A new public memo from OpenAI calls for what superficially seems to be common sense collaboration between governments and private industry on cyber defense hardening against emerging AI threats.
Vulnerability disclosure programs remain a blind spot for too many organizations—and frontier AI could soon make vulnerability discovery far easier and more frequent. New CISA and NSA guidance outlines practical steps for building effective coordinated vulnerability disclosure programs.
Between-version security updates have been relatively unusual for Apple until now, usually reserved for zero-days under active exploitation. Apple appears to be altering its usual practice of bundling security updates with new OS version rollouts in response to the looming threat of AI hacking.
NGINX has been available since 2004 and the critical vulnerability that was uncovered is thought to have been present since 2008. The open source web server is a very popular tool for load balancing and serving static content, with estimates putting almost a third of the world’s most popular websites down as users.
The attack chain relies on three specific vulnerability elements: an open redirect from the main Claude website that makes a malicious URL look like a legitimate link to the AI, a prompt injection in the attack URL that is not visible to the end user, and a means by which to exfiltrate requested data via the Claude API.
Misconfigured Supabase database allowing full read/write access to all platform data resulted in a data leak that exposed some 1.5 million API authentication tokens along with 35,000 email addresses and about 4,000 private messages.
Google’s Threat Intelligence Group (GTIG) documents the first known uses of their Gemini AI assistant to actively participate in live malware attacks, with the capability to do things like generate scripts and change up obfuscation methods on the fly without a hacker’s input.
The dangerous “ForcedLeak” flaw in Salesforce’s Agentforce platform has been addressed with a patch, plugging a hole that made it possible for attackers to exfiltrate sensitive data via a prompt injection.
Vibe coding user caught the AI attempting to hide errors and bugs as well as lying about test results. Several days after this started, it unexpectedly (and without authorization or prompting) wiped out a contact information database containing thousands of curated entries for executives.
An attempt involving Rubio’s voice and writing style was made in an attempt to compromise assorted US and foreign officials, and a warning has gone out about the increasing potential of AI deepfakes and the need for awareness of how realistic they can now be.