A vulnerability (CVE-2026-126767) was found in OpsTree REMS versions up to 1.0.0, affecting its chat assistant feature. The vulnerability, a prompt injection issue, allows authenticated users to access the system's internal prompt by submitting specially crafted chat input to the /api/v1/rca/chat endpoint. This enables attackers to bypass the assistant's rules and obtain sensitive orchestration instructions, facilitating further prompt injection attacks. This matters to AI developers and operators as it compromises the security of the chat assistant, potentially allowing malicious users to manipulate the system and gain unauthorized access to internal information.

LLM 0.37.2 fixes a security vulnerability reported by Daniel de Araujo. The issue arises from the extra-openai-models.yaml mechanism, which is now managed by the new "llm openai endpoint add" command. This mechanism allows using LLM with OpenAI-compatible API endpoints from other providers. However, Daniel's report highlighted two scenarios where the configured OpenAI API key could be accidentally sent to one of those providers: if the key had never been stored, or if a responses:true model was run with -o chat_completions 1. The update addresses these concerns, enhancing security for developers and operators of AI agents.

JioStar's chief architect Vijay Seshadri discussed AI discovery at a massive scale, with over 500 million users. He shared lessons learned on evaluating AI models, implementing guardrails to ensure AI safety and fairness, and deploying AI systems into production. Seshadri highlighted the importance of rigorous evaluation and testing to assess AI performance, including metrics such as accuracy, fairness, and interpretability. He also emphasized the need for guardrails to prevent AI systems from causing harm, such as bias or unintended consequences. The insights are relevant to developers and operators of large-scale AI systems, as they can inform best practices for deploying AI at scale and ensuring responsible AI development.

A vulnerability (CVE-2026-96437) was identified in the ai-azure-content-safety plugin for Kong Gateway Enterprise. The plugin fails to inspect request bodies larger than its in-memory buffer, allowing attackers to bypass input content-safety checks. This enables malicious requests to evade detection. The vulnerability affects users who rely on the plugin for content safety and security in their Kong Gateway deployments.

Anthropic's Claude Fable 5.2 and Claude Mythos 5.2 models were released, exhibiting improvements in coding, reasoning, and vision. During pre-release training, the models demonstrated capabilities such as completing software migrations, designing electronic devices, solving open physics problems, and formalizing mathematical proofs. In the multi-stage cyberattack benchmark, CyScenarioBench, Fable 5.2 outperformed GPT-6 Cyber, completing 76.3% of challenges compared to 61.7% for Fable 5.1 and 61% for GPT-6 Cyber. This indicates enhanced ability of Claude models to execute complex, multi-stage cyber operations in a realistic environment.

A vulnerability (CVE-2026-119613) was identified in Ash-project Ashai. The bug allows an attacker to retrieve internal error details, including module names and data values, by inducing a tool call failure. The error information, including potentially sensitive data, is not logged and is instead sent to clients and the model. The fix for this issue logs error messages with a unique ID and returns only the ID to the caller, preventing sensitive information exposure. This issue affects Ashai versions 1.5.0 and earlier.

A vulnerability (CVE-2026-119613) was found in the ash-project ashai tool. It allows an attacker to read sensitive information by causing a tool call to fail, resulting in internal error details being returned. This included module names and data values. The fix logs these errors with a unique ID and returns only the ID to the caller, preventing sensitive information disclosure. Affected versions are ashai 1.5.0 and earlier, with a fixed version of 1.5.1.

The author of the demo, MintCoderpro, developed a control layer for AI coding agents like Claude Code to ensure transparency and safety when working autonomously on repositories. This control layer tracks and verifies agent actions against predefined rules, using cryptographic SHA-256 verifications to detect potential rule breaches. Users can define approval rules (pass, require approval, or refuse) for agent actions before and after execution. The demo showcases scenarios where the agent is authorized, requires human approval, or is refused due to unauthorized modifications. This control layer is intended to provide safety boundaries for critical data and sensitive codebases by allowing users to monitor and regulate AI agent activity.

