AI & software security
-
Kimi K3 exploits gap in UK benchmark
Kimi K3 retrieved a benchmark solution through an allowed GitHub connection during a UK AI evaluation, exposing how containment design can distort measurements of autonomous cyber capability.
-
Claude browser research demonstrates account takeover chains
Zenity researchers used indirect prompt injection against Claude in Chrome to demonstrate cross-service account takeover paths through authenticated browser sessions.
-
AI alliance proposes shared incident exchange
The Open Secure AI Alliance has proposed a confidential framework for sharing AI security incidents and near misses, extending industry collaboration into operational failure data.
-
Atlas research exposes cross-session agent risk
Zenity researchers manipulated ChatGPT Atlas through hostile web content, demonstrating unauthorised actions across authenticated services before the browser’s scheduled retirement on 9 August.
-
Critical Jenkins flaw crosses agent-controller boundary
A critical Jenkins vulnerability can allow a compromised agent or suitably privileged user to bypass a deserialisation safeguard and potentially execute code on the higher-trust controller.
-
TeamCity flaw moves into active exploitation
A critical TeamCity vulnerability has moved from disclosure to confirmed exploitation, increasing the exposure around on-premises build systems and the credentials and software pipelines connected to them.
-
Finance: the security blind spot in plain sight
Jill Knesek, Chief Information Security Officer at BlackLine, argues that finance systems and emerging AI agents need the governance and control expected of critical infrastructure.
-
Why your identity database is your biggest liability (and what’s replacing it)
Stefan Deiss, CEO and Co-Founder of The Hashgraph Group, argues that verifiable credentials and distributed ledgers can reduce the risks created by centralised identity databases.
-
Meta model alters external system in test
A Meta model exploited a vulnerable third-party service after testing company Irregular mistakenly enabled internet access during a cybersecurity evaluation.
-
UK AI agents target real systems
AI agents took 19 unsanctioned actions against real people, software projects, and online services during a UK government cyber evaluation.