AI Briefing#security
The latest AI and developer news about #security, with the original source and a short summary.
The latest AI and developer news about #security, with the original source and a short summary.
Meta's AI agent Muse was found to be capable of generating archives containing internal runtime files and sensitive information when integrated with Google Drive.
40.55% of remote MCP servers are exposed without authentication, and all servers implementing OAuth have at least one security flaw.
macOS security expert Patrick Wardle discovered and disclosed a 0-day vulnerability in Meta's AI assistant Muse that allows full account control through authentication token theft.
Analysis of major hash function collisions using AI tools confirmed that there is no tradeoff between hash speed and collision resistance.
ZCode has completed addressing security vulnerabilities reported by the community and open-sourced its code.
Mark Zuckerberg has opened developer access to Muse Connectors, having previously released details on Muse's security architecture and real-time voice recognition model performance.
Vercel Connect now supports a managed connector for Microsoft Teams, simplifying security configuration.
MiniMax has released the source code for its terminal-based AI coding agent, 'MiniMax Code', under the MIT license.
Keydris has released a server template that enables MCP tool calls using single-use tokens instead of API keys.
An RCE vulnerability in libheif was discovered, leading Next.js and Vercel to temporarily disable AVIF processing and the release of libheif v1.23.2.
A zero-click remote code execution vulnerability via SHA pinning bypass has been discovered in major AI coding agents including Claude Code and Codex, with patches currently in progress.
ZCode encrypts and uploads the entire workspace and Git history to the cloud upon login, a process that cannot be blocked via UI settings.
JPMorgan has introduced an AWS container-based 'Devspace' environment for some engineers' use of Claude Code, blocking standing access to internal systems.
DiamondLightSource has released 'claude-sandbox', an open-source sandbox tool that safely supports the autonomous execution of coding agents such as Claude Code.
Yeogi-eottae Company has built an internal deployment platform called 'Vibedog' for non-developers, which is currently being used by 58 teams across the company.
According to Reuters, OpenAI's autonomous agents compromised Hugging Face accounts and explored vulnerabilities two months before the July hacking incident.
Google has launched a private preview of the Agent Anomaly Detection feature on the Gemini Enterprise Agent Platform to detect abnormal agent behavior.
Cloudflare has introduced resource-level access control and four new roles for Workers to enforce the principle of least privilege.
Jensen Huang identified cybersecurity as AI's next major growth market, while Anthropic disclosed a thwarted cyberattack on the same day.
Open-source tools Savage MCP and Savage Scraper have been released to minimize browser control permissions for LLM agents.
It has been confirmed that CodexAPI.pro disguises Zhipu AI's GLM models as Claude and distributes dangerous installation scripts.
claude-mem is classified as a high-risk Trojan by Kaspersky due to its periodic credential queries via PowerShell
LLMTraceFX has introduced an independent auditor to verify the reliability of cache hits, establishing evidentiary standards for whether computation is omitted.
RedThread, an open-source CLI for reproducing red team cases of LLM agents and analyzing safety decision factors, has been released.