All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
Microsoft's Semantic Kernel SDK (a tool for building AI agents that work together) had a vulnerability before version 1.70.0 that allowed attackers to write arbitrary files (files placed anywhere on a system) through the SessionsPythonPlugin component. The vulnerability has been fixed in version 1.70.0.
Fix: Update to Microsoft.SemanticKernel.Core version 1.70.0. Alternatively, users can create a Function Invocation Filter (a check that runs before function calls) which inspects the arguments passed to DownloadFileAsync or UploadFileAsync and ensures the provided localFilePath is allow listed (checked against an approved list of file paths).
NVD/CVE DatabaseEnclave is a secure JavaScript sandbox used to safely run code written by AI agents. Before version 2.10.1, attackers could bypass its security protections in three ways: using dynamic property accesses to skip code validation, exploiting how error objects work in Node.js's vm module (a built-in tool for running untrusted code safely), and accessing functions through host object references to escape sandbox restrictions.
Pydantic AI, a Python framework for building AI applications, has a Server-Side Request Forgery vulnerability (SSRF, where an attacker tricks a server into making requests to unintended internal resources) in versions 0.0.26 through 1.55.x. If an application accepts message history from untrusted users, attackers can inject malicious URLs that make the server request internal services or steal cloud credentials. This only affects apps that take external user input for message history.
Pydantic AI versions 1.34.0 to before 1.51.0 contain a path traversal vulnerability (a flaw where attackers can access files outside intended directories) in the web UI that lets attackers inject malicious JavaScript code by crafting a specially crafted URL. When victims visit this URL or load it in an iframe (an embedded webpage), the attacker's code runs in their browser and can steal chat history and other data, but only affects applications using the Agent.to_web feature or the CLI web serving option.
Claude Code, a tool that uses AI to help write software, had a security flaw in versions before 2.1.2 where its bubblewrap sandboxing mechanism (a security container that isolates code) failed to protect a settings file called .claude/settings.json if it didn't already exist. This allowed malicious code running inside the sandbox to create this file and add persistent hooks (startup commands that execute automatically), which would then run with elevated host privileges when Claude Code restarted.
Claude Code (an AI tool that can write and modify software) before version 2.1.7 had a security flaw where it could bypass file access restrictions through symbolic links (shortcuts that point to other files). If a user blocked Claude Code from reading a sensitive file like /etc/passwd, the tool could still read it by accessing a symbolic link pointing to that file, bypassing the security controls.
Claude Code (an AI tool that can write and run code automatically) had a security flaw before version 2.0.55 where it didn't properly check certain commands, allowing attackers to write files to protected folders they shouldn't be able to access, as long as they could get Claude Code to run commands with the "accept edits" feature turned on.
Claude Code, an agentic coding tool (AI software that can write and execute code), had a security flaw in versions before 2.0.57 where it failed to properly check directory changes. An attacker could use the cd command (change directory, which moves to a different folder) to navigate into protected folders like .claude and bypass write protections, allowing them to create or modify files without the user's approval, especially if they could inject malicious instructions into the tool's context window (the information the AI reads before responding).
N/A -- The provided content appears to be navigation menu text and marketing copy from a GitHub webpage, not technical documentation describing a security issue, bug, or vulnerability related to langchain-anthropic version 1.3.2.
LangChain version 1.2.9 includes several bug fixes and feature updates, such as normalizing raw schemas in middleware response formatting, supporting state updates through wrap_model_call (a function that wraps model calls to add extra behavior), and improving token counting (the process of measuring how many units of text an AI needs to process). The release also fixes issues like preventing UnboundLocalError (a programming error where code tries to use a variable that hasn't been defined yet) when no AIMessage exists.
A website called Moltbook, built using agentic AI (AI systems that can take actions autonomously to complete tasks), exposed all its user data because its API (the interface that lets different software talk to each other) was left publicly accessible without proper access controls. This is a predictable security failure that highlights risks when AI is used to build complete platforms without adequate security oversight.
Anthropic released Opus 4.6 and OpenAI released GPT-5.3-Codex (currently available only through the Codex app, not via API) as major new model releases. While both models perform well, they show only incremental improvements over their predecessors (Opus 4.5 and Codex 5.2), with one notable demonstration being the ability to build a C compiler (a program that translates code into machine instructions) using multiple parallel instances of Claude working together.
