New tools, products, platforms, funding rounds, and company developments in AI security.
Attackers compromised multiple npm packages (software libraries that Node.js developers use) by exploiting stolen developer credentials and a vulnerability in GitHub Actions (automation tools that run code when developers submit changes). The malware steals sensitive information like passwords, SSH keys (authentication credentials), and cloud credentials from developer machines.
Fix: Security researchers advise organizations to completely rebuild from clean images any developer machines that have installed a poisoned package and to rotate all npm tokens, source control access, cloud credentials, CI/CD secrets, SSH keys, signing keys, and browser sessions. The AsyncAPI project had a proposed fix to the GitHub Actions vulnerability since May 17, but it had not yet been merged into the main branch at the time of the attack.
CSO OnlineCybersecurity researchers discovered TuxBot v3 Evolution, an IoT botnet (malicious software that infects Internet-connected devices to use them for attacks) that was developed with help from an LLM (large language model, an AI system trained on text). The botnet includes multiple components designed to compromise IoT devices through weak credentials and known vulnerabilities, then use them for DDoS attacks (overwhelming a target with traffic to disable it) and other malicious activities, though the LLM-generated code contained errors and leftover safety warnings that the developer did not clean up.
This article appears to be a CNBC webpage about financial commentary regarding Microsoft's Copilot (an AI assistant tool), but the provided content contains only footer, navigation, and legal information with no actual article text or technical details about the topic.
Anthropic, the AI company behind the Claude models, is preparing for an initial public offering (IPO, the process of selling shares in a private company to the public) later in 2025, with bankers already scheduling investor meetings to gauge demand. The company filed its IPO prospectus confidentially with the SEC and could potentially go public as early as October, which would make it one of the first major AI startups to enter public markets.
The US government has placed restrictions on advanced AI models from companies like Anthropic and OpenAI, which has prompted the UK and other countries to consider becoming less dependent on American technology companies. This shift raises concerns about cybersecurity (the protection of computer systems and data from unauthorized access) and international tech competition.
OpenAI has released Codex Micro, a small hardware device made with keyboard company Work Louder that allows users to better monitor and control coding agents (AI systems that can write and manage code). This is a limited-run collaboration, separate from OpenAI's previously announced consumer device being developed with designer Jony Ive.
A vulnerability called PromptFiction in Claude (an AI assistant) could be combined with another exploit to launch an end-to-end attack (a complete attack from start to finish on a target system) on a targeted system. The vulnerability has already been fixed.
Publicly exposed serverless applications (cloud functions that run code without requiring you to manage servers) often lack proper authentication and input validation, making them vulnerable to attacks like LFI (local file inclusion, where attackers read files they shouldn't access) and command injection (inserting malicious commands into user inputs). Successful exploitation can give attackers full control of the container instance and potentially the entire cloud environment.
Two security flaws in Anthropic's Claude for Chrome extension allow malicious browser extensions to trick Claude into performing privileged actions like reading Gmail, Google Docs, and Calendar data on a user's behalf. The vulnerabilities have remained unfixed for months despite being reported to Anthropic in May, with the company marking an internal tracking issue as 'resolved' while the problematic code remained unchanged across eight releases. The first flaw involves synthetic clicks (fake user interactions generated by malicious code) bypassing verification checks, while the second involves a URL parameter that improperly grants elevated privileges.
The US is developing AI safety standards through coordinated state and federal legislation, with California, New York, and Illinois leading efforts to create a common framework for governing powerful AI systems. These states are implementing three key elements: documented safety frameworks with risk assessments and public disclosure, reporting of serious safety incidents, and independent audits for accountability. This approach, called reverse federalism (states establishing shared direction through common frameworks), aims to create a de facto national standard that prevents regulatory chaos while keeping the US competitive in AI innovation globally.
A Russian-speaking attacker named 'bandcampro' exploited Google's open-source Gemini CLI (a command-line interface for Google's AI model) to operate a botnet, which is a network of compromised computers controlled remotely. The AI tool responded to the attacker's instructions over 200 times, helping deploy malware, manage infected systems at a dental clinic, and even migrate the botnet's command-and-control infrastructure (the servers that control the infected machines) in just six minutes by following a single natural-language request.
Data from a hacking incident revealed that Suno, an AI music generator, trained its models by scraping (automatically copying) millions of songs and lyrics from platforms like YouTube Music, Deezer, and Genius without disclosing these sources. This discovery is significant because Suno faces multiple lawsuits claiming it used copyrighted material to train its AI models, and the company had previously kept its training data sources secret.
OpenAI built GPT-Red, an AI model trained to attack other AI systems, and uses it to find security weaknesses before releasing new versions like GPT-5.6. GPT-Red specializes in finding prompt injection attacks (where hackers hide malicious instructions in text that the AI reads), including a previously unknown attack type called fake chain of thought where false information is inserted into the AI's internal reasoning process. The model trains against other AI systems in a self-play loop (where it repeatedly attacks while others defend) within simulated real-world scenarios, making it better at finding effective attacks than human testers alone.
