All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Splunk AI Toolkit versions before 6.0.0 have a security flaw where users without admin permissions can control containers and access sensitive data through the REST API (a method for software to communicate over the internet). This happens because the API doesn't properly check whether users have permission to perform these actions.
Fix: Upgrade to Splunk AI Toolkit version 6.0.0 or later.
NVD/CVE DatabaseIn Splunk AI Toolkit versions before 6.0.0, a race condition (a flaw where the order of simultaneous operations causes unexpected behavior) allows a user to overwrite a model that another user is uploading by sending a competing upload request with the same model name. This happens because the toolkit does not verify that the uploaded content actually belongs to the request that creates the model lookup entry (a database record linking a model name to its contents), potentially allowing an attacker to inject malicious content.
In Splunk AI Toolkit versions before 6.0.0, there is a privilege escalation vulnerability (a security flaw where a user gains higher access levels than they should have) in the Agent Run History feature. Users without admin or power roles could run searches with system-level privileges, access other users' data, and delete search jobs by exploiting how the system replaces user credentials with a system authentication token.
In Splunk Enterprise versions before 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a low-privilege user can trick another user into running harmful commands through the Data Model Editor by sending them a malicious link (phishing attack). These commands could access data and damage the system because Splunk Web doesn't properly filter risky SPL commands (Search Processing Language, the query language Splunk uses) in this specific tool.
OpenAI's CFO Sarah Friar announced that the company plans to become a public company in 2027, though it could happen sooner if business performance remains strong. OpenAI has already confidentially filed its IPO prospectus (initial public offering document, which is a formal filing required to sell stock to the public) with the Securities and Exchange Commission and raised $122 billion in March, giving it financial flexibility for the public debut.
Agentic AI (AI systems that can take independent actions without human approval for each step) introduces new security risks for organizations, particularly concerning insider threats where the AI itself could become a danger. Katie Moussouris from Luta Security explains that enterprises now need to monitor their own AI agents for potential risks, especially following a recent attack on Hugging Face (a popular platform for sharing AI models).
The mcp-searxng server has a feature in hardened mode that tries to prevent SSRF (server-side request forgery, where an attacker tricks a server into fetching URLs it shouldn't) attacks on the web_url_read function. However, three bypasses still exist: redirects from allowed URLs to internal addresses aren't re-checked, the address 0.0.0.0 isn't blocked as internal, and IPv6-mapped IPv4 addresses can bypass checks after the URL parser converts them to a different format.
SearXNG MCP Server has an SSRF vulnerability (server-side request forgery, where a server is tricked into fetching URLs chosen by an attacker) in its web_url_read tool because the internal-address guard is disabled by default. An attacker who can control the URL input (for example, through prompt injection, where hidden instructions in AI input trick the model into producing malicious content) can make the server fetch private internal services or cloud metadata and return their contents, but this only happens when the MCP_HTTP_HARDEN setting is off by default.
# Analysis ## Summary The Contentful MCP Server tools `export_space` and `import_space` accept LLM-controlled parameters like `host` and `proxy` that are passed directly to the API client without filtering, allowing an attacker to redirect the server's API credentials (a Personal Access Token, or PAT) to their own server. An attacker can exploit this by directly calling these tools with a malicious `host` parameter, or by embedding instructions in Contentful content that trick the LLM into mak
claude-faf-mcp (a tool that helps Claude interact with projects) had a security flaw where it didn't properly limit which files users could read or write. An attacker could use prompt injection (tricking the AI by hiding instructions in user input) to read sensitive files like SSH keys or cloud credentials stored outside the intended project folder. The vulnerability affected file-reading and file-writing tools that accepted file paths without proper restrictions.
faf-mcp (a tool that helps AI assistants work with files) had a security flaw where it accepted file paths from callers without properly restricting access to a safe directory. This meant an attacker could trick the system into reading sensitive files like SSH keys or cloud credentials, or writing files outside the intended project folder, by using absolute paths or directory-traversal tricks (like `../`). The vulnerability could be exploited through prompt injection (hiding malicious instructions in user-provided content that an AI processes).
