Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
The `set_functype_version` tool in functype-mcp-server accepts any version string without validation and installs it via `pnpm add`, allowing an attacker to supply a malicious package path (like `file:/path/to/evil`). After installation, the server immediately imports the package using dynamic import (a technique where code loads modules at runtime), executing arbitrary attacker code with full server privileges (RCE - remote code execution).
Nuxt Ollama version 1.2.26 has a vulnerability where API keys for the Ollama service are accidentally placed in public runtime configuration (data that gets sent to web browsers). This means anyone can visit the website, look at the page source code, and steal the API key in plain text, then use it to make expensive API calls at the website owner's expense.
Two vulnerabilities (CVE-2026-87912 and CVE-2026-87913) were found in AWS Security Agent plugins where the system doesn't verify that an S3 bucket (cloud storage container) actually belongs to the account using it. This allows attackers to intercept private source code archives containing sensitive data like credentials and infrastructure information by creating buckets with predictable names based on publicly known account identifiers.
A vulnerability was found in awslabs mysql-mcp-server (a Model Context Protocol server, which is software that helps AI models interact with MySQL databases) versions 1.0.21 and earlier. An attacker could bypass the read-only protection by using SQL inline comments (special text that gets ignored by the database), allowing them to run commands that should have been blocked. However, the read-only mode is only a basic safeguard, and the real protection depends on the database user permissions (access rules) that are set up.
n8n, an open source workflow automation platform, had a security flaw in its OpenAI Chat Model node where credential restrictions (rules about which websites are allowed) were not checked when searching for models in the editor dropdown. This allowed a workflow editor to redirect the API credential to an attacker's server by changing the base URL (the main web address where requests are sent). The vulnerability existed because the code that checks allowed domains was missing from the model-search feature.
n8n (a workflow automation tool) had a security gap where the '_This workflow can be called by_' access control (a setting that restricts who can run a workflow) was ignored when that workflow was used as a tool in an Agent (an AI system that can perform actions). This meant someone could use an Agent to run workflows they weren't supposed to have access to and see their results.
The Windows ML CLI tool exposes commands over HTTP on localhost without authentication and sets CORS (cross-origin resource sharing, which controls what websites can access a server) to allow all origins via a wildcard. This means any website you visit can call the CLI endpoint, and if you use the '--trust-remote-code' flag with a malicious model repository, an attacker can execute arbitrary code on your computer when the server imports that model.
A vulnerability in MLflow (a platform for managing machine learning workflows) versions 0.0.1 and newer allows attackers to run arbitrary code (unrestricted commands) on a user's computer by creating a malicious model artifact (a saved machine learning model file) that executes when someone loads it into their project.
GitHub Copilot and Visual Studio Code have a security flaw where credentials (secret login information) are not properly protected, allowing an attacker on a network to steal and expose this sensitive data.
GitHub Copilot and Visual Studio Code have a vulnerability where special characters in commands aren't properly filtered, allowing an attacker to inject malicious commands (command injection, where an attacker manipulates input to run unintended commands) and access sensitive information over a network.
NVIDIA Triton Inference Server for Linux has a security flaw where missing authorization checks allow attackers to access or modify data and disrupt service. An attacker could exploit this to steal information, change data, or make the system unavailable.
NVIDIA Triton Inference Server for Linux has a security flaw (CVE-2026-16497) where an attacker can trick the system into repeating operations excessively, potentially causing a denial of service (a situation where a service becomes unavailable to legitimate users).
China-based AI companies like DeepSeek, Alibaba, and Moonshot AI are systematically stealing capabilities from U.S. AI models through knowledge distillation (a technique where one AI learns by studying another AI's outputs), extracting billions of data tokens since late 2024 by routing requests through APIs (application programming interfaces, which are interfaces that let software communicate), cloud providers, and proxy services to hide their identity. These companies use tactics like chain-of-thought reasoning extraction (pulling out the AI's step-by-step thinking process) and automated failover switching to bypass security measures, allowing them to train their own models faster and cheaper while threatening U.S. technological leadership.
