AI Briefing#security-vulnerability
The latest AI and developer news about #security-vulnerability, with the original source and a short summary.
The latest AI and developer news about #security-vulnerability, with the original source and a short summary.
ForgePtr and NvRoot allow unprivileged processes to gain root access and modify read-only files on the host, compromising GPU container isolation.
Security researchers identified 2,539 real secrets exposed in public GitHub repositories through the .claude/settings.local.json file.
The GhostShares investigation found that Grok's default 'Anyone with the link' setting and DNS-discoverable hostnames exposed 35,578 apps, affecting 30 external organizations and SpaceXSI/X staff.
Apiiro research identifies 2,539 real secrets in 1,994 public GitHub repositories exposed by Claude Code's local settings file, with 1,122 files containing active credentials.
While Cloudflare patched its systems within hours, 50 million probes show that over half of large network traffic still accepts the compromised eMudhra certificates.
A vulnerability chain involving MathLive and YouTube JSONP allowed attackers to execute arbitrary JavaScript in victims' authenticated sessions via public shares, enabling private data exfiltration.
A known configuration mismatch and an SGLang bug caused 155 GLM-5.3 responses to contain data from other customers' requests.
A researcher demonstrated a 'Loopjacking' attack in LangGraph Agent Server where a maker could mutate a pending task's arguments after human approval was requested but before execution, causing the system to execute the malicious action under the approver's authority.
A remote code execution vulnerability named 'GitSpawn' has been discovered in major AI coding agents such as Claude Code and Goose, exploiting Git configurations, with some instances remaining unpatched.
An AI agent discovered a security flaw missed by GitHub Copilot and accessed Snowflake's internal Jira.
It provides a CLI and TypeScript SDK that can detect, verify, and fix security vulnerabilities.
A security vulnerability was discovered in which Anthropic's Claude Code escaped the sandbox in the Mac environment and gained access to the entire system's files.
A security vulnerability has been discovered in the AI code editor Cursor that allows arbitrary code execution when a malicious git.exe in the project root is executed.
A security vulnerability was discovered in which xAI's Grok Build CLI uploaded entire Git repositories and confidential information to an external cloud without user consent.
A proxy attack exploiting Claude Desktop's MCP connector permissions and a DeepSeek-based ransomware PoC have been reported.
A vulnerability called 'SearchLeak', which leaks 2FA codes from Microsoft Copilot through prompt injection, has been reported.
A vulnerability was discovered that allows account takeover using only a user's username, due to a lack of guardrails in Instagram's support AI.
A new security vulnerability has been discovered that exploits Meta's support AI to hijack Instagram accounts.
Apple fixed a bug that left deleted and disappearing messages behind in the notification cache.
The order of IndexedDB.databases() exposed a per-process identifier in Firefox/Tor.
Over 40,000 OpenClaw instances have been exposed externally, putting them at risk of RCE attacks.
iTerm2's SSH integration allowed command execution from malicious text alone.
A critical security vulnerability has been discovered in React Server Components, requiring the attention of React and Next.js users.
Replit patched a security vulnerability found in its Single-Sign-On (SSO) feature and completed proactive security measures.