LangChain-core version 1.2.9 includes several bug fixes and improvements, particularly adjusting how the software estimates token counts (the number of units of text an AI processes) when scaling them. The release also reverts a previous change to a hex color regex pattern (a rule for matching color codes) and adds testing improvements.
OpenAI CEO Sam Altman publicly criticized rival company Anthropic on social media for running satirical Super Bowl advertisements that mock the idea of ads in AI chatbots, calling Anthropic 'dishonest' and 'deceptive.' Social media users mocked Altman's lengthy response, comparing it to an emotional outburst, with one tech executive advising him to avoid responding to humor with lengthy written posts.
Fix: This vulnerability is fixed in version 2.10.1.
NVD/CVE DatabaseFix: Update Pydantic AI to version 1.56.0 or later, where this vulnerability is fixed.
NVD/CVE DatabaseFix: This vulnerability is fixed in version 1.51.0. Update Pydantic AI to 1.51.0 or later.
NVD/CVE DatabaseFix: This issue has been patched in version 2.1.2.
NVD/CVE DatabaseFix: Update Claude Code to version 2.1.7 or later. According to the source: 'This issue has been patched in version 2.1.7.'
NVD/CVE DatabaseFix: This issue has been patched in version 2.0.55.
NVD/CVE DatabaseFix: This issue has been patched in version 2.0.57.
NVD/CVE DatabaseSecurity researchers discovered multiple vulnerabilities in OpenClaw, an AI assistant, including malicious skills (add-on programs that extend the assistant's abilities) and problematic configuration settings that make it unsafe to use. The issues affect both the installation and removal processes of the software.
Differentially private databases (DP-DBs, systems that add mathematical noise to data to protect individual privacy while allowing useful analysis) need auditing services to verify they actually protect privacy as promised, but current approaches don't handle database-specific challenges like varying query sensitivities well. This paper introduces DPAudit, a framework that audits DP-DBs by generating realistic test scenarios, estimating privacy loss parameters, and detecting improper noise injection through statistical testing, even when the database's inner workings are hidden.
Fix: The source presents DPAudit as a framework solution but does not describe a patch, update, or deployment fix for existing vulnerable systems. N/A -- no mitigation discussed in source.
IEEE Xplore (Security & AI Journals)PROTheft is a model extraction attack (a method where attackers steal an AI model's functionality by observing its responses to many input queries) that works on real-world vision systems like autonomous vehicles by projecting digital attack samples onto a device's camera. The attack bridges the gap between digital attacks and physical-world scenarios by using a projector to convert digital inputs into physical images, and includes a simulation tool to predict how well attack samples will work when converted from digital to physical to digital formats.
Anthropic's Claude Opus 4.6, a new AI language model, discovered over 500 previously unknown high-severity security flaws in popular open-source software libraries like Ghostscript, OpenSC, and CGIF by analyzing code the way a human security researcher would. The model was able to find complex vulnerabilities, including some that traditional automated testing tools (called fuzzers, which automatically test software with random inputs) struggle to detect, and all discovered flaws were validated and have since been patched by the software maintainers.
Fix: The CGIF heap buffer overflow vulnerability was fixed in version 0.5.1. The source text notes that Anthropic emphasized the importance of 'promptly patching known vulnerabilities,' but does not describe mitigation steps for the other vulnerabilities beyond noting they have been patched by their respective maintainers.
The Hacker NewsVersion 5.4.0 (released February 5, 2026) is an update to a security framework that documents new attack techniques targeting AI agents, including publishing poisoned AI agent tools (malicious versions of legitimate tools), escaping from AI systems to access the host computer, and exploiting vulnerabilities to steal credentials or evade security. The update also includes new real-world case studies showing how attackers have compromised AI agent control systems and used prompt injection (tricking an AI by hiding commands in its input) to establish control.
Most organizations struggle with AI security because they lack visibility and control over where employees actually use AI tools, including shadow AI (unauthorized tools), browser extensions, and AI features embedded in everyday software. Traditional security tools weren't designed to monitor AI interactions at the moment they happen, creating a governance gap where AI adoption has far outpaced security controls. A new approach called AI Usage Control (AUC) is needed to govern real-time AI behavior by tracking who is using AI, through what tool, with what identity, and under what conditions, rather than just detecting data loss after the fact.