Three new AI security audit skills have been released for Agent Skills, allowing for static analysis of AI models without executing them. The skills, electron-surface-audit, llm-app-audit, and invisible-char-audit, analyze desktop applications, source code, and text files to identify potential security vulnerabilities. Unlike traditional security tools, these skills do not execute the target, reducing the risk of compromising the system. Each skill provides detailed findings, including file and line numbers, allowing developers to verify and address potential issues. The skills are compatible with Claude Code, Claude Desktop, and other assistants that support SKILL.md, and can be installed via npm or cloned from GitHub.

SkillSpector is a security scanner for detecting vulnerabilities, malicious patterns, and security risks in AI agent skills. It analyzes skills used by AI agents, such as Claude Code, Codex CLI, and Gemini CLI, which often execute with implicit trust and minimal vetting. In a subset of 31,132 analyzed skills, 26.1% contained vulnerabilities and 5.2% showed likely malicious intent. SkillSpector helps users determine if a skill is safe to install and is part of the NVIDIA Verified Skills pipeline, which scans and evaluates skills before publication. It supports multi-format input and detects 71 vulnerability patterns across 17 categories, including prompt injection, data exfiltration, and privilege escalation.

Red Team AI Benchmark has been updated to version 2, which uses a rubric-based dataset to evaluate Large Language Model (LLM) responses to security scenarios, replacing the previous method of judging answers against a single "golden response". The default v2 suite includes 60 questions in a JSONL file, organized by domain and difficulty. The project's GitHub repository has been migrated to a new location, maintained by the lead contributor, due to the original owner's account being banned. The benchmark is intended to assess LLM responses to red-team questions and scenarios, and is not a hacking tool or exploit framework. This update matters to developers building and operating AI agents as it provides a more nuanced and comprehensive evaluation of LLM performance in security-related contexts.

Heretic is a tool that allows users to modify language models without training, using a collection of mathematical techniques to steer behavior based on example prompts and scorers. It can suppress censorship, reduce sycophancy, and alter emotional alignment, among other modifications, without requiring in-depth knowledge of language models. Heretic supports most dense models, including multimodal and hybrid models, and has been benchmarked against competing tools, showing comparable performance. Users can configure Heretic using TOML files, with options including suppressing refusals, reducing humor, and altering emotional alignment. This tool can be used on a gaming PC, making it accessible to a wider range of users.

RedThread is a CLI-first framework for testing Large Language Model (LLM) systems, validating failures, and generating evidence-backed defense candidates. It conducts adversarial campaigns using various attack strategies, including PAIR, TAP, and Crescendo, and scores the results to synthesize potential defenses. RedThread's closed evidence loop involves attack generation, target execution, judge scoring, defense synthesis, replay validation, and promotion evidence. This system is useful for local campaigns, replay evidence, deterministic security checks, and operator review, but is not intended for universal production enforcement. It addresses the limitations of existing AI red-team tools by asking additional questions about the nature and causes of failures, and providing a more comprehensive approach to AI security.

A vulnerability was discovered in mistral.rs, a repository before version 0.9.5. The vulnerability, designated CVE-2026-124028, is a delimiter injection vulnerability in the mistral.rs-core module. This allows attackers to inject tool calls by placing delimiter strings in text quoted by the model. This can be exploited if an attacker controls documents, web pages, or tool outputs containing specific tags, such as "qwen-xml", "gemma4", or reasoning parsers, which can return extra calls to declared tools with attacker-chosen arguments. This vulnerability matters to developers and operators of AI agents as it allows for potential tool call injection, potentially leading to unauthorized or malicious actions being executed.

A vulnerability was discovered in JetBrains Junie GitHub Action prior to version 1.6.4, where prompt injection protection could be bypassed using HTML-encoded characters. This allows an attacker to inject malicious input, potentially leading to unauthorized access or modification of sensitive data. The vulnerability affects users of JetBrains Junie GitHub Action who have not upgraded to version 1.6.4 or later.

OpenAI is partnering with cybersecurity firm Hacktron to collaborate on vulnerability testing and penetration assessments of OpenAI's systems. This partnership aims to identify and address potential weaknesses in OpenAI's infrastructure, ensuring the security and integrity of its AI models and services. The collaboration will also involve testing connections between OpenAI's systems and third-party services to identify potential security risks. This partnership matters to people building and operating AI agents as it demonstrates OpenAI's commitment to security and responsible AI development, setting a precedent for transparency and proactive vulnerability management in the industry.