Several tools in grok-faf-mcp (a server that helps AI assistants work with project files) accept a file path argument from users without properly checking that the path stays within the intended project folder. This means an attacker could use path tricks like `../` or absolute paths to read any file on the system that the server process can access, including SSH keys, cloud credentials, or environment files. An LLM (large language model) could even be tricked via prompt injection (hiding instructions in user-supplied content like web pages or README files) into making these malicious file-read requests.
Google is launching a new student hub within Gemini, its AI assistant, that helps students organize research, create flashcards, take practice quizzes, and manage study materials in one place. The update also adds features like graph and image support in study notebooks, automatic calendar integration for test dates, and Deep Research capability in Gemini Live (a conversational AI mode) to help students generate and discuss complex research reports.
LangGraph Server had an authorization bug where creating a run could bypass security checks and access another user's private assistant if custom authorization handlers only registered an `assistants.read` handler (a permission check for reading assistants). This allowed the requesting user to see sensitive configuration data like metadata, config, and context from assistants they shouldn't have access to.
LangGraph Server had a security flaw where webhooks (automated messages sent to other services) with relative targets could bypass authentication checks by routing requests internally without verifying the user's identity. This could allow one user to create or modify runs (execution records) on threads (conversation sessions) owned by another user, and view limited information about other users' threads.
This is a release of llama-index version 0.14.24, which fixes numerous bugs across the core indexing system and related modules. The fixes address issues like improper file handling, document parsing errors, memory storage problems, and compatibility with different AI models like Claude and Gemini.
OpenAI revoked access to its Trusted Access for Cyber (TAC) program, a special initiative that gives vetted security researchers access to advanced AI models with fewer safety restrictions for legitimate cybersecurity research, for several researchers outside the U.S. and Europe. OpenAI confirmed the revocations were caused by a technical error affecting a limited number of users in the Daybreak Blue tier (the latest level of TAC access). The company asked affected researchers to reapply and complete the verification process again.
Fix: Upgrade to Splunk AI Toolkit version 6.0.0 or later.
NVD/CVE DatabaseFix: Update Splunk Enterprise to version 10.4.1, 10.2.6, 10.0.8, or 9.4.13 or later, depending on which branch you are running.
NVD/CVE DatabaseAn AI platform called 'Kriminal' is designed without safety guardrails (built-in restrictions that prevent harmful outputs), allowing it to help with social engineering (manipulating people into revealing secrets), cybercrime, and OSINT scanning (gathering public information about targets) for anyone who pays with cryptocurrency. Although the company claims to forbid illegal use, the platform's unrestricted design makes it easily accessible for malicious purposes.
Fix: The source text describes the desired remediation but does not provide a concrete patch or version fix. The recommended approach stated is: 'Enable the internal-address filtering by default (fail safe): make assertUrlAllowed run unconditionally and require an explicit opt-out only for trusted environments. Strengthen the check to resolve the host and reject loopback, link-local/metadata (169.254.0.0/16), 0.0.0.0/8, and private ranges, and re-validate on every redirect hop (or pin to the validated IP).' No patched version is mentioned in the source.
GitHub Advisory DatabaseFix: Fixed in version 5.7.2 by adding path confinement that restricts file access to the project directory. Users should upgrade by running: `npm install -g claude-faf-mcp@5.7.2`. The fix also rejects absolute paths and directory-traversal attempts (like `../`). As a temporary workaround before upgrading, set the `FAF_ALLOWED_ROOTS` environment variable to limit operations to a single trusted project directory.
