Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Kludex Starlette contains an HTTP request/response smuggling vulnerability (a technique where attackers manipulate how web servers process requests and responses) that allows attackers to inject malicious paths into the host part of a URL, potentially bypassing authentication systems that rely on checking the URL's path. This vulnerability is being actively exploited by attackers in the wild.
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-09-16.
CISA Known Exploited VulnerabilitiesNLTK's Stanford wrapper classes have a security vulnerability where the `java_options` parameter bypasses validation that was supposed to block dangerous JVM (Java Virtual Machine, the software that runs Java programs) flags like `-agentpath` and `-javaagent`. While a previous fix added validation through the `config_java()` function, the per-call `options` parameter in the `java()` function skips this validation entirely, allowing attackers to inject malicious JVM arguments and execute arbitrary code.
A vulnerability in Kibana's machine learning feature allows users with only read access to view data they shouldn't have permission to see. The problem occurs because an operation runs with elevated internal service permissions instead of the user's actual permissions, letting attackers access unauthorized information from Elasticsearch (a data storage system) without needing special cluster or index privileges.
Elasticsearch's machine learning component has a vulnerability where it unsafely processes untrusted data during deserialization (the conversion of saved data back into usable objects), allowing attackers to inject and execute malicious code through specially crafted trained models. An attacker would need valid authentication and permissions to create and deploy models to exploit this flaw.
A flaw in the nanoid library causes an integer overflow (a calculation error where a number wraps around to an unexpected value) when the size parameter exceeds 2^31, permanently breaking the random number generator for the entire process and making all generated IDs return the identical string "uuuuuuuuuuuuuuuuuuuuu". This allows attackers to predict session tokens, CSRF tokens (data that prevents forged requests), and other security-critical identifiers by passing a large user-controlled value to the size parameter, which persists until the process restarts.
Amazon SageMaker Python SDK stores HMAC keys (cryptographic secrets used to verify data hasn't been tampered with) in plain text in pipeline definitions, allowing users with DescribePipeline permissions to read these keys and inject malicious code into other users' pipeline executions within the same AWS account. The vulnerability affects SageMaker Python SDK v3 versions before v3.11.0 and v2 versions before v2.256.0.
OpenAI Codex Desktop for Windows and macOS automatically checked Git metadata (version control system files) when opening a workspace, which could allow an attacker to run malicious code if the repository contained a specially crafted .git/config file (Git's configuration file). This malicious code would run with the user's full permissions outside of Codex's security protections, potentially letting the attacker read, modify, or delete files and steal credentials.
OpenAI's Codex CLI and Desktop tools automatically collected Git repository metadata without disabling a Git setting that could run attacker code. If a user opened a specially prepared repository with a malicious core.fsmonitor setting (a Git configuration that monitors file system changes), the attacker's code could run with the user's full privileges, potentially reading, modifying, or deleting files. This attack requires the repository to be delivered with the malicious configuration already in place, since normal Git cloning doesn't preserve these local settings.
OpenAI's Codex CLI and Desktop tools have a vulnerability where they incorrectly identify certain PowerShell commands as safe due to misunderstanding PowerShell's stop-parsing token (--%, a special symbol that changes how PowerShell interprets commands). An attacker can exploit this by preparing a malicious repository that, when opened by a user, tricks Codex into running file-writing commands without asking for permission, potentially modifying Codex's configuration to launch attacker-controlled code with the user's privileges.
OpenAI Codex Desktop for Windows and macOS has a vulnerability where it automatically runs Git hooks (scripts that execute during Git operations) from a repository's local settings without checking if they're malicious. An attacker can create a specially prepared repository that, when opened in Codex, runs their malicious hook with the user's full permissions, potentially allowing them to steal, modify, or delete files.
MLflow's statsmodels flavor has a security control bypass that allows remote code execution (RCE, where an attacker can run commands on a system they don't own) even when pickle deserialization is disabled. The statsmodels flavor loads model files using pickle (a Python method for serializing objects) without checking the `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` security control, so an attacker can upload a malicious model artifact and execute arbitrary code when someone loads it with `mlflow.pyfunc.load_model()`.