A vulnerability was discovered in Ollama software up to version 0.31.1 that allows an integer overflow (a situation where a number calculation exceeds the maximum value a program can store, causing it to wrap around) in the GGUF Decoder component (the part that reads model files). An attacker can remotely exploit this vulnerability, and the exploit code has been made public.
A vulnerability was discovered in ModelCloud GPTQModel up to version 7.2.0 that allows an attacker to cause an out-of-bounds read (accessing memory outside the intended range) by manipulating the g_idx argument in the Triton dequantization kernel (a component that decompresses compressed numerical data). This vulnerability can be exploited remotely and has been publicly disclosed.
A security flaw (CVE-2026-85704) was found in the freegpt-webui project's Jailbreak Mode feature, affecting a function called getJailbreak in the server/config.py file. The flaw creates a race condition (a bug where the timing of operations causes unexpected behavior), which can be exploited remotely, though it requires significant technical skill to carry out. The vulnerability affects an older version of the product that is no longer maintained.
A vulnerability (CVE-2026-85703) was found in freegpt-webui, a web interface for accessing free AI services, in a feature called Jailbreak Mode that allows users to bypass AI safety restrictions. The flaw lets attackers remotely cause the system to waste computing resources (allocation of resources), and because the code has been publicly released, attackers can easily use this exploit. The affected software is no longer being maintained by its creator.
CVE-2026-85787 is a vulnerability in Amazon's postgres-mcp-server (a tool for connecting AI systems to PostgreSQL databases) where the SQL validation component doesn't block all dangerous inputs, allowing attackers to craft malicious SQL commands that let them modify data they shouldn't be able to access, even though the server is supposed to be read-only (restricted to viewing data only).
Amazon awslabs.dynamodb-mcp-server, an open-source tool that lets AI assistants work with Amazon DynamoDB (a database service), has a code injection vulnerability in its CDK generator (the part that creates infrastructure-as-code templates). An attacker could craft malicious table or attribute names in a data model file to execute arbitrary code on the host machine that deploys the generated application.
CodeWhale versions before 0.8.64 have a vulnerability where a malicious config file (`.codewhale/config.toml`) in a cloned repository can secretly enable the `allow_shell` setting, giving an AI model the ability to run arbitrary shell commands on a user's computer without their knowledge. This bypasses the security boundary that `allow_shell` was designed to protect, since the setting can be enabled by repository maintainers without the user explicitly opting in.
Fix: Move the `api_key` from public runtime config to private runtime config by separating it from other options during module setup. The `api_key` should only be used on the server side through `useRuntimeConfig().ollama.api_key` in server utilities, not sent to the browser. The source text provides a code diff showing how to split `api_key` from `publicOptions` and place it in `runtimeConfig.ollama` instead of `runtimeConfig.public.ollama`.
GitHub Advisory DatabaseFix: Update aws-agents-for-devsecops to version 1.1.0 or later, and update AWS Security Agent MCP server to version 0.2.0 or later.
AWS Security BulletinsFix: This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
NVD/CVE DatabaseFix: The issue has been fixed in n8n versions 2.37.7 and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should: restrict n8n instance access to fully trusted users only, audit workflows attached as Agent tools and review their caller policy settings, or remove sensitive workflows from Agent tool configurations until the instance is patched. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
GitHub Advisory DatabaseFix: The NSA, CISA, and FBI recommend U.S. AI companies take three immediate actions: (1) Implement comprehensive detection and mitigation by detecting anomalous and malicious prompts, accounts, networks, and behaviors, and monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns. (2) Deploy targeted response changes by subtly altering responses for suspected malicious distillation attempts to reduce the benefit to attacking companies. (3) Enable coordinated information-sharing across the U.S. Government, private industry, and allied nations.
CISA Cybersecurity AdvisoriesFix: Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b.
NVD/CVE DatabaseFix: Upgrading to version 7.3.0 resolves this issue. The patch is identified as 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1.
NVD/CVE DatabaseFix: Update the postgres-mcp-server package to version 1.1.7 or later. The vulnerability affects all PyPI package versions before 1.1.7.
AWS Security BulletinsFix: Users should upgrade to CodeWhale version 0.8.64 or later, which contains the fix in commit 43563356b98c6b993085554da82e77370160a31c.
GitHub Advisory Database