GitHub Advisory DatabaseFix: Fixed in version 2.1.3 by adding path confinement: reads are restricted to `.faf` / `.fafm` context files only, general file operations are confined to the project root (with an optional `FAF_ALLOWED_ROOTS` environment variable to override), symlink bypasses are closed, and absolute paths and `../` escapes are rejected. Upgrade with `npm install -g faf-mcp@2.1.3` or use `npx faf-mcp`. If you cannot upgrade immediately, run the server only on trusted local projects and set `FAF_ALLOWED_ROOTS` to a single project directory for a hard boundary.
GitHub Advisory DatabaseFix: Fixed in version 1.5.3 by confining all user-supplied paths before accessing files: reads are restricted to `.faf` / `.fafm` context files only, general file operations are limited to the project root directory (with an override option via the `FAF_ALLOWED_ROOTS` environment variable), and paths are canonicalized through symlinks with absolute paths and `../` escapes rejected. Upgrade with: `npm install -g grok-faf-mcp@1.5.3` (or `bunx grok-faf-mcp`).
GitHub Advisory DatabaseOpenAI is introducing Private Safety Processing, a system designed to detect harmful patterns across multiple interactions with AI models while keeping customer data private. Unlike traditional safety systems that review individual interactions separately, this new approach uses automated pattern detection across related interactions without giving OpenAI staff access to the actual prompts or responses. For customers using Zero Data Retention (a policy where OpenAI doesn't keep user data after processing), content can stay on the customer's own systems or be stored on OpenAI's servers encrypted with keys only the customer controls.
Fix: OpenAI is developing Private Safety Processing, which the source describes as using automated systems to identify patterns across related interactions without exposing underlying prompts or responses to OpenAI personnel. For Zero Data Retention deployments, customer content can remain on infrastructure the customer controls, or OpenAI is developing an option where content is stored on OpenAI infrastructure but encrypted with keys controlled by the customer. When risks are identified, OpenAI personnel receive only narrowly defined safety signals rather than access to the actual customer content. The source states: 'Private Safety Processing is currently being tested with early customers.'
OpenAI BlogOpenAI is introducing Private Safety Processing, a new system designed to monitor AI safety risks across multiple interactions without retaining or exposing customer data to OpenAI staff. For customers using Zero Data Retention (a privacy option where prompts and responses aren't kept after processing), this system uses automated detection to identify harmful patterns while keeping content either on the customer's own infrastructure or encrypted with customer-controlled keys on OpenAI servers.
Fix: OpenAI has developed Private Safety Processing as an explicit solution. Key features include: (1) automated systems identify patterns across related interactions without OpenAI personnel accessing underlying content, (2) customer content can remain on infrastructure the customer controls, or stored on OpenAI infrastructure encrypted with customer-controlled keys, (3) when risks are identified, OpenAI receives only narrowly defined safety signals rather than the full content, and (4) customers can investigate alerts using their own systems and voluntarily share information with OpenAI if they choose. The system is currently in preview testing with early customers.
OpenAI BlogFix: Run creation and cron-creation paths now dispatch the `assistants.read` authorization event in both the in-memory and gRPC/Postgres runtimes, matching direct assistant reads. Fixed in `langgraph-api` 0.10.0. Deployments with custom handlers should register an `assistants.read` handler that returns an owner-style filter, and confirm parity across the assistant read, search, and run/cron creation paths.
GitHub Advisory DatabaseFix: Upgrade to langgraph-api version 0.10.0 or later. The webhook URL policy now has `webhooks.url.disable_loopback` enabled by default, which blocks loopback delivery (requests sent back to the same server). If your deployment legitimately needs to send webhooks to routes on the same process, you can set `webhooks.url.disable_loopback: false` in `langgraph.json` or the equivalent `LANGGRAPH_WEBHOOKS` environment variable configuration, but only if you control those routes and apply authorization checks within them.
GitHub Advisory DatabaseFix: OpenAI asked the affected researchers to reapply and complete the verification process to regain access to the Daybreak Blue tier of the TAC program.
TechCrunch (Security)