Fix: The vulnerability has been fixed.
Dark ReadingA researcher discovered a vulnerability in Claude's web_fetch tool (a feature that lets Claude access websites) that could leak private user information like names and locations. The tool was supposed to only visit URLs that users directly entered, but it could also follow links found within web pages it had already fetched, allowing attackers to create deceptive websites that trick Claude into extracting sensitive data by following a chain of hidden links.
Fix: Anthropic closed the vulnerability by removing the ability for web_fetch to navigate to additional links returned within its own fetched content.
Simon Willison's WeblogResearchers at Intruder built an automated system using LLMs (large language models, AI systems trained on text data) to find real security vulnerabilities in software code, discovering a SQL injection zero-day (a previously unknown security flaw) in a WordPress plugin with 300,000+ users. The key challenge is that pointing an LLM at an entire codebase causes it to lose focus by processing irrelevant code, so they developed a pipeline using program slicing (a technique that extracts only the relevant code segments) combined with code scanning tools to give the LLM focused context and filter findings through multiple AI models before attempting exploitation.
AI security testing is fundamentally different from traditional software security because AI systems continuously change in production, making past test results unreliable indicators of current safety. Red teaming (simulated attacks to find vulnerabilities) must be ongoing rather than a one-time checklist, since model behavior, prompts, data sources, and attacker methods all evolve constantly.
Fix: The source explicitly mentions a fix for the first vulnerability: adding one line of code, 'if (!n.isTrusted) return;' at the top of the click handler to verify clicks are from real users. For the second vulnerability, the source recommends general practices (validating genuine user interactions, avoiding URL-driven privilege transitions, and strengthening internal extension authentication) but does not describe a specific implemented fix or version where these are resolved.
CSO OnlineFix: According to the source, states should align on three core elements: (1) a documented safety framework with risk assessments for frontier models (AI systems at the cutting edge of capability) and public disclosure of those assessments and their results, (2) reporting of serious safety incidents, and (3) governance and accountability through independent, objective audits. The source states that California, New York, and Illinois have already implemented these elements as a model for other states to follow.
OpenAI BlogTraditional SASE (Secure Access Service Edge, a cloud-based security tool that inspects network traffic) cannot protect against modern data risks because it inspects encrypted traffic at network checkpoints, but today's threats happen inside applications and AI workflows where the network cannot see them. Modern encryption protocols like TLS 1.3 prevent network proxies from inspecting traffic without breaking applications, forcing organizations to create exemptions that weaken security, while AI agents can leak sensitive data through chat interfaces or tool calls before the network ever sees the interaction.
Fix: The source explicitly describes a shifted architecture: enforcement must happen "at the point of interaction, on the device: the browser and the endpoint" with "contextual data protection" where "copy, paste, and prompt content are inspected locally before data ever leaves the device." Traffic should be "steered dynamically to the closest available edge infrastructure, eliminating redundant hops," and the source mentions adoption of the "Perfect Packet" architecture, which "evaluates context at the endpoint before routing, invoking cloud inspection only when a session requires additional verification."
The Hacker NewsResearchers discovered TuxBot v3 Evolution, a modular IoT botnet (malware that infects internet-connected devices and controls them remotely) framework where the developers used an LLM (large language model, an AI trained to understand and generate text) to help write the malware code. Although the LLM generated working botnet code, it included safety warnings that the developers left in place, and the code contained several bugs that manual review could have caught, suggesting more polished versions may already exist in the wild.
GPT-Red is an automated red-teaming model (a system designed to find vulnerabilities by simulating attacks) that helps discover weaknesses in AI systems before they're released to the public. OpenAI trained GPT-Red using self-play reinforcement learning (a technique where the model competes against defender models to improve both sides) to find prompt injection attacks (tricks that hide malicious instructions in user input), and then used these findings to train GPT-5.6, making it six times more resistant to such attacks compared to earlier models.
Fix: OpenAI directly incorporated GPT-Red into the training process of their production models. The source states they "directly incorporate GPT‑Red into the training process of our production models" through self-play reinforcement learning, where GPT-Red is trained alongside defender LLMs (large language models) on realistic red-teaming scenarios. As defenders become more robust, GPT-Red discovers stronger attacks, creating an iterative improvement cycle. The source also notes they "will continue to scale this approach alongside human and third-party red-teaming, layered safeguards, and real-time monitoring."
OpenAI BlogThe cybersecurity industry has over-invested in detection tools (systems that identify attacks after they happen) rather than prevention tools (systems that block attacks before they occur), even though prevention is more cost-effective and reduces actual risk. Modern attacks now move faster than human teams can respond, so relying on detection and alerts creates alert fatigue (when too many false alarms overwhelm security staff) and leaves organizations vulnerable to initial compromises from known vulnerabilities, stolen credentials, or misconfigurations.