A vulnerability in Hugging Face Transformers (a library for building AI models) versions 4.49.0 through 5.8.1 allows attackers to write Python files to a user's computer without permission when using the GenerativePreTrainedModel.load_custom_generate() function. The problem occurs because the function downloads and saves remote code before checking if the user trusts that code, breaking the security model used elsewhere in the library. Even if a user refuses the trust prompt, malicious code files are already saved to disk and can persist across sessions.
OpenAI's ChatGPT Work (an enterprise AI agent) and Microsoft Outlook both experienced outages on Monday, with users unable to access or use these services for several hours. OpenAI reported elevated errors and latency in ChatGPT Work, while Microsoft had issues with Exchange Online (the cloud service that powers Outlook), though the outages appeared to be unrelated.
A security flaw was found in Doccano (an open-source tool for labeling data used in machine learning projects) version 1.8.5 and earlier that allows attackers to bypass access controls (protections that restrict who can do what) through the bulk-delete endpoint. The flaw can be exploited remotely (from anywhere over the internet), the exploit code has been publicly released, and the vendor has not responded to early notifications about the problem.
A security flaw was found in Doccano, an open-source tool used to label data for machine learning projects, affecting versions up to 1.8.5. The vulnerability is in a specific function that handles project examples and allows attackers to bypass access controls (restrictions on who can view or modify data), and the attack can be done remotely over the internet. The vendor was notified but did not respond, and working exploits are already publicly available.
MCPHub is a system that manages multiple MCP servers (APIs that handle specific tasks) and routes requests to them. Before version 1.0.32, the software had a security flaw where non-admin users could create or modify global prompt templates and resources (stored instructions shared across all users) because the system didn't check user permissions. This allowed attackers to inject malicious prompts (hidden instructions in input) that would affect other users' AI sessions.
Eclipse Theia versions 1.73.0 to 1.75.0 have a vulnerability in AI 'Agent Mode' where file-writing tools don't check if file paths stay within the workspace (the allowed project folder). An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to make the AI write files anywhere on the system, potentially modifying shell startup files or SSH keys to run malicious code with the privileges of the server running Theia.
A code injection vulnerability in ash_ai allows unauthenticated attackers to execute arbitrary Elixir code (a programming language) on a server. The vulnerability occurs because the system uses EEx.eval_string/2 (a template evaluator that treats input as code) to process user-supplied prompt text, meaning an attacker can embed malicious commands that get executed before any AI model even processes the request.
NextChat versions 2.15.8 through 2.16.1 have a security flaw in their proxy endpoint (a server component that forwards requests) where URL validation uses simple text matching instead of proper hostname parsing. This allows attackers to craft malicious URLs containing the text 'api.openai.com' to trick the server into sending its OpenAI API key (a secret credential for accessing OpenAI's services) to them.
JFrog Artifactory has an improper authentication vulnerability (a flaw in how the software checks whether users are who they claim to be) that allows attackers without valid credentials to gain admin access through its default configuration. This is being actively exploited by real attackers in the wild.
Fix: Apply mitigations according to vendor instructions from JFrog's security advisories at https://docs.jfrog.com/releases/docs/jfrog-security-advisories, following CISA's BOD 26-04 guidance for patching timelines and risk assessment. If mitigations are unavailable, discontinue use of the product.
CISA Known Exploited VulnerabilitiesFix: Update to SageMaker Python SDK v3.11.0 or later, or update to SageMaker Python SDK v2.256.0 or later.
AWS Security BulletinsFix: Add a guard check to `mlflow/statsmodels/__init__.py` in the `_load_model` function that mirrors the pattern used in other flavors like sklearn. The fix imports `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` and related Databricks utilities, then raises an `MlflowException` if pickle deserialization is disabled and the code is not running in a Databricks environment, with an error message explaining that the statsmodels model requires pickle and directing users to set `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` to `'true'` to allow it.
GitHub Advisory DatabaseFix: OpenAI stated it was 'continuing work on implementing a mitigation' and that the team was 'working on a fix.' Microsoft said it was 'reviewing service telemetry and diagnostic data to isolate the source of the issue,' but no specific fix or timeline was provided in the source text.
CNBC TechnologyFix: This issue has been patched in version 1.0.32.
NVD/CVE DatabaseFix: Update to Eclipse Theia version 1.75.0 or later.
NVD/CVE DatabaseFix: The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated. This issue affects ash_ai versions from 0.1.0 before 1.0.0, meaning users should upgrade to version 1.0.0 or later.
NVD/CVE Database