" with escalation to automated investigators; (4) a "strict operational SLA" requiring that "if responders cannot conclusively prove the alert is a false positive within 30 minutes, they are required to pause the activity"; and (5) a "two-week pause in reinforcement learning training for deployment-bound models and an ongoing hold on its largest planned frontier training run."
SecurityWeekEmployees often bypass approved corporate AI tools by using personal accounts or adopting unapproved AI services (shadow AI, meaning unauthorized tools running alongside official ones) when enterprise versions lack needed features or when new AI features appear in routine software updates. This creates security and compliance risks because IT departments cannot monitor or control data flowing through these unauthorized channels.
OpenAI's Strategic Futures team launched Intelligence Age to address concentration of power risks, the idea that AI systems could allow states to project force and collect revenue without needing human cooperation, potentially removing ordinary people from political decision-making. Historically, political power has depended on soldiers, police, and bureaucrats (human workers whose cooperation was needed), but autonomous systems and machine intelligence could change this by automating force projection and eliminating the need for human labor or tax revenue from workers. The team argues that preserving human freedom requires preventing this concentration of power, as technological progress is not worth sacrificing long-term individual autonomy.
OpenAI's Strategic Futures team argues that AI poses a unique threat to human freedom through concentration of power risks, because advanced autonomous systems and machine intelligence could allow governments to project force and collect revenue without needing the cooperation and consent of people that historically sustained political power. The team contends that traditional democratic processes alone may not prevent this disempowerment, and that restructuring society to preserve individual rights while accommodating transformative AI is the most serious challenge facing free societies.
Fix: OpenAI acknowledged the issues on its status page and stated it is 'working on implementing a mitigation,' though the specific details of that mitigation were not described in the source text.
BleepingComputerOpenAI announced it temporarily slowed its scaling efforts, paused reinforcement learning (a training technique where an AI improves by learning from its own actions), and will offer zero data retention for eligible API customers to address security and privacy concerns. The company also hardened its research environment through red-teaming (simulated attacks to find weaknesses), expanded monitoring, and implemented workload and network isolation, though these monitoring efforts will add roughly 20% overhead costs. Analysts suggest these moves may be positioning OpenAI for an upcoming IPO rather than representing fundamental changes to safety practices.
Fix: OpenAI stated it will require stronger evidence of aligned behavior throughout training, is conducting smaller-scale training and evaluations to assess model behavior and validate safeguards, and will share more details about its monitoring system in a forthcoming blog post. The zero data retention program will begin in September with details provided in a technical white paper.
CSO OnlineTrueConf Server has a code injection vulnerability (a flaw where attackers can insert malicious code) that allows an unauthorized attacker with network access to port 4307/TCP to escape the isolated environment and run arbitrary code (commands of their choice) on the host system. This vulnerability is actively being exploited in the wild. The deadline to apply fixes is September 3, 2026.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 (a directive on prioritizing security updates based on risk). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. See the vendor's security advisories page at https://trueconf.com/blog/news/security-fixes-updates-and-advisories for specific patch or update instructions.
CISA Known Exploited VulnerabilitiesTrueConf Server has a missing authentication for critical function vulnerability, which means an attacker on the network can access port 4307/TCP without logging in and run arbitrary scripts (code of their choosing) on the server. This vulnerability is currently being exploited by attackers in the wild.
Fix: Upgrade Splunk AI Toolkit to version 6.0.0 or later.
NVD